Privacy policy

If you join the waiting list, we store your name, email address, desired offer, language, and the time and version of your consent. We email you once when the offer becomes available again. This does not create a booking. The legal basis is your consent (Article 6(1)(a) GDPR); you can withdraw it for the future at any time by emailing hello@loft45.de.

If your account email is unconfirmed, we send a six-digit verification code through Resend. The code is valid for ten minutes. Until confirmation, we store the form details, a hash of the code and a pseudonymous identifier to limit abuse; unconfirmed requests are regularly cleared after one day. For the notification, we store sending attempts, status and time. Active waiting-list entries are deleted automatically after six months at the latest, or earlier on request.

MBU GmbH processes data arising from visits, contact, accounts, bookings and payments for the purposes described below. Optional services such as Google Maps require your consent. The following sections explain the controller, recipients, retention and your rights.

Vercel

The website runs on Vercel Inc. (USA). Data generated there includes your IP address, time, requested URL, browser and connection details, and data sent for application functions. Vercel uses a global delivery network; server functions for this project are configured in fra1 (Frankfurt). The purpose is secure delivery of the website and requested functions (Article 6(1)(f) or (b) GDPR, respectively). Under the current Pro plan, runtime logs are retained by default for one day; no additional exports were found in the project. For transfers to the USA, the Vercel DPA published for Pro accounts provides EU Standard Contractual Clauses under Article 46(2)(c) GDPR. A copy is available at https://vercel.com/legal/dpa.

Supabase

Accounts, enquiries, bookings and records are processed by Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513, in a Supabase database. The production and staging projects are in eu-central-1 (Frankfurt). Authentication processes email address, password hash and session data. The purposes are provision of the account and requested services (Article 6(1)(b) GDPR); security operations rely on Article 6(1)(f) GDPR. Support and subprocessors may give Supabase access from third countries. The published Supabase DPA provides EU Standard Contractual Clauses (Module Two for controller-to-processor transfers) under Article 46(2)(c) GDPR for transfers outside the EEA. A copy and the subprocessor list are available at https://supabase.com/legal/customer-resources/data-processing-addendum and https://supabase.com/legal/customer-resources/subprocessor-list.

Controller

The controller is:

MBU GmbHPaulusstr. 45A33602 BielefeldPhone: +49 521 52052060Email: info@mbugmbh.de

Retention and deletion

Retention of personal data depends on its purpose and legal obligations. Ongoing contracts, tax and commercial retention rules, and possible legal claims may delay erasure. Continuous automatic deletion is not set up for booking, invoice, payment and withdrawal records. Use for other purposes requires a separate legal basis. Once it ends, that retention ground ceases to apply.

Your rights

Subject to the GDPR, you can request access, rectification, erasure, restriction of processing and data portability. Portability covers data you provided to us that we process automatically on the basis of your consent or a contract (Article 20 GDPR). You can withdraw consent at any time for the future. You can object, on grounds relating to your particular situation, to processing based on Article 6(1)(f) GDPR. Contact us at the email address above.

Complaint

You can lodge a complaint with a data protection supervisory authority, in particular where you usually live, work or where an alleged infringement occurred. The authority responsible for the registered office of MBU GmbH is:

Landesbeauftragte für Datenschutz und Informationsfreiheit NRWPostfach 20 04 44, 40102 DüsseldorfPhone: 0211 38424-0Email: poststelle@ldi.nrw.de

Cookies and consent management

We use strictly necessary cookies for sign-in and guest access (section 25(2)(2) TDDDG). Supabase Auth cookies named “sb-…-auth-token” can remain in the browser for up to 400 days by default; the server-side session may end earlier. Signing out and account deletion are distinct from this browser lifetime. A “CookieConsent” cookie stores your privacy choice for up to twelve months according to the provider.

The consent management service provided by Usercentrics A/S processes technical connection data when displaying the banner and records your choice with its time and consent identifier. Storage of the necessary choice relies on section 25(2)(2) TDDDG; the record of consent on Articles 6(1)(c) and 7(1) GDPR. You can change your choice for the future through “Privacy settings” in the footer.

