How we process your personal data under GDPR
The controller responsible for data processing under GDPR is:
Stacey Real Estate GmbH
Brooktorkai 7, 20457 Hamburg, Germany
Email: booking@stacey.de
Phone: +49 40 696389600
For the residents of houses we manage on behalf of their owner, the owner is the controller for the tenancy; see section 5.
We process personal data of our users only as necessary to provide a functional website and our content and services. Processing of personal data generally takes place only with the user's consent or where the processing is authorised by legal provisions (Art. 6 (1) GDPR).
When a booking is started, we store the details entered during the booking process, beginning with the name and email address, followed by the further booking data. The legal basis is Art. 6 (1) (b) GDPR (pre-contractual measures taken at the user's request): the stored details allow an interrupted booking to be resumed and allow us to contact the user about their booking. If the booking is not completed, this data is deleted or anonymised in accordance with section 9.
During a tenancy we process contract, payment and communication data (for example name, contact details, room and rent, bank details for rent payments and security payment refunds, defect reports and correspondence) to perform the tenancy and to meet legal obligations (Art. 6 (1) (b) and (c) GDPR). Reminders about a booking that was started but not completed are sent on the basis of Art. 6 (1) (f) GDPR (legitimate interest in completing bookings); you can object to them at any time.
To operate our website and booking process, we use the following service providers. The legal basis is, respectively, Art. 6 (1) (b) GDPR (contract performance) or Art. 6 (1) (f) GDPR (legitimate interest).
Provider: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA
Purpose: Website hosting. Processes server logs (IP address, user agent, referrer, timestamp) to ensure operation and security.
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in secure operation)
Provider: Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992
Purpose: Storage of booking data, tenant master data, rent payments. Server location: EU (Frankfurt).
Legal basis: Art. 6 (1) (b) GDPR
Provider: Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA
Purpose: Sending transactional emails (booking confirmations, contracts, payment information, reminders). To verify that our emails arrive and to detect delivery problems, they contain a tracking pixel that reports the delivery and the first opening of a message (timestamp) to Resend. You can prevent this by blocking the loading of remote images in your email client; the emails remain fully readable.
Legal basis: Art. 6 (1) (b) GDPR; for the open measurement Art. 6 (1) (f) GDPR (legitimate interest in the reliable delivery of our messages)
Provider: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland
Purpose: Processing of the one-time booking fee and of the security payment (credit card, SEPA direct debit and other payment methods); for existing tenancies also of monthly rent payments by SEPA direct debit.
Legal basis: Art. 6 (1) (b) GDPR
Provider: Yousign SAS, 350 rue Saint Sauveur, 14000 Caen, France
Purpose: Legally valid electronic signing of rental contracts.
Legal basis: Art. 6 (1) (b) GDPR
Provider: apaleo GmbH, Rosental 10, 80331 Munich, Germany
Purpose: Management of short stays, reservations, check-in/check-out, billing.
Legal basis: Art. 6 (1) (b) GDPR
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Purpose: Handling of our email correspondence (e.g. booking@stacey.de) and storage of tenancy-related documents in Google Drive. Transfers to Google LLC (USA) are safeguarded by EU Standard Contractual Clauses and the EU-US Data Privacy Framework.
Legal basis: Art. 6 (1) (b) GDPR (correspondence and documents relating to a booking or tenancy), Art. 6 (1) (f) GDPR (efficient handling of enquiries)
Provider: Enable Banking Oy, Otakaari 5, 02150 Espoo, Finland
Purpose: Retrieval of the statements of our own bank account via the PSD2 account information interface to match incoming rent and booking payments. This processes the transaction details visible on our statements (payer name, IBAN, amount, payment reference). Enable Banking is an account information service provider supervised by the Finnish Financial Supervisory Authority; processing takes place in the EU.
