Skip to content

Privacy Policy for Prospective Tenants

Last updated: 5 November 2026. How Immomio GmbH processes your personal data when you use our platform as a prospective tenant.

This English translation is provided for convenience only. The German version is legally binding.

Introduction

In this privacy policy, we, Immomio GmbH (hereinafter “Immomio”, “we”, “us”), would like to explain how we process your personal data when you (hereinafter “prospective tenant” or “user”) use our services. By our services we mean the digital services for prospective tenants operated on the website immomio.com (the “platform”), including the user interfaces, interfaces and IT systems used for this purpose. We also inform you about the processing of your data when you visit our presences on social networks.

If you use our services as an employee of one of our business customers (e.g. a landlord), you will find further information in our privacy policy for landlords.

The terms under which you use our platform are set out in our General Terms and Conditions for Prospective Tenants (hereinafter “T&Cs”). The terms used in this privacy policy have the same meaning as in the T&Cs. We explain the most important terms in section 1 below.

In this privacy policy, we strive to be as easy to understand as possible. For this reason, we do not use female and male forms of language simultaneously. All references to persons apply equally to all genders.

1. How does Immomio work?

So that you can understand who sees which of your data when, and who is responsible for it, we will first explain how our platform is structured.

1.1 Immomio is a marketplace, not a landlord

Immomio operates a digital marketplace for rental flats and other rental properties (where applicable also for purchase). Two groups meet on this marketplace:

  • Providers: landlords, housing companies, property management companies and other companies that publish properties on the platform and offer them for rent.
  • Prospective tenants: you as a user who is looking for a flat or another property and would like to apply for it.

We provide the technology through which providers offer their properties and through which you can apply for them, communicate with the provider and arrange viewing appointments. We are neither a landlord nor an estate agent ourselves. We do not pre-select applicants and do not influence the provider’s decision. Whom a provider invites to a viewing and with whom it concludes a tenancy agreement is decided by the provider alone.

1.2 One platform, many separate areas: the multi-tenant infrastructure

Technically, our platform is built as a so-called multi-tenant infrastructure. You can think of it as a large office building:

  • Each provider has its own, self-contained office in this building, its so-called Tenant. A Tenant is a logically isolated technical area that is accessible only to the respective provider. A provider cannot see into the Tenants of other providers.
  • Your own data is held in your personal user account with your tenant profile, in your own data safe, so to speak. We manage this safe on your behalf as a trustee (data trusteeship).
  • A provider only gains insight into your data if and to the extent that this data is released in its Tenant. Which data this is depends on our staged model and on how far you have progressed in the application process. As a rule, you yourself decide whether to apply for a property and move on to the next phase (details in section 4).

Because only providers with their own Tenant can offer properties on the platform and communicate with you, your data remains within this protected system. You do not have to send sensitive documents by email or via other insecure channels.

1.3 The most important terms

  • Provider: landlords, housing companies, property management companies and other companies that publish properties via the platform and offer them for rent. Where we refer to a “landlord” in this privacy policy, this means the respective provider.
  • Tenant: the logically isolated technical area (Mandant) of a provider on the platform.
  • Basic account: your free personal user account, which you receive when you register. In it, you can, among other things, create a tenant profile and search profiles, apply and communicate with providers.
  • Tenant profile: the area of your user account in which you can store information about yourself, your household and your search criteria and upload documents.
  • Connected provider: a provider that you have actively linked to your basic account. Two options are available to you for establishing such a connection:
  • Either you register as an Immomio user via a link provided by the provider on its website and create a search profile in the process. If you already have a basic account with Immomio, you can log in via this link and the connection is established even without creating a search profile.
  • Or you apply for a property that the provider has advertised on its website or on third-party property portals and, in this context, register as an Immomio user via the link provided by the provider. If you already have a basic account with Immomio, you can log in via this link and thereby establish the connection between your basic account and this provider.

With the basic account, you can only use the functions of the platform in relation to connected providers.

  • Immomio Now: a subscription with which your user account is linked not only to your connected providers but to the Tenants of all providers on Immomio. Depending on the variant, this applies to your chosen search region (free subscription), to all regions (paid subscription) or to all regions, restricted to housing that requires a housing entitlement certificate (Wohnberechtigungsschein, WBS) (free subscription with WBS). Details can be found in section 3.9.
  • Staged model and release: our procedure under which your data is not disclosed to a provider all at once, but step by step in its Tenant, depending on the progress of the application process (phases 0 to 3, see section 4.2).
  • Matching: a procedure in which we calculate a numerical value indicating how well your profile matches the criteria that a provider has defined for a property (ideal tenant profile), without the provider seeing your individual details for this purpose (see section 4.5).
  • Applying as a guest: an application via the platform that a provider makes possible without you creating a user account with Immomio (see section 4.6).
  • Housing entitlement certificate (Wohnberechtigungsschein, WBS): the time-limited certificate issued by the competent authority with which you prove your entitlement to occupy publicly subsidised (WBS-restricted) housing.

1.4 When is Immomio a “controller” and when a “processor”?

Data protection law distinguishes between the controller, who decides on the purposes and means of data processing and is accountable for it, and the processor, who processes data only on behalf of and on the instructions of a controller. Both roles occur on our platform.

