anyrooms

Privacy policy

This translation is provided for information purposes only. The German version is legally binding.

1. Data protection at a glance

The protection of your personal data is important to us. We process personal data exclusively in accordance with the General Data Protection Regulation (GDPR, in Germany: DSGVO), the German Federal Data Protection Act (BDSG) and other applicable provisions. In this privacy policy, we inform you about which personal data we process when you visit our website and use our enquiry form, for what purposes and on what legal basis this happens, and which rights you have.

Personal data is any data that can be used to identify you personally (e.g. name, address, telephone number, email address, IP address).

2. Controller

The controller responsible for data processing on this website is:

Anyrooms UG (haftungsbeschränkt) Brückenstraße 19 59065 Hamm Germany

Represented by the managing director: Eldin Hasinovic

Phone: +4915112334985 Email: info@anyrooms.eu

3. Legal bases of processing

Where we obtain your consent for processing operations, Art. 6(1)(a) GDPR serves as the legal basis. If processing is necessary for the performance of a contract or in order to take steps prior to entering into a contract, processing is based on Art. 6(1)(b) GDPR. We process data to comply with a legal obligation on the basis of Art. 6(1)(c) GDPR. In all other cases, processing is based on our legitimate interest pursuant to Art. 6(1)(f) GDPR, provided your interests do not override it.

4. Your rights as a data subject

You have the following rights vis-à-vis us with regard to the personal data concerning you:

  • Right of access (Art. 15 GDPR) – to the data stored about you and its processing
  • Right to rectification (Art. 16 GDPR) – of inaccurate or incomplete data
  • Right to erasure (Art. 17 GDPR) – of your data stored by us, insofar as no statutory retention obligations stand in the way
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR) – receipt of your data in a structured, commonly used, machine-readable format
  • Right to object to processing (Art. 21 GDPR – see the separate notice below)
  • Right to withdraw consent given (Art. 7(3) GDPR) with effect for the future

To exercise these rights, an informal message to the contact details stated above under "Controller" is sufficient.

Right to object (Art. 21 GDPR)

Where the processing of your data is based on Art. 6(1)(f) GDPR, you have the right to object to this processing at any time on grounds relating to your particular situation. Where your data is processed for direct marketing purposes, you have the right to object to the processing at any time; after your objection, the data will no longer be used for marketing purposes.

Right to lodge a complaint with a supervisory authority

Without prejudice to any other remedies, you have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW) Kavalleriestraße 2–4 40213 Düsseldorf Website: https://www.ldi.nrw.de

You may also contact the supervisory authority of your habitual place of residence.

5. Storage period

Unless a more specific storage period is stated in this privacy policy, your personal data remains with us until the purpose of the data processing no longer applies. If you submit an erasure request or withdraw consent, your data will be erased unless we have other legally permissible grounds for storage (e.g. retention periods under tax or commercial law); in the latter case, erasure takes place once those grounds no longer apply.

6. Recipients and processing on our behalf

To provide this website and to handle your enquiries, we use carefully selected service providers who process personal data on our behalf and according to our instructions (processors). Where required, we have concluded data processing agreements pursuant to Art. 28 GDPR with these service providers. Your data is only passed on to third parties beyond what is described in this policy if you have consented, if it is necessary for the performance of a contract, or if we are legally obliged to do so.

7. Data transfers to third countries (USA)

Some of the services we use are operated by providers based in the USA or process data (also) in the USA (including hosting, analytics and advertising services). Transfers to the USA only take place where they are secured by an appropriate basis:

  • For providers certified under the EU-U.S. Data Privacy Framework (DPF), the transfer is based on the adequacy decision of the EU Commission pursuant to Art. 45 GDPR.
  • For transfers to providers that are not certified (or not certified for the relevant service), we conclude the Standard Contractual Clauses (SCC) provided by the EU Commission pursuant to Art. 46 GDPR and take supplementary protective measures where necessary.

We point out that a level of data protection fully comparable to that in the EU cannot be guaranteed in the USA and that, in particular, access by US authorities cannot be completely ruled out. Transfers to US services relating to cookies/tracking only take place with your consent.

8. SSL/TLS encryption

For security reasons and to protect the transmission of confidential content — such as the data you send us via the enquiry form — this website uses SSL/TLS encryption. You can recognise an encrypted connection by "https://" in your browser's address bar.

9. Hosting and technical provision

We host the content of our website with external service providers. When the website is accessed, technically necessary data (in particular the IP address) is processed. The legal basis is our legitimate interest in the secure and efficient provision of our online offering (Art. 6(1)(f) GDPR); where corresponding consent has been requested, processing takes place exclusively on the basis of Art. 6(1)(a) GDPR.

Vercel

The provider is Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Vercel provides the server and content delivery infrastructure (CDN) through which this website is delivered. In the process, access data (see "Server log files") is processed to ensure the delivery, security and performance of the site. Data may be transferred to the USA; this is safeguarded by the mechanisms described in the section "Data transfers to third countries (USA)". We have concluded a data processing agreement with Vercel.

Database hosting (Neon)

To store enquiry data (see the section "Enquiry form"), we use the hosted PostgreSQL database service of Neon, LLC (a Databricks Company), 160 Spear Street, 15th Floor, San Francisco, CA 94105, USA. A data processing agreement is in place with the provider. Where processing takes place outside the EU, the safeguards described in the section "Data transfers to third countries (USA)" apply.

Object storage and media delivery (Cloudflare R2)

Images and media files are provided via the object storage with CDN "Cloudflare R2" of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. When media files are retrieved, your IP address is transmitted to the provider, which is technically necessary to deliver the content to your browser. The legal basis is Art. 6(1)(f) GDPR. Transfers to the USA are safeguarded by the mechanisms described in the section "Data transfers to third countries (USA)".

