Privacy policy.
This English translation is provided for convenience only. The German version is legally binding.
1. Who is responsible
The controller for the processing of personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is workin up GmbH, Kaiser-Wilhelm-Straße 89, 20355 Hamburg, Germany, phone +49 40 6077963-91 (hereinafter "workin.", "we", "us").
You can reach us with questions about data protection and requests regarding your rights by email at datenschutz@workin.de or by post at the address above, marked "Datenschutz".
This policy applies to the website workin.de and, to the extent described below, to the Client Hub at hub.workinup.de. We use terms such as "personal data", "processing", "processor" and "consent" as defined in Art. 4 GDPR.
2. Visiting the website
2.1 Hosting
The website is operated by a specialised hosting provider that delivers it through a global server network. When you open a page, the provider necessarily processes your IP address, the requested address, date and time, your browser identifier (user agent) and the referring page. This is required to deliver the page to you and to protect it against attacks and overload. The legal basis is our legitimate interest in a secure and functioning website (Art. 6(1)(f) GDPR).
We do not keep access logs containing IP addresses ourselves. The provider processes the data as our processor under a contract pursuant to Art. 28 GDPR. For transfers to countries outside the EU, see section 6.
2.2 Cookieless audience measurement
Our hosting provider also counts for us how often each page is viewed and how fast it loads. For this, your browser loads a small script. It sets no cookies, stores nothing on your device and builds no profiles; we only see aggregated figures. The legal basis is our legitimate interest in improving the website (Art. 6(1)(f) GDPR).
2.3 Error reports
If the website shows its error page because of a technical fault, your browser sends a short report to our server: the affected page, the error message and the browser type with its main version (for example "Chrome 131 mobile"). IP address, search parameters and the full browser identifier are not stored, and email addresses in the error text are masked. The reports are kept in our hosting provider's log and deleted automatically after a few days. The legal basis is Art. 6(1)(f) GDPR.
2.4 Database
Properties, images, texts and forms on the website are served from our database, which a service provider operates for us in a data centre in Germany. Your browser only communicates with our own domain; we forward the requests to the database. The provider is our processor.
3. Storage in your browser
The website itself sets no cookies. To work, however, it stores a few items in your browser's local storage (localStorage and sessionStorage). These items do not leave your device unless you explicitly send them to us, for example when you send your shortlist to an advisor.
• Your shortlist (saved properties), until you clear it or delete your browser storage.
• Your choice in the privacy dialog and when you made it, so that we do not ask you again on every visit.
• Your language choice (German or English).
• After an exposé request, your email address and an access key, so that you can download further exposés without entering your details again.
• For the current session only: your last search, your position in the map list and, if you arrived via a share link, its identifier.
The legal basis is Section 25(2) no. 2 TDDDG, because this storage is strictly necessary for the functions you request, and Art. 6(1)(f) GDPR. You can delete these items at any time in your browser settings.
4. When you send us data
4.1 Enquiry, viewing and contact forms
Through the forms on the website (contact and briefing, viewing request, waiting list for let properties, search mandate, sending your shortlist to an advisor, enquiries from landlords) we collect the details you enter: name, email address, optionally phone number and company, your message and the search criteria or properties your enquiry refers to. Required fields are marked.
We create the enquiry in our customer system (CRM), which runs in the same database, and assign it to an advisor who will reply to you. So that the team sees the enquiry immediately, an internal notification containing your details is also sent to our mailbox, which an email service provider operates for us as our processor.
To protect against spam, every form contains a field that is invisible to humans, and we limit the number of enquiries per IP address for a short period. For this we store a check value (hash) of your IP address and your browser identifier together with the enquiry, not the IP address itself.
The legal basis is the consent you give by ticking the box in the form (Art. 6(1)(a) GDPR) and, where the enquiry concerns the initiation or performance of an advisory mandate, Art. 6(1)(b) GDPR. You can withdraw your consent at any time with effect for the future; an email to datenschutz@workin.de is sufficient. We delete the details once they are no longer needed for handling your enquiry and no statutory retention obligation (for example under commercial or tax law) applies.
4.2 Exposé as PDF
We provide an exposé for a property after you enter your name, email address and optionally your company. We treat the request like an enquiry under 4.1. Our server generates the PDF from the property page; no further data about you is processed for this. We record every exposé download with email address, property and time on your contact in our CRM. The access is valid for 90 days; after that we ask for your details again.
4.3 Newsletter
For our Hamburg newsletter we only need your email address and your consent (Art. 6(1)(a) GDPR). We store the address together with the time of sign-up. Before we send you the first newsletter, you confirm your sign-up via a link in an email (double opt-in); without confirmation we send nothing. We will name the service used to send the newsletter here before the first issue is sent. You can withdraw your consent at any time via the unsubscribe link in every issue or by email to datenschutz@workin.de.
4.4 AI search
In the office search you can describe freely what you are looking for. An AI language model, operated on our behalf by a specialised service provider, evaluates your text and derives search criteria such as district, floor area and budget from it. Only the text is transmitted, not your IP address or any other details about you, and we do not store the text. To prevent misuse we limit the number of searches and store a check value (hash) of your IP address for this purpose. Please do not enter names, phone numbers or other personal details there; the search does not need them. The legal basis is our legitimate interest in showing you suitable office space (Art. 6(1)(f) GDPR).
4.5 Sharing your shortlist and share links
If you share your shortlist, the link only contains the identifiers of the properties, no details about you. If an advisor sends you a share link to a non-public property, our server checks the identifier in the link and shows you only that one property. Share links are valid for no more than 90 days and can be revoked by the advisor at any time.
4.6 Job applications
We accept job applications by email. We process the documents exclusively for the application process (Art. 6(1)(b) GDPR) and delete them no later than six months after it has ended, unless you have consented to longer retention.
5. Third-party services
5.1 Maps
We show the location of properties on maps from Google Maps (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). When you open a page with a map, your browser loads map data and scripts directly from Google; Google receives your IP address, browser data and the map section. Without a map, an office search cannot reasonably be used; the legal basis is therefore our legitimate interest in a functioning search (Art. 6(1)(f) GDPR, Section 25(2) no. 2 TDDDG). Google may also transfer data to the USA (see section 6). More at https://policies.google.com/privacy.
If Google Maps is not available, we show maps from a free map service. Its operator also receives your IP address.
5.2 Code libraries and images
Your browser loads some code libraries and a few district photos from external servers. Your IP address is transmitted to the respective operator. The legal basis is Art. 6(1)(f) GDPR.
5.3 Leadinfo
We use Leadinfo (Leadinfo B.V., Rotterdam, Netherlands). Leadinfo matches the IP address of a visit to a company and shows us publicly available company information such as name and address, along with the pages viewed and, in the office search, the selected search criteria. Leadinfo does not identify individuals. We transfer the company information into our CRM. For this, Leadinfo sets two cookies on our own domain (_li_id and _li_ses). The legal basis is our legitimate interest in being able to approach companies interested in office space (Art. 6(1)(f) GDPR). You can object to this at any time; an email to datenschutz@workin.de is sufficient. More at https://www.leadinfo.com/en/privacy.
5.4 Google Analytics (only with your consent)
Only if you agree to statistics in the privacy dialog do we load Google Analytics 4 (Google Ireland Limited). Google Analytics evaluates how the website is used: pages viewed, time spent, device and browser, approximate location and whether an enquiry was sent. For this, Google sets cookies. Google Analytics 4 does not store IP addresses; we have switched off Google signals and ad personalisation.
The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw it at any time via "Privacy settings" at the bottom of every page; the withdrawal takes effect from the next page view. Google may transfer data to the USA (see section 6). More at https://policies.google.com/privacy.
5.5 Social networks
We only link to Instagram, LinkedIn and Facebook with plain links. No plugins are embedded; data only flows once you click a link and open the network's page. The privacy policy of the respective provider applies there.
6. Transfers to countries outside the EU
Some of our service providers and Google are based in the USA or also process data there. For the USA, the European Commission adopted an adequacy decision on 10 July 2023 for companies certified under the EU-US Data Privacy Framework (Art. 45 GDPR). Where this does not apply, EU standard contractual clauses (Art. 46(2)(c) GDPR) safeguard the transfer.
7. Client Hub
Clients we work with receive access to the Client Hub at hub.workinup.de. There we provide properties, documents and the status of the search.
When you open the Client Hub, we store the shortened IP address (for IPv4 without the last group of digits, for IPv6 only the first three blocks), the browser identifier, a random device identifier and the time of access in order to detect misuse of your access link. We do not derive a location or any other origin information from this. The device identifier is stored on your device for this purpose. Only your advisor and the management can see this data; it is deleted after 90 days.
The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you give before first use. Without this consent, the Client Hub cannot be used. You can withdraw it at any time with effect for the future; after that, access to the Client Hub is no longer possible and your advisor will provide the documents to you in another way.
8. Disclosure and retention
Apart from us, only service providers that we have carefully selected and contractually bound under Art. 28 GDPR receive your data, and each only to the extent necessary for its purpose: hosting, database, email, AI-assisted search and document generation. In addition, there are the third-party services named in section 5. Beyond that, we only disclose data if we are legally obliged to, for example by order of an authority.
We store personal data only for as long as necessary for the respective purpose or as required by statutory retention periods. After that, it is deleted.
9. Your rights
You have the right of access to your stored data (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent you have given at any time with effect for the future (Art. 7(3) GDPR).
Right to object: where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims. You can object to processing for direct marketing purposes without giving reasons.
An email to datenschutz@workin.de is sufficient to exercise your rights. You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the Hamburg Commissioner for Data Protection and Freedom of Information, Ludwig-Erhard-Straße 22, 20459 Hamburg.
10. Changes
We update this policy when our website or the legal situation changes. The version published here applies. Last updated: October 2026.