Privacy policy
1. Controller
The controllers within the meaning of the General Data Protection Regulation (GDPR) are the two operators of this offering jointly (Art. 26 GDPR): ONSTUDIO Louis Maurice Dietl Am Schoolkamp 104 46238 Bottrop Germany Email: info@onstudio.de Services Cologne Mehmet Ayan Vogelsanger Straße 197c 50825 Köln Germany Email: info@services.koeln In an arrangement pursuant to Art. 26 GDPR, both controllers have determined which of them fulfils which obligations under the GDPR. You may exercise your rights against either controller. For general data protection enquiries, please contact us at hallo@easytenant.de.
2. General information on this privacy policy
This privacy policy informs you about the processing of personal data (a) when you visit our website easytenant.de and (b) in connection with the use of our EasyTenant software. Personal data is any information relating to an identified or identifiable natural person. We process personal data exclusively in accordance with the GDPR and the German Federal Data Protection Act (BDSG).
3. Accessing the website and server log files
When you access this website, technical access data is automatically processed in server log files: IP address of the accessing device, date and time of access, page or file accessed, volume of data transferred, notification of successful retrieval, browser type and version, operating system and the previously visited page (referrer). This data is technically necessary to deliver the website, ensure its stability and security, and defend against attacks. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and uninterrupted operation). Log files are deleted after no more than 30 days, unless they are exceptionally required for longer to investigate a specific security incident.
4. Hosting
Our website and the EasyTenant software are operated by specialised hosting providers that process the data on our behalf (processing on behalf pursuant to Art. 28 GDPR): • Website and application: Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. • Database: Neon Inc., 209 Kearny Street, San Francisco, CA 94108, USA (serverless PostgreSQL). The database is operated in a data centre region within the EU (Frankfurt am Main). The respective provider processes the access data mentioned above and the content data arising from use solely to provide the service. The legal basis is Art. 6(1)(f) GDPR and, for use of the software, Art. 6(1)(b) GDPR. As Vercel and Neon are US companies, data may be transferred to the USA; see section 13 for this and for the server location.
5. Cookies and language setting
Our website uses only strictly necessary cookies. When you switch languages, a cookie (NEXT_LOCALE) is set that stores your language choice (German or English) so the site can be displayed in the desired language. This cookie is necessary to operate the website; the legal basis is Art. 6(1)(f) GDPR and § 25(2) TDDDG (strictly necessary storage access). We do not use any analytics, marketing or tracking cookies or any audience-measurement services. A consent banner is therefore not required.
6. Contact
If you contact us by email (e.g. hallo@easytenant.de), via the contact form on our website or via the contact details in our legal notice, we process your information (name, email address, content of your message) solely to handle your request and for any follow-up questions. The legal basis is Art. 6(1)(b) GDPR where your request is aimed at concluding or performing a contract, and otherwise Art. 6(1)(f) GDPR (interest in responding to enquiries). We delete your request once it has been dealt with and no statutory retention obligations apply.
7. Registration and customer account
To use EasyTenant, you set up a customer account as a property manager or landlord. In doing so, we process the data required to perform the contract, in particular name, company, address, email address, telephone number, login credentials and the properties you create. The legal basis is Art. 6(1)(b) GDPR (performance of the usage contract). This data is stored for the duration of the contractual relationship and deleted after it ends, subject to statutory retention periods. To document the consents given (terms, DPA, privacy), we log the time, the accepted document version and the IP address at registration. The legal basis is Art. 6(1)(b) and (f) GDPR in conjunction with the accountability requirement under Art. 7(1) GDPR.
8. Processing within the EasyTenant software
EasyTenant helps you, as a manager, to receive and handle requests from your tenants. In particular, the following data is processed: tenant master data (name, address of the residential or commercial unit, contact details, personal customer number in the format KD-000000-0), the content of incoming reports (e.g. „dripping tap“), the automatically determined category (plumbing, heating, electrical, locksmith or caretaker/other), the processing status and data of the assigned service providers (name, trade, contact details, order of priority). For this processing, you as our customer are generally the data controller; we act as a processor on your behalf (see section 12). The legal basis for our activity is the contract concluded with you (Art. 6(1)(b) and Art. 28 GDPR). The automatic assignment of a report to a category is AI-assisted. For this purpose, the message content is passed via our messaging provider SendSeven GmbH to Google Vertex AI (Enterprise tier, Gemini models, currently gemini-2.5-flash) and processed exclusively in the EU region europe-west4 (Netherlands). Google does not use this data to train or improve its models (Vertex AI enterprise data protection). This does not involve any solely automated decision producing legal effects concerning you within the meaning of Art. 22 GDPR.