Immomio as controller

We are the controller for all processing that we carry out in relation to you on the basis of our contract with you or for our own reasons. This includes in particular:

  • the operation of the website (e.g. web server logs, cookies);
  • your registration, your basic account, your tenant profile and your search profiles;
  • the management of your data as a trustee, the staged model and the transfer (release) of your data to providers;
  • matching;
  • the conclusion, management and billing of Immomio Now, including the verification of your WBS for Immomio Now with WBS;
  • SMS verification, the WBS checker and the SCHUFA-BonitätsCheck (SCHUFA credit check);
  • our support;
  • combating misuse, notice procedures and complaint procedures.

This privacy policy applies to this processing, and you can assert your rights against us.

Immomio as a provider’s processor

As soon as your data has been released in a provider’s Tenant, the provider processes this data for its own purposes, for example to select applicants, conduct viewings and conclude a tenancy agreement. The provider may also ask you to answer certain additional questions or its own tenant self-disclosure forms. The provider is the controller for this processing. We then store and process the released data in the Tenant as the provider’s processor, i.e. only on its instructions and on the basis of a data processing agreement pursuant to Art. 28 GDPR. The same applies if you apply as a guest (section 4.6) or if a landlord has commissioned us to operate its tenant app.

For you, this distinction has the following practical significance:

  • Information on how a provider uses your data can be found in the privacy policy of the respective provider.
  • Rights relating to data that a provider processes in its Tenant (e.g. access or erasure) are best addressed to the provider. If you contact us, we will forward your request to the provider.
  • If you withdraw an application or delete data in your tenant profile, we restrict the provider’s access via the platform in accordance with the more detailed provisions of this privacy policy (see section 4.4). If a provider has already downloaded data from its Tenant or transferred it to its own systems, the provider alone is responsible for this.

2. Who we are and how to contact us

The controller within the meaning of data protection law is

Immomio GmbH
Zippelhaus 2
20457 Hamburg
Email for data protection matters: mieterdatenschutz@immomio.de

We have appointed an external data protection officer, whom you can contact as follows:

External data protection officer of Immomio GmbH
c/o PLANIT//LEGAL Rechtsanwaltsgesellschaft mbH
Jungfernstieg 1, 20095 Hamburg
Email: mail@planit.legal
Tel. +49 40 60944190

3. What personal data we process and for what purposes

Whether and which of your personal data we process depends on how you get in touch with us and which of our services you use. Our platform is aimed exclusively at persons who are of legal age.

3.1 Internet connection data and web server logs

When you access our services in a browser on your device, we process your internet connection data. This is information about the type and version of your browser, about your device (e.g. device type, operating system), your screen resolution, where applicable the address of the website from which you came to us (referrer URL), and your IP address. We store this data for up to seven days in a log file on our web server (web server logs). Its processing is necessary so that our services can be displayed and used correctly on your device, and it serves the security of our systems. The legal basis is our legitimate interest in providing our services in a functional and secure form, Art. 6(1)(f) GDPR.

3.2 Cookies and similar technologies

When you access our services, we may use technologies with which information is stored on your device or read from it (hereinafter “cookies”). The following applies accordingly to other technologies such as scripts, pixels or tags. Cookies are small text files that a web server sends to your browser and that are stored on your device. They make it possible, for example, to recognise your browser when you visit again.

Technically necessary cookies

Some cookies are strictly necessary so that we can provide you with the service you have requested (e.g. so that you remain logged in). Access to your device then takes place on the basis of Section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act, formerly TTDSG). Insofar as we further process the personal information obtained in this way, the legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR) if you are a registered user, and otherwise our legitimate interest in providing our services and in data security (Art. 6(1)(f) GDPR).

Cookies that are not technically necessary

We only use cookies that are not technically necessary, for example for analysis purposes, if you have given your prior consent. For this purpose, we display a cookie banner when you access our services, through which you can give or refuse your consent and find further information on the individual cookies. The legal basis for access to your device is then your consent pursuant to Section 25(1) TDDDG, and for the further processing of personal data your consent pursuant to Art. 6(1)(a) GDPR.

To obtain and manage your consents, we use a consent management platform provided by a processor. In the process, your IP address and information about your browser and your device are processed and your selection is stored in a cookie. The legal basis is our legal obligation to be able to demonstrate consent (Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR) and our legitimate interest in consent management that complies with the law (Art. 6(1)(f) GDPR).

You can withdraw your consent at any time with effect for the future. On the website, open the privacy preference centre via the fingerprint symbol at the edge of the screen, deactivate individual cookies there using the slider and save the setting via “Save settings”. In the logged-in area, you can find the cookie settings in your profile under “Settings”.

Google Analytics

If you have given your consent, we use the web analytics service Google Analytics of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The parent company is Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (together “Google”). For this purpose, Google stores cookies with a pseudonymous identifier in your browser, assigns your usage behaviour on our website to this identifier and provides us with analyses and reports on the use of our website. We have activated IP anonymisation: your IP address is truncated within the EU or the EEA and only in exceptional cases transferred in full to a Google server in the USA and truncated there. Data may be stored on Google servers in the USA. For the USA, there is an adequacy decision of the European Commission of 10 July 2023 (EU-US Data Privacy Framework), under which Google is certified. The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can find Google’s privacy policy at https://policies.google.com/privacy.

3.3 Registration and basic account

You can visit our website without registering. However, to use the functions of the platform, you must register. When you register, we collect your name, your email address and a password of your choice (login data). We also store when and how you registered and confirmed your email address and which contracts you have concluded with us (contract data). This information is mandatory; without it, we cannot create a user account for you.

