Inquire now

Privacy Policy

This translation is provided for convenience. The German version is legally binding: read the German version.

Last updated: October 2, 2026

1. Who is responsible for your data

The controller responsible for processing your personal data on this website is:

One Haven GmbH
Widenmayerstrasse 34
80538 Munich
Email: kontakt@onehaven.de
Phone: +49 173 3129106

We have not appointed a data protection officer. The requirements of Article 37 GDPR and Section 38 BDSG are not met in our case. For any questions about data protection, you can reach us at the address listed above.

2. Overview: what we process and how

So you do not have to read the entire text, here is a brief summary first. Each point is explained in detail below.

  • When you visit the website, server logs are created on our server in Germany.
  • When you submit an inquiry, we process your contact details and your housing preferences.
  • When you apply for an apartment, we process your documents, including proof of income.
  • Before making an offer, we check your creditworthiness through Creditreform.
  • When you schedule a viewing, we process your appointment.
  • If a contract is concluded, you sign it through our own signature server.
  • Our emails to you are sent through Google Workspace.
  • If you write to us via WhatsApp, Meta also processes that message.
  • Reach measurement and ad tracking are currently turned off. They will start only if you consent.

3. Website delivery and server logs

Purpose. We need to deliver the website technically and secure its operation. This includes defending against attacks and troubleshooting errors.

Types of data. Each time the website is accessed, our web server automatically stores: your IP address, the date and time of access, the address accessed, the transfer status, the amount of data transferred, the page visited previously, and the browser and operating system identifier.

Legal basis. Article 6 paragraph 1 letter f GDPR. Our legitimate interest is the technically error-free and secure operation of this website.

Recipients. Our hosting provider operates the server in Germany and is our processor. The website itself is built statically. When a page is accessed, no third-party scripts, fonts, or map services are loaded from third-party servers. All fonts are stored locally on our server. The only exception is the map on the building pages, and only if you load it yourself (see below, maps only after clicking).

Storage period. The log files of our web server are rotated daily and deleted after 52 days. Beyond that, we evaluate only data that can no longer be attributed to you.

Transfer to third countries. Does not take place.

Maps only after clicking. On the pages for our buildings, only a placeholder is shown at first. Only when you click “Load map” does your browser load a map from OpenStreetMap, operated by the OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom. In the process, the Foundation receives your IP address and the usual technical information from your browser. The legal basis is your consent through the click (Article 6 paragraph 1 letter a GDPR). An adequacy decision by the European Commission applies to the United Kingdom. Without a click, no data is sent there; by using the “Open in Google Maps” link, you leave our website.

4. Your inquiry through the inquiry form

Purpose. You tell us which building you would like to live in. We check availability, get back to you, and prepare a possible rental relationship.

Types of data. Required information is your name, your email address, and the apartment you are inquiring about. Optional information includes your phone number, your desired move-in date, the planned rental period, your message to us, and a company code if your employer works with us.

For technical purposes, we also record: which campaign or link your click came from, known as UTM parameters, an additional field that is invisible to you, and the time between opening and submitting the form. We use the last two pieces of information exclusively to identify automated spam.

Legal basis. Article 6 paragraph 1 letter b GDPR, because the processing is carried out at your request to prepare a contract. For spam prevention, we rely on Article 6 paragraph 1 letter f GDPR; our legitimate interest is protection against abusive submissions.

Recipients. Your inquiry is processed on our own application server, which runs on the same server in Germany. No one receives access except our hosting provider.

Storage period. If no rental relationship is concluded, we delete your inquiry six months after the last contact. The period results from the two-month period for asserting claims under Section 21 paragraph 5 AGG, plus time for delivery and review of possible claims. If a rental relationship is concluded, the periods in Section 8 apply.

Transfer to third countries. Does not take place. However, we send our response to you by email; see Section 9.

5. Your application documents

Purpose. If your inquiry is shortlisted, we send you a personal link that you can use to upload your documents. We use them to check whether we can offer you the apartment.

Types of data. Depending on the building and the process, this includes your self-disclosure form and proof of income, such as pay slips, employment contract, or tax assessment. This is sensitive financial information about you. We do not request special categories of personal data within the meaning of Article 9 GDPR. Please black out information that is not needed for the review, such as religious affiliation or health data on a pay slip.

How we protect the documents. The upload link applies only to your case and cannot be guessed. We activate it specifically for each building. Your files are stored outside the publicly accessible area of our server, so they cannot be accessed through a web address.

Legal basis. Article 6 paragraph 1 letter b GDPR, pre-contractual measure at your request.

Recipients. The documents are viewed by the responsible OneHaven employees and the property management company for the respective building. The property management company acts for the owner, who concludes the rental agreement with you as the landlord. It receives only the documents it needs to conclude and manage the rental relationship, and processes them under its own responsibility.

Storage period. If we decline your application, we delete your documents three months after the rejection. This period covers the period for asserting claims under Section 21 paragraph 5 AGG. At your request, we will delete them earlier. If a rental agreement is concluded, the periods in Section 8 apply.

