Privacy Policy

Privadi, Inhaber Martin Schröder Ernst-Kromayer-Straße 28 06112 Halle (Saale) Deutschland Telefon: 0177/480 90 10 E-Mail: info@privadi.net

A data protection officer has not been appointed; the legal requirements for such an appointment are not met.

When you access a page, your browser transmits technically necessary data to the server: IP address, date and time, the address requested, the volume of data transferred, a message about whether the request succeeded, and details of your browser and operating system.

These data are required for the page to be delivered and serve the security of operations. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the stable and secure operation of the portal.

The server logs are deleted after seven days at the latest.

We count how often a page of this portal is accessed. We store only the date, the page accessed and, if available, the page you came from.

Since 7 September 2026 we additionally store the visitor’s country, that is only the country code such as “DE”. It is determined from the IP address when the page is opened, on our own server, using a country list held there. The IP address itself is neither stored nor passed on, and no third-party service is asked. A country allows no conclusion about a person or a place. The country list comes from DB-IP (IP Geolocation by DB-IP, https://db-ip.com, licence CC BY 4.0).

We do not store: IP addresses, identifiers of any kind, cookies or other features that would allow a visitor to be recognised again. Nothing is stored on or read from your device. No profiling takes place.

Technically this count is kept by PrivadiOffice, which is operated by the same controller (see item 1). The figures for this portal, the brand website and PrivadiOffice are held there together so that they can be evaluated side by side.

No third-party service such as Google Analytics is used. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is to understand how the portal is found and used.

Searching for businesses, the postcode search and the map can be used without an account. Registration only becomes necessary when you want to submit an enquiry or have your business listed.

For an account we process: name, e-mail address, password, telephone number if you wish to provide one, whether you are acting as a private individual or a business, and, for business users, the company name.

The password is not stored in plain text, only as a check value that cannot be reversed (scrypt with a random salt). For business accounts, item 7 applies instead.

The legal basis is Art. 6(1)(b) GDPR - the processing is necessary in order to use the portal.

The data are deleted when you have your account deleted, unless statutory retention obligations prevent this.

After you sign in we set a technically necessary session cookie. It contains no content, only a random identifier by which your session in the portal is recognised. It cannot be read by scripts in the browser and expires after 30 days.

The legal basis is Section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act) in conjunction with Art. 6(1)(b) GDPR. No consent is required for this, because the cookie is strictly necessary for the service you have requested.

We do not set any cookies for advertising or analytics purposes and do not integrate any services for measuring reach.

This section applies only to businesses that register as partners. Customer accounts remain solely in the portal; PrivadiOffice receives no data about them.

The brokerage portal and PrivadiOffice are operated by the same controller (see item 1) and have kept one shared account for businesses since 4 September 2026: a business signs in to both services with the same e-mail address and the same password. There is no redirection.

When a business registers in the portal, its account is technically created at PrivadiOffice. The following are transmitted there: name, e-mail address, password, company name and the time of consent to the terms, the privacy policy and the data processing agreement. The password is stored there only as a check value that cannot be reversed (bcrypt); the portal does not store it. Each time the business signs in to the portal, e-mail address and password are passed to PrivadiOffice for verification; changes to the password or e-mail address are made there and apply to both services. If a business signs in to PrivadiOffice with an account that previously existed only in the portal, PrivadiOffice verifies the password with the portal and creates the shared account at that moment; name and company name are transmitted.

The transmission takes place exclusively within the same server; the data do not leave it. This is not a disclosure to third parties. Both services keep separate data holdings for their content (tenders and enquiries in the portal, business data at PrivadiOffice). The legal basis is Article 6(1)(b) GDPR.

Deletion: the PrivadiOffice deletion rule applies to the shared account. When the account is deleted there — at the business's request or automatically three months after the end of the subscription — access, quotes, messages and data releases in the portal are deleted in the same step, and the business is no longer visible to anyone. The business entry and the documents including the files are then kept for three years so that claims arising from brokered jobs — for instance in an insurance case — can still be settled (Art. 6(1)(f) and Art. 17(3)(e) GDPR; period under Section 195 of the German Civil Code). After that they are deleted automatically unless a statutory obligation requires longer retention. Customer enquiries remain with the customers, without assignment to the business. If a business cancels — in the partner area or in PrivadiOffice —, we store the time of cancellation and the day the membership ends; both programs synchronise these details with each other. From that day on, the business is no longer visible to anyone.

In order to admit a business we additionally process: company name, address, postcode, town, federal state, telephone number, the services offered and the processing status of your admission.

