Condomana
Sign in Try free
This English translation is provided for your convenience only. The German version is legally authoritative.

Privacy Policy

Last updated: August 2026

Protecting your personal data matters to us. Below we explain which personal data we process when providing and operating our application “Condomana” (the “Service”), for which purposes and on which legal basis we do so, and which rights you have. Personal data is any information relating to an identified or identifiable natural person (Art. 4 No. 1 DSGVO — the EU General Data Protection Regulation, GDPR).

1. Controller

The controller within the meaning of Art. 4 No. 7 DSGVO (General Data Protection Regulation, GDPR) is:

nelo digitalagentur GmbH & Co KG
Magirus-Deutz-Straße 14
89077 Ulm
Germany
Telephone: +49 151 64403159
E-mail: info@condomana.com

2. Data Protection Officer

We are not required by law to appoint a data protection officer and have not appointed one. For any questions concerning data protection and the exercise of your rights, please use the contact details given in section 1.

3. Processing when visiting the website (server log files)

When you use our website purely for information — that is, if you do not register or otherwise submit information to us — we collect only the personal data that your browser transmits to our server and that is technically necessary to display the website to you and to ensure its stability and security:

  • IP address
  • date and time of the request
  • the page or file requested
  • access status/HTTP status code and the volume of data transferred
  • the website previously visited (referrer)
  • the browser, operating system and language setting used

The legal basis is Art. 6(1)(f) DSGVO. Our legitimate interest lies in the technically flawless presentation and the security of our Service. This data is not merged with other data sources and is deleted after three months at the latest.

4. Cookies and local storage

We use cookies and comparable local storage techniques (e.g. Local Storage) to provide the Service. Cookies are small text files stored on your device.

  • Strictly necessary cookies: These are essential for operating the Service, in particular the session cookie that keeps you signed in, a cookie protecting against cross-site request forgery (CSRF), and the storage of your language and display settings. The legal basis for storing them is § 25(2) No. 2 TDDDG (the German Telecommunications Digital Services Data Protection Act, TDDDG); the subsequent processing is based on Art. 6(1)(f) DSGVO (legitimate interest in a functional, secure Service) or Art. 6(1)(b) DSGVO in the course of performing the contract.
  • Optional cookies/services: Cookies that are not strictly necessary (e.g. for analytics or reach measurement) are only set with your consent pursuant to § 25(1) TDDDG and Art. 6(1)(a) DSGVO. You can withdraw your consent at any time with effect for the future in the settings of the Service.

You can configure your browser to reject or delete cookies. In that case some functions of the Service may not be available to you.

5. Registration and user account

A user account is required in order to use the Service. During registration and ongoing operation we process in particular your name, your e-mail address, your password (stored in encrypted form), the language you have chosen, and the organisation and role assigned to your account. The legal basis is Art. 6(1)(b) DSGVO (performance of the usage contract). We store this data for the duration of the contractual relationship.

As part of the Service we send system- and contract-related notifications by e-mail (e.g. access credentials, invoices, notices about documents, defects or announcements). You can control the type and frequency of these notifications in the settings of the Service; messages required by law or by contract are excluded from this. The legal basis is Art. 6(1)(b) DSGVO.

6. Payment processing and invoicing

For paid subscriptions we issue invoices and process the contract and invoice data required for this purpose (name, address, e-mail address, VAT identification number, invoicing and payment history). The legal basis is Art. 6(1)(b) DSGVO (performance of the contract) and Art. 6(1)(c) DSGVO in conjunction with the retention obligations under commercial and tax law (§ 257 HGB — German Commercial Code; § 147 AO — German Fiscal Code).

Payment is made exclusively by bank transfer to the account shown on the invoice. We use no payment service provider and no card processor, and we never collect card details at any point. We process only the transfer data received via our bank in order to allocate the incoming payment (Art. 6(1)(b) DSGVO).

7. Processing of data in the course of administration activities

Condomana is an application for managing properties, residential units, owners and residents. Insofar as you, as a customer (property manager or similar), record and process third parties' personal data within the Service (e.g. of owners, tenants or advisory board members), we process this data exclusively on your behalf and in accordance with your instructions.

For this processing you are the controller under data protection law; we act for you as a processor within the meaning of Art. 28 DSGVO. We conclude a separate data processing agreement (DPA) with you setting out the details. Data subjects should contact the respective responsible administration to exercise their rights.