Google Analytics

With your consent to the “Statistics” category, we use Google Analytics 4 (Google Ireland Limited) to analyse use of our public information and offer pages. This may involve processing cookies and online identifiers, device and browser information and page views, and transmitting them to Google. The legal basis is your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. Without consent, the Analytics tag is not loaded.

The integration sends page views without URL query parameters or fragments. Account, sign-in, booking, payment and withdrawal pages are excluded from these page views. The following requirement applies to the use of Google Analytics: Google Signals, advertising personalisation and additional automatic events must not be enabled in the GA4 data stream in use. GA4 loads directly, without Google Tag Manager, in a separate invisible page area that receives only the permitted page information. This area is removed on withdrawal or navigation to an excluded page; without Statistics consent, the website also removes its accessible GA4 cookies. Google Ads and contact conversions for Google are not integrated.

Google privacy information: https://policies.google.com/privacy

Server logs

Website visits produce technical logs with IP address, time, requested path, browser and connection details. They serve delivery, error analysis and abuse prevention (Article 6(1)(f) GDPR). Vercel runtime logs are retained for one day by default under the current Pro plan. Application errors from sevDesk log only method, status and route template, not response content.

Contact form and email

For an enquiry we process your contact details, selected topic and message to respond (Article 6(1)(b) GDPR for pre-contract enquiries, otherwise (f) for answering). General contact enquiries are sent through Resend and are not stored as a separate database record; certain office enquiries are also recorded in Supabase. Messages may be processed in our Microsoft/Outlook mailbox. Resend, provided by Plus Five Five, Inc. (USA), receives recipient, sender, subject, content and sending details. We also use Resend for account and sign-in messages, guest access codes, booking and invoice messages, cancellation and refund notices, waiting-list alerts, withdrawal acknowledgements and enquiry messages. Sharing with these providers is necessary for communication and does not require separate consent.

According to Resend, email data is processed in the USA even though sending for loft45.de takes place from eu-west-1. Click and open tracking are disabled for the domain. Resend states 30 days for emails and logs and seven days for backups on standard plans. Its published DPA describes EU Standard Contractual Clauses and participation in the EU-US Data Privacy Framework for US transfers (https://resend.com/security/gdpr and https://resend.com/legal/dpa). Microsoft publishes a data protection addendum for its services (https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA); exceptions to its EU Data Boundary may apply, for example for support (https://learn.microsoft.com/en-us/privacy/eudb/eu-data-boundary-transfers-for-all-services).

Registration on this website

You can register with an email address, password and customer type (“private” or “business”). Name, company and phone number are optional. The name is also displayed in the signed-in portal to identify your account to you. Name, company and phone number may also be used to contact you about an enquiry. The legal basis is Article 6(1)(b) GDPR. Deleting an account removes authentication and profile data; independent enquiry, booking and invoice records may remain for the reasons stated below.

Supabase account

Supabase processes email address, password hash, account identifier, optional profile details and session information. We use these data for sign-in and account management (Article 6(1)(b) GDPR). The customer classification in the profile is a starting value for later bookings but does not alone determine the legal classification of each contract.

Guest booking and access code

At the start of a guest booking, Supabase creates a technical anonymous authentication identity. For later access to a guest booking, we send a one-time code through Resend to the associated email address. The database stores a hash of the code, session and booking association, and pseudonymous identifiers to limit attempts. The code is valid for no more than ten minutes and the guest access session for no more than one hour. The “loft45-guest-challenge” and “loft45-guest-booking” cookies carry those validity periods. Expired records are cleared during the next successful maintenance run; an exact deletion time is not guaranteed. Technical anonymous accounts can be deleted after 30 days subject to blocking conditions. Booking and invoice data remain separate.

Contract records

For certain bookings we record the version and time of the withdrawal information shown and, where applicable, the request for early performance and its acknowledgement. Authorised administrators can document actual performance, cancellation, refunds and possible proportional payment with times and factual notes. This serves contract handling and evidence (Article 6(1)(b) and, where a duty applies, (c) GDPR); retention follows the relevant booking record.

Cloudflare Turnstile

For direct booking and protected sign-in and registration pages we load Cloudflare Turnstile by Cloudflare, Inc. (USA) via challenges.cloudflare.com. According to Cloudflare, it processes IP address, TLS fingerprint, User-Agent and technical browser signals, but no form entries. A single-use token is sent to Supabase Auth for verification; LOFT45 does not store it in the application database. The token is valid for no more than five minutes.

