Privacy Policy

Last updated: July 2026

1. Controller

WOLOHO GmbH, Managing Director: Reza Memari, Rueckerstr. 5, 10119 Berlin. Email: hello@woloho.com, phone: +49 176 11144789.

We are not required to appoint a Data Protection Officer under Art. 37(4) GDPR in conjunction with Section 38(1) BDSG (German Federal Data Protection Act).

2. Collection and processing of personal data

a) Visiting the website

When you access www.woloho.com, your browser automatically collects the following data and transmits it to our server: IP address, date and time of access, requested URL, referrer URL, browser type, operating system and access provider. This data is temporarily stored in server log files and serves to ensure a smooth connection, convenient use, system security and administrative purposes. The legal basis is Art. 6(1)(f) GDPR. We do not use this data to draw conclusions about you.

b) Letters (Workletter, Loveletter, Homeletter, special promotions)

If you have given your consent under Art. 6(1)(a) GDPR, we use your email address to send our Letters (newsletters). In addition to the Workletter, Loveletter and Homeletter, you can also take out an optional subscription for special promotions, discounts and news, which are sent at irregular intervals. To sign up, all you need is your email address and your choice of Letters. Sign-up uses the double opt-in procedure. When you sign up, your IP address, timestamp and user agent are stored in a local GDPR log so that we can demonstrate your consent. This log entry is automatically anonymized after 3 years and stored beyond that point solely to defend against claims under competition and data protection law.

Sending via Mailjet:

Letters are sent via Mailjet (Mailjet SAS, 13-13bis rue de l’Aubrac, 75012 Paris, France, part of the Sinch group). Mailjet stores email addresses and other data and uses them to send and analyze the Letters on our behalf. The emails we send contain a tracking pixel and links that let us measure open and click rates. We have concluded a data processing agreement with Mailjet in accordance with Art. 28 GDPR. If you do not want this analysis, you need to unsubscribe from the Letters. You can do this at any time via the “Unsubscribe from all Letters” link at the end of every Letter or by email to hello@woloho.com. When you unsubscribe, your contact is completely deleted at Mailjet. More information: mailjet.com/de/rechtliches/sicherheit-datenschutz/

c) Creating a listing

On our website, you can create listings in the various Letters. Your name and a valid email address are required. Depending on the Letter and category, further details may be necessary (e.g. location details for events, apartment details). You can optionally provide a logo, phone number and website, which are then published. In Workspace and Homeletter listings, you can also upload up to 3 photos, which are published in the online Letter. Photos may only show the space and must not contain any people or personal data of third parties.

For paid listings, a billing address and the contact details of a contact person are also required. This data is not published and is used solely for confirmation emails and internal queries.

The legal basis for free listings is Art. 6(1)(a) GDPR (consent), and for paid listings Art. 6(1)(b) GDPR (performance of a contract).

Listings are not automatically deleted once the booked runtime ends. You can delete individual listings at any time in your customer account or request their deletion by email to hello@woloho.com. What happens to your data when your account is deleted is explained under 2d.

d) Customer account for people placing listings

For paid listings, we offer a customer account on our website. It stores company data, credit and current and past listings. The legal basis is Art. 6(1)(b) GDPR (performance of a contract).

When your account is deleted, all personal data is anonymized: listings older than 3 months are anonymized immediately, while more recent listings are anonymized afterwards through a daily automated process. The anonymized listings generally remain archived. Orders are retained due to statutory retention obligations, but personal invoice data is cleared. Credit is set to 0, the Letter contact at Mailjet is completely deleted, and all account metadata is removed.

e) Contact by email

If you contact us by email, we process the data you provide in order to handle your request. The legal basis is Art. 6(1)(f) GDPR (legitimate interest) or Art. 6(1)(b) GDPR in the case of pre-contractual measures. The data is deleted once your request has been dealt with.

3. Hosting

Our website is hosted by WL Artworld Solutions GmbH, Weydingerstraße 6, 10178 Berlin. The host processes the data collected when you visit the website (see 2a) on our behalf and handles maintenance and backups. The legal basis is Art. 6(1)(f) GDPR. We have concluded a data processing agreement in accordance with Art. 28 GDPR.

4. Cookies

Our website uses only technically necessary cookies. No cookie banner or consent is required for this. The legal basis is Section 25(2) TDDDG in conjunction with Art. 6(1)(f) GDPR.

The following cookies are set:

• Session cookie (PHPSESSID): session management, deleted at the end of the session
• WooCommerce session cookie: shopping cart and checkout functionality
• WPML language cookie: stores your language preference

No analytics, marketing or third-party cookies are used. The cookies are stored only for as long as the respective function requires.

5. Web analytics with Matomo

We use the open source software Matomo for statistical analysis of website usage. Matomo runs on our own server (self-hosting), so all data stays with us and is not transmitted to third parties. No user profiles are created and no data is merged with other data.

Matomo works without cookies and with full IP anonymization. Since your device is not accessed, no consent under Section 25(1) TDDDG is required. The legal basis for processing is Art. 6(1)(f) GDPR (legitimate interest in analyzing website usage to improve our offering).

Opt-out complete; your visits to this website will not be recorded by the Web Analytics tool. Note that if you clear your cookies, delete the opt-out cookie, or if you change computers or Web browsers, you will need to perform the opt-out procedure again.

