Condomana
Sign in Try free
This English translation is provided for your convenience only. The German version is legally authoritative.

Privacy Policy

Last updated: 19 October 2026

Protecting your personal data matters to us. Below we explain which personal data we process when providing and operating our application “Condomana” (the “Service”), for which purposes and on which legal basis we do so, and which rights you have. Personal data is any information relating to an identified or identifiable natural person (Art. 4 No. 1 DSGVO — the EU General Data Protection Regulation, GDPR).

1. Controller

The controller within the meaning of Art. 4 No. 7 DSGVO (General Data Protection Regulation, GDPR) is:

nelo digitalagentur GmbH & Co KG
Magirus-Deutz-Straße 14
89077 Ulm
Germany
Telephone: +49 151 64403159
E-mail: info@condomana.com

2. Data Protection Officer

We are not required by law to appoint a data protection officer and have not appointed one. For any questions concerning data protection and the exercise of your rights, please use the contact details given in section 1.

3. Processing when visiting the website (server log files)

When you use our website purely for information — that is, if you do not register or otherwise submit information to us — we collect only the personal data that your browser transmits to our server and that is technically necessary to display the website to you and to ensure its stability and security:

  • IP address
  • date and time of the request
  • the page or file requested
  • access status/HTTP status code and the volume of data transferred
  • the website previously visited (referrer)
  • the browser, operating system and language setting used

The legal basis is Art. 6(1)(f) DSGVO. Our legitimate interest lies in the technically flawless presentation and the security of our Service. This data is not merged with other data sources and is deleted after three months at the latest.

Our own audience measurement

To learn how visitors find our website and which of our ads and posts draw interest, we count page views on the public pages ourselves, on our own server and without any third party. For each view we store only: the page (without any address suffixes), language, date and time, the campaign tag from the link (utm parameters), the name of the referring website, the device class (phone, tablet or computer), and a value computed from the IP address and browser identifier with a key that changes daily. The IP address and browser identifier themselves are not stored for this; the value only lets us group views from the same day and cannot be linked to a person. No cookies are set for this, and no information is stored on or read from your device. On our forms (rollout plan, offer, registration) we also count whether they were started and submitted; on the pages our ads link to, also which sections of the page were shown and whether it stayed open for 15 seconds. We keep the campaign tag you arrived with for the duration of the session and store it with a plan request or a registration, so we can see which ad led to it. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is improving our service and our advertising. The data is deleted after 400 days at the latest.

4. Cookies and local storage

We use cookies and comparable local storage techniques (e.g. Local Storage) to provide the Service. Cookies are small text files stored on your device.

  • Strictly necessary cookies: These are essential for operating the Service, in particular the session cookie that keeps you signed in, a cookie protecting against cross-site request forgery (CSRF), and the storage of your language and display settings. The legal basis for storing them is § 25(2) No. 2 TDDDG (the German Telecommunications Digital Services Data Protection Act, TDDDG); the subsequent processing is based on Art. 6(1)(f) DSGVO (legitimate interest in a functional, secure Service) or Art. 6(1)(b) DSGVO in the course of performing the contract.
  • Optional cookies/services: Cookies that are not strictly necessary (e.g. for analytics or reach measurement) are only set with your consent pursuant to § 25(1) TDDDG and Art. 6(1)(a) DSGVO. You can withdraw your consent at any time with effect for the future in the settings of the Service.

You can configure your browser to reject or delete cookies. In that case some functions of the Service may not be available to you.

5. Registration and user account

A user account is required in order to use the Service. During registration and ongoing operation we process in particular your name, your e-mail address, your password (stored in encrypted form), the language you have chosen, and the organisation and role assigned to your account. The legal basis is Art. 6(1)(b) DSGVO (performance of the usage contract). We store this data for the duration of the contractual relationship.

As part of the Service we send system- and contract-related notifications by e-mail (e.g. access credentials, invoices, notices about documents, defects or announcements). You can control the type and frequency of these notifications in the settings of the Service; messages required by law or by contract are excluded from this. The legal basis is Art. 6(1)(b) DSGVO.