With the exception of internal notes, these details are publicly visible in the portal once your business has been approved. That is the purpose of the listing.

In the “Profile” area you can also add a logo, a description and your website, change your services, telephone number and address, and under “My story” voluntarily answer questions about your business and upload photos of the owner, the team and your work. Only answered questions and uploaded photos appear publicly. We first store every change as a draft with a timestamp; it only becomes publicly visible once we have reviewed and approved it. If we reject a change, we store the reason, which you see in your area. A replaced, removed or rejected logo or photo is deleted immediately. All other profile details are deleted together with the business listing under the deletion rules in section 7.

The legal basis is Art. 6(1)(b) GDPR.

When you register, we also store the time at which you accepted the Partner Terms. The purpose is to prove that the contract was concluded; the legal basis is Art. 6(1)(b) GDPR. This time is deleted together with the business listing in accordance with the deletion rules in item 7.

Before approval we require three documents: the trade registration, an identity document of the authorised representative, and proof of business liability insurance. We store the file itself together with the file name, file type, size, review status, review date and, where applicable, an expiry date. If a document has an expiry date, we automatically remind the company by email 30 days beforehand; for this we store when that reminder was sent, so it is not sent repeatedly. As soon as a company registers, a notification containing its company and contact details is sent to the operator, and we notify the company of the decision — approval or rejection including the reason.

The purpose is to verify that a business actually exists and is commercially active. The portal quality seal rests on this. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest, and at the same time the interest of the clients, is protection against sham businesses.

On the identity document you may redact all details that are not required for verifying identity - in particular the access number, the serial number and the machine-readable zone. We only need the name, the photograph and the period of validity. Under Section 20(2) PAuswG (German Identity Card Act), an identity card may not be copied for purposes going beyond establishing identity; we use it exclusively for that purpose.

This is how the files are protected: they are stored outside the publicly accessible area of the server, carry randomly generated file names and can only be opened through a protected retrieval address which first checks whether the person retrieving the file is the owner or a reviewer. Access via a public address is not possible.

Retention: the documents are kept until the end of the membership and for three years thereafter, so that in the event of a dispute it remains possible to demonstrate on what basis a business was approved. The period is based on the standard limitation period under Section 195 BGB (German Civil Code). If a document is replaced by a new one, the old file is deleted immediately.

When you submit an enquiry or post a tender, we process the data you provide in doing so: type of service, description, postcode and town, duration, and the link to your account.

These details are passed on to one or more partner businesses so that they can make you an offer. Without this transfer the portal cannot fulfil its purpose. The legal basis is Art. 6(1)(b) GDPR.

We review enquiries and tenders before any company sees them. For an enquiry, companies initially see only the service, postcode, town and whether it comes from a private or business customer. Your name, phone number and email address are only given to the one company that takes on the enquiry; it sees these details in the portal and in its PrivadiOffice account, which is operated by the same controller on the same server.

The receiving business is independently responsible for its further processing. It is obliged towards us to use your data solely for handling your enquiry.

Please do not include any details in the description that are unrelated to cleaning - in particular no health data and no details about other people.

For every enquiry and tender we keep a placement log: which company received it, took it on or made an offer for it, and when; and when you accepted or declined an offer, or extended or withdrew your tender. Your name, phone number and email address are not included. The purpose is to document how the placement took place; the legal basis is Art. 6(1)(f) GDPR. The log is deleted together with the enquiry or tender.

The map of Germany on the home page is generated on our own server. No map images are loaded from third-party servers, and your IP address is not transmitted to anyone in the process.

The underlying geodata come from OpenStreetMap and are available under the Open Database License (ODbL).

The area boundaries follow the constituencies of the 2025 German federal election. This data comes from Die Bundeswahlleiterin and is available under the Data licence Germany – Attribution – Version 2.0. It is also stored on our own server; nothing is loaded from third-party servers.

The portal runs on a server operated by STRATO AG in Germany. STRATO processes the data exclusively on our behalf on the basis of a data processing agreement under Art. 28 GDPR.

The server is backed up; the backups also include the uploaded documents and are treated with the same protection.

No transfer to countries outside the European Union takes place.

Beyond this, we only pass on data where we are legally obliged to do so.

Under the General Data Protection Regulation you have the following rights:

• Access to the data stored about you (Art. 15)
• Rectification of inaccurate data (Art. 16)
• Erasure (Art. 17)
• Restriction of processing (Art. 18)
• Data portability (Art. 20)
• Objection to processing based on legitimate interests (Art. 21)

For all of these matters a message to the e-mail address given above is sufficient.