By registering, you conclude a free-of-charge contract of use with us for your basic account. The basic account includes in particular:

  • creating and managing a tenant profile, including uploading documents;
  • creating and managing search profiles so that connected providers can offer you suitable properties on the basis of our matching (providers do not see your search profile itself);
  • searching and filtering the offers of connected providers;
  • the management of your data as a trustee and its step-by-step release in the event of an application (section 4);
  • matching (section 4.5);
  • communication with connected providers via the platform, e.g. to arrange viewing appointments;
  • automatic status messages and notifications to your email address.

With an Immomio Now subscription, you can also use these functions in relation to other providers (section 3.9). We process the data mentioned to perform the contract of use, Art. 6(1)(b) GDPR.

To make automated registrations by bots more difficult, we compare the domain of your email address during registration with a list of known providers of disposable email addresses. The comparison takes place on our own systems; your email address is not transferred to third parties for this purpose. If the domain is listed, registration with this address is not possible; you can use a different address or contact our support. The legal basis is our legitimate interest in preventing misuse and fake profiles, Art. 6(1)(f) GDPR.

3.4 Your tenant profile

When you register, we ask for basic information about your search (e.g. what type of property you are looking for in which region). Mandatory fields are marked as such. All other information in your tenant profile is voluntary. You can add to or change your profile or delete information at any time. The more complete your profile is, the better your search can go. However, if information is missing, this may result in providers asking you for it later in the application process.

In particular, you can add the following information to your tenant profile: profile picture, address, telephone number, earliest possible move-in date, date of birth, household type, number of people moving in (adults and children), pets requiring approval, employment status, occupation, net household income, monthly financial commitments, guarantees, information about your WBS and uploaded documents such as a credit report, proof of income or WBS.

We process this data to perform the contract of use, Art. 6(1)(b) GDPR. Which of this data a provider gets to see and when is decided by you through your actions in the application process (section 4).

Note on uploaded documents: Before uploading, please redact all information that is not necessary for the flat application (e.g. tax ID, social security number or religious affiliation on payslips, individual transactions on bank statements, information on health, disability or pregnancy on the WBS). Please do not upload copies of identity documents and, as proof of creditworthiness, do not upload a full copy of the data held by a credit reference agency pursuant to Art. 15 GDPR, but a credit report specifically intended for tenancies (see section 3.7).

3.5 Applications and communication with providers

As a registered user, you can apply for properties, communicate with the provider via the platform and arrange viewing appointments. In doing so, we process your applications, their status, your messages and the booked appointments to perform the contract of use, Art. 6(1)(b) GDPR. We explain how and when your data is transferred to the provider in the context of an application in section 4.

3.6 Support

If you contact us with questions about our platform or with a request for assistance, we process your contact details, the content of your enquiry and our correspondence with you. Subscribers to the paid Immomio Now subscription also have access to personal support by email and contact form. For this purpose, we also process your customer and contract number.

The legal basis is the performance of the contract concluded with you (Art. 6(1)(b) GDPR) or, insofar as we provide services as a goodwill gesture or answer enquiries from non-users, our legitimate interest in answering enquiries and in customer satisfaction (Art. 6(1)(f) GDPR). For our helpdesk service provider, see section 5.

3.7 SCHUFA-BonitätsCheck

In your user account, you can commission us under a separate contract to obtain a credit report about you from SCHUFA Holding AG, Kormoranweg 5, 65201 Wiesbaden (“SCHUFA”) (SCHUFA-BonitätsCheck). This is a report specifically intended to prove your ability to pay to landlords, which contains only the information required for this purpose.

In doing so, we may in particular collect the following data and transfer it to SCHUFA: surname, first name, birth name, date of birth, place of birth, address, previous addresses as well as order, processing, payment, contract, usage, communication and consent data. The information marked as mandatory fields is required to carry out the order; without it, we cannot obtain the report. Further information is voluntary. We do not carry out a credit check of our own. The legal basis is your order, Art. 6(1)(b) GDPR. Further information on data processing by SCHUFA can be found at https://www.meineschufa.de/check/datenschutz.pdf.

3.8 SMS verification of your mobile number

You can verify your user account by SMS. To do so, we send a one-time code to the mobile number you have provided, which you then enter. Verification is voluntary. In the paid Immomio Now subscription, it is part of your subscription as a one-time verification that applies across all providers.

We process your mobile number and the result of the verification in order to confirm the accuracy of your contact details, to prevent automated applications by bots, to prevent multiple accounts held by one person and to display a verification badge to providers. Before sending the code, we therefore compare your number with the numbers that have already been verified. The verification badge is already displayed to providers in phase 0 (section 4.2). Providers can decide to offer their properties preferentially to users with a verified account.

If the verification is part of your contract or subscription, the legal basis is Art. 6(1)(b) GDPR; otherwise it is our legitimate interest in preventing misuse and fake profiles and in a fair application process and, where applicable, in fulfilling contractual obligations towards the respective provider, Art. 6(1)(f) GDPR.

We store your mobile number and the verification badge for as long as your account exists. Both are deleted when your account is deleted. We use a processor to send the SMS (section 5.3).