Legal basis: Art. 6 (1) (b) GDPR (allocation of your payments), Art. 6 (1) (f) GDPR (orderly accounting)
Provider: Slack Technologies Limited, Salesforce Tower, 60 R801, North Dock, Dublin, Ireland
Purpose: Internal notifications to our team about operational events (e.g. new bookings, payment or check-in issues); these can contain guest names and booking details. No guest communication takes place via Slack. Transfers to the USA are safeguarded by EU Standard Contractual Clauses and the EU-US Data Privacy Framework (Salesforce).
Legal basis: Art. 6 (1) (f) GDPR (internal coordination of our operations)
Provider: Anthropic, PBC, 500 Howard Street, San Francisco, CA 94105, USA
Purpose: AI-assisted pre-sorting of incoming email to our booking inbox (labelling by topic and urgency), drafting of replies and support of our staff in operational tasks such as looking up booking and tenancy details. Content is processed via Anthropic's commercial API under a data processing agreement and is not used to train AI models. Replies to guests and tenants are always written or approved by our staff; no automated decision-making within the meaning of Art. 22 GDPR takes place. Transfers are safeguarded by EU Standard Contractual Clauses.
Legal basis: Art. 6 (1) (f) GDPR (efficient handling of enquiries and of our operations)
Provider: Qonto SA, 6 Impasse Bonne Nouvelle, 75010 Paris, France
Purpose: Our business bank account for incoming transfers, security payment refunds and other payouts. Processes the transaction details (name, IBAN, amount, payment reference).
Legal basis: Art. 6 (1) (b) GDPR (payments relating to your booking or tenancy), Art. 6 (1) (f) GDPR (orderly accounting)
Provider: KIWI.KI GmbH, Wattstraße 11, 13355 Berlin, Germany
Purpose: Digital access to building and apartment doors in some of our locations. To issue your access we transmit your name, email address and the access period; KIWI processes the door openings.
Legal basis: Art. 6 (1) (b) GDPR
Provider: SALTO Systems GmbH, Schwelmer Str. 245, 42389 Wuppertal, Germany
Purpose: Digital access to the front door in some of our locations. To issue your access we enter your name, email address and the access period.
Legal basis: Art. 6 (1) (b) GDPR
Provider: Upstash, Inc., USA
Purpose: Protection of our booking and login forms against abuse by short-lived request counters per IP address. Transfers to the USA are safeguarded by the EU-US Data Privacy Framework.
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in secure operation)
Provider: Matterport, Inc., 352 East Java Drive, Sunnyvale, CA 94089, USA
Purpose: Display of 3D tours of our rooms. The tour is only loaded when you open it; Matterport then processes your IP address and usage data.
Legal basis: Art. 6 (1) (f) GDPR
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Purpose: Display of public Google reviews of our locations and machine translation of review texts. Retrieved by our server; no data of website visitors is transmitted to Google.
Legal basis: Art. 6 (1) (f) GDPR
Provider: The push service of your browser or device manufacturer (for example Google, Apple or Mozilla)
Purpose: Delivery of push notifications in our member app, only if you allow them. We send an encrypted message to the push address your browser or device created.
Legal basis: Art. 6 (1) (a) GDPR (consent)
Provider: Mapbox Inc., 1714 14th Street NW, Washington, DC 20009, USA
Purpose: Embedding of interactive maps to display our locations.
Legal basis: Art. 6 (1) (f) GDPR
Provider: Functional Software, Inc. dba Sentry, 132 Hawthorne Street, San Francisco, CA 94107, USA
Purpose: Technical monitoring for error resolution. Captures stack traces and browser metadata; no personal form data is stored.
Legal basis: Art. 6 (1) (f) GDPR
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Purpose: Embedding of the 'Montserrat' typeface. Loaded locally via next/font, NO connection to Google servers on page load.
Legal basis: Art. 6 (1) (f) GDPR
Provider: Cybot A/S, Havnegade 39, 1058 Copenhagen, Denmark
Purpose: Display and documentation of cookie consent, automatic blocking of non-essential scripts until consent is granted.