Transfer to third countries. Does not take place.

6. Credit check through Creditreform

Purpose. Before we confirm an apartment for you, we obtain information about your ability to pay. We want to know whether the rent can be paid on an ongoing basis.

Types of data. We transmit your title, first and last name, and full address. In return, we receive an assessment of your ability to pay.

Recipient. Verband der Vereine Creditreform e. V. or the Creditreform company responsible for us. Creditreform explains how it handles your data in its own privacy information under Article 14 GDPR at creditreform.de.

Legal basis. Article 6, paragraph 1, point b GDPR. The information is part of the steps leading to the rental agreement for which you apply with your application. We obtain it only after you have submitted your application, and only for the apartment you are applying for.

No automated decision. A person always decides on your application. The result of the credit check is one factor, not the decision itself. Approval is granted by the property management company. A decision based solely on automated processing within the meaning of Article 22 GDPR does not take place.

Storage period. If we decline your application, we delete the information three months after the rejection. If a rental agreement is concluded, we keep only the check result in the rental file, not the complete information data set.

Transfer to third countries. Does not take place.

7. Viewing appointments

Purpose. You schedule your viewing appointment yourself through a link and can cancel it again through your own link.

Types of data. Your name, your contact details, the selected building, and the selected appointment time.

Legal basis. Article 6, paragraph 1, point b GDPR.

Recipient. Appointment management runs on our own application server. The person conducting the viewing also receives the appointment information.

Storage period. Six months after the appointment, unless a rental relationship is established. This means the same period applies as for your inquiry.

Transfer to third countries. Does not take place.

8. Rental agreement and electronic signature

Purpose. If a contract is concluded, you sign electronically.

Where this takes place. We operate the signature software ourselves on our own server in Germany. Your contract data does not leave this server. No external signature service provider is involved.

Types of data. All information in the rental agreement, including name, address, date of birth, occupation, rent amount, and deposit, for up to four people if there are several tenant parties. This also includes the signature log data, meaning the time and technical proof.

Legal basis. Article 6, paragraph 1, point b GDPR for the performance of the rental agreement. For retention after the agreement ends, additionally Article 6, paragraph 1, point c GDPR, because we are subject to retention obligations under tax and commercial law.

Storage period. We retain rental agreement documents until three years after the end of the rental relationship, calculated from the end of the year in which the rental relationship ends. This corresponds to the regular limitation period under Sections 195 and 199 BGB. We keep documents that must be retained under tax or commercial law for ten years, pursuant to Section 147 AO and Section 257 HGB. The signature logs follow the retention period of the respective contract.

Transfer to third countries. Does not take place.

9. Emails from us to you

Purpose. We respond to your inquiry and send you appointment confirmations, documents, and contract documents by email.

Recipient. Our email delivery runs through Google Workspace, operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google processes the content and metadata of our emails on our behalf.

Legal basis. Article 6, paragraph 1, point b GDPR, insofar as the email serves to take steps prior to entering into your rental agreement or to perform it. Otherwise, Article 6, paragraph 1, point f GDPR. Our legitimate interest is functioning and secure business communication.

Third-country transfer. Google may also process data in the United States. Google LLC is certified under the EU-US Data Privacy Framework, and Google also uses the standard contractual clauses of the EU Commission. Despite these safeguards, processing in the United States carries the risk that authorities there may access data without an effective legal remedy available to you.

Processing on our behalf. We have a data processing agreement with Google under Article 28 GDPR (Google Workspace Data Processing Addendum). Google processes emails only on our behalf and according to our instructions.

Storage period. Emails relating to the rental relationship follow the periods stated in Section 8. We delete emails relating to inquiries that do not result in a contract after six months.

10. WhatsApp

Purpose. Each building has its own WhatsApp number. You can write to us there instead of calling or sending an email.

Important information first. WhatsApp is a service of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. If you write to us via WhatsApp, Meta learns that and when you are in contact with us, which phone number you use, and which device you use. The content of your messages is end-to-end encrypted. The connection data about those messages is not. We have only limited influence over this processing by Meta.

We use both the WhatsApp Business App and the WhatsApp Business Cloud API. With the Cloud API, your messages are also processed on Meta servers before they reach us. With the Business App, the address book of the relevant service phone may also be affected.

If you do not want this. Please email us instead at kontakt@onehaven.de or call us. You can reach us just as easily through either of these channels, and Meta is not involved.

Types of data. Your phone number, your profile name, the content of your messages, and the time and delivery status.

Legal basis. Article 6, paragraph 1, point b GDPR, insofar as the exchange serves to take steps prior to entering into your contract or to perform it. Otherwise, Article 6, paragraph 1, point f GDPR. Our legitimate interest is a fast and convenient communication channel for you. By contacting us via WhatsApp, you consciously choose this channel.

Third-country transfer. Meta may process data in the United States. Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework, and standard contractual clauses also apply. The residual risk of access by authorities described in Section 9 remains.

