1. General information on data processing

   1. Scope of processing personal data

      We collect and use our users' personal data only to the extent necessary for providing a functional website and our content and services. The collection and use of our users' personal data is generally only carried out with the user's consent. An exception applies in cases where obtaining prior consent is not possible for practical reasons and the processing of the data is permitted by law.

      The data controller is:

      Stay in Berlin GmbH,

      Koenigsallee 40, 14193 Berlin, Germany. Email: info@stayinberlin.com

      For security reasons and to protect the transmission of confidential content, our website uses SSL or TLS encryption.

   2. Categories of recipients

      We use external service providers (data processors), for example, for hosting, maintenance, support, accounting, or marketing. These providers only have access to the data they need to perform their tasks and process it exclusively on our behalf. Apart from this, your personal data will not be transferred to third parties, except in the cases explained in this statement. Typical exceptions include, for example, if you have consented to the transfer, if the transfer is necessary for the performance of a contract with you, or if we are legally obligated to do so.

   3. Legal basis for the processing of personal data

      Where we obtain consent from the data subject for processing personal data, Article 6(1) (a ) of the EU General Data Protection Regulation (GDPR) serves as the legal basis. When processing personal data necessary for the performance of a contract to which the data subject is a party, Article 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations necessary for taking steps prior to entering into a contract. Where processing personal data is necessary for compliance with a legal obligation to which our company is subject, Article 6(1) ( c) GDPR serves as the legal basis.

      In the event that the processing of personal data is necessary to protect the vital interests of the data subject or another natural person, Article 6(1) ( d) GDPR serves as the legal basis.

      If processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party, and the interests or fundamental rights and freedoms of the data subject do not override those interests, then Article 6(1) ( f) GDPR serves as the legal basis for the processing.

   4. Data deletion and storage period

      The personal data of the data subject will be erased or blocked as soon as the purpose of storage no longer applies. Storage may also take place if this is provided for by European or national legislation in EU regulations, laws, or other provisions to which the controller is subject. Data will also be blocked or erased when a storage period prescribed by the aforementioned regulations expires, unless further storage of the data is necessary for the conclusion or performance of a contract.

   5. Data transfer to third countries

      Visiting our website may involve the transfer of certain personal data to third countries, i.e., countries where the GDPR is not applicable law. Such a transfer is permissible if the European Commission has determined that the third country in question ensures an adequate level of data protection. If no such adequacy decision by the European Commission exists, personal data will only be transferred to a third country if appropriate safeguards are in place pursuant to Article 46 GDPR or if one of the conditions of Article 49 GDPR is met.

      Unless otherwise stated below, we use the EU Standard Contractual Clauses adopted by the EU Commission and currently valid as suitable safeguards for the transfer of personal data to processors in third countries.

      If you consent to the transfer of personal data to third countries, the transfer will be carried out on the legal basis of Art. 49 para. 1 letter a GDPR.

   6. Automated decision-making

      Our website does not use automated decision-making (profiling) within the meaning of Article 22 GDPR.

2. Data processing when visiting our website

   1. Provision of the website and creation of log files

      Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer.

      The following data is collected:

      • Information about the browser type and version used
      • The user's operating system
      • The user's internet service provider
      • The user's IP address
      • Date and time of access
      • Websites from which the user's system accessed our website
      • Websites accessed by the user's system via our website

      The log files contain IP addresses or other data that could allow identification of a user. This could be the case, for example, if the link to the website from which the user accessed the website, or the link to the website the user navigates to, contains personal data.

      The data is also stored in our system's log files. This does not include the user's IP address or other data that would allow the data to be linked to a specific user. This data is not stored together with other personal data of the user.

      2.1.1. Legal basis for data processing

      The legal basis for the temporary storage of the data and log files is Article 6(1) ( f) GDPR.

      2.1.2. Purpose of data processing

      The temporary storage of the IP address by the system is necessary to enable the delivery of the website to the user's computer. For this purpose, the user's IP address must be stored for the duration of the session.

      The data is stored in log files to ensure the website's functionality. We also use this data to optimize the website and to ensure the security of our IT systems. The data is not used for marketing purposes.

      These purposes also constitute our legitimate interest in data processing pursuant to Art. 6 para. 1 lit. f GDPR.

      2.1.3. Storage duration

      The data will be deleted as soon as it is no longer needed for the purpose for which it was collected. In the case of data collected for the provision of the website, this is the case when the respective session has ended.

      If the data is stored in log files, this occurs after a maximum of seven days. Storage beyond this period is possible. In this case, the users' IP addresses are deleted or anonymized so that it is no longer possible to identify the requesting client.

   2. Contact form and email contact

      When you contact us (e.g. via a contact form provided on the website or by email), we process the data you provide in order to handle your request.