The purpose is protection against automated and abusive access (Article 6(1)(f) GDPR; section 25(2)(2) TDDDG for strictly necessary device access). Cloudflare describes its roles as processor for protecting the site and independent controller for improving bot detection. For transfers outside the EEA, Cloudflare’s DPA describes EU Standard Contractual Clauses (Module Two when processing for controllers). Provider information and a copy are available at https://www.cloudflare.com/turnstile-privacy-policy/ and https://www.cloudflare.com/cloudflare-customer-dpa/.

Office enquiries

For office enquiries we store the requested offer, language, start date, optional message, status and processing details. Without an account, name, email address and optional phone number are added; with an account, its identifier is associated. Authorised administrators process these data to prepare the requested service and apply agreed price benefits (Article 6(1)(b) GDPR). Account invitation links are single-use and valid for 24 hours; we store only their hash, expiry and use. Independent office enquiries can remain after account deletion. No automatic deletion period has yet been set up for these records.

Booking and invoice

For bookings we collect name, email address and billing address, and for business bookings the organisation as well. A buyer reference is required for business bookings and is not requested for other bookings. We store booking, service, payment and invoice details. For the invoice, sevDesk GmbH receives recipient and address details, email address, technical customer number, and invoice and service data. A saved billing address book in Supabase is optional; merely saving an address does not send it to sevDesk. The legal bases are Article 6(1)(b) GDPR for the contract and (c) for statutory invoicing and retention duties.

Depending on the document, commercial and tax law generally requires six years for business correspondence, eight years for accounting vouchers and invoices, and ten years for books and financial statements; each period starts at the end of the relevant calendar year (section 257 HGB, section 147 AO, section 14b UStG). Open tax proceedings or legal claims may require longer retention. Account deletion or changing a billing address does not remove booking or invoice records that must still be kept.

Electronic withdrawal

When you use the electronic withdrawal function, we store your name, contract reference, email address supplied, declaration, and the times of receipt and sending. The acknowledgement and internal notification to the responsible administrators are sent through Resend. The bases are Article 6(1)(c) GDPR together with section 356a BGB, and Article 6(1)(b) GDPR for contract handling. Automatic deletion of these records is not currently implemented; erasure is possible after handling and once applicable retention or claim grounds end.

Payment methods and data

For card payments, the SumUp Payment Widget from gateway.sumup.com loads at the final booking step. We send a checkout reference, amount, currency, description, merchant code and return URL. Full card numbers and CVVs go directly from the browser to SumUp; LOFT45 does not store them. For booking, refunds and reconciliation, LOFT45 stores checkout, transaction and refund identifiers, statuses, amounts, currency and timestamps. The legal basis is Article 6(1)(b) GDPR and, for required accounting records, (c).

The Apple Pay and Google Pay wallets enabled by SumUp are available for selection. Only after you select a wallet do we load its SDK and check browser support before a payment checkout is created. Technical connection and device data may therefore reach Apple or Google before final payment authorisation. After you authorise payment, the wallet payment token passes temporarily through LOFT45 to SumUp; LOFT45 does not store it. The selected payment method is retained without card details in Session Storage for the tab session. The providers describe further technical processing in their privacy notices: https://www.apple.com/legal/privacy/, https://policies.google.com/privacy and https://www.sumup.com/de-de/datenschutzbestimmungen/.

Roles and transfers

SumUp states that it processes some payment data as an independent controller. SumUp describes possible recipients and transfers outside the EEA with contractual or other permitted safeguards. Details and a copy of its published terms are available at https://www.sumup.com/de-de/datenschutzbestimmungen/ and https://www.sumup.com/de-de/geschaeftsbedingungen/dpa/. Payment and invoice records are retained under the statutory criteria described above.