E-mails during the free trial

Whoever registers an organisation for the free trial receives a limited series of e-mails from us that help with getting started in the Service and point out the end of the trial. The only recipient is the person who registered the organisation; colleagues invited later do not receive these e-mails. We send the first e-mail (welcome) as soon as you have confirmed your e-mail address. Up to eleven further e-mails follow, at most one per day and as a rule at least two days apart: notes on individual setup steps and on the costs during the first 18 days after registration, as well as notes five days and one day before the end of the trial, one day after it and 23 days after it. The last e-mail announces that a trial that is not continued is deleted with all its data 30 days after the end of the trial. As soon as you take out a paid subscription, the series ends.

Which of these e-mails you receive depends on the state of your account. To decide this, we evaluate which setup steps have already been completed (e.g. whether properties, units, owners or documents have been created), how many properties and units have been created, when anything was last done in the account and whether a subscription has been taken out. A note on a setup step is only sent as long as that step is still open; an offer of help only if nothing has happened in the account for at least seven days. In the e-mails about the costs we state a price calculated from the number of your units. We also use your name, your e-mail address, your language and the name of the organisation. For each e-mail we store which e-mail it was, to whom and in which language it was sent, on which day it was due, when it was sent and whether sending failed.

To find out whether these e-mails are helpful, we measure whether they are opened and whether their links are clicked. This takes place on our own server and without third-party providers: each e-mail contains an invisible 1 × 1 pixel image that is loaded from our server when the e-mail is displayed, and its links first lead via our server, which then forwards you to the destination in the Service. Both carry a random identifier of the respective e-mail. For each e-mail we store only the time of the first opening, the number of openings, the time of the first click, the number of clicks and which link was clicked last (only as an internal short name of the link, not as an address). We do not store the IP address or browser identifier for this purpose; the retrieval itself is subject to section 3 (server log files). Many e-mail programs load images automatically, so a counted opening does not reliably mean that you have read the e-mail. If your e-mail program does not load images, no opening is recorded. The evaluation is accessible only to Condomana staff in our internal administration.

The legal basis is Art. 6(1)(f) DSGVO. Our legitimate interest lies in making it easier for you to get started with the Service, informing you in good time about the end of the trial and the deletion of your data, offering you continuation as a paid subscription and recognising which of these e-mails are useful.

We store the information on the e-mails sent, including openings and clicks, for as long as the organisation exists. For a trial that is not continued, it is deleted together with the organisation 30 days after the end of the trial. If your user account is deleted, the link between this information and your user account is removed.

You can object to these e-mails at any time and without giving reasons (Art. 21(2) and (3) DSGVO): via the “Stop these emails” link at the end of every e-mail, via the unsubscribe function of your e-mail program, or by message to the contact details given in section 1. After that you will receive no further e-mails of this series, neither notes on setup nor notes on costs and the end of the trial. We store the time of your objection with your user account so that we can observe it and demonstrate that we have done so. System- and contract-related notifications (see above) are not affected.

6. Payment processing and invoicing

For paid subscriptions we issue invoices and process the contract and invoice data required for this purpose (name, address, e-mail address, VAT identification number, invoicing and payment history). The legal basis is Art. 6(1)(b) DSGVO (performance of the contract) and Art. 6(1)(c) DSGVO in conjunction with the retention obligations under commercial and tax law (§ 257 HGB — German Commercial Code; § 147 AO — German Fiscal Code).

Payment is made exclusively by bank transfer to the account shown on the invoice. We use no payment service provider and no card processor, and we never collect card details at any point. We process only the transfer data received via our bank in order to allocate the incoming payment (Art. 6(1)(b) DSGVO).

7. Processing of data in the course of administration activities

Condomana is an application for managing properties, residential units, owners and residents. Insofar as you, as a customer (property manager or similar), record and process third parties' personal data within the Service (e.g. of owners, tenants or advisory board members), we process this data exclusively on your behalf and in accordance with your instructions.

For this processing you are the controller under data protection law; we act for you as a processor within the meaning of Art. 28 DSGVO. We conclude a separate data processing agreement (DPA) with you setting out the details. Data subjects should contact the respective responsible administration to exercise their rights.

Photos that managers capture against a defect using the service's mobile view are re-encoded on the device itself. All embedded camera metadata — in particular GPS location data and device/serial numbers — is removed before the image is transmitted to us. This data therefore never reaches our systems.

