Privacy notice

Controller

VON RUEDEN Rechtsanwälte GbR
Partners: Rechtsanwalt Johannes von Rüden and Rechtsanwalt Fabian Heyse
Leipziger Platz 9
10117 Berlin
Telephone: +49 30 200 590 770
Email: info@rueden.de

Data Protection Officer

Legaltrust GmbH, Michael Michalak
Lietzenburger Straße 94
10719 Berlin
Telephone: +49 30 887 27 609
Email: datenschutz@prive.eu

Anonymous questionnaire

If you select “Answer questions”, your answers are processed exclusively in the browser’s local state. During the questionnaire, the address, tenancy information, rent figures and the summary generated from them are not transmitted to the law firm, linked to a user account or stored in the database. These entries are lost if you reload or close the rent-check window.

The short check does not query an official address service in real time. Only on the result screen do you decide whether to keep the displayed summary for yourself or prepare a personal enquiry.

Express submission of a personal enquiry

Nothing from the short check is sent automatically. If you request a personal review from the result screen, the complete summary to be transmitted is shown to you first. You can amend or remove information and decide which documents, if any, to add.

Data is transmitted only after you actively tick the submission confirmation and then select “Send enquiry securely”. Only then are the displayed summary, your email address, an optional name and the documents you selected transmitted. Without this express confirmation, the summary remains local.

Alternatively, you can use the direct upload. You may select the tenancy agreement, attachments and other relevant documents together. A maximum of eight PDF, JPG or PNG files is permitted, each up to 20 MB and up to 40 MB in total. Required file metadata such as filename, format and size are also stored, together with the time of receipt, processing status, confirmation time, language of the enquiry and the version of this privacy notice.

The data is processed in order to handle the enquiry you requested and provide a personal response. The legal basis is Article 6(1)(b) GDPR insofar as the processing, at your request, is necessary to take steps prior to a potential legal engagement.

The documents are stored in a private file store that is not publicly accessible. Contact details, the summary and technical file references are stored as protected intake data. No automated legal decision is made. The enquiry creates neither a legal engagement nor a power of attorney, and your landlord is not contacted as a result.

Retention period and access

The summary, contact details and documents are retained only for as long as required for the requested assessment and response. They are then deleted unless a legal engagement is established or statutory retention obligations or the establishment, exercise or defence of legal claims require further retention.

The internal review area and file downloads are protected by separate access controls. An intake can be deleted there manually and in full. This removes the summary, contact details, processing and file metadata from the intake database and all associated files from the private file store. Merely marking an intake as “Completed” does not delete it.

Access-controlled backups are created daily and automatically overwritten after seven days. If an intake is deleted from the active system, it may therefore remain in a backup until that backup period expires. Backups are used only to restore service after a technical failure and are not part of the active review area.

Technical delivery

When a web page is retrieved, the hosting infrastructure processes technically necessary access data, in particular the IP address, time, requested file, browser information and access status. This processing is necessary to deliver the service securely. Access and error logs are rotated daily and deleted after no more than 14 days. The legal basis is Article 6(1)(f) GDPR.

Internal notification of new enquiries

After a personal enquiry has been stored successfully, a short notification is sent through Mailjet, a Sinch Email service, to a fixed internal team recipient. This message contains only the reference number, time of receipt, number of files transmitted, whether a summary is present, and a link to the access-controlled internal review area.

The notification contains neither your email address or name nor the content of the summary, addresses, filenames or documents. Open and click tracking are disabled for these messages. In addition to this deliberately limited message content, Mailjet receives technically necessary sending and delivery metadata, such as the internal sender and recipient addresses, time of sending and delivery status. The retention period for this metadata is governed by the contract and plan agreed with Mailjet.

Mailjet or Sinch Email acts as a processor for this purpose; production use requires a data-processing agreement applicable to the specific account. Mailjet states that personal data for the service is stored in data centres within the European Union, currently in Frankfurt and Saint-Ghislain. The contractual, plan and location terms agreed for the specific account and the then-current information on subprocessors remain authoritative.

Aggregated first-party funnel counters

To identify usability problems and drop-off points in the rent check, KIEZRECHT counts selected funnel steps solely in aggregated form. Only the calendar date, event type and corresponding total count are stored, for example starts of the questionnaire, views of the result or successful enquiries. These figures describe events, not uniquely identifiable individuals.

The counter endpoint stores no IP address, user or device identifier, URL or referrer, answers, address, rent information, filenames, contact details or reference number. The counters therefore cannot be linked to an individual or a specific intake. The legal basis is Article 6(1)(f) GDPR; the legitimate interest is improving the clarity and reliability of the service while minimizing data.

For technical abuse protection, only the minute, event type and a global count without a user identifier are additionally aggregated. Once such a short-term counter is more than two days old, it is removed when the next event is recorded or during the next hourly cleanup and, until then, is not used in the conversion analysis. KIEZRECHT uses no analytics or marketing cookies for this purpose and transmits no data to external analytics or advertising services. Full deletion of a personal enquiry does not alter the independent aggregated total counters.

Cookies and external media

KIEZRECHT itself uses no analytics or marketing cookies and embeds no maps, videos or social-media feeds. Fonts and images are loaded from the service’s own delivery environment. Technically necessary hosting functions are unaffected.

Contacting us

If you actively use the direct upload, linked email address or telephone number, the data you provide is processed in order to handle and respond to your enquiry. The legal basis is Article 6(1)(b) GDPR insofar as pre-contractual steps or performance of a legal engagement are concerned, and otherwise Article 6(1)(f) GDPR.

Rights

Subject to the GDPR, you have rights of access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to lodge a complaint with a data-protection supervisory authority.

Competent supervisory authority: Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin.

www.datenschutz-berlin.de