3.9 Additional data processing with Immomio Now

Registered users can additionally take out an Immomio Now subscription. Sections 3.3 to 3.8 apply accordingly. In addition, the following applies:

Inclusion in matching depending on the subscription variant

With Immomio Now, the aggregated matching score of your search profile (see section 4.5 below for more details) and the other phase 0 data (section 4.2) are automatically displayed to the providers covered by your subscription so that they can offer you suitable properties:

  • Free Immomio Now subscription: to all providers in the search region you have chosen.
  • Paid Immomio Now subscription: to all providers in all regions in Germany.
  • Free Immomio Now subscription with WBS: to all providers in all regions, but restricted to properties that are WBS-restricted housing.

Without an Immomio Now subscription, the matching score and your phase 0 data are only visible to your connected providers. The legal basis is the contract on Immomio Now concluded with you, Art. 6(1)(b) GDPR.

Transitional rule for existing search profiles: If the aggregated matching score of your search profile and the phase 0 data were already visible to all providers before Immomio Now was introduced, this remains the case for a transitional period, at most until the search profile expires. After that, this data is only visible to your connected providers unless you take out an Immomio Now subscription.

Subscription management, cancellation and withdrawal

When you take out a subscription, you receive a customer number and a contract number. We process these together with your master and contact data to manage your subscription, for example when it is concluded, changed, cancelled or withdrawn from and in the case of support requests. If you declare a cancellation via the “Cancel subscription” button or a withdrawal via our online function, we store the content of the declaration as well as the date and time of its receipt and send you a confirmation. If, in the case of the paid subscription, you expressly request that we begin providing the service before the withdrawal period expires, we store this request. The legal basis is the contract on Immomio Now (Art. 6(1)(b) GDPR) and, insofar as we store evidence on the basis of statutory obligations, Art. 6(1)(c) GDPR.

Payment processing and invoices

For the paid subscription, we use the payment service provider Stripe to process payments (section 5.5). We issue invoices for your payments by email, which in particular contain your name, your customer and contract number, the invoice amount and the service period. If a payment fails, we inform you and request payment. For this purpose, we process your payment and contract data on the basis of Art. 6(1)(b) GDPR. We retain invoices to comply with statutory retention obligations, Art. 6(1)(c) GDPR (section 6).

Immomio Now with WBS

Holders of a valid WBS can use Immomio Now free of charge to search for WBS-restricted housing. The prerequisite is that we verify your WBS before the subscription is concluded. You have two equivalent options for this:

  • automatic verification using our AI-supported WBS checker (section 5.2), which requires separate consent, or
  • manual verification by our support team, without consent to the AI-supported reading.

In addition, you always have the option of using your basic account via the website of a connected provider. The basic account is free of charge and therefore does not require you to upload your WBS.

As part of the Immomio Now subscription, we process your WBS in order to determine whether the requirements for free use are met. The legal basis is the contract on Immomio Now with WBS, Art. 6(1)(b) GDPR. Insofar as your WBS contains special categories of personal data (e.g. health information), we only process this data during automatic verification on the basis of your explicit consent (Art. 9(2)(a) GDPR, see section 5.2). The subscription ends automatically when your WBS expires. For this purpose, we process the expiry date of your WBS.

3.10 Combating misuse, notices and complaints

In order to protect our platform and its users and to fulfil our obligations under Regulation (EU) 2022/2065 on digital services (Digital Services Act, “DSA”), we process personal data in the following cases:

  • Notices of illegal content: If you report content to us via the “Report a legal violation” link, we process the information you provide (name, email address, your organisation, content of and reasons for the notice) in order to review the notice, confirm its receipt to you and inform you of our decision. We only disclose your identity to the user or provider concerned if this is exceptionally strictly necessary.
  • Measures in the event of violations: If there are specific indications of a violation of our T&Cs or applicable law (e.g. use of bots, multiple accounts, forged documents), we process the data required to investigate it, in particular account data, log data, IP addresses and the content concerned. Depending on the severity of the violation, we may issue a warning, restrict functions, temporarily suspend your account, terminate the contract or technically restrict access (e.g. by means of rate limits or IP blocks). We will inform you of any such measure and the reasons for it.
  • Complaints: You can lodge a complaint against our decisions free of charge via our contact form within six months. We process your complaint and the associated documents in order to review it. Complaints are decided on by our staff, not solely by automated systems.

The legal basis is the fulfilment of our legal obligations under Art. 16, 17 and 20 DSA (Art. 6(1)(c) GDPR) and, insofar as the preventive detection and prevention of misuse is concerned, our legitimate interest in a secure and fair platform (Art. 6(1)(f) GDPR). With regard to registered users, the processing also serves the performance of the contract of use (Art. 6(1)(b) GDPR).

3.11 Usage statistics and reports

We want to understand how our platform is used in order to improve it, manage our business and provide our customers, the providers, with meaningful information about the demand for their properties. For this purpose, we collect usage data, combine it (aggregation) and otherwise anonymise it in such a way that it can no longer be linked to you personally. The statistics and reports themselves do not contain any personal data.

What data we use

For the statistics, we use in particular the following usage data:

  • the time and frequency of your logins as well as the functions you use and the areas of the platform you access;
  • the number, time and status of your applications as well as transitions between the phases of the staged model;
  • reaction and response times in the application process, for example to flat suggestions or appointment requests;
  • search region, type of property sought and comparable general search parameters;
  • matching scores;
  • the subscription variant used (basic account or variant of Immomio Now);
  • technical information such as device type, operating system and browser.

The content of your messages, uploaded documents and special categories of personal data pursuant to Art. 9 GDPR (e.g. health information from a WBS) are not used.

For what purposes

Internal reports: We prepare analyses for managing our company, for example on the development of user numbers, on the use of individual functions and subscription variants, for error analysis and capacity planning, and for improving and further developing the platform.