Google Maps

On the home and contact pages, Google Maps loads only after your marketing consent through privacy settings, independently of whether GTM is enabled. If you consent, Google Ireland Limited receives in particular IP address, browser and device data; the map may load further services such as Google Fonts. The purpose is to show our location. The legal basis is Article 6(1)(a) GDPR and section 25(1) TDDDG. Without consent we display the address as text. You can withdraw your choice for the future through “Privacy settings”. A transfer to Google LLC in the USA is possible; Google refers to the EU-US Data Privacy Framework. Details: https://policies.google.com/privacy

Local site fonts

The LOFT45 site fonts are delivered locally by the website host. This creates no additional Google Fonts request. Only the separately approved Maps embed may make its own font requests to Google.

After you consent to the Marketing category, we use the OpenAI Pixel and Conversions API on our production website. The purpose is to measure and assess our ChatGPT ads. We report checkout starts, successfully accepted contact, office and event enquiries, and successfully paid and confirmed bookings. Waiting lists are excluded.

We transmit the event type and time, a pseudonymous event identifier, the website origin and, where available, a click or browser reference. For completed bookings, we transmit the gross amount paid and the currency. Browser loading and transmission also disclose technical connection data to OpenAI, particularly the IP address and browser information. Our server does not add customer IP addresses or contact information for advanced matching.

We do not transmit message contents, names, contact or billing addresses, card or bank details, or hashes derived from contact details. Automatic advanced matching remains disabled. URLs exclude access tokens, personal information in paths, query parameters and fragments. Pseudonymous identifiers may nevertheless constitute personal data.

MBU GmbH is responsible for our processing; its contact details appear in the “Controller” section. The recipient for EEA data is OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. Under its Conversion Terms, OpenAI acts as an independent controller in standard operation. These terms also allow the provision and improvement of its products and services. Different roles apply to contractually defined restricted processing.

The legal bases for our advertising measurement are Article 6(1)(a) GDPR and, where information is stored on or accessed from your device, Section 25(1) TDDDG. Without consent, we do not load the Pixel or transmit conversion events. You may withdraw consent for the future at any time through “Privacy settings”. Withdrawal does not affect the lawfulness of prior processing. It stops future reporting and deletes accessible tracking cookies and tracking data awaiting transmission; it does not automatically delete data already transmitted to OpenAI. For access or erasure requests, contact us at info@mbugmbh.de or OpenAI at privacy@openai.com.

Retention periods appear in the following overview. Statutory retention of booking and invoice records is separate. OpenAI may process data outside the EEA, particularly in the United States. The Ad Tools DPA requires a valid mechanism for onward transfers; OpenAI describes adequacy decisions and, otherwise, EU Standard Contractual Clauses. Information and copies of appropriate safeguards are available through the terms listed below or privacy@openai.com.

Your choice permits conversion measurement; we exclude use of these events for future user-level ad personalisation through OpenAI’s opt-out feature.

Retention periods and erasure

The click reference “__oppref” is stored in the browser for up to 30 days from writing; capturing a click parameter again resets expiry. The browser reference “__obref” lasts for up to 365 days from creation. Browser restrictions or clearing cookies may shorten these lifetimes.

The signed tracking context “__loft45_ads” and the associated technical click timestamp last for at most 30 days. Server-side click associations and consent contexts are deleted after at most 30 days, earlier on withdrawal. An identifier-based withdrawal record remains until the context expires so delayed requests cannot reactivate withdrawn consent.

We retain event data awaiting transmission until delivery confirmation, at most seven days from the event. Successful or permanently failed delivery removes the amount and click association earlier. A technical deduplication record remains for 30 days from the event; it contains an opaque event ID, type, delivery status and technical timestamps, no amount, click reference or full event data.

Withdrawal removes accessible tracking cookies and event data awaiting transmission. If there is no connection or the browser is closed immediately, server-side withdrawal may only take effect upon the next successful reconciliation or expiry. Clearing all browser cookies without notifying the server does not allow anonymous server data to be identified immediately. Transmissions already started cannot be recalled.

These periods apply to the LOFT45 integration and do not determine OpenAI’s own retention of data already received. The reviewed Ads documentation does not state a maximum retention period for raw conversion data. OpenAI’s privacy notices and terms apply to its independent processing; further information is available at https://openai.com/policies/eu-privacy-policy/ and https://openai.com/policies/ad-tools-dpa/ or privacy@openai.com. Cookie lifetimes, advertising attribution windows and provider retention are distinct.