You may choose to prevent this website from aggregating and analyzing the actions you take here. Doing so will protect your privacy, but will also prevent the owner from learning from your actions and creating a better experience for you and other users.

You are not opted out. Uncheck this box to opt-out. You are currently opted out. Check this box to opt-in.

The tracking opt-out feature requires cookies to be enabled.

6. Payments

a) WooCommerce

We use the open source plugin WooCommerce to process orders. All order and customer data is processed exclusively on our own server. No order or payment data is transmitted to Automattic or any other third party.

b) Stripe

For payments by credit card, Apple Pay and Google Pay, we use Stripe (Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland). If you select this payment method, your name, address, email address, IP address and payment data are transmitted automatically to Stripe. This transmission serves the purposes of identity verification, payment administration and fraud prevention. Stripe may pass on data to affiliated companies and subcontractors insofar as this is necessary to perform the contract. Stripe is part of a US group, so processing in the USA cannot be entirely ruled out. The transmission takes place on the basis of the EU-US Data Privacy Framework, under which Stripe is certified, supplemented by the EU Standard Contractual Clauses as a fallback. Privacy terms: stripe.com/de/privacy

c) PayPal

For PayPal payments, we use the service of PayPal (Europe) S.à.r.l. & Cie. S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg, Luxembourg. If you select PayPal, your name, address, email address, IP address and payment data are transmitted to PayPal. PayPal may transmit this data to credit agencies for identity and creditworthiness checks. PayPal is part of a US group, so a transfer to the USA cannot be entirely ruled out. It takes place on the basis of Binding Corporate Rules and the EU Standard Contractual Clauses or other appropriate safeguards under Art. 46 GDPR. Privacy terms: paypal.com/de/webapps/mpp/ua/privacy-full

With both Stripe and PayPal, you can withdraw your consent to the handling of personal data at any time by contacting the respective provider. A withdrawal does not affect data that must necessarily be processed to carry out the payment as agreed.

d) Invoicing (FastBill)

We create invoices via FastBill (FastBill GmbH, Wildunger Str. 6, 60487 Frankfurt am Main). For this purpose, we transmit invoice data and have concluded a data processing agreement with FastBill. Privacy policy: fastbill.com/datenschutz

7. External accounting

To fulfill our statutory commercial and tax obligations, we transmit the necessary invoice and accounting data (in particular name, address, invoice data and invoice items) to our tax advisors:

Merle Gaydoff + partner Rechtsanwälte und Steuerberater PartG mbB, Charlottenstraße 65, 10117 Berlin

Processing takes place on the basis of Art. 6(1)(c) GDPR (fulfillment of statutory retention and documentation obligations) and Art. 6(1)(f) GDPR (legitimate interest in proper bookkeeping and tax advice).

The tax advisors process the personal data transmitted to them within the scope of their statutory and professional obligations as an independent controller within the meaning of the GDPR.

8. Disclosure of data

Your data is not transmitted to third parties for any purposes other than those stated here. We only pass on your data if you have consented (Art. 6(1)(a) GDPR), if disclosure is necessary to assert, exercise or defend legal claims (Art. 6(1)(f) GDPR), if there is a legal obligation (Art. 6(1)(c) GDPR), or if this is necessary to carry out contractual relationships (Art. 6(1)(b) GDPR).

9. Storage duration and deletion of personal data

We store personal data only for as long as this is necessary for the respective processing purposes or as long as statutory retention obligations exist.

In particular, the following storage periods apply:

• Server log files are generally deleted after 30 days at the latest, unless retaining them for longer is necessary to investigate security incidents.
• Records of newsletter sign-ups (double opt-in log) are stored to demonstrate the consent given and anonymized after three years.
• Listings generally remain archived even after their runtime ends. Personal data is anonymized when the customer account is deleted, in accordance with the rules described in this privacy policy.
• Customer accounts are anonymized following a deletion request. Statutory retention obligations, in particular under commercial and tax law, remain unaffected by this.
• Contract, order and invoice data is stored for the duration of the statutory retention periods, regularly six or ten years under the provisions of commercial and tax law.
• Email requests are deleted once they have been dealt with, provided that no statutory retention obligations or legitimate interests prevent their deletion.

Once the respective storage period has ended, the personal data is deleted or anonymized, unless there is a legal obligation or a legitimate interest in storing it further.

10. Your rights

Under the GDPR, you have the following rights:

• Access to your stored data (Art. 15)
• Rectification of inaccurate data (Art. 16)
• Erasure of your data (Art. 17)
• Restriction of processing (Art. 18)
• Data portability (Art. 20)
• Withdrawal of consent given, with effect for the future (Art. 7(3))

11. Right to object

If your data is processed on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object under Art. 21 GDPR. If the objection is directed against direct marketing, we will act on it without you having to give any reason. An email to hello@woloho.com is enough.

12. Data security

We use TLS encryption to transmit data on our website and apply appropriate technical and organizational measures to protect your data against loss, destruction or unauthorized access. We continuously improve our security measures.

13. Validity of this privacy policy

This privacy policy is dated July 2026. As our website develops or legal requirements change, adjustments may become necessary. You can find the current version on our website at any time.