Privacy policy

The controller responsible for data processing on this website and platform is:

Shaffans Studios, owner: Shaffans Studios, Köln, Deutschland. Email: info@sitelager.com.

No data protection officer has been appointed, as the statutory conditions for one are not met. Please direct privacy enquiries to the email address above.

SiteLager is two things: a public marketplace where you search for and book storage from independent operators, and software (SaaS) with which those operators manage their sites, contracts and invoices.

• For running the website, your user account, search, the booking form, saved searches, the waitlist, the contact form, content reports, reviews and communication with you, we are the controller within the meaning of Art. 4(7) GDPR.
• The rental contract for the storage space is concluded between you and the respective operator. For the data the operator processes to perform that contract (rental contract, invoices, payments, identity check, access), the operator is the controller. We process that data on its behalf as a processor under Art. 28 GDPR on the basis of our data processing agreement.

Which operator is your contract partner is shown in the listing, in the booking confirmation and in your tenant portal.

• Account data: name, email address, password (stored only as a hash), language, role within an organisation, login times and security events (e.g. failed logins).
• Booking and contract data: chosen site and storage unit, move-in date, term, options such as insurance or accessories, prices, invoices, reminders, contract documents and electronic signatures.
• Payment data: payment method, payment status, mandate reference and creditor identifier for SEPA direct debit and – where the operator collects a direct debit mandate – account holder and IBAN. We store the IBAN with field-level encryption (AES-256-GCM); only its last digits are displayed. Card or bank details for online payments are entered directly with our payment provider; they never reach our servers.
• Identity documents: the operator decides for each site whether an identity check is required. If it is, you show the operator your ID before move-in or send them a copy; the operator checks it and can store a copy of your ID in SiteLager. It is transmitted encrypted (TLS) and kept in a non-public document store in the Frankfurt am Main data centre. It can only be retrieved through short-lived signed links, and only by the operator and – for maintenance – by us; every retrieval is logged.
• Access data: door codes and similar access details for your storage unit; they are stored with field-level encryption (AES-256-GCM).
• Communication: messages, support requests, problem reports, reviews and the emails we send you (booking confirmation, invoices, reminders) including delivery status.
• Saved searches, contact requests and reports: email address, search criteria and the confirmation of the saved search; name, email address and message of a contact request; for a report of content (Art. 16 DSA) the content reported, your explanation and your contact details.
• Waitlist: email address, optionally your name and phone number, the site and size you sign up for, when you signed up, and whether and when we notified you. The operator of the site sees your entry in its management tools. Every waitlist email contains a link with which you can delete your entry yourself at any time.
• Technical data: IP address, browser type, time of access, page requested and error messages in server logs.
• Marketplace usage: which listings are viewed, saved or booked – without IP address and without browser identifier (see section 8).

• Performance of a contract and pre-contractual steps, Art. 6 (1) (b) GDPR: providing your account, search and booking, reservations, the waitlist (a notice once a matching unit becomes free), handling rental contracts and payments, the tenant portal, customer service, answering contact requests.
• Legal obligations, Art. 6 (1) (c) GDPR: retention of invoices and booking records under § 147 AO and § 257 HGB, tax obligations, handling notices of illegal content (Art. 16 DSA), requests from authorities.
• Legitimate interests, Art. 6 (1) (f) GDPR: security and stability of the platform (logs, abuse and fraud prevention, rate limiting), proof of consent, statistical analysis of marketplace usage without personal reference, enforcement of legal claims. Our interest is to run a secure and economically viable service; we protect your interests by collecting little, deleting or anonymising early and building no profiles.
• Consent, Art. 6 (1) (a) GDPR: saved searches (only once you confirm the link in our email) and marketing emails and – only after your consent in the cookie banner – audience measurement with Google services (§ 25 (1) TDDDG). You may withdraw consent at any time with effect for the future.

We pass on data only where necessary for the purposes stated. Processors are bound by contract under Art. 28 GDPR; the complete list with purpose and location is under sub-processors.

• The operator you book with: receives your booking, contract and contact data as an independent controller. If you join a waitlist, the operator of the site sees your entry (section 3) in its management tools.
• Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands – payment processing, SEPA direct debit mandates, payout to the operator. Mollie processes payment data as an independent controller; see mollie.com/en/privacy.

• Sendinblue SAS (Brevo), Paris, France – sending transactional emails (confirmations, invoices, reminders).
• MapTiler AG, Höfnerstrasse 98, 6314 Unterägeri, Switzerland – map tiles for the site map and turning site addresses into coordinates. When a map loads, your IP address is transmitted to MapTiler. Switzerland is covered by an adequacy decision of the EU Commission.
• DigitalOcean, LLC, New York, USA – hosting of the servers, databases and document storage. The data is stored and processed in the Frankfurt am Main data centre (region FRA1, Germany). DigitalOcean acts as a processor; on transfers to the USA see section 6.
• Functional Software, Inc. (Sentry), processing in the EU – error logging, where enabled. What is sent is the kind and place of a program error and the address requested; request contents, cookies, headers, user data and IP addresses are not sent.
• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland – Google Tag Manager and Google Analytics 4, only after your consent (see section 7).

Authorities, courts or legal advisers receive data only where we are legally obliged or where necessary to enforce our rights.

Our systems run in the European Union; servers and storage are located in the Frankfurt am Main data centre (Germany). Our hosting provider DigitalOcean, LLC is based in the United States. Access from there, for example for maintenance and support, cannot be ruled out; such a transfer is based on the EU-US Data Privacy Framework (adequacy decision of the EU Commission, Art. 45 GDPR) where the recipient is certified under it, and in addition on the EU Commission's standard contractual clauses (Art. 46(2)(c) GDPR). The same applies to access from the United States by Functional Software, Inc. (Sentry) to error logs processed in the EU. Map tiles are fetched from Switzerland, which is covered by an adequacy decision of the EU Commission. Beyond that, a transfer to the United States takes place only if you have consented to audience measurement with Google; Google LLC is certified under the EU-US Data Privacy Framework and the EU Commission's standard contractual clauses apply in addition.