      We typically collect the following information (input fields) via our contact form:

      • Salutation,
      • First name,
      • Last name,
      • E-mail address,
      • telephone number,
      • Address,
      • mobile number (if applicable)
      • Your message content.

      When you submit the message, your current IP address, as well as the date and time, are automatically recorded. This additional information is used solely to prevent misuse of our contact form and to ensure the security of our systems.

      As part of the submission process , we obtain your consent to the processing of the entered data and refer you to this privacy policy. Alternatively, you can contact us directly via the provided email address; in this case, we will process at least your email address and any other personal data contained in your message.

      2.2.1. Legal basis

      Article 6(1) (a) GDPR (consent) is the primary legal basis for processing your data. If you contact us by email, we can base the processing on Article 6(1) ( f) GDPR (legitimate interest) – the legitimate interest here being the processing of your inquiry. If your inquiry aims at concluding a brokerage agreement, Article 6(1)(b) GDPR may be used as an additional legal basis.

      2.2.2. Storage duration

      We delete your data as soon as it is no longer needed to process your request. This is usually the case when the conversation with you has ended and the underlying issue has been fully resolved. The additional technical data collected during the submission process (IP address, timestamp) will be deleted after a maximum of 7 days.

      2.2.3. Revocation and objection

      You can withdraw your consent to the processing of your contact form data at any time. Please send your withdrawal or objection to the storage of your data to us (e.g., by email). In such a case, we unfortunately cannot continue the conversation. Following your withdrawal, we will delete all personal data that we have stored from you in connection with your contact, unless legal retention obligations prevent us from doing so.

3. Cookies and tracking technologies

   We use cookies and similar technologies ("cookies") on our website. Cookies are small text files that are stored by your browser when you visit a website. This identifies the browser used and allows it to be recognized by web servers. You have full control over the use of cookies through your browser settings. You can delete cookies at any time in your browser's security settings. You can also generally or specifically object to the use of cookies through your browser settings. Further information on this topic is available from the Federal Office for Information Security (BSI) at www.bsi.bund.de

   The use of cookies is partly technically necessary for the operation of our website and is therefore permissible without the user's consent. The legal basis for this is our legitimate interest in the proper operation of our website (Art. 6 para. 1 lit. f GDPR).

   In addition, we use cookies to offer special functions and content, as well as for analysis and marketing purposes. These may include cookies from third-party providers (so-called third-party cookies). We only use such cookies, which are not technically necessary, with your consent in accordance with Section 25 Paragraph 1 of the German Telemedia Act (TTDSG) or Article 6 Paragraph 1 Letter a of the GDPR. give and withdraw your consent at any time via our consent management tool.

   Here you will find an overview of the cookies we use, as well as further information and legal notices about the individual cookies.

4. Your rights as a data subject

   As a data subject, you have the following rights regarding your personal data (pursuant to Articles 15–21 GDPR):

   • Right to information: You can request information about what data we have stored about you and how it is processed.
   • Right to rectification: You have the right to have inaccurate or incomplete personal data corrected.
   • Right to erasure: You can request the erasure of your personal data, provided the legal requirements (Art. 17 GDPR) are met. For example, if the purpose of the processing no longer applies or you withdraw your consent.
   • Right to restriction of processing: Under certain conditions you can have the processing of your data restricted (e.g. if you contest the accuracy of the data, for the duration of the review).
   • Right to data portability: You have the right to receive the personal data you have provided in a commonly used, machine-readable format or – where technically feasible – to request its transmission to another controller.
   • Right of objection: You have the right to object, on grounds relating to your particular situation, to the processing of your personal data where we process it on the basis of a legitimate interest (Art. 21 GDPR). In particular, you may object at any time to data processing for direct marketing purposes.
   • Right to withdraw consent: If we process your data based on your consent, you can withdraw this consent at any time with effect for the future. Such a withdrawal does not affect the lawfulness of the processing already carried out.
   • Right to complain: You have the right to lodge a complaint with a data protection supervisory authority regarding our processing of your data. The competent supervisory authority is usually the one in your place of habitual residence or our company headquarters (Berlin).

   To exercise your rights, you can contact us or our data protection officer at any time without any specific form. Please use the contact details provided (in writing or by email).

   You can, for example, send us an email to info@stayinberlin.com to request information, make corrections, or submit a cancellation/objection. We will then address your request immediately.

   Please do not hesitate to contact us if you have any questions or wish to exercise your rights. We take the protection of your data very seriously and are happy to assist you in exercising your data protection rights.

5. Processing when exercising your rights

   When you exercise your data subject rights as described above, we process the data you provide in order to comply with your request and to provide proof thereof. The legal basis for this is Article 6(1) ( c) GDPR in conjunction with Articles 15–22 GDPR and Section 34(2) BDSG.

6. Data Protection Officer

   You can reach our data protection officer using the following contact details:

   Email: info@stayinberlin.com

As of November 2025