Privacy Notice

When you use our website, contact us or engage with our social media channels, your personal data is generally processed. This refers to all data that can be linked to you as an individual.
We store and process your personal data exclusively for the purposes set out below and only for as long as is necessary to fulfil those purposes, where there is a legitimate interest for evidential purposes, or as required by statutory retention obligations. Once the relevant purpose no longer applies or these retention periods have expired, the corresponding data will be routinely blocked or deleted in accordance with statutory provisions.
On this page, we provide information about the relevant data processing activities and the rights you have in this context under the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG).

The data controller for this website is:

Aufbau Haus GmbH
represented by managing directors Matthias Koch and Holger Fuchs
Prinzenstr. 84.1
10969 Berlin
Telephone: 030 34046511
Email: info@aufbauhaus.de
You may direct any specific enquiries regarding data protection to us at any time at: datenschutz@aufbauhaus.de

Data processing when visiting this website
We have commissioned the provider uberspace, Kaiserstr. 15, 55116 Mainz, to host our website. The website is operated using the Drupal content management system. We have carefully selected this provider – taking data protection considerations into account – and have entered into a data processing agreement with them. Information on data protection and data security can be found at https://uberspace.de/privacy.
When you visit our website, anonymised server log files are created for the purpose of analysing errors and security incidents. This data is collected on the basis of Article 6(1)(f) of the GDPR in the legitimate interest of ensuring the technically error-free display and optimisation of our website. When you visit our website, our system automatically collects the following access data (log files) and transmits them to our server:
- IP address, with the last few characters anonymised
- Date and time of the request
- Time zone difference from Greenwich Mean Time (GMT)
- Content of the request (specific page)
- Access status/HTTP status code
- Amount of data transferred in each instance
- Website from which the request originates
- Browser type
- Operating system and its user interface
- Version of the browser software

The data is stored for a period of seven days, is not combined with any other data, and is subsequently automatically deleted.

Cookies
We use so-called ‘cookies’ on our website. Cookies are small text files that are stored on your device and created automatically by your browser.
The use of cookies may involve the processing of personal data, in particular information about your browser, your operating system, your IP address and your usage behaviour on our website.
We distinguish between technically necessary cookies and those that are not required for the operation of the website:
We ourselves use only technically necessary cookies on our website, which are required for the website to function properly – unless, in exceptional cases, you give us your consent (see the next section). The legal basis for storing technically necessary cookies is Section 25(2)(2) of the TTDSG. The subsequent data processing is carried out on the basis of Article 6(1)(f) of the GDPR – our legitimate interest in ensuring the website functions properly and is secure.
You can configure your browser settings so that cookies are not stored at all, or so that you are notified each time a cookie is set. Cookies that have already been stored can be deleted at any time.

Embedding videos (YouTube and Vimeo) on this website
We have embedded content from the video platforms YouTube and Vimeo on certain sub-pages. However, the respective cookies from these two providers will only be set once you have given your consent. They enable the collection of information such as your IP address, browser data and your usage behaviour. You can give your consent for both providers by clicking on the ‘Accept video cookies’ button. In this case, some of your data may be transferred to the USA. If you wish to select only one of the two providers or receive further information, please click on the ‘Cookie settings’ button. If you do not wish to accept any cookies from these providers, please click on the ‘Reject video cookies’ button. You can change your settings at any time by accessing the cookie settings again at the bottom of our website. The legal basis is Section 25(1) of the TTDSG in conjunction with your consent pursuant to Article 6(1)(a) of the GDPR. You may withdraw your consent at any time via the cookie settings.

Web analytics
Our website uses the web analytics software Matomo, a service provided by InnoCraft Ltd, 150 Willis St, 6011 Wellington, New Zealand.
Data processing is carried out on the basis of a legitimate interest pursuant to Article 6(1)(f) of the GDPR, namely the statistical analysis of user behaviour and the optimisation of our public relations work.
We operate Matomo in a privacy-friendly configuration. In particular:
- IP addresses are anonymised before being stored (IP masking),
- no data is aggregated to identify individual users,
- no data is disclosed to third parties, and
- no cookies are set.

Social media presence
We maintain an online presence on social networks and platforms to draw attention to our services and provide information about activities at the Aufbau Haus. When you visit these pages, personal data may be processed by the respective platform operators. We have only limited control over this.
When you visit our social media pages, the respective platform operators regularly collect personal data, in particular through:
- Cookies and similar technologies
- Analytics and tracking functions
- Profiling based on usage behaviour (including across platforms)
This may also affect individuals who do not have their own user account on the respective platform. In some cases, the processing is carried out to create usage profiles for advertising and market research purposes.
Data processing may also take place in countries outside the European Union, in particular in the USA. This may make it more difficult to enforce the rights of data subjects.
The use of our social media presence is based on our legitimate interests under Article 6(1)(f) of the GDPR in conducting modern, information-oriented and communicative public relations work, as well as in presenting our services. Where you have given your consent to data processing to the relevant platform operator, processing takes place on the basis of Article 6(1)(a) of the GDPR.