Server log files

The provider of the website automatically collects and stores information in so-called server log files, which your browser transmits automatically. These are:

  • browser type and browser version
  • operating system used
  • referrer URL
  • host name of the accessing computer
  • time of the server request
  • IP address

This data is not merged with other data sources. It is collected on the basis of Art. 6(1)(f) GDPR; we have a legitimate interest in the technically error-free presentation and security of our website.

10. Cookies and consent management

Our website uses cookies and comparable technologies. Technically necessary cookies that enable the operation of the website (e.g. storing your cookie selection) are set on the basis of Art. 6(1)(f) GDPR and § 25 (2) TDDDG (German Telecommunications Digital Services Data Protection Act) and do not require consent.

All non-essential cookies and technologies — in particular for analytics and marketing purposes — are only set or activated after you have expressly consented via our consent management tool (cookie banner). The legal basis in this respect is § 25 (1) TDDDG in conjunction with Art. 6(1)(a) GDPR. You can withdraw or adjust your consent at any time with effect for the future via the settings of the cookie banner.

We use Google Consent Mode v2: as long as no consent has been given, only limited, cookieless signals without personal identifiers are sent to embedded Google services.

11. Contact by email or telephone

If you contact us by email or telephone, your details are stored by us for the purpose of processing your enquiry and in case of follow-up questions. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to the initiation or performance of a contract, otherwise Art. 6(1)(f) GDPR (processing of enquiries) or Art. 6(1)(a) GDPR where consent has been requested. We do not pass this data on without your consent and delete it as soon as the purpose no longer applies and no retention obligations stand in the way.

12. Enquiry form (placement of accommodation)

The core of our offering is the placement of accommodation (in particular worker and company accommodation). You can send us an accommodation enquiry via our enquiry form. In doing so, we process the data you enter in order to handle your enquiry and to arrange suitable accommodation for you.

Data processed (mandatory fields): location of the desired accommodation, number of people, name, telephone number, email address.

Optional details: company, desired period (from/to).

Automatically collected details: language version (locale) of the page and — where present and consent-based — origin and campaign identifiers (e.g. utm_source, utm_medium, utm_campaign, gclid, fbclid) for attributing the enquiry.

Purposes: processing and answering your enquiry, arranging suitable accommodation, contacting you to clarify your requirements.

Legal basis: the processing of the details you provide takes place in order to take steps prior to entering into a contract and to initiate a contract on the basis of Art. 6(1)(b) GDPR. In all other respects, processing is based on our legitimate interest in the effective handling of placement enquiries (Art. 6(1)(f) GDPR).

Storage and forwarding: your enquiry is stored in our database (see the section "Hosting and technical provision") and additionally transmitted by email to our responsible mailbox for internal processing. The data is deleted as soon as your enquiry has been conclusively processed and no statutory retention obligations stand in the way; if a contractual relationship comes about, the statutory retention periods apply.

13. Passing on your data to partner accommodation providers (placement)

Anyrooms acts as an intermediary. In order to offer you suitable accommodation, it is necessary to pass on the details from your enquiry required for the placement (in particular the desired location, period, number of people and your contact details) to one or more potentially suitable accommodation providers or landlords. This transfer takes place exclusively for the purpose of the placement and the preparation of offers.

The legal basis is Art. 6(1)(b) GDPR (taking steps prior to entering into a contract at your request). The respective accommodation providers are independently responsible for the further processing of the data transmitted to them. We only pass on the data required for the specific placement. If you do not wish your data to be passed on to partners, a placement is not possible; please let us know when making your enquiry.

14. Protection against spam and misuse

To protect our enquiry form against misuse and automated submissions (spam), we use technical protective measures, including rate limiting, a "honeypot" field and a bot protection service.

For this purpose, we use Cloudflare Turnstile of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. To distinguish between human users and bots, technical information (including IP address, device and browser data) is transmitted to Cloudflare. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in preventing misuse and in the security of our offering). Transfers to the USA are safeguarded by the mechanisms described in the section "Data transfers to third countries (USA)".

15. Web analytics and advertising

The following services are only activated after your consent via our consent management tool (Art. 6(1)(a) GDPR in conjunction with § 25 (1) TDDDG). Without consent, no processing by these services takes place. You can withdraw your consent at any time with effect for the future.

Google Tag Manager

We use Google Tag Manager (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The Tag Manager is a tool for managing website tags and does not itself set any analytics cookies. It serves to trigger other services (see below) only after consent has been given.

Google Analytics 4

We use Google Analytics for the analysis and statistical evaluation of website usage (Google Ireland Limited). Usage data (e.g. truncated IP address, pages viewed, time spent, approximate location, device information) is processed in the process. Data may be transmitted to Google LLC in the USA; this is safeguarded by the mechanisms described in the section "Data transfers to third countries (USA)".

Google Ads (conversion tracking and remarketing)

To measure the success of our advertising and to deliver remarketing, we use Google Ads. When the enquiry form is successfully submitted, a conversion signal may be transmitted to Google. Cookies may be set and usage data processed in the process.

Meta Pixel (Facebook/Instagram)

To measure and optimise our advertising within Meta's services, we use the Meta Pixel (Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland). Usage data (including IP address, device and browser information, pages visited, triggered events such as a form submission) may be processed and transmitted to Meta, including to the USA (safeguarded by the mechanisms described in the section "Data transfers to third countries (USA)"). Where used, the "Conversions API" may additionally transmit event data to Meta server-side.

16. Currency and amendment of this privacy policy

This privacy policy is currently valid and was last updated on 15 July 2026. As our website evolves or due to changed legal or regulatory requirements, it may become necessary to amend this privacy policy. The current version can be accessed on this page at any time.

Request a room now
CallWhatsApp