Skip to content
UniWo Furnished student rooms in Leipzig
Enquire
Open menu

Legal

Privacy policy

The legally binding version is the German Datenschutzerklärung; this English page is a courtesy translation.

1. Controller

Responsible for data processing on this website:
UniWohnen GmbH
Dimpfelstraße 56
04347 Leipzig, Germany
Email: [email protected]

2. Applications

If you apply for a room, we process the details you provide in the form, such as your name, email address, study status, room and move-in preferences, and message. We use this information to review your application, contact you, and prepare a possible tenancy. The legal basis is taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR).

We intentionally do not request document uploads or special-category information such as health, financial or identity-document data. Applications are kept only for as long as needed for the application and tenancy process. Declined or withdrawn applications are automatically deleted after 180 days unless a documented legal hold or legal obligation requires longer retention.

3. Hosting, technical operation and recipients

The website, application service and application database are hosted with Hetzner. Hetzner processes personal data as our hosting processor; UniWohnen remains responsible for deciding the purposes and means of processing. Traffic may also be routed or protected by Cloudflare. Application and contact emails are sent through our email service provider. These providers receive only the data needed for their service and act as recipients or processors where applicable.

Without your consent to website analytics, UniWohnen does not create individual visitor profiles. Infrastructure may temporarily process technical connection data, such as an IP address, request time, requested path and browser information, to deliver and protect the service. The legal basis is our legitimate interest in stable and secure operation (Art. 6(1)(f) GDPR). We do not use this data to create visitor profiles; technical data is deleted or overwritten when it is no longer needed for those purposes.

Only with your consent, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, also receives data for the advertising measurement described below.

4. Contact by email

You can reach us by email. We process your details to answer your message and, where relevant, prepare a possible rental agreement. The legal basis is taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR). We keep the correspondence only for as long as it is needed for that purpose or for a related legal obligation.

5. Advertising measurement, website analytics and your choices

Anonymous page counting

Regardless of your cookie choice, our server at Hetzner counts requests for public pages to help improve our content and navigation. For this purpose, we record only the UTC calendar date and public page path without URL parameters. We do not store or analyse IP addresses, visitor identifiers, browser information, referring pages, precise timestamps or form contents for this counting. No additional information is stored on or read from your device.

Each day, counting entries for completed days are combined into daily totals for each page and then deleted. We retain only the anonymous daily totals for the last 365 UTC calendar days. We do not create visitor profiles or link individual visits. These figures remain with us and are not sent to PostHog or Google.

Google Ads

With your voluntary consent, we use the Google tag for Google Ads (AW-18433947206) to measure our ads' effectiveness. The code is loaded from Google only after you accept. Until you have consented, no advertising measurement requests are sent to Google. This also applies if you reject measurement from the outset. You can use the website and application form regardless of your choice. We do not use this integration for remarketing (advertising to previous visitors again) or personalized advertising.

If you accept, Google may process technical connection data such as your IP address, browser and device information, pages visited and information about ad clicks. Cookies beginning with _gcl_ help associate visits with an ad; Google lists a lifetime of 90 days. See Google's cookie information and explanation of data use on partner websites.

After the server confirms an application was received, we also send a conversion event (a signal that an application was submitted successfully). We do not send names, email addresses, phone numbers or messages from the application form to Google.

Advertising measurement relies on your consent under Art. 6(1)(a) GDPR; storage or access to information on your device relies on Section 25(1) TDDDG. You can change your choice or withdraw consent for future processing at any time through “Cookie settings” at the bottom of the page. Withdrawal does not affect the lawfulness of processing carried out before you withdrew consent.

When you withdraw consent, we tell the Google tag already loaded on the page that your consent no longer applies. Google may receive a status message without cookies during this update. We then send no further successful-application events. On the next page you visit, the Google tag stays unloaded unless you consent again.

We store your choice, the consent-text version and the time of your choice in your browser's local storage (localStorage) for 180 days to respect your decision. After that, we ask again. This necessary storage is used only to manage your choice (Section 25(2)(2) TDDDG; Art. 6(1)(f) GDPR).

Further information: Google's privacy policy and Google's EU user consent policy. Our fonts remain stored on our own server; no requests are made to Google Fonts.

Website analytics with PostHog

If you separately consent to website analytics, we send PostHog Inc., through its EU project, page views, enquiry and email-link clicks, submit-button clicks, enquiry starts, confirmed submissions and technical error categories. We collect only known public page paths, language, device category, referring domain and, where relevant, a room identifier. If you arrive through a tagged campaign link, we also collect short campaign labels for source, medium and campaign. These are associated with the session so we can understand which campaigns lead to enquiries. Other URL parameters and full referring URLs are not sent. Website, form and room-numbering version labels and an internal test-visit indicator help us interpret the reports correctly. Form contents such as names, email addresses, phone numbers, study details and messages are not sent. We do not record sessions or capture arbitrary clicks or keystrokes.

Random visitor and session identifiers connect the steps toward a room enquiry. They are stored only after consent in your browser's local storage under uniwo-analytics-visitor and uniwo-analytics-session. Session data also contains the campaign labels described above, when present. The visitor identifier lasts no longer than 180 days; a session ends after 30 minutes of inactivity or at most 24 hours. Your analytics choice is stored separately from your advertising choice for 180 days under uniwo-analytics-consent. For explicitly marked internal test visits, we also store uniwo-analytics-internal after consent for at most 180 days.

Events are sent to PostHog's EU service in Frankfurt. Your IP address is necessarily involved in that connection; we disable location enrichment. PostHog describes a one-year retention period for its free plan, after which data may be deleted. Details are available in PostHog's storage information, privacy policy and data processing information.

The legal bases are your consent under Art. 6(1)(a) GDPR and §25(1) TDDDG. Without consent, we send no analytics events to PostHog. You can enable or withdraw analytics independently of advertising measurement under “Cookie settings”. On withdrawal, we stop further events, abort pending transmissions where technically possible, and delete local analytics identifiers, campaign attribution and internal test markers. This does not automatically delete data already transmitted. The application form works regardless of your choice.

6. International transfers and automated decisions

The website is operated in the EU. If a service provider processes personal data outside the EU/EEA, UniWohnen uses a legally applicable GDPR transfer safeguard and provides the relevant information where required. We do not use solely automated decision-making or profiling for applications.

Optional Google Ads measurement may involve processing in the United States. Google identifies the EU-U.S. Data Privacy Framework, under which Google LLC is certified, and standard contractual clauses for transfers not covered by an adequacy decision. Google's data transfer information explains these arrangements and how to request a copy of the clauses.

7. Your rights

Under the GDPR you have the following rights towards us:

  • Access to your stored data (Art. 15 GDPR)
  • Rectification of inaccurate data (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection to processing (Art. 21 GDPR)

Just write to us at [email protected].

8. Right to lodge a complaint

You also have the right to complain to a data protection supervisory authority. The authority responsible for us is the Saxon commissioner for data protection and transparency (Sächsische Datenschutz- und Transparenzbeauftragte), Devrientstraße 5, 01067 Dresden, Germany.

Last updated: September 2026