We set strictly necessary cookies and entries in your browser's storage on the basis of § 25 (2) no. 2 TDDDG; they serve only to provide the service you use and cannot be opted out of:

• sl_locale – your chosen language. Lifetime 12 months.
• sl_access, sl_refresh – login session for operator accounts. HttpOnly; they are deleted when you close the browser, and the login itself expires after 15 minutes and 7 days respectively.
• sl_tenant_access, sl_tenant_refresh – login session for the tenant portal, likewise.
• sl_platform_admin, sl_platform_challenge – sign-in and its confirmation step for internal administration; for SiteLager staff only. HttpOnly, session and 10 minutes respectively.
• sl_impersonating, sl_impersonating_org – mark a support session that a SiteLager employee holds in an operator's dashboard at the operator's request. Session.
• sl_consent – stores your cookie banner decision (only yes/no for audience measurement and the time). Lifetime 12 months.
• sitelager.sidebar.open (local storage) – whether the dashboard sidebar is expanded or collapsed.
• sitelager.onboarding.dismissed (local storage) – whether an operator has hidden the setup checklist.
• sl-book-hold, sl-booking-done (session storage) – the reservation in progress in the booking form, so that reloading the page does not lose the booking; deleted when you close the tab.

Optional cookies are set only after your consent via the cookie banner (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG):

• Google Tag Manager and Google Analytics 4 (_ga, _ga_*) – audience measurement. Lifetime up to 14 months. We use Google Consent Mode v2: before your decision every storage purpose is set to "denied", advertising purposes remain denied permanently, and IP addresses are truncated.

You can change your decision at any time via "Cookie settings" in the footer. If you allow only necessary cookies, no Google services are loaded.

To learn which listings are found and booked, we count events such as "listing viewed" or "booking started" on our own servers. We store neither your IP address nor your browser identifier nor a cookie; the count cannot be traced back to you. The legal basis is Art. 6 (1) (f) GDPR. As no personal data is stored, no consent is required.

Fonts are served from our own servers; no fonts or scripts are loaded from third-party content delivery networks. Map tiles are fetched from MapTiler only when a page shows a map. Google scripts are loaded only after your consent.

We keep personal data only as long as it is needed for its purpose or a statutory retention obligation applies. The periods for bookings without a contract, identity documents, user accounts, proof of consent, online notices and withdrawals, reports of content, saved searches and waitlist entries are applied by a daily automatic run:

• Invoices, booking records and payment data: 10 years after the end of the calendar year of issue (§ 147 AO, § 257 HGB).
• Rental contracts and contract documents (the operator is the controller, see section 2): the contract (including its signed version), handover records, notices of termination, withdrawals and their acknowledgements of receipt, notices of price changes, and deposit statements and notices of a deposit deduction are accounting records and business letters; they are kept for 10 years from when they are stored and locked against deletion during that time (§ 147 AO, § 257 HGB). Other contract data and the communication about the contract are kept until the operator has your details erased after the contract has ended; the documents named and the invoices then remain locked until their retention period expires.
• Bookings that did not lead to a contract (expired or cancelled reservations): your details for that booking are anonymised 6 months later, provided there is no invoice or other matter with the operator for it. Your user account, your saved searches and your waitlist entries (periods below), and your other bookings and contracts are not affected.
• Identity documents: the file and its reference are deleted 3 years after the end of your last rental contract, earlier if the operator deletes them. The result of the check is kept without the ID copy.
• User account: until you have it deleted or there has been no login for 3 years and no contract is running any more; personal details are then anonymised unless a retention obligation prevents this.
• Server and access logs: 90 days.
• Proof of consent: 3 years after withdrawal, then deleted.
• Notices of termination and withdrawals through our online functions that could not be matched to a contract, and closed reports of content: 3 years after receipt.
• Saved searches: unconfirmed ones when the confirmation link expires, confirmed ones until you unsubscribe. After that we keep the unsubscribed search, with the times of confirmation and unsubscription, for 3 years as proof of your consent and then delete it.
• Waitlist entries: deleted 12 months after you signed up, whether or not you were notified; at once if you remove yourself with the link in one of our waitlist emails.
• Data of an operator organisation after the SiteLager contract has been terminated: 30 days for export, then deleted unless a retention obligation applies.
• Cookie decision (sl_consent): 12 months.

Data subject to a statutory retention obligation is blocked until that period expires and then deleted. Deleted data disappears from backups once these are overwritten in rotation.

You have the following rights towards the controller:

• access to your stored data (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• objection to processing based on legitimate interests (Art. 21 GDPR),
• withdrawal of consent with effect for the future (Art. 7 (3) GDPR).

Please contact info@sitelager.com. If your request concerns the rental contract with an operator, we forward it to the operator and assist with the response.

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement. The authority competent for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany. The Federal Commissioner for Data Protection lists all German authorities at bfdi.bund.de.

We make no decisions based solely on automated processing that produce legal effects concerning you (Art. 22 GDPR). Availability and prices are calculated according to the operator's fixed rules, which are the same for everyone; no profiling takes place.

For a booking we need your name, your email address and the details of the storage unit you want; without them no contract can be concluded. All other information is voluntary unless the operator requires it for the rental contract (e.g. identity check).

We update this privacy policy when our processing or the legal situation changes. The current version is always available at sitelager.com/legal/privacy; the date of the last change is shown at the top of this page.