1. General information on data processing

   1. Scope of processing personal data

      We collect and process personal data only to the extent necessary for the provision of our services – in particular in the context of apartment brokerage – and for the provision of our related services.

      The data controller is:

      Stay in Berlin GmbH,

      Koenigsallee 40, 14193 Berlin, Germany. Email: info@stayinberlin.com

      We generally only process data that you provide to us yourself.

      If necessary, further data may be collected later, when a rental agreement is actually concluded (e.g., identity card data for identity verification, proof of a legitimate interest in the case of temporary accommodation, signature on the rental agreement, etc.). This data is typically collected directly by the landlord. If Stay in Berlin GmbH assists in individual cases (e.g., forwarding a signed contract document by email), such processing also falls under this privacy policy.

   2. Categories of recipients

      As part of the apartment rental process, your personal data will be shared with third parties, specifically the respective landlords or apartment providers of the apartments you are interested in. Stay in Berlin GmbH works with the following partner companies in particular:

      • DieApart GmbH, Behrenstraße 1C, 10117 Berlin
      • Elisapart GmbH, Zeppelinstraße 143, 14471 Potsdam

      These companies are the owners or main tenants of the apartments we broker. We only transmit to the respective partner the data necessary for them to conclude a rental agreement with you. This typically includes your contact details (name, address, email, telephone) and relevant information about your rental request (e.g., desired rental period).

      Our partner companies use your data to decide whether to enter into a contract and to prepare the lease agreement. You will not receive any information from us that goes beyond the purpose of initiating a lease agreement. Naturally, our partners also treat your data confidentially and in accordance with legal regulations. If necessary, they will inform you again about data processing once you enter into direct contract negotiations with them (Art. 14 GDPR).

      Your data will only be shared with other third parties if this is necessary for the performance of the contract (e.g., with a property manager to organize an apartment viewing with your consent) or if we are legally/officially obligated to do so (e.g., providing information to a government agency). In such cases, we will inform you separately, if permitted.

   3. Legal basis for the processing of personal data

      Where we obtain consent from the data subject for processing personal data, Article 6(1)(a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis. When processing personal data necessary for the performance of a contract to which the data subject is a party, Article 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations necessary for taking steps prior to entering into a contract. Where processing personal data is necessary for compliance with a legal obligation to which our company is subject, Article 6(1)(c) GDPR serves as the legal basis.

      In the event that the processing of personal data is necessary to protect the vital interests of the data subject or of another natural person, Article 6(1)(d) GDPR serves as the legal basis.

      If processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party, and the interests or fundamental rights and freedoms of the data subject do not override those interests, then Article 6(1)(f) GDPR serves as the legal basis for the processing.

   4. Data deletion and storage period

      Your personal data will be deleted or blocked as soon as the purpose for processing it no longer applies. Data may also be stored if required by European or national legislation (e.g., statutory retention periods) or if it is necessary for the establishment, exercise, or defense of legal claims. Once there are no longer any grounds for retention, the data will be deleted. If storage is necessary for initiating or fulfilling a contract, the data will be stored for a longer period accordingly (see also the detailed information below regarding storage duration for rental inquiries).

   5. Data transfer to third countries

      In individual cases, the processing of your data may involve the transfer of personal data to third countries (countries outside the EU or the EEA) – for example, if we use cloud services or external service providers located outside the EU. Such transfers only take place in compliance with the GDPR: either there is an adequacy decision by the EU Commission for the destination country, or we have agreed on suitable safeguards such as EU standard contractual clauses pursuant to Article 46 GDPR, or a legal exception pursuant to Article 49 GDPR applies.

      Unless otherwise stated below, we use the EU Standard Contractual Clauses adopted by the EU Commission and currently valid as suitable safeguards for the transfer of personal data to processors in third countries.

      If you consent to the transfer of personal data to third countries, the transfer will be carried out on the legal basis of Art. 49 para. 1 letter a GDPR.

   6. Automated decision-making

      As part of our placement services, no automated decision-making – such as profiling – takes place in accordance with Article 22 of the GDPR. In other words, decisions that significantly affect you legally or otherwise are not made solely by automated means.

2. Data processing for rental inquiries / brokerage activities

   When you contact us as a prospective tenant – whether by email, via a form, or by telephone – we process the personal data you provide to handle your apartment inquiry and to carry out the placement process. This typically includes:

   • Master data: Name (first and last name) and, if applicable, title, date of birth (if required for the contract).
   • Contact information: Address, telephone number(s), email address.
   • Details of your rental request: e.g. desired rental period, apartment preferences (location, size), budget expectations.
   • Communication content: All further information that you provide us with as part of the inquiry (e.g., professional background, special requirements for the apartment, planned move-in/move-out date).
   • Correspondence: Written exchanges with you (emails, possibly chat messages) as well as notes from telephone conversations, insofar as relevant.