Reports for providers: We provide providers with statistical analyses, for example on the number of prospective tenants and applications per property, region or period, on the development of demand, on average matching scores or on the average time until a property is let. These reports contain only aggregated values. From them, a provider cannot identify which individual persons are behind the figures.

These reports are to be distinguished from the information that a provider can in any case view in its Tenant about the applications for its own properties within the framework of the staged model (section 4). Insofar as we prepare analyses of this data within the Tenant, we process this data as the provider’s processor (section 1.4).

How we anonymise

We separate usage data from your direct identifiers such as name or email address as early as possible and replace them with an identifier (pseudonymisation). We then combine the data into groups and calculate totals, averages or distribution values from them. We do not combine the statistical data with other data sources in order to re-identify persons.

Legal basis

The collection of usage data, its pseudonymisation, aggregation and anonymisation are themselves processing of personal data. The legal basis is our legitimate interest, Art. 6(1)(f) GDPR. Our legitimate interest consists in improving our platform in line with demand and managing our company. In addition, there is the legitimate interest of our customers in information about the demand for their properties.

3.12 Signing in with your Google or Apple account

If you have a user account with Google or Apple, you have the option of registering on the Immomio platform with this account (“single sign-on”, SSO). In this case, you do not have to enter your name and email address separately on the Immomio platform; instead, this data is transmitted directly from Google or Apple to Immomio. You can find more information on data processing by Google here, and information on data processing by Apple can be accessed here.

Please note that if you use a Google account to sign in, Google may collect data relating to your usage behaviour and add it to your Google user profile. This includes in particular the information that you have registered on the Immomio platform.

4. Transfer of data to providers: data trusteeship and staged model

We only pass on your personal data to third parties insofar as this is necessary to provide our services or is required by law. The most important recipients are the providers with whom you apply or to whom your search profile is displayed.

We have aligned our staged model with the “Guidance on obtaining tenant self-disclosures from prospective tenants” (Orientierungshilfe zur Einholung von Selbstauskünften bei Mietinteressent:innen) of the German Data Protection Conference (Datenschutzkonferenz, DSK), the conference of the independent data protection supervisory authorities of the Federal Government and the federal states.

4.1 Immomio as your data trustee

A landlord wants to know to whom it is letting its flat. In practice, prospective tenants therefore often have to fill in extensive questionnaires and send sensitive documents via insecure channels (e.g. by email) right at the start, even though it is not yet clear whether they will make the shortlist at all. However, a landlord may only collect data in which it has a legitimate interest and which is necessary for the decision on the tenancy agreement in the respective phase.

This is where our model comes in. We see ourselves as your data trustee: you store your data in your password-protected, encrypted tenant profile, and the provider is only given step-by-step access depending on the application phase. You retain control throughout the entire process. You can withdraw applications and edit or delete your data at any time.

Providers can choose stricter data protection settings on the platform and will then see less data in the individual phases than described below. Less strict settings are not possible.

4.2 Staged transfer of data in four phases

Phase 0: Search profile

In phase 0, providers can identify which prospective tenants are a good fit for their properties and send them flat suggestions. Your profile information is not displayed to the provider in full; instead, the provider sees your matching score (section 4.5). Without an Immomio Now subscription, you are only included in matching for properties of your connected providers; with a subscription, you are included in matching for properties of the providers covered by your subscription (section 3.9). In this phase, providers only see:

  • first name and surname;
  • whether a WBS is available and, if so, the type of WBS, the number of persons covered, the approved number of rooms, the approved living space and the period of validity. If you entered this information using the WBS checker, the provider also sees whether it was read automatically or entered manually and, where applicable, a notice that the name on the WBS differs from the name in your profile;
  • your search criteria (matching score, see section 4.5);
  • your earliest move-in date and since when you have been searching;
  • the verification badge, if you have verified your mobile number (section 3.8);
  • your application history and correspondence, in each case only in relation to this provider;
  • whether a credit report or proof of income has been uploaded; the provider does not receive the documents themselves in this phase.

Phase 1: Application and viewing

When you apply for a property, you enter phase 1. The provider additionally receives the information required for identification and for arranging a viewing:

  • address (including country);
  • email address and telephone number;
  • your WBS certificate (partially redacted, where applicable) as proof of your WBS entitlement;
  • your profile picture (if you use one);
  • free text entered by you (e.g. on when you are available for appointments).

The provider does not receive any information about your financial circumstances in this phase.

Phase 2: Interest in renting

After the viewing, you can declare that you would like to rent the property. You then enter phase 2, and the provider receives the following additional data:

  • date of birth;
  • number of people moving in and household type;
  • occupation and type of employment;
  • amount of your net household income;
  • information on guarantees;
  • information on pets requiring approval (not on small animals such as hamsters or ornamental fish).

Phase 3: The provider decides in your favour

If the provider decides to conclude the tenancy agreement with you (you are the “first-ranked applicant”), it can start phase 3. Only now does the provider receive full access to the further data stored in your profile, such as your credit report, your proof of income or your certificate of enrolment, insofar as you have stored them.

4.3 Legal bases for the transfer of data to providers

The legal basis for our transfer (release) of your data to providers is the contract of use concluded between you and us or the contract on Immomio Now, Art. 6(1)(b) GDPR.

Please refer to the provider’s privacy policy for the legal basis on which the provider processes your data. The provider is responsible for the processing in the Tenant (section 1.4).

