Legal notice & privacy

Legal notice

Information pursuant to § 5 DDG (German Digital Services Act, “Digitale-Dienste-Gesetz”)

Zenveo GmbH
Härtelstraße 4
04107 Leipzig
Germany

Phone Leipzig: 0341 2253722 0
Phone Berlin: 030 2408785 0
Phone Munich: 089 2880674 0
Email: info@zenveo.de

HRB 284379
Amtsgericht München (Local Court of Munich)

VAT ID: DE361640387

Represented by the managing directors
Moritz Aepfelbacher
Rico Meuschke

Responsible for content pursuant to § 18(2) MStV (German Interstate Media Treaty, “Medienstaatsvertrag”)
Maximilian Werner

Resources used

Berlin: Adobe Stock: 273681270
Leipzig: Adobe Stock: 224310091, Unsplash: Photo by Clara Pfister on Unsplash
Munich: Adobe Stock: 254648941, Unsplash: Photo by Agent J on Unsplash
Submission confirmation: Photo by Anders Holm-Jensen on Unsplash
For property management companies: Photo by Lewis Keegan on Unsplash, Photo by Medienstürmer on Unsplash, Photo by Jakub Żerdzicki on Unsplash, Photo by Constantin Wenning on Unsplash
Legal notice & privacy: Adobe Stock: 283352650
For building owners: Adobe Stock: 297767498, 468085576, 470221227
Blog: Adobe Stock: 118907247, 234154184, 400191576

Liability for content

As a service provider, we are responsible for our own content on these pages in accordance with general law pursuant to § 7(1) DDG. Pursuant to §§ 8 to 10 DDG, however, we as a service provider are not obliged to monitor transmitted or stored third-party information or to investigate circumstances that indicate illegal activity. Obligations to remove or block the use of information under general law remain unaffected. However, liability in this respect is only possible from the point in time at which a specific infringement becomes known. As soon as we become aware of such infringements, we will remove this content immediately.

Liability for links

Our website contains links to external third-party websites over whose content we have no influence. We therefore cannot accept any liability for this third-party content. The respective provider or operator of the linked pages is always responsible for their content. The linked pages were checked for possible legal violations at the time of linking. Illegal content was not recognisable at the time of linking. However, permanent monitoring of the content of the linked pages is not reasonable without concrete indications of an infringement. As soon as we become aware of infringements, we will remove such links immediately.

Copyright

The content and works created by the site operators on these pages are subject to German copyright law. Reproduction, editing, distribution and any kind of exploitation beyond the limits of copyright law require the written consent of the respective author or creator. Downloads and copies of this site are permitted only for private, non-commercial use. Insofar as the content on this site was not created by the operator, the copyrights of third parties are respected. In particular, third-party content is marked as such. Should you nevertheless become aware of a copyright infringement, please let us know. As soon as we become aware of infringements, we will remove such content immediately.

Privacy information

(Last amended: 15 October 2026)

This privacy information explains how personal data is processed by Zenveo GmbH on the website zenveo.de (hereinafter “website”). Zenveo GmbH processes only such data as is necessary to provide and secure the website and its services, and is guided by the principle of data minimisation. “Personal data” means any information relating to an identified or identifiable natural person (data subject), such as name, address, telephone number, date of birth, email address or IP address. Information that cannot be attributed to a specific person, for example due to anonymisation, is not considered personal data.

1. Controller

The controller for the processing of personal data on the website within the meaning of the General Data Protection Regulation (GDPR) is:
Zenveo GmbH
Härtelstraße 4
04107 Leipzig
Germany
For data protection enquiries or to exercise your rights as a data subject, please contact datenschutz@zenveo.de.

2. Data protection officer

The following has been appointed as data protection officer:
Kertos GmbH
Brienner Straße 41
80333 München
Germany
Email: dsb(at)kertos.io

3. Data processing on our website

3.1 Provision of the website

Purpose of processing: We process your data in order to

• ensure the reliable operation of the website
• enable user-friendly access to our website
• and maintain IT security

The website runs on a server in the EU that we operate ourselves. An upstream web server establishes the encrypted connection (HTTPS) and compresses the content. We deliver the website's fonts, images and scripts from this server; we do not load fonts or other content from third parties (such as Google Fonts). The only exception is the script for audience measurement (section 4.1).

Recipient: OVH SAS, 2 rue Kellermann, 59100 Roubaix, France (provision of the server).

Data processed (server log data):

• IP address of the requesting device
• Date and time of the request
• Address of the page or file requested (URL)
• Information on the browser and operating system used (user agent)

Legal basis: Art. 6(1)(f) GDPR. Processing of the data listed is necessary to provide the website and to ensure secure and stable operation.
Storage period: Server log data is deleted as soon as it is no longer required for the operation and security of the website, but no later than after 30 days, unless there is a statutory retention obligation.
Transfer to third countries: None. The data is processed in the EU.

3.2 Enquiry form

Purpose: Handling of quote requests received via the enquiry form on our website.

Your browser transmits the information to our own server, which forwards it to our CRM system Brevo. There we create a contact (email address, first and last name, telephone number) and a deal for your enquiry, and add a note containing all the information provided. If, exceptionally, an enquiry cannot be transmitted to Brevo, we write it in full to our server's log so that no enquiry is lost.

Recipient: Sendinblue SAS (Brevo), 106 boulevard Haussmann, 75008 Paris, France. Brevo processes the data as a processor on our behalf; a data processing agreement pursuant to Art. 28 GDPR is in place.

Data processed:

• Contact details (name, email address, telephone number)
• Property details (address, postcode, city, number of units)
• Enquiry details (type of management, desired start of management, language of the website)
• Time of submission

Legal basis: Art. 6(1)(b) GDPR (handling your enquiry and implementing pre-contractual measures).
Storage period: The data is stored for as long as is necessary to handle your request; in the event of a subsequent contractual relationship, for the duration of the business relationship and beyond that in accordance with statutory retention periods. Entries in the server log are deleted in line with the periods set out in section 3.1.
Transfer to third countries: None. Brevo is based in France and the data is processed in the EU.
Further information: https://www.brevo.com/legal/privacypolicy/

3.3 Protection of the enquiry form against misuse

Purpose: Detecting and preventing automated requests (spam, bots) without presenting you with a captcha.

Recipient: None. The checks take place exclusively on our own server; no captcha and no third-party service is used.

Data processed:

• IP address and the associated network segment (subnet), in order to limit the number of requests per sender
• a signed, single-use security feature (token) with a timestamp, generated when the page is loaded
• a form field that is invisible to humans and is only filled in by automated programs

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting the form and our systems against misuse.
Storage period: IP address and subnet are held only in the server's memory, are not stored on any storage medium and are discarded after one hour at the latest. The security feature expires after twelve hours at the latest.
Transfer to third countries: None.

3.4 Job applications

Purpose: Selection of applicants with a view to possibly establishing an employment relationship.

Recipient: Personio SE & Co. KG, Seidlstraße 3, 80335 München, Germany

Data processed:

• Contact details (e.g. name, email address, telephone number)
• Application documents (e.g. CV, cover letter, references)
• Data on qualifications and career history (e.g. professional experience, education)
• Technical data (e.g. IP address, browser type, operating system, time of access)

Legal basis: Art. 6(1)(