Privacy notice

Joint controllers for the website and private rental enquiries:

Hendrik Vegelahn und Sina Scharbau

Kleine Straße 52, 25785 Nordhastedt
Email: info@vegelahn.de
Telephone: +49 162 8900492

Both jointly determine the purposes and essential means of processing. Hendrik Vegelahn is your primary contact for data protection enquiries, information and erasure requests; Sina Scharbau acts as his deputy. Regardless of this allocation of responsibilities, you may exercise your rights against either person.

When you access a page, our hosting providers process connection data such as your IP address, access time, the address accessed, data volume, browser and device details, referrer, and error and security data. This serves to operate the website, analyse errors and protect against misuse (Article 6(1)(f) GDPR).

The hosting platform provides page-view and visitor counts. We use the aggregated statistics to assess and improve our offering without linking them to rental enquiries (legitimate interest, Article 6(1)(f) GDPR). According to the provider's confirmation, visitor statistics are deleted on a 30-day cycle. This does not also apply to server logs, emails or rental enquiries; nor does the aggregated display mean that all underlying connection data is anonymous. We do not integrate any additional analytics services.

To counter mass requests and login attempts, the application uses hashed identifiers and counters for assessment windows of no more than 24 hours. Expired counters are cleared upon subsequent requests, rather than on a timed schedule. The basis is our legitimate interest in protecting the portal and the stored data (Article 6(1)(f) GDPR).

When you contact us by email or telephone, we use your details to handle your request. General questions and viewing arrangements are based on our legitimate interest in responding (Article 6(1)(f) GDPR); necessary communication after you have expressed an interest in renting a specific apartment is based on Article 6(1)(b) GDPR.

• Initial enquiry: The form requires your name, email address, telephone number, number of people moving in, and employment situation or source of funding. Your age, specific occupation, preferred move-in date and message are optional. We use these details to process and personally review your enquiry about the selected listing and to arrange a viewing. We use your telephone number for follow-up questions and appointment arrangements. Providing your age is optional, not a required field; no date of birth is requested. Mentioning the Jobcenter or Sozialamt does not confirm that the rent will be paid in full directly by that authority. An online enquiry is not possible without the required details; to contact us without the form, you can call or email us. The legal basis depends on the nature of the request described above. Submission replaces neither consent under data protection law nor a separate declaration of a specific interest in renting. We do not require supporting documents for the initial enquiry.
• Further processing: We store the associated listing, time of receipt, processing status and, where applicable, your selected appointment or preferred times. We separately document any intention to rent that you expressly declare later.
• Additional details after a viewing: If necessary, we ask for an income range and have household and payment details confirmed or updated. You may voluntarily provide details of pets that require consent, but not small pets. If the full rent is paid directly by a public authority, we do not need any additional income details. Legal basis: Article 6(1)(b) GDPR.
• Selected prospective tenant: Only immediately before the contract is concluded do we request any still-required proof of income or creditworthiness, or proof of direct payment by a public authority (Article 6(1)(b) GDPR). Please redact unnecessary information. Do not send a copy of your identity document, a full SCHUFA data copy under Article 15 GDPR, or a certificate confirming the absence of rent arrears.

Enquiries, appointment and additional details, processing notes and messages are held in a database; supporting documents are kept in protected document storage. Personal links are generally valid for 14 days: anyone who has them can use the corresponding function. Please keep them confidential. Supporting documents can only be accessed through the protected administration area.

Use your personal appointment link to book or cancel a viewing. When you book, we email you a confirmation and automatically notify the landlord. After booking, your link remains valid until at least the day after the viewing.

Acknowledgements of receipt, appointment confirmations, cancellation notices and internal notifications may be sent automatically. For booked viewings, we schedule a reminder with the email delivery service for 90 minutes before the appointment; bookings made close to the appointment time receive only the appointment confirmation. We personally approve invitations and substantive replies before they are sent. Rental decisions are not made solely by automated means, and we do not use automated applicant scoring.

In addition to the two controllers, the following receive the necessary data: OpenAI Ireland Ltd. (ChatGPT Sites) and Cloudflare as a hosting subprocessor for the website, database, document storage and security; Hetzner Online GmbH for our email mailboxes; and Resend (Plus Five Five, Inc.) for website emails. INWX GmbH provides DNS name resolution for the website and does not receive any form contents in doing so. Further disclosures take place only on a separate legal basis, such as a legal obligation or the necessary pursuit of legal claims.

Resend processes the sender, recipient, subject, message content and delivery information for confirmations, internal notifications and approved replies. The legal basis depends on the purpose of communication described in Section 3. Personal links may be included, but supporting-document files are not. Open and click tracking are disabled; transport encryption is mandatory.

For scheduled reminders, Resend also stores the planned sending time. When an appointment is cancelled, we cancel any reminders that are still scheduled. Messages that have already been sent cannot be recalled.

Resend stores email content and delivery logs in the USA, even though our sending region is Ireland. The Resend data processing agreement includes EU Standard Contractual Clauses; further recipients are listed in the list of subprocessors.

Sites and Cloudflare also do not guarantee processing exclusively in Europe; access and processing may take place in the USA, among other countries. The Sites data processing agreement provides for Standard Contractual Clauses or applicable adequacy decisions. The OpenAI list of subprocessors names the providers and countries. You can obtain information and copies of the relevant safeguards through our data protection contact.

We delete correspondence that is no longer needed and unsuccessful rental enquiries, including messages, supporting documents and copies, as soon as the relevant purpose ceases to apply. Necessary data is retained for longer only where required by law or specifically necessary for pursuing or defending legal claims (Article 6(1)(c) or (f) GDPR). For completed cases with a justified continuing need, a further review is scheduled no later than after 180 days; a legal dispute may require a longer retention period that is documented. There is no blanket six-month retention period and no automatic deletion upon expiry of a deadline in the portal.

When a contract is concluded, we retain only the data needed for the tenancy and legal obligations; the remaining application documents are deleted. The erasure review also covers mailboxes and local copies.

Under the plan we use, Resend retains email content and sending logs for 30 days; backup copies may remain for up to seven additional days. If earlier deletion is required, it can be arranged through the provider's support service. Details: Resend data protection information. The separate information in Section 2 applies to visitor statistics and misuse counters. Providers' technical logs and backups serve their own operational and security purposes; the period stated for statistics is not a deletion commitment for these records.

The selected language is carried only in the page address as a lang parameter. We do not use a cookie or browser storage for this purpose. No data is sent to external translation services.

The application we developed does not set advertising, analytics or tracking cookies. For requested access to the administration area, it uses a protected login cookie with a lifetime of up to eight hours.

The hosting infrastructure also uses Cloudflare's security cookie __cf_bm, to detect automated abusive access. It contains encrypted information for bot detection and expires after 30 minutes of continuous inactivity. Processing in the USA is possible in this context; see Section 5 and the Cloudflare cookie information.

For storage on your device that is necessary for secure provision of the service, we rely on Section 25(2), no. 2 TDDDG; for subsequent processing, we rely on our legitimate interest in secure operation (Article 6(1)(f) GDPR).

Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction of processing and data portability. A message to info@vegelahn.de is sufficient to exercise these rights.

Right to object: You may object at any time to processing under Article 6(1)(f) GDPR on grounds relating to your particular situation. We examine whether compelling legitimate grounds or the pursuit of legal claims justify continued processing.

You may lodge a complaint with a data protection supervisory authority, in particular the Landesbeauftragte für Datenschutz Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, mail@datenschutzzentrum.de. Information and ways to lodge a complaint.