4.4 What happens to my data at the end of an application process?

You can withdraw your application at any time. In that case, the following applies, and the same applies if the provider discontinues the application process or awards the property to another applicant:

  • The provider’s access to your phase 2 and phase 3 data via the platform is blocked immediately.
  • Your phase 1 data remains visible for the period specified by the provider in its Tenant under its own responsibility under data protection law. After that, the data reverts to phase 0. The provider can specify these retention and erasure periods individually for the different properties you have applied for.
  • If you delete your account, all providers’ access to your data via the platform is blocked.

The provider itself is responsible for data that a provider has already downloaded from its Tenant or transferred to its own systems. This applies in particular to further processing if the tenancy agreement is concluded.

4.5 Matching

A provider can store a ideal tenant profile for its property, i.e. describe which characteristics (e.g. WBS required, minimum income, number of occupants) it is looking for in relation to the property and how important they are to it. The ideal tenant profile is part of the provider’s offer; it does not concern the question of how your data is processed.

If the provider has defined a ideal tenant profile, we calculate an aggregated numerical value that indicates the extent to which the information in your tenant and search profiles corresponds to the criteria and their weighting. The provider only sees this overall score, not your individual details and not your search profile either. The provider can also decide that its employees are shown a letter grade instead of the overall score, which corresponds to a certain range of overall scores.

The provider has no influence on the technical matching procedure itself and does not receive access to the underlying data. The score is calculated in such a way that it does not allow any conclusions to be drawn about specific data (e.g. your exact income). Special categories of personal data (e.g. health data) are not included in the score.

We provide matching to you on the basis of our contract with you: it is intended to enable you to receive suitable offers without having to disclose the data in your tenant and search profiles.

The legal basis is the contract of use concluded with you, Art. 6(1)(b) GDPR. We explain in section 7 why this does not involve any automated decision about you.

4.6 Applying as a guest

A provider can redirect prospective tenants from its own website to the platform so that they can apply for its properties without their own user account (guest application). In this case, we do not process your data on the basis of a contract with you, but on behalf of the provider as its processor. The provider is the controller. Further information can be found in its privacy policy.

4.7 Additional questions and landlord questionnaires

The provider may ask you its own additional questions, use its own questionnaires or ask you for further information following your viewing, in particular regarding

  • your birth name and place of birth;
  • your employer and your income situation;
  • whether you have applied for consumer insolvency proceedings, made a declaration of assets (Vermögensauskunft) or been requested to do so;
  • whether an eviction order has been issued against you or whether there were rent arrears in an existing or previous tenancy;
  • whether the people moving in are adults or children, and information on persons who are to become parties to the contract as co-tenants.

This data is not released by us for the provider’s Tenant as part of the data trusteeship, but is collected directly from you by the provider under its own responsibility under data protection law.

5. Other recipients: our service providers

5.1 General information on our processors

We use technical service providers who process your data exclusively in accordance with our instructions on the basis of data processing agreements pursuant to Art. 28 GDPR. These include in particular the following categories of service providers:

  • hosting and data centre operation
  • helpdesk, chat and ticket system for support
  • consent management (section 3.2);
  • email dispatch, IT maintenance and IT security.

We provide you with further information on the following service providers because data may be transferred to third countries or in order to explain the respective processing in more detail.

5.2 AI-supported WBS checker

We use an AI language model to read your WBS. It first checks whether the uploaded document is a WBS and then reads out the type of WBS, the number of persons covered, the approved number of rooms, the approved living space, the expiry date, the issuing authority and the name of the holder. As the model captures the document as a whole, other information contained in it is also processed, unless you have redacted it before uploading.

Your WBS may contain information that is subject to the special protection of Art. 9 GDPR, for example about a severe disability, a pregnancy or your state of health, if this was relevant to an increased need for living space. The AI-supported reading is therefore only carried out if, before uploading, you have given your explicit consent by actively ticking the box provided for this purpose. We process the data exclusively in order to pre-fill your WBS information in your tenant profile, which you can then check and correct, and to check whether you meet the requirements for Immomio Now with WBS. We obtain your consent again for each new upload. The legal basis is your consent, Art. 6(1)(a) and Art. 9(2)(a) GDPR.

Consent is voluntary. Without it, you can enter your information yourself or have your WBS checked by our support team; this will not result in any disadvantages for you. You can withdraw your consent at any time with effect for the future, e.g. by email to mieterdatenschutz@immomio.de.

What happens to Art. 9 information: We do not transfer information covered by Art. 9 GDPR to your structured profile data, and the stored response of the language model does not contain any such information.

To operate the language model, we use the cloud service Microsoft Azure (Azure AI Foundry) of Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, as a processor. The model is operated in a data centre within the EU; no transfer to the USA or other third countries takes place. Your data is not used to train AI models, and Microsoft stores neither the document nor the result of the reading.

In addition to the information read out, we store the result of the check, the type of WBS, the issuing authority and the response of the language model in order to be able to trace the check. If you change or delete the WBS document, we delete this data. The WBS information in your profile remains until you change or delete it or it is replaced by reading a new WBS. For previous checks, we only retain metadata (time, result and model version) until your account is deleted, in order to be able to prove the check (Art. 6(1)(f) GDPR).