Legal basis: Art. 6 (1) (c) GDPR (legal obligation to obtain consent)
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Purpose: Measurement of website usage (pages viewed, sessions, rough geography) to improve our product. IP-anonymisation enabled. Data shared with Google LLC (USA) under SCC + EU-US Data Privacy Framework. Loaded ONLY after explicit consent.
Legal basis: Art. 6 (1) (a) GDPR (consent)
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Purpose: Measurement of ad campaign effectiveness (conversions) and re-targeting to users who previously visited our site. Data shared with Google LLC (USA) under SCC + EU-US Data Privacy Framework. Loaded ONLY after explicit consent.
Legal basis: Art. 6 (1) (a) GDPR (consent)
When you first visit our website, a cookie banner (Cookiebot) asks you to choose which categories of cookies to accept: Necessary, Preferences, Statistics and Marketing. Necessary cookies are set by default, they are required for the website to function (session, security, consent storage).
Statistics and Marketing cookies (Google Analytics, Google Ads) are only set AFTER you actively consent. If you decline, no tracking scripts are loaded. You can change or withdraw your consent at any time via the 'Cookie settings' link in the footer.
We implement Google Consent Mode v2: while you have not consented, no personal identifiers are transmitted to Google. Upon consent, tracking begins.
Some houses we operate on behalf of their owner under a management agreement (currently STACEY Moabit, Stromstraße 48a, Berlin). There, the owner is the landlord and the controller for the data of the tenancy; we process these data on the owner's behalf as processor (Art. 28 GDPR) under a data processing agreement. Rent and security payments go to the owner's accounts.
The owner receives the information needed to run and account for the house, in particular names, rooms, rents, payments, arrears and security payments of the residents, in a monthly report. Residents can exercise their rights towards us; where needed we pass the request on to the owner.
Booking platforms: if you book through a platform (Wunderflats, HousingAnywhere, Spotahome, Uniplaces or Spacest for long stays, Booking.com or Airbnb for short stays), we receive your booking details from the platform and exchange with it the data needed for the booking. The platform's own privacy policy applies to your use of the platform (Art. 6 (1) (b) GDPR).
Authorities: where the law requires, we pass data to public authorities, for example registration forms and tourist tax for short stays. For long stays we issue the landlord confirmation you need to register your address (§ 19 Federal Registration Act) (Art. 6 (1) (c) GDPR).
Tax advisor: our tax advisory firm receives the accounting records, including invoices and payment records (Art. 6 (1) (c) GDPR).
Debt collection and lawyers: if claims remain unpaid despite reminders, we may pass the data needed to enforce them to a debt collection agency or a law firm (Art. 6 (1) (f) GDPR, legitimate interest in enforcing our claims).
Tenants of our houses can use our member app. To sign in, we send a one-time login code to your email address. In the app we process your tenancy details, messages to our team, defect reports, bookings of extras and event participation (Art. 6 (1) (b) GDPR).
If you allow push notifications, your browser or device stores a push subscription with us, and messages are delivered via the push service of your browser or device manufacturer. You can switch notifications off at any time in your browser or device settings (Art. 6 (1) (a) GDPR).
You have the right to access, rectify, erase, restrict, and receive your personal data, as well as to object to processing. You may withdraw any consent you have given at any time. To exercise these rights, please contact us at booking@stacey.de.
You also have the right to lodge a complaint with a supervisory authority. For Hamburg: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit.
Personal data is deleted as soon as the purpose of processing ceases. For contract-related data, statutory retention periods of up to 10 years apply under German commercial and tax law. Data from booking enquiries that were not completed is anonymised at the latest 12 months after the enquiry is closed; anonymised records serve statistical purposes only and no longer contain personal data. Tenancy data are kept for the duration of the tenancy and afterwards for the statutory retention periods.
We reserve the right to update this privacy policy to reflect changes in legal or factual circumstances. Last updated: October 2026.