   As a rule, we do not request special categories of personal data (Art. 9 GDPR) – data such as health information, religious affiliation, etc., are irrelevant for the rental process. Please refrain from sending us such sensitive information unless it is absolutely necessary for the rental process. In these cases, we will request your explicit consent.

   In addition to the data you actively provide to us, we may also process personal data that we have lawfully obtained from third parties. This may be the case, in particular, within the context of a credit check: We may transmit the information required for a credit report to a credit agency (e.g., SCHUFA Holding AG) to verify your creditworthiness. We will then receive a credit rating or relevant information about your financial reliability from the agency. The legal basis for this transmission and inquiry is our legitimate interest in assessing the risk of rental default (Art. 6 para. 1 lit. f GDPR). Please note that a negative credit report may prevent a rental agreement from being concluded.

   1. Legal basis for data processing

      The primary legal basis for processing your data as a prospective tenant is Article 6(1)(b) GDPR, as the data processing is carried out to perform our contractually owed brokerage services, which are provided at your request.

      If you submit a general inquiry to us that does not directly aim at concluding a contract, we can use our legitimate interest (Art. 6 para. 1 lit. f GDPR) in answering your inquiry as a legal basis, or it may involve pre-contractual (contract initiation) processing activities which are also covered by Art. 6 para. 1 lit. b GDPR.

      If we ask for your consent (for example, to be allowed to store your documents for future suitable offers even after an initial unsuccessful placement), the processing is based on Article 6 Paragraph 1 Letter a GDPR. You can withdraw your consent at any time with effect for the future.

   2. Purpose of data processing

      Your personal data will be processed solely for the purpose of finding you a rental property in connection with your rental inquiry. We will share your data with the potential landlord and contact you as part of the process (e.g., to schedule viewings, clarify any questions, or send you a draft lease). Without the provision of the necessary personal data, we would be unable to process your rental inquiry.

   3. Storage duration

      We generally only store your personal data as a prospective tenant for as long as is necessary for the purposes mentioned above.

      • If no rental agreement is concluded between you and a landlord, we will delete your data after a maximum of six months. This period begins from the point at which it is clear that no agreement will be concluded (e.g., your inquiry was rejected or you have decided otherwise). These six months allow us time to contact you again if a suitable property becomes available and to follow up on our services. After this period, your data will be completely deleted unless you explicitly grant us permission to store it for a longer period.
      • If a lease agreement is concluded, we will store your personal data (in particular the information contained in the lease agreement) for the duration of the lease and for 10 years after its termination. This extended retention period is based on the statutory retention requirements for business documents (in particular Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB), which generally stipulate 10 years) and our legitimate interest in being able to access the contract documents in the event of a dispute. After 10 years from the end of the lease agreement, we will delete your data unless there is another legal basis for further storage.

      In all cases, the following applies: As soon as it is determined that data is no longer needed (because the purpose has been achieved and there is no longer an obligation to retain it), this data is routinely deleted or anonymized.

3. Your rights as a data subject

   As a data subject, you have the following rights regarding your personal data (pursuant to Articles 15–21 GDPR):

   • Right to information: You can request information about what data we have stored about you and how it is processed.
   • Right to rectification: You have the right to have inaccurate or incomplete personal data corrected.
   • Right to erasure: You can request the erasure of your personal data, provided the legal requirements (Art. 17 GDPR) are met. For example, if the purpose of the processing no longer applies or you withdraw your consent.
   • Right to restriction of processing: Under certain conditions you can have the processing of your data restricted (e.g. if you contest the accuracy of the data, for the duration of the review).
   • Right to data portability: You have the right to receive the personal data you have provided in a commonly used, machine-readable format or – where technically feasible – to request its transmission to another controller.
   • Right of objection: You have the right to object, on grounds relating to your particular situation, to the processing of your personal data where we process it on the basis of a legitimate interest (Art. 21 GDPR). In particular, you may object at any time to data processing for direct marketing purposes.
   • Right to withdraw consent: If we process your data based on your consent, you can withdraw this consent at any time with effect for the future. Such a withdrawal does not affect the lawfulness of the processing already carried out.
   • Right to complain: You have the right to lodge a complaint with a data protection supervisory authority regarding our processing of your data. The competent supervisory authority is usually the one in your place of habitual residence or our company headquarters (Berlin).

   To exercise your rights, you can contact us or our data protection officer informally at any time. Please use the contact details provided (in writing or by email). For example, you can send us an email to info@stayinberlin.com to request information, make corrections, or declare a revocation/objection. We will then respond to your request immediately.

   Please do not hesitate to contact us if you have any questions or wish to exercise your rights. We take the protection of your data very seriously and are happy to assist you in exercising your data protection rights.

   • Processing when exercising your rights

   When you exercise your data subject rights as described above, we process the data you provide in order to comply with your request and to provide proof thereof. The legal basis for this is Article 6(1)(c) GDPR in conjunction with Articles 15–22 GDPR and Section 34(2) BDSG.

4. Data Protection Officer

   You can reach our data protection officer using the following contact details:

   Email: info@stayinberlin.com

As of November 2025