5.3 SMS dispatch by Infobip

To send verification SMS (section 3.8), we use Infobip Ltd., Fifth Floor, 35-38 New Bridge Street, London EC4V 6BW, United Kingdom, as a processor. The data is stored in a data centre in Frankfurt am Main. In individual cases, for example in the case of support requests, Infobip group companies outside the EU and the EEA may be given access. For the United Kingdom, there is an adequacy decision of the European Commission pursuant to Art. 45 GDPR; for access from other third countries, we have agreed standard contractual clauses pursuant to Art. 46 GDPR with Infobip.

5.4 Friendly Captcha

To protect against automated requests and misuse by bots, we use Friendly Captcha GmbH, Am Anger 3-5, 82237 Wörthsee, Germany, as a processor. Processing takes place exclusively in the EU. You do not have to solve any picture puzzles: the check takes place in the background by your browser solving a small computing task; depending on how it is integrated, one click at most is sufficient. In addition, connection, environment, interaction and function data of your browser are analysed in order to assess whether the request comes from a human. Your IP address is anonymised by one-way hashing. Friendly Captcha does not store any of your personal data, does not use the data either to identify you or for marketing purposes and does not set any cookies. The legal basis is our legitimate interest in protecting our services against misuse, Art. 6(1)(f) GDPR. Insofar as information on your device is accessed, this is strictly necessary to provide the service you have requested, Section 25(2) no. 2 TDDDG.

5.5 Payment processing by Stripe

As the payment service provider for the paid Immomio Now subscription, we use Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland (“Stripe”). After the contract has been concluded, we redirect you to Stripe’s payment page. As a rule, you only enter your payment data, such as credit card details, with Stripe; we have no access to it, but only see the last 4 digits. We receive information from Stripe about successful or failed payments. The legal basis is Art. 6(1)(b) GDPR.

When processing payments, Stripe acts on our behalf as a processor. For its own purposes, Stripe processes your data as an independent controller, in particular for selecting and integrating banks and payment methods, for fraud prevention, for averting financial and security-related risks, for complying with legal obligations (e.g. prevention of money laundering) and for further developing its own products. Details can be found at https://stripe.com/de/privacy. The easiest way to submit enquiries about this processing is directly to Stripe.

Stripe may transfer data to Stripe, LLC in the USA. Stripe, LLC is certified under the EU-US Data Privacy Framework, for which there is an adequacy decision pursuant to Art. 45 GDPR; in addition, standard contractual clauses pursuant to Art. 46 GDPR may apply.

If you choose PayPal, Apple Pay or Google Pay as your payment method, the respective companies (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg; Apple Distribution International Ltd., Ireland; Google Ireland Limited, Ireland) process your data as independent controllers in accordance with their own privacy policies. In the process, data may also be transferred to third countries, in particular the USA.

5.6 Data platform for usage statistics

To analyse usage data (section 3.11), we use Microsoft Fabric of Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, as a processor. We only transfer pseudonymised usage data to it, in which direct identifiers such as name or email address have already been replaced by an identifier encrypted by means of hashing and salting. Processing takes place exclusively in data centres within the EU.

5.7 Sending system emails

We send automatic system notifications to your email address, e.g. when you register for the first time or when the status of one of your applications changes. To send such system emails, we use the Sendgrid service of our processor Twilio Inc., 101 Spear Street, 5th Floor (Suite 500), San Francisco, CA 94105, USA. Immomio transmits the recipient’s email address and the respective system message, including a subject line, to Twilio’s server. The emails themselves are processed by Twilio only transiently, i.e. for the duration of the forwarding. They are not stored on the servers used by Twilio. Twilio stores the recipient’s email address, the subject line and the event that the recipient “clicked” the email. This data is stored for 30 days and then deleted automatically. For the USA, there is an adequacy decision of the European Commission of 10 July 2023 (EU-US Data Privacy Framework), under which Twilio is certified. In addition, Twilio relies for international data transfers on its own Binding Corporate Rules (BCRs) approved by European supervisory authorities and on standard contractual clauses (SCCs).

5.8 Ticket system for support requests

To handle technical support requests, users’ declarations of withdrawal or cancellation, and messages in the context of the statutory notice procedure under the Digital Services Act, we use a ticket system of Atlassian Inc., 350 Bush Street, Floor 13, San Francisco, CA 94104, USA. We have agreed various measures with this processor to protect your data against the risks of a transfer to third countries, in particular to the USA. The data processed on our behalf is hosted on servers in the EU. Should a data transfer to the USA take place in exceptional cases, for example because we require second-level support from Atlassian and this can only be provided in the USA, this is safeguarded by the adequacy decision of the European Commission of 10 July 2023 (EU-US Data Privacy Framework), under which Atlassian is certified. Data transfers to Atlassian’s Australian group company are protected by the European standard contractual clauses (SCCs). Atlassian has published a detailed transfer impact assessment on this here.

6. How long we store your data

We erase your personal data as soon as it is no longer necessary for the purposes of processing stated in this privacy policy, in the event of an objection no compelling legitimate grounds on our part preclude erasure, or in the event of a withdrawal of consent there is no other legal basis for the processing. In certain cases, e.g. where there is a statutory retention obligation, your personal data is first blocked and then erased when the retention period expires.

Such retention obligations may apply to us in particular for reasons of commercial law (Sections 238, 257 HGB – German Commercial Code) and tax law (Section 144 AO – German Fiscal Code) and range from five to eight years, calculated from the end of the year.

If you contact us with a data subject request under data protection law, we store the correspondence with you for three years, calculated from the end of the year, in order to be able to prove that we have fulfilled your rights (Art. 6(1)(f) GDPR).