Facebook & Instagram (Meta Platforms Ireland Limited)
Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland
In operating our Facebook and Instagram pages, we are jointly responsible with Meta Platforms Ireland Limited, within the meaning of Article 26 of the GDPR, for certain processing operations (in particular ‘Page Insights’). The relevant joint controller agreement is available at: https://www.facebook.com/legal/terms/page_controller_addendum
Meta processes personal data independently and on its own responsibility, in particular for the purposes of advertising, analysis and profiling. A transfer of data to the USA cannot be ruled out. Meta bases international data transfers in particular on the European Commission’s Standard Contractual Clauses in accordance with Article 46 of the GDPR, as well as on the EU-US Data Privacy Framework (DPF), where applicable.
Privacy policy: https://www.facebook.com/privacy/policy
Options for objecting: https://www.facebook.com/help/contact/1994830130782319
On participation in the DPF: https://www.dataprivacyframework.gov/participant/4452

YouTube
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
When using YouTube, personal data may be processed by Google, in particular when playing embedded videos and when interacting with the platform.
A transfer to third countries, in particular the USA, cannot be ruled out. Google bases such transfers, amongst other things, on standard contractual clauses in accordance with Article 46 of the GDPR and on the EU-US Data Privacy Framework (DPF), where applicable.
Privacy policy: https://policies.google.com/privacy?hl=de
Options for objecting: https://support.google.com/policies/contact/general_privacy_form
DPF participation: https://www.dataprivacyframework.gov/participant/5780

Vimeo
Provider: Vimeo Inc., 555 West 18th Street, New York, NY 10011, USA
When Vimeo videos are used, personal data may be transferred to Vimeo Inc., in particular through the embedding of video players and when accessing content.
A transfer to the USA cannot be ruled out. Vimeo generally bases international data transfers on the European Commission’s standard contractual clauses in accordance with Article 46 of the GDPR, as well as supplementary safeguards.
Whether and to what extent joint controllership applies depends on the specific technical integration and the respective processing operations.
Privacy policy: https://vimeo.com/privacy
Settings & Privacy: https://vimeo.com/980730257

Newsletter
To send out our newsletter, we use the German newsletter service Brevo (formerly Sendinblue) provided by Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany, hereinafter referred to as ‘Brevo’ – a subsidiary of the French company Sendinblue SAS. The data you provide when subscribing to the newsletter is stored on Brevo’s servers within the EU.
We use the so-called double opt-in procedure for newsletter registration. This means that after you have registered with your email address, you will receive a confirmation email. Only once you have clicked on the link contained therein will your registration be completed and your email address added to our mailing list.
We use your data exclusively to send you the newsletter. The legal basis for the processing is your consent in accordance with Article 6(1)(a) of the GDPR.
Brevo enables us to carry out anonymised statistical analysis of the behaviour of newsletter recipients. Among other things, this allows us to analyse how many recipients have opened the newsletter and how often each link in the newsletter has been clicked. All links in the email are so-called tracking links, which allow us to count your clicks.
We only collect anonymised, statistical data and do not carry out any personalised analyses. If you do not wish Brevo to carry out this analysis either, you will unfortunately need to unsubscribe from the newsletter. We provide a corresponding unsubscribe link in every newsletter for this purpose. Furthermore, you may withdraw your consent at any time with future effect by sending an email to the data controller specified in this privacy notice. The lawfulness of any data processing operations that have already taken place remains unaffected by this withdrawal.
The data you provided when subscribing to the newsletter will be stored by us until you unsubscribe from the newsletter, after which it will be deleted from both our servers and Brevo’s servers. Data stored by us for other purposes remains unaffected by this.
We have entered into a data processing agreement with Brevo, under which Brevo undertakes to protect the data of our newsletter subscribers and to process it in accordance with the requirements of the GDPR.
Brevo’s privacy policy can be found at: https://www.brevo.com/de/legal/privacypolicy/
Basic information on data protection and data security when using Brevo is available here: https://www.brevo.com/de/company/datenschutz-uebersicht/

Email and other communication channels
You can contact us by email, telephone or via our social media channels.
Please note that data transmitted by email is generally not fully protected against access by third parties. It cannot therefore be ruled out that data sent may be viewed, altered or deleted by unauthorised persons. Please therefore send us any confidential data in encrypted form and provide us with the password, for example by telephone.
You decide for yourself what data you provide to us when contacting us. We process this data solely for the purpose of dealing with your enquiry.
We process your data on the legal basis of Article 6(1)(b) of the GDPR, insofar as your enquiry relates to (pre-)contractual measures (e.g. rental enquiries), and on the basis of Article 6(1)(f) of the GDPR in our legitimate interest in processing enquiries and communication.
Your data will be deleted as soon as it is no longer required to process your enquiry, provided there are no statutory retention obligations to the contrary or a legitimate interest in retaining evidence to defend against potential civil law claims.
Where content is relevant under criminal law, we reserve the right to store it for the purposes of legal proceedings and to pass it on to the relevant authorities. The legal basis for this is Article 6(1)(f) of the GDPR.

Data subject rights
When we process your data, you, as the data subject, have the following rights:
- The right of access: You may request information from us regarding which of your personal data we hold.
- The right to rectification: If you believe that we are holding personal data about you that is incorrect, you may request that it be rectified.
- The right to erasure and restriction of processing: Under certain conditions, you may request that we erase your personal data or restrict its processing.
- The right to object: You have the right to object to the processing of your data on grounds relating to your particular situation; we will cease processing unless we are required to do so by other legal provisions.
- The right to data portability: You have the right to request that we transfer personal data you have provided to us to another data controller, or that we provide you with this data in a commonly used, machine-readable format.
- The right to lodge a complaint: If you suspect a data protection breach, we would be grateful if you could let us know – please contact us so that we can look into the matter. However, you also have the right to lodge a data protection complaint with a supervisory authority, for example the competent supervisory authority in the federal state where you live or the authority responsible for us:

Berlin Commissioner for Data Protection and Freedom of Information
Alt-Moabit 59–61, Entrance: Alt-Moabit 60
10555 Berlin
Telephone: +49 30 13889-0
Email: mailbox@datenschutz-berlin.de
A list of all supervisory authorities (for the non-public sector) with their addresses can be found at: https://www.bfdi.bund.de/DE/Service/Anschriften/Laender/Laender-node.html

This privacy notice was last updated on 27 August 2026.