Privacy policy

Controller

The controller for processing your data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

[ANBIETER / FIRMA] [STRASSE UND HAUSNUMMER] [PLZ] [ORT] Germany Email: kontakt@flaty.online

[If a data protection officer has been appointed, name them here with contact details. Otherwise delete this paragraph.]

The essentials

This website itself sets no cookies and uses no analytics, tracking or marketing services. Apart from the Cloudflare Turnstile security check, which is loaded once the form comes close to your viewport, it loads nothing from third-party servers, not even fonts.

We process data about you in two cases only: technically when you open the site, and when you write to us through the form or by email.

Hosting with Cloudflare

This website is delivered through Cloudflare Pages. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When you open a page, Cloudflare processes the connection data this requires, in particular your IP address, date and time, the address requested and details about your browser and operating system. Without this data the site cannot be delivered or protected against attacks.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is providing the website securely and reliably.

Cloudflare processes the data on our behalf (Art. 28 GDPR). Data may be transferred to the USA in the process. Cloudflare is certified under the EU-US Data Privacy Framework. The transfer relies on the European Commission’s adequacy decision for it (Art. 45 GDPR).

Retention of connection data: [define retention period]. More information: https://www.cloudflare.com/privacypolicy/

Request form

When you submit the form, we process what you enter there: first name, last name, email address, phone number, time slots for the call back, city and preferred area, minimum size, maximum rent including utilities, net income, whether you hold a housing entitlement certificate (WBS) and which one, and the language of the page.

We use these details to handle your request, contact you for the first call and, if we work together, carry out your apartment search.

The legal basis is Art. 6(1)(b) GDPR: processing is needed for steps you request before a contract, and later to perform the contract. Without the required fields we cannot handle your request.

By ticking the box before submitting, you confirm that your details may be processed to handle your request. We do not store the tick itself. The legal basis remains Art. 6(1)(b) GDPR as described above. [Check whether the box is needed as consent or can be removed.]

How your request travels

Your request is sent to Cloudflare encrypted and checked there. Through the Cloudflare Queues service it then waits in a queue until our own server collects it, usually within a few minutes. If processing fails, delivery is retried. Messages that still cannot be processed remain in a separate error queue (dead-letter queue) until we handle them, at most [define retention period]. For Cloudflare, what is stated under “Hosting with Cloudflare” applies.

Our server is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in a data centre in [CONFIRM DATA CENTRE LOCATION, e.g. Germany]. Hetzner processes the data on our behalf (Art. 28 GDPR). On this server we store your request in our database (PostgreSQL).

Internal notification via Telegram

For every new request, our server notifies our team in an internal, non-public chat on the messaging service Telegram. The message contains the details from the form so that we can get back to you quickly. The legal basis is Art. 6(1)(b) GDPR, because the notification serves to handle your request.

Telegram is operated by companies based outside the EU, among them Telegram FZ-LLC in Dubai (United Arab Emirates). There is no adequacy decision by the European Commission for the United Arab Emirates. [Define Telegram’s role and the basis and safeguards for the transfer to a third country, Art. 44 et seq. GDPR.] More information: https://telegram.org/privacy

Security check with Cloudflare Turnstile

To keep automated requests out, the form uses Cloudflare Turnstile to check that a person is filling it in. Turnstile is loaded from Cloudflare servers as soon as the form comes close to your viewport, i.e. before you use it. Your IP address and technical characteristics of your browser and device are then transmitted to Cloudflare.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is protecting the form against abuse and spam. Accessing information in your browser is strictly necessary for this protection (§ 25(2) no. 2 TDDDG). [Check whether Turnstile stores or reads information in your browser, for example in local storage, and whether § 25(2) no. 2 TDDDG applies.]

On the provider, the transfer to the USA and the Data Privacy Framework, what is stated under “Hosting with Cloudflare” applies. [Check Cloudflare’s role for Turnstile: processor or independent controller.] More information: https://www.cloudflare.com/turnstile-privacy-policy/

Contact by email

When you email us, we process your email address and the content of your message to reply. The legal basis is Art. 6(1)(b) GDPR if it concerns working together, otherwise Art. 6(1)(f) GDPR with our legitimate interest in answering enquiries.

Our mailbox is hosted by [EMAIL PROVIDER WITH ADDRESS].

Retention

We keep your request while we handle it and, if we work together, for the duration of your apartment search. After that we delete it [define retention period], unless statutory retention duties apply, for example under commercial or tax law.

We delete messages in the internal Telegram chat [define retention period].

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20).

Right to object: where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).

Where you have given consent, you may withdraw it at any time with effect for the future (Art. 7(3) GDPR).

For any of these, an email to kontakt@flaty.online is enough.

Complaint to a supervisory authority

You may lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU country where you live or work or where the alleged infringement took place.

The authority responsible for us is: [DATA PROTECTION AUTHORITY OF THE FEDERAL STATE WHERE THE PROVIDER IS BASED, WITH ADDRESS]