8. Hosting and processors

We operate our Service with a service provider that provides the infrastructure (servers, storage, database) for us. The provider processes the data exclusively to provide the hosting service and in accordance with our instructions, on the basis of a data processing agreement pursuant to Art. 28 DSGVO. The legal basis is Art. 6(1)(f) DSGVO (legitimate interest in secure and efficient operation).

The provider of the hosting infrastructure is:

Hetzner Online GmbH
Industriestr. 25
91710 Gunzenhausen
Germany

The servers are located in data centres within the European Union. We have concluded a data processing agreement pursuant to Art. 28 DSGVO with the provider. Our system e-mails are also sent via this provider's infrastructure.

If the responsible property management has switched on the service's optional AI features, we use a further processor for the processing of text (e.g. defect reports, documents, questions asked in the owner portal):

Langdock GmbH
Germany

Processing takes place exclusively on servers within the European Union under a data processing agreement pursuant to Art. 28 GDPR. The content is not used to train AI models. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in efficient handling); whether the features are enabled is decided solely by the respective property management.

9. Contacting us

If you contact us by e-mail or via a contact form, we process the data you provide (e.g. e-mail address, name, content of the message) in order to answer your enquiry. The legal basis is Art. 6(1)(b) DSGVO where the enquiry serves the initiation or performance of a contract, and otherwise Art. 6(1)(f) DSGVO (legitimate interest in answering enquiries). We delete this data as soon as storage is no longer necessary, unless statutory retention obligations prevent this.

10. Product news by e-mail

Where you have expressly consented, we inform you by e-mail about product news and updates to our Service. The legal basis is your consent pursuant to Art. 6(1)(a) DSGVO in conjunction with § 7(2) No. 2 UWG (the German Act Against Unfair Competition, UWG). To document your consent, we log the time it was given as well as the IP address and browser identifier used (Art. 7(1) DSGVO). You can withdraw your consent at any time with effect for the future — directly in the settings of the Service under “Consents” or by message to the contact details given in section 1. The lawfulness of processing carried out until the withdrawal remains unaffected.

11. Our social media profiles

We maintain publicly accessible profiles on social networks in order to provide information about the Service, product news and our company, and to get in touch with prospective customers. These are:

  • X (formerly Twitter): x.com/condomana — for users in the European Economic Area the provider is Twitter International Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland. Privacy information: x.com/en/privacy.
  • Instagram: instagram.com/condomana_com — for users in the European Economic Area the provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Privacy information: privacycenter.instagram.com/policy.

No social media plugins are embedded on our website. We use neither the networks' like, share or follow buttons nor their tracking pixels or advertising and conversion tracking (such as the Meta pixel). Visiting condomana.com therefore transmits no data to X or Meta, and no cookies of those providers are set for that purpose. References to our profiles, where they exist, are plain hyperlinks: data is transmitted to the respective network only once you click such a link and open the network's page.

The entity named in section 1 is responsible for operating our profiles. In the profiles themselves we link to our imprint and to this privacy policy.

Visiting these profiles is not necessary in order to use the Service. When you open a profile, interact with a post (e.g. like, comment, share, follow) or send us a direct message, the respective provider processes your personal data — in particular usage data, IP address, device and browser information as well as cookies and comparable identifiers — also for its own purposes, for example to measure reach, to build usage profiles and to display personalised advertising. This processing is outside our sphere of influence; we have no access to the underlying raw data. It may also affect people who are not logged in to, or not registered with, the respective network. For details please refer to the providers' privacy information linked above.

From the providers we receive aggregated statistical analyses of how our profiles are used (e.g. number of views, reach and interactions, as well as coarse information about the country, language and age groups of the people reached). We cannot attribute these analyses to any individual person and we cannot switch off their collection. Insofar as we are joint controllers with the provider within the meaning of Art. 26 DSGVO with regard to the collection and transfer of this statistical data — which is the case for Instagram — we have concluded a corresponding arrangement with the provider. Meta makes it available at facebook.com/legal/terms/page_controller_addendum and assumes primary responsibility therein for informing data subjects and for fulfilling their rights in respect of that data.