Photos that managers capture against a defect using the service's mobile view are re-encoded on the device itself. All embedded camera metadata — in particular GPS location data and device/serial numbers — is removed before the image is transmitted to us. This data therefore never reaches our systems.

8. Hosting and processors

We operate our Service with a service provider that provides the infrastructure (servers, storage, database) for us. The provider processes the data exclusively to provide the hosting service and in accordance with our instructions, on the basis of a data processing agreement pursuant to Art. 28 DSGVO. The legal basis is Art. 6(1)(f) DSGVO (legitimate interest in secure and efficient operation).

The provider of the hosting infrastructure is:

Hetzner Online GmbH
Industriestr. 25
91710 Gunzenhausen
Germany

The servers are located in data centres within the European Union. We have concluded a data processing agreement pursuant to Art. 28 DSGVO with the provider. Our system e-mails are also sent via this provider's infrastructure.

If the responsible property management has switched on the service's optional AI features, we use a further processor for the processing of text (e.g. defect reports, documents, questions asked in the owner portal):

Langdock GmbH
Germany

Processing takes place exclusively on servers within the European Union under a data processing agreement pursuant to Art. 28 GDPR. The content is not used to train AI models. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in efficient handling); whether the features are enabled is decided solely by the respective property management.

9. Contacting us

If you contact us by e-mail or via a contact form, we process the data you provide (e.g. e-mail address, name, content of the message) in order to answer your enquiry. The legal basis is Art. 6(1)(b) DSGVO where the enquiry serves the initiation or performance of a contract, and otherwise Art. 6(1)(f) DSGVO (legitimate interest in answering enquiries). We delete this data as soon as storage is no longer necessary, unless statutory retention obligations prevent this.

10. Product news by e-mail

Where you have expressly consented, we inform you by e-mail about product news and updates to our Service. The legal basis is your consent pursuant to Art. 6(1)(a) DSGVO in conjunction with § 7(2) No. 2 UWG (the German Act Against Unfair Competition, UWG). To document your consent, we log the time it was given as well as the IP address and browser identifier used (Art. 7(1) DSGVO). You can withdraw your consent at any time with effect for the future — directly in the settings of the Service under “Consents” or by message to the contact details given in section 1. The lawfulness of processing carried out until the withdrawal remains unaffected.

11. Our social media profiles

We maintain publicly accessible profiles on social networks in order to provide information about the Service, product news and our company, and to get in touch with prospective customers. These are:

  • X (formerly Twitter): x.com/condomana — for users in the European Economic Area the provider is Twitter International Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland. Privacy information: x.com/en/privacy.
  • Instagram: instagram.com/condomana_com — for users in the European Economic Area the provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Privacy information: privacycenter.instagram.com/policy.

No social media plugins are embedded on our website. We use neither the networks' like, share or follow buttons nor their tracking pixels or advertising and conversion tracking (such as the Meta pixel). Visiting condomana.com therefore transmits no data to X or Meta, and no cookies of those providers are set for that purpose. References to our profiles, where they exist, are plain hyperlinks: data is transmitted to the respective network only once you click such a link and open the network's page.

The entity named in section 1 is responsible for operating our profiles. In the profiles themselves we link to our imprint and to this privacy policy.

Visiting these profiles is not necessary in order to use the Service. When you open a profile, interact with a post (e.g. like, comment, share, follow) or send us a direct message, the respective provider processes your personal data — in particular usage data, IP address, device and browser information as well as cookies and comparable identifiers — also for its own purposes, for example to measure reach, to build usage profiles and to display personalised advertising. This processing is outside our sphere of influence; we have no access to the underlying raw data. It may also affect people who are not logged in to, or not registered with, the respective network. For details please refer to the providers' privacy information linked above.

From the providers we receive aggregated statistical analyses of how our profiles are used (e.g. number of views, reach and interactions, as well as coarse information about the country, language and age groups of the people reached). We cannot attribute these analyses to any individual person and we cannot switch off their collection. Insofar as we are joint controllers with the provider within the meaning of Art. 26 DSGVO with regard to the collection and transfer of this statistical data — which is the case for Instagram — we have concluded a corresponding arrangement with the provider. Meta makes it available at facebook.com/legal/terms/page_controller_addendum and assumes primary responsibility therein for informing data subjects and for fulfilling their rights in respect of that data.