You may also lodge a complaint with a supervisory authority. The authority responsible for us is the Landesbeauftragte für den Datenschutz Sachsen-Anhalt, Leiterstraße 9, 39104 Magdeburg.

Up to ten photos may be uploaded with a job posting. This is voluntary. We do not collect a street address; we store only the image file, its original file name, the file type and the size. The legal basis is Art. 6(1)(b) GDPR (performing the placement).

By default the photos are not publicly accessible; they are then served only to the person who created the posting, to approved partner companies allowed to see the posting, and to the controller. That person may release the photos of their posting to all visitors of the site. In every case the photos are excluded from search engines (robots.txt and the header X-Robots-Tag: noindex, noimageindex). Anyone who knows or is given the address of an individual image can nevertheless open it; services that disregard these instructions cannot be excluded technically. The release can be reversed at any time — copies already downloaded cannot be recalled. The photos are deleted together with the posting.

Through the feedback form you can tell us what works, what does not, or report a problem. We store your message, the type of feedback, the page you wrote from and — if you provide it voluntarily — your email address for a reply. If you are signed in, your account identifier is stored as well. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is improving the portal.

Feedback is deleted once the matter has been dealt with, at the latest after three years.

If businesses submit an offer for your listing, we store the price, the tax rate, the description of the work, any period of validity, the current status and your reason for declining, if you give one. The legal basis is Art. 6(1)(b) GDPR.

Questions between you and a business run through the portal. We store the message text, the time and who wrote it. This route exists so that you can clarify questions without disclosing your name and phone number. The legal basis is Art. 6(1)(b) GDPR.

We never pass your contact details — name, company, phone number, email address and address — to all businesses in the area. They go to individual businesses only, and only in three cases: when a business asks for a site visit or a phone call and you allow it, or when you award a business the job. If you allow a site visit or a call in advance when creating the listing, that permission applies to the individual business that asks. Every disclosure is logged with the business, the reason and the time; you can see it in your account and withdraw it there. Withdrawing ends the display in the portal — it cannot retrieve details the business has already received. Withdrawal is not possible for an awarded job, because the business must be able to reach you to carry it out. The legal basis is Art. 6(1)(b) GDPR; we keep the log additionally under Art. 6(1)(f) GDPR (evidence of the referral).

Business customers can save sites (a name, an address and an optional note for the business). A site's address is subject to the same rule as your other contact details.

We notify you about new offers, messages, requests for site visits and listings that are about to expire. Every notification appears in the inbox in your account; we also send it by email. You choose in your account which emails you receive. Sending is done via our own mail server; no dispatch service provider is involved. The legal basis is Art. 6(1)(b) GDPR.

After a job has been completed you can give us feedback about the business. This feedback is not published. It serves us alone for quality assurance and may lead us to warn a business or exclude it from referrals. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the quality of the businesses we refer.

For "forgotten password" and for changing your email address we generate a one-time token valid for two hours. Only its hash is stored in the database, not the token itself. It becomes invalid after use or expiry. When you register as a customer or as a company we also send you a confirmation email containing such a token; it is valid for seven days. We store the time of your confirmation. Without it the companies do not see your job posting and a company is not approved. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to prevent registrations using other people's or invented email addresses.

If you delete your account, all of the above data is deleted with it. If an awarded job is still running at that time, we instead remove your personal details (name, company, phone number, email address); the fact of the referral remains as evidence (Art. 17(3)(b) and (e) GDPR). Using the "Download my data" button you can obtain a machine-readable file of everything stored about your account at any time (Art. 15 and 20 GDPR).

Using the “Give feedback” form next to the cleaning calculator, you can tell us what you actually pay for a cleaning service. Providing this is voluntary and does not require an account. We store: whether you are a private or business customer, the service concerned, the price you state together with whether it is net or gross, your voluntary description of the size or scope of the job, your postcode, your email address, optionally your telephone number and an optional free-text message.

We need the email address so that we can ask you if something is unclear; without the ability to ask, a stated price is of no use to us. Your information is used solely to check and improve the guide values of the cleaning calculator. You will not receive advertising as a result, and we do not pass your information on to businesses or any other third party. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the accuracy of the price information we publish.

Your feedback is deleted once it has been evaluated, at the latest after three years.

We adapt this policy as soon as the processing changes - for example when new details are collected or a further service provider is added. The version published here, bearing the date stated below, applies in each case.