Privacy Policy

1. Controller

The controller within the meaning of Art. 4 No. 7 GDPR is:

StudentCampus · E+R Eppinger Owners: Emilia and Romy Eppinger Buchenweg 27, 72663 Großbettlingen, Germany Phone: +49 15679 813 068 Email: kontakt@studentcampus.info

2. Data protection officer

We are not legally required to appoint a data protection officer. For all questions concerning data protection and the exercise of your rights, please contact us directly using the contact details given in section 1.

3. General information on data processing

3.1 Scope of processing

As a matter of principle, we process personal data of our users only to the extent necessary to provide a functional website and our content and services. Processing regularly takes place only with consent or on one of the other legal bases.

3.2 Legal bases

Depending on the processing situation, the legal basis is:

• Art. 6(1)(a) GDPR where consent has been obtained;
• Art. 6(1)(b) GDPR for the performance of a contract or pre-contractual measures (e.g. initiating a tenancy);
• Art. 6(1)(c) GDPR for compliance with a legal obligation (e.g. retention duties under tax and commercial law);
• Art. 6(1)(f) GDPR to safeguard legitimate interests, unless overridden by the interests or fundamental rights of the data subject.

3.3 Data minimisation and storage period

Personal data is erased or blocked as soon as the purpose of storage no longer applies. Storage beyond that occurs only where statutory retention obligations (in particular under commercial and tax law, generally 6 or 10 years) so require, or where data is needed to establish, exercise or defend legal claims. Specific retention periods are stated for the individual processing operations.

4. Your rights as a data subject

Where we process your personal data, you as a data subject have the following rights:

• Access (Art. 15 GDPR) to the data stored about you, its origin and recipients and the purpose of the processing;
• Rectification (Art. 16 GDPR) of inaccurate data or completion of incomplete data;
• Erasure (Art. 17 GDPR), unless a statutory retention obligation or another exemption applies;
• Restriction of processing (Art. 18 GDPR);
• Data portability (Art. 20 GDPR) in a structured, commonly used and machine-readable format;
• Objection (Art. 21 GDPR): you have the right to object at any time, on grounds relating to your particular situation, to processing of your data based on Art. 6(1)(f) GDPR;
• Withdrawal of consent (Art. 7(3) GDPR) with effect for the future; the lawfulness of processing carried out before the withdrawal remains unaffected.

Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI BW) Lautenschlagerstraße 20, 70173 Stuttgart, Germany PO Box 10 29 32, 70025 Stuttgart Phone: +49 711 615541-0 Email: poststelle@lfdi.bwl.de Web: www.baden-wuerttemberg.datenschutz.de

5. Provision of the website and server log files

Each time our website is accessed, our system or that of our hosting provider automatically collects data and information from the accessing device. The following data is collected:

• truncated or full IP address of the requesting computer,
• date and time of access,
• name and URL of the retrieved file and the volume of data transferred,
• confirmation of successful retrieval (HTTP status code),
• browser type and version, operating system and the previously visited page (referrer), where transmitted.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the technically sound provision, stability and security of our website (prevention and investigation of attacks). The data is not merged with other data sources and is not used to draw conclusions about you personally.

Storage period: server log files are stored for a maximum of 7 days and then deleted automatically. Longer storage occurs only in the event of security-relevant incidents; in that case the affected log files are kept until the incident has been conclusively resolved.

6. Hosting

This website is operated by an external service provider (host). The personal data collected on this website is stored on the host’s servers. The host is:

ALL-INKL.COM – Neue Medien Münnich Owner: René Münnich Hauptstraße 68, 02742 Friedersdorf, Germany

The host is used to provide our online offering securely and in accordance with the contract, based on Art. 6(1)(f) GDPR. We have concluded a data processing agreement with the host pursuant to Art. 28 GDPR, which ensures processing in accordance with the contract and our instructions as well as an appropriate level of data protection. The host processes the data exclusively within the European Union.

7. Cookies, consent and device information

This website does not use cookies for analytics, marketing or tracking purposes and does not integrate any such third-party services. No information is stored on your device and no information already stored there is accessed in a way that would require consent under Section 25(1) TDDDG.