Role of Meta. For the WhatsApp Business Cloud API, Meta processes your messages as a processor under Article 28 GDPR on the basis of the WhatsApp Business data processing terms. If you write to us through the WhatsApp Business App, Meta processes the connection and usage data of your account under its own responsibility according to the WhatsApp Terms of Service and Privacy Policy that you have agreed to with WhatsApp.

Storage period. We delete chat histories relating to inquiries that do not result in a contract after six months. Histories relating to an existing rental relationship follow the periods stated in Section 8.

11. Reach measurement and ad tracking

What runs on this website. We measure the reach of the website and the success of our ads, but only with your consent. For this, we use Google Tag Manager. Until you have consented, we do not set any marketing cookies, measure any reach, or analyze any ads. There are no social media plugins and no fonts from third-party servers. Map services load only if you click “Load map” yourself (Section 3).

How consent works. When you first visit the site, a consent banner asks you for your choice. Google Tag Manager itself is a management tool. It does not analyze anything on its own, but starts the services listed below. It is loaded from Google servers when the page is opened. For technical reasons, your IP address is transmitted to Google in the process. The measurement and advertising services start only after you have consented. If you decline, they remain inactive.

Legal basis. For storing information on your device and accessing it, Section 25, paragraph 1 TDDDG applies. For the subsequent processing of your data, Article 6, paragraph 1, point a GDPR applies. You can withdraw your consent at any time with effect for the future, without any disadvantages for you.

Services used with your consent.

Checked on September 18, 2026 in container GTM-PNMCZ4LP (“onehaven.de relaunch 2026”): exactly two services are set up, both from Google. No Meta pixel, no LinkedIn, no Microsoft Advertising, no Hotjar, and no Clarity. The list below is therefore short, and it is complete.

  • Google Analytics 4 (measurement ID G-S8S4TFFP5S). Traffic measurement. Provider: Google Ireland Limited. Processed data includes truncated IP address, device and browser information, pages visited, time spent on the site, and triggered events. Cookie retention period up to 24 months, retention period for analytics reports 14 months. Transfer to a third country, the United States, is possible; see section 9.
  • Google Ads Conversion Tracking (conversion ID AW-17040232852). Measures whether an inquiry came from an ad. Provider: Google Ireland Limited. Processed data includes click identifier, time, and the fact that a conversion occurred. Currently recorded: clicks on an email address, clicks on a phone number, clicks on WhatsApp, and submitted forms. Transfer to a third country, the United States, is possible.
  • Google Consent Mode v2. Transmits your consent decision to the two services named above so they can act accordingly. It is not a separate analytics service.

Google Tag Manager itself only manages tags; it does not analyze anything. It starts only the three components named above, and none of them without your consent.

Consent management. The consent banner is our own development and runs in your browser. No third-party service is integrated, and no data is transmitted to third parties for this purpose. Your decision is stored as an entry in your browser’s local storage and requested again after 180 days. So we know how many visitors consent, our own server counts each decision anonymously: only whether statistics and marketing were allowed, as a daily total, without a cookie, without an identifier, and without a stored IP address. You can change or withdraw your decision at any time through “Cookie settings” in the footer.

12. What we do not do

We do not operate a newsletter. We do not use cookies for advertising purposes unless you have consented. We do not sell your data or share it with third parties, except with the parties named in this statement or where we are legally required to do so.

13. Your rights

You have the following rights with respect to us. A brief message to kontakt@onehaven.de is enough; you do not need a form.

  • Access, Article 15 GDPR. You can find out which data we process about you, for what purpose, for how long, and who receives it. Upon request, you will receive a copy.
  • Rectification, Article 16 GDPR. If something is incorrect or incomplete, we will correct it.
  • Erasure, Article 17 GDPR. We delete your data as soon as the purpose no longer applies and no statutory retention obligation prevents deletion.
  • Restriction of processing, Article 18 GDPR. Instead of deleting data, we may also freeze processing, for example while the accuracy of information is being clarified.
  • Data portability, Article 20 GDPR. Data that you have provided to us on the basis of consent or a contract will be provided to you in a commonly used, machine-readable format, or we will transmit it directly to another party.
  • Objection, Article 21 GDPR. You may object, on grounds relating to your particular situation, to processing that we base on a legitimate interest. We will then stop the processing unless we can demonstrate compelling legitimate grounds.
  • Withdrawal of consent, Article 7 paragraph 3 GDPR. If you have given consent, you can withdraw it at any time for the future. This does not affect the lawfulness of processing carried out before the withdrawal.

14. Complaint to the supervisory authority

You may lodge a complaint with a data protection supervisory authority at any time, without contacting us first. The authority responsible for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 27
91522 Ansbach

You may also contact the supervisory authority for your place of residence or workplace.

15. Changes to this statement

We update this statement when our processing activities or the legal situation change, for example if we enable traffic measurement or introduce new features. The version available here always applies. The date of the current version appears at the top of the page.