7. Profiling and no automated decision-making

We do not subject you to any decision based solely on automated processing within the meaning of Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you.

Registration: If we automatically reject an email address because it belongs to a disposable email provider (section 3.3), you can register with a different address or request a review by our staff.

Matching: We do not use the matching score (section 4.5) to make any decision as to whether a property is offered to you, whether you are invited to a viewing or whether you are awarded a property. These decisions are made by the provider alone. The matching score does not exclude you from any application: you can also apply if your score is low, and depending on the phase, the provider additionally sees your application and your information. The score only indicates the extent to which your information corresponds to the characteristics described in the offer; the calculation method is determined by us alone.

WBS checker in the tenant profile: The WBS checker merely pre-fills your WBS information. You can check it and correct it at any time. If automatic recognition fails, you can enter the information manually. The provider is shown whether the information was read automatically or entered manually. The decision on invitations and awarding the property is made by the provider alone.

Immomio Now with WBS: If the automatic verification of your WBS is positive, the subscription is activated automatically. If the result is negative or unclear, activation is initially withheld, and you can have your WBS checked manually by our support team. A decision that is unfavourable to you is therefore not made solely on the basis of automated processing. You also have the option of using your basic account at any time, for which you do not need to provide proof of a WBS.

Moderation: Complaints against moderation decisions are decided on by our staff (section 3.10).

8. Our presences on social networks

We maintain presences on the social networks Facebook, Instagram, LinkedIn, Xing and YouTube. If you visit them or communicate with us through them, we and the respective operator process your usage data. The legal basis for our processing is our legitimate interest in communicating with you via social networks and providing information about us (Art. 6(1)(f) GDPR).

Please note that your data may also be processed outside the EU or the EEA, where the level of data protection may be lower. Operators of social networks generally also process user data for market research and advertising purposes, create usage profiles from usage behaviour, including across devices, in particular if you are logged in there, and store cookies on your device for this purpose. They may also use your data to train AI models. For details and options to object (opt-out), please refer to the operators’ privacy policies. You can assert requests for access and other data subject rights most effectively with the operators, as only they have access to the data. Should you nevertheless need help, please feel free to contact us.

8.1 Facebook and Instagram

Facebook and Instagram are provided by Meta Platforms Ireland Limited, Block J, Serpentine Avenue, Ballsbridge, Dublin 4, Ireland, a subsidiary of Meta Platforms, Inc., 1 Willow Road, Menlo Park, CA 94025, USA. Privacy policies: https://www.facebook.com/privacy/policy and https://privacycenter.instagram.com/policy.

We are jointly responsible with Meta Platforms Ireland Limited for the collection (but not the further processing) of data of visitors to our Facebook page and our Instagram page. This includes information about the content users view or interact with, about their actions and about the devices used (e.g. IP addresses, operating system, browser type, language settings, cookie data). Meta also uses this information to provide us, as the page operator, with statistical analyses (“Page Insights”). We have concluded a joint controllership agreement with Meta (https://www.facebook.com/legal/terms/page_controller_addendum), which in particular sets out the security measures Meta must observe and in which Meta has undertaken to fulfil data subject rights. Your rights are not restricted by this: you can assert them both against us and against Meta. Further information: https://www.facebook.com/legal/terms/information_about_page_insights_data.

8.2 LinkedIn

LinkedIn is a social network of LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. Privacy policy: https://www.linkedin.com/legal/privacy-policy; opt-out option: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

8.3 YouTube

YouTube is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; the parent company is Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy policy: https://policies.google.com/privacy; opt-out option: https://adssettings.google.com/authenticated.

8.4 Xing

Xing is operated by XING SE & Co. KG, Baumwall 7, 20459 Hamburg. Privacy policy: https://privacy.xing.com/de/datenschutzerklaerung.

9. Your rights

As a data subject, you have in particular the following rights, subject to the respective statutory requirements:

  • the right to obtain confirmation as to whether we process data concerning you, to access this data and to receive a copy (Art. 15 GDPR);
  • the right to rectification of inaccurate data (Art. 16 GDPR); you can change much of the information in your profile yourself;
  • the right to erasure (Art. 17 GDPR); you can delete your account yourself at any time;
  • the right to restriction of processing (Art. 18 GDPR);
  • the right to data portability (Art. 20 GDPR);
  • the right to withdraw consent at any time with effect for the future, without affecting the lawfulness of the processing carried out up to that point (Art. 7(3) GDPR);
  • the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

Your right to object under Art. 21 GDPR

Insofar as we process your personal data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation.

You can object to processing for direct marketing purposes at any time without giving reasons; the data will then no longer be processed for these purposes.

You can send your objection informally to mieterdatenschutz@immomio.de.

If you have any questions or complaints about data protection or would like to exercise your rights, you can contact us and our data protection officer at any time (section 2). Please address rights relating to data that a provider processes in its Tenant primarily to the provider (section 1.4).

For complaints, you can contact the supervisory authority at your place of residence or work or the authority responsible for us:

The Hamburg Commissioner for Data Protection and Freedom of Information (Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit)
Ludwig-Erhard-Str. 22, 7th floor
20459 Hamburg
Tel.: 040 / 428 54 – 4040
Email: mailbox@datenschutz.hamburg.de

10. Changes to this privacy policy

New legal requirements, business decisions or technical developments may make changes to this privacy policy necessary. You can always find the current version on our website.