Should technically necessary cookies or comparable techniques be used that are strictly required for operating the website, their storage is permitted without consent under Section 25(2) No. 2 TDDDG; the subsequent processing is based on Art. 6(1)(f) GDPR. A consent banner is therefore not required for this website.

8. Contact by email and telephone

If you contact us by email or telephone, we process the data you provide (e.g. name, contact details and the content of your enquiry) in order to handle your enquiry and in case of follow-up questions. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to the conclusion or performance of a contract, and otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries).

Storage period: we store this data until your enquiry has been dealt with conclusively and no follow-up communication is to be expected. If the enquiry leads to a contract or the data is subject to statutory retention obligations, the corresponding statutory periods apply. The data is not passed on to third parties without your consent.

9. Enquiries and placement of flat-share rooms (prospect management)

Our offering consists of renting out furnished flat-share rooms to apprentices, interns and students. If you are interested in a room or submit an enquiry, we process the data required for this, in particular:

• name and contact details (phone, email, address where applicable),
• details of the desired location, move-in date and rental period,
• voluntary information about your apprenticeship, internship or studies, where required to match you with a suitable room.

Purpose and legal basis: the processing serves to answer your enquiry, to examine and initiate and, where applicable, to perform a tenancy. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures or performance of a contract).

9.1 Origin of the data

Enquiries also reach us via rental platforms we use (e.g. WG-gesucht.de and Kleinanzeigen.de). In these cases we receive your data from the respective platform as soon as you contact us through it. The operator of the platform is responsible for data processing on the platform itself; its privacy policy applies there.

9.2 Storage period

If no tenancy comes about, we delete your enquiry data no later than six months after the last contact, unless statutory retention obligations prevent this or the data is required to defend legal claims. If a tenancy comes about, storage is governed by the contractual and statutory retention periods.

10. Other services

Google Search Console. We use Google Search Console to analyse how easily our website can be found in search engines. The service is not embedded in the website and sets no cookies and performs no tracking of visitors; ownership is verified via a DNS record. Only aggregated search statistics that cannot be traced to individual persons are provided. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Web fonts (Google Fonts). For a consistent appearance, this website uses fonts from Google Fonts. When you open a page, your browser loads the required fonts directly from servers of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; in the process your IP address is transmitted to Google, possibly also to Google LLC in the USA. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a consistent, appealing presentation of our online offering). Google LLC is certified under the EU-U.S. Data Privacy Framework.

Messenger contact. If you contact us via a messenger service (e.g. WhatsApp), we process the data transmitted in order to handle your enquiry. Please note the independent responsibility and the privacy policies of the respective messenger provider. The legal basis is Art. 6(1)(b) or (f) GDPR.

Social media presences. Where we maintain profiles on social networks, we process the data you provide when you interact with us. The operator of the platform is (jointly) responsible for the processing within the platform. The legal basis is Art. 6(1)(f) GDPR.

11. Recipients and transfers to third countries

Your personal data is passed on to third parties only where this is necessary for the performance of a contract, where we are legally obliged to do so, where it is necessary to safeguard legitimate interests, or where you have given your prior consent. Where we use service providers, this is done on the basis of a data processing agreement pursuant to Art. 28 GDPR.

As a rule, no data is transferred to countries outside the EU/EEA (third countries). Where a third-country transfer nevertheless occurs in the context of optional services, it takes place only on the basis of suitable safeguards under Art. 44 et seq. GDPR (in particular EU standard contractual clauses or an adequacy decision) or your explicit consent.

12. Data security

We take technical and organisational measures to protect your data against accidental or intentional manipulation, loss, destruction and unauthorised access. Our website uses TLS encryption (recognisable by the padlock symbol and “https” in the address bar). Our security measures are continuously reviewed and adapted in line with technological developments.

13. No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

14. Currency and amendment of this privacy policy

This privacy policy is dated August 2026. As our website and offerings evolve, or due to changed legal or regulatory requirements, it may become necessary to amend this privacy policy. The current version is available on this website at all times.

15. Objection to advertising emails

We hereby object to the use of the contact details published as part of our legal notice or this privacy policy for sending advertising and information material not expressly requested. We expressly reserve the right to take legal action in the event of unsolicited advertising, for example spam emails.