The legal basis for operating our profiles and for processing the statistical data made available to us is Art. 6(1)(f) DSGVO. Our legitimate interest lies in public relations, in presenting our company and in designing our content to meet demand. Insofar as the respective provider asks you for consent (e.g. for cookies or advertising tracking), the legal basis is Art. 6(1)(a) DSGVO; in that case you give and withdraw your consent vis-à-vis the provider. We process comments and direct messages you address to us in order to answer your request (Art. 6(1)(f) DSGVO, and Art. 6(1)(b) DSGVO for contract-related enquiries); section 9 applies accordingly.

Both providers may also transfer personal data to the USA and to further third countries and process it there. According to the providers, they base these transfers on their certification under the EU-US Data Privacy Framework (Art. 45 DSGVO) or on EU standard contractual clauses (Art. 46 DSGVO). A level of protection corresponding in every respect to European standards cannot be guaranteed in doing so; in particular, access by state authorities in the third country cannot be ruled out.

Publishing our posts through a service provider

We use a publishing tool to plan, schedule and publish our posts. The provider is Buffer, Inc., 2443 Fillmore Street #380-7163, San Francisco, CA 94115, USA. It processes the content of our posts and the associated image and video files; through an authorisation we have granted, the provider also accesses our profiles and thereby receives the interaction and reach data the networks make available for them — including the public comments on our posts. No personal data from the Condomana service — that is, data concerning managers, owners or tenants — is transferred to this provider.

The legal basis is Art. 6(1)(f) DSGVO; our legitimate interest lies in efficient and consistent public relations work. We have concluded a data processing agreement with the provider pursuant to Art. 28 DSGVO. Processing also takes place in the USA; according to the provider, it bases these transfers on its certification under the EU-US Data Privacy Framework (Art. 45 DSGVO) or on EU standard contractual clauses (Art. 46 DSGVO). The provider's privacy notice: buffer.com/privacy.

You may assert your rights as a data subject (section 15) both against us and against the respective provider. Since the providers have direct access to the data and we do not hold it in full, please address requests for access and erasure primarily to them directly; we will support you as far as we can. If you wish to avoid processing by the networks, please access our content via our website rather than via the profiles.

12. Data transfers to third countries

As a rule, your personal data is not transferred to countries outside the European Union or the European Economic Area. The one exception is the social media profiles described in section 11. Should a further transfer become necessary in an individual case, it will take place only in compliance with the requirements of Art. 44 et seq. DSGVO, in particular on the basis of an adequacy decision or appropriate safeguards (e.g. EU standard contractual clauses).

13. Retention period

We store personal data only for as long as is necessary for the respective purposes or as required by statutory retention periods (e.g. commercial and tax law obligations of up to ten years under § 257 HGB, § 147 AO). Thereafter the data is deleted or, where a retention obligation exists, restricted in processing (blocked).

14. Data security

We take appropriate technical and organisational measures to protect your data against loss, destruction, manipulation and unauthorised access. Transmission is encrypted via a TLS connection (HTTPS). Passwords are stored exclusively as a cryptographic hash. Our measures are continuously improved in line with technological developments.

15. Your rights as a data subject

Under the DSGVO you have the following rights vis-à-vis us regarding the personal data concerning you:

  • the right of access (Art. 15 DSGVO),
  • the right to rectification (Art. 16 DSGVO),
  • the right to erasure (Art. 17 DSGVO),
  • the right to restriction of processing (Art. 18 DSGVO),
  • the right to data portability (Art. 20 DSGVO),
  • the right to object to processing (Art. 21 DSGVO).

Where processing is based on your consent (Art. 6(1)(a) DSGVO), you have the right to withdraw it at any time with effect for the future. The lawfulness of processing carried out until the withdrawal remains unaffected.

Right to object

Where your personal data is processed on the basis of legitimate interests pursuant to Art. 6(1)(f) DSGVO, you have the right, pursuant to Art. 21 DSGVO, to object to the processing on grounds relating to your particular situation.

Right to lodge a complaint with a supervisory authority

Without prejudice to any other legal remedy, you have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your data infringes the DSGVO. The supervisory authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Lautenschlagerstraße 20, 70173 Stuttgart
www.baden-wuerttemberg.datenschutz.de

16. Changes to this Privacy Policy

We amend this Privacy Policy whenever changes to the data processing we carry out make this necessary or the legal situation changes. The current version published on this page applies in each case.