9. Communication via WhatsApp, SMS and email
Tenants can submit their requests via WhatsApp, SMS or email; EasyTenant sends automated responses (e.g. acknowledgements and status updates) via the same channel. This involves processing the telephone number or email address and the message content and assigning it to the respective tenant. For technical delivery, we use the following providers as processors: • WhatsApp and SMS: provided via SendSeven GmbH, Werner-Haas-Straße 8, 86153 Augsburg, Germany (email: privacy@sendseven.com) as messaging provider. To deliver messages, SendSeven in turn uses sub-processors: Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland (WhatsApp) and seven.io, operated by seven communications GmbH & Co. KG, Kiel, Germany (SMS gateway, servers in the EU). Please note that using WhatsApp may also result in data being transmitted to Meta. • Email: sent via Resend, operated by Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. The legal basis is Art. 6(1)(b) GDPR and Art. 28 GDPR within the processing relationship with our customers. For third-country transfers, see section 13.
10. Welcome letters by post
On request, EasyTenant automatically sends welcome letters to new tenants, containing among other things the personal customer number and the contact channels. To produce and send the letters, we transmit the recipient's name and address to a print and mailing provider that processes this data solely on our behalf or on behalf of our customer: A&O Fischer GmbH & Co. KG, Maybachstraße 9, 21423 Winsen (Luhe), Germany. The legal basis is Art. 6(1)(b) GDPR and Art. 28 GDPR.
11. Payment processing via Stripe
The usage fees (€7.50 per property per month) are billed via the payment service provider Stripe. For users in the European Economic Area, the provider is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. When a payment is made, the data required to process it (e.g. name, billing address, email address, payment method and transaction data) is transmitted to and processed by Stripe; full payment data (such as credit card numbers) is collected directly by Stripe and we have no access to it. The legal basis is Art. 6(1)(b) GDPR (performance of contract) and Art. 6(1)(c) GDPR (compliance with tax and commercial law obligations). Further information: https://stripe.com/privacy.
12. Allocation of roles and processing on behalf
Two levels of processing must be distinguished when using EasyTenant: • For the website easytenant.de and our own customer data (sections 3–7 and 11), we – ONSTUDIO and Services Cologne – are the data controllers. • For the personal data that you as a customer process about your tenants, properties and service providers in EasyTenant (sections 8–10), you are the controller and we act as a processor pursuant to Art. 28 GDPR. This is based on a data processing agreement to be concluded with you, which governs, among other things, the sub-processors used (hosting, message delivery, printing, payment). We process this data exclusively on your instructions and not for our own purposes.
13. Recipients and transfers to third countries
We only pass personal data to recipients where this is necessary to perform the contract, you have consented, or we are legally obliged to do so. Recipients are, in particular, the processors named in this policy (hosting, payment service provider, message and print providers) as well as the service providers and tradespeople you commission, to whom a report is forwarded for handling. Where individual providers process data outside the EU or EEA (e.g. providers based in the USA), the transfer only takes place on the basis of appropriate safeguards pursuant to Art. 44 et seq. GDPR – in particular an adequacy decision (EU-US Data Privacy Framework) or the EU Commission's standard contractual clauses. This applies in particular to our US providers Vercel Inc. (website and application) and Neon Inc. (database); the transfer is based on the standard contractual clauses agreed in their respective data processing agreements. The same applies to the email delivery provider Resend, Inc. (USA) and – when WhatsApp is used – to a possible transfer to Meta Platforms, Inc. in the USA. Our messaging provider SendSeven GmbH (Augsburg), its SMS gateway seven.io (seven communications GmbH & Co. KG, Kiel), the AI processing via Google Vertex AI (EU region europe-west4, Netherlands) and our print and mailing provider A&O Fischer GmbH & Co. KG (Winsen/Luhe) process the data within the EU.
14. Retention period
We store personal data only for as long as is necessary for the respective purposes or as required by statutory retention periods. Contract and billing data is subject to commercial and tax retention periods of generally 6 or 10 years (§ 257 HGB, § 147 AO). Report and communication data of your tenants is deleted in accordance with your instructions as the controller. After a processing relationship ends, we delete or return the processed data at your choice, unless a retention obligation applies.
15. Data security
We take technical and organisational measures pursuant to Art. 32 GDPR to protect your data against loss, misuse and unauthorised access. These include, in particular, encrypted data transmission via TLS/HTTPS, access restrictions and regular review of our security measures. Our measures are continuously adapted in line with technological developments.
16. Your rights as a data subject
Within the statutory framework, you have the right to access the data stored about you (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing based on legitimate interests on grounds relating to your particular situation (Art. 21 GDPR). You may withdraw any consent given at any time with effect for the future. If you are a tenant, please address your requests primarily to the property manager responsible for you as the controller; otherwise we will forward requests to them. Irrespective of this, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your residence or of the alleged infringement. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.
17. Changes to this privacy policy
We adapt this privacy policy whenever changes to our processing or the legal situation make this necessary. The current version published on this page applies in each case. Last updated: July 2026.