The legal basis for operating our profiles and for processing the statistical data made available to us is Art. 6(1)(f) DSGVO. Our legitimate interest lies in public relations, in presenting our company and in designing our content to meet demand. Insofar as the respective provider asks you for consent (e.g. for cookies or advertising tracking), the legal basis is Art. 6(1)(a) DSGVO; in that case you give and withdraw your consent vis-à-vis the provider. We process comments and direct messages you address to us in order to answer your request (Art. 6(1)(f) DSGVO, and Art. 6(1)(b) DSGVO for contract-related enquiries); section 9 applies accordingly.

Both providers may also transfer personal data to the USA and to further third countries and process it there. According to the providers, they base these transfers on their certification under the EU-US Data Privacy Framework (Art. 45 DSGVO) or on EU standard contractual clauses (Art. 46 DSGVO). A level of protection corresponding in every respect to European standards cannot be guaranteed in doing so; in particular, access by state authorities in the third country cannot be ruled out.

Publishing our posts through a service provider

We use a publishing tool to plan, schedule and publish our posts. The provider is Buffer, Inc., 2443 Fillmore Street #380-7163, San Francisco, CA 94115, USA. It processes the content of our posts and the associated image and video files; through an authorisation we have granted, the provider also accesses our profiles and thereby receives the interaction and reach data the networks make available for them — including the public comments on our posts. No personal data from the Condomana service — that is, data concerning managers, owners or tenants — is transferred to this provider.

The legal basis is Art. 6(1)(f) DSGVO; our legitimate interest lies in efficient and consistent public relations work. We have concluded a data processing agreement with the provider pursuant to Art. 28 DSGVO. Processing also takes place in the USA; according to the provider, it bases these transfers on its certification under the EU-US Data Privacy Framework (Art. 45 DSGVO) or on EU standard contractual clauses (Art. 46 DSGVO). The provider's privacy notice: buffer.com/privacy.

You may assert your rights as a data subject (section 15) both against us and against the respective provider. Since the providers have direct access to the data and we do not hold it in full, please address requests for access and erasure primarily to them directly; we will support you as far as we can. If you wish to avoid processing by the networks, please access our content via our website rather than via the profiles.

12. Data transfers to third countries

As a rule, your personal data is not transferred to countries outside the European Union or the European Economic Area. The one exception is the social media profiles described in section 11. Should a further transfer become necessary in an individual case, it will take place only in compliance with the requirements of Art. 44 et seq. DSGVO, in particular on the basis of an adequacy decision or appropriate safeguards (e.g. EU standard contractual clauses).

13. Retention period

We store personal data only for as long as is necessary for the respective purposes or as required by statutory retention periods (e.g. commercial and tax law obligations of up to ten years under § 257 HGB, § 147 AO). Thereafter the data is deleted or, where a retention obligation exists, restricted in processing (blocked).

14. Data security

We take appropriate technical and organisational measures to protect your data against loss, destruction, manipulation and unauthorised access. Transmission is encrypted via a TLS connection (HTTPS). Passwords are stored exclusively as a cryptographic hash. Our measures are continuously improved in line with technological developments.

15. Your rights as a data subject

Under the DSGVO you have the following rights vis-à-vis us regarding the personal data concerning you:

  • the right of access (Art. 15 DSGVO),
  • the right to rectification (Art. 16 DSGVO),
  • the right to erasure (Art. 17 DSGVO),
  • the right to restriction of processing (Art. 18 DSGVO),
  • the right to data portability (Art. 20 DSGVO),
  • the right to object to processing (Art. 21 DSGVO).

Where processing is based on your consent (Art. 6(1)(a) DSGVO), you have the right to withdraw it at any time with effect for the future. The lawfulness of processing carried out until the withdrawal remains unaffected.

Right to object

Where your personal data is processed on the basis of legitimate interests pursuant to Art. 6(1)(f) DSGVO, you have the right, pursuant to Art. 21 DSGVO, to object to the processing on grounds relating to your particular situation.

Right to lodge a complaint with a supervisory authority

Without prejudice to any other legal remedy, you have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your data infringes the DSGVO. The supervisory authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Lautenschlagerstraße 20, 70173 Stuttgart
www.baden-wuerttemberg.datenschutz.de

16. Changes to this Privacy Policy

We amend this Privacy Policy whenever changes to the data processing we carry out make this necessary or the legal situation changes. The current version published on this page applies in each case.