Privacy policy

As of 4 October 2026

1. Who is responsible

Responsible for processing personal data on flatways.de is:

Email: kontakt@flatways.de

2. What happens when you open this website

Flatways is hosted by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, and delivered from there. So that your browser gets a page, Cloudflare processes what your browser sends with every request:

• IP address
• date and time of the request
• the address you opened
• the page you came from
• browser and operating system

Without this information, no page can be delivered and no attack can be stopped. The legal basis is Art. 6(1)(f) GDPR. Flatways has no server and no database of its own: what is delivered are finished files.

Cloudflare processes this data on our behalf and keeps it as long as the company needs it to deliver and protect the website. The data may be transferred to the USA. Cloudflare is certified under the EU-US Data Privacy Framework. For companies with this certification, the EU Commission has decided that an adequate level of data protection applies.

3. How we count visits

Flatways counts page views with Plausible Analytics, a service of Plausible Insights OÜ from Estonia. For this, a small script from Flatways reports to plausible.io which page you opened and which page you came from. It also reports how long a page is in the foreground. The service reads which browser, which operating system and which kind of device you use from what your browser sends with every request. From your IP address it works out roughly which country, region and city you are in.

The script sets no cookie and reads and writes nothing in the storage of your browser. According to the provider, Plausible stores no IP address. To count the visits of a day, the service creates an identifier from your IP address and browser information, and it deletes the key for it after 24 hours. The service keeps the count itself as long as we use it. What the service collects is described in its data policy. According to the service, its servers are in the European Union.

Beyond the page views, we count how often these 5 things happen:

• a click from the row of a landlord to the website of the landlord, with its identifier
• a click from the row of a student residence to the website of the residence, with its identifier
• a click from a row of the platforms or the tools to the website of the service, with its identifier
• that a list was filtered on an overview page, once per page view, without the choice itself
• a click on “Give me tips” on the home page

For the clicks in this list, the script also reports where the link leads. Nothing else is counted. This shows us which entries are needed, and it decides which landlords and tools get more than one row next. The legal basis is Art. 6(1)(f) GDPR. Without an identifier in your browser and without a cookie this needs no consent, and that is why no banner asks you here. If you still do not want to be counted, any blocker that rejects plausible.io helps. The website works fully without this script.

4. What Flatways does not do

• No cookies. Flatways sets none.
• No recognition on other websites. No service follows you from here to other websites, and no identifier stays in your browser for that.
• No accounts. There is nothing to sign in to, nothing to register for and no password.
• No mailing list. There is no field where you enter an address.
• No advertising. There are no ads on Flatways.
• No fonts from other servers. The font DM Sans comes from flatways.de itself, not from a font service.
• Nothing from linked websites. Nothing from the websites Flatways links to is embedded: no logos, no maps, no videos. Only your click makes the connection, and from there the privacy policy of the other website applies.

5. What stays in your browser

The moving checklist remembers which tasks you have ticked off. This is kept in the local storage of your browser, under the key flatways:umzugscheckliste, and it is only the identifiers of the ticked tasks, nothing else. This list does not leave your browser: it is not sent, not analysed and not combined with anything.

This needs no consent: § 25(2) no. 2 TDDDG allows storing it when it is needed for a service you explicitly want to use. Without the storage, the ticks would be gone the next time you open the page.

You can delete the list at any time. The button “Reset” at the top next to the progress bar deletes the key. Deleting the website data in your browser does the same.

Your browser also remembers which city you last looked at or chose, under the key flatways:stadt, and it is only the name of the city. With it the menu on pages without a city, such as the moving checklist, leads into that city, and the photo at the top is that city's. This does not leave your browser either, and deleting the website data deletes it.

6. If you write to us

If you write to kontakt@flatways.de, we process your address and the content of the email in order to reply. The legal basis is Art. 6(1)(f) GDPR. We keep the email as long as the matter is open and delete it afterwards, unless a legal duty to keep it applies.

Your email is received by Cloudflare, Inc. (San Francisco, USA), which forwards it to our mailbox at Proton AG (Plan-les-Ouates, Switzerland). How Cloudflare protects the transfer to the USA is explained in section 2. For Switzerland, the EU Commission has decided that it has an adequate level of data protection.

7. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). To use them, write to kontakt@flatways.de.

Everything processed here is based on Art. 6(1)(f) GDPR. You can object to this at any time, on grounds relating to your particular situation.

8. If you want to complain

Under Art. 77 GDPR you can complain to a data protection supervisory authority: the one where you live, where you work or where the suspected infringement took place. Which one that is depends on the federal state. The addresses are listed by the Federal Commissioner for Data Protection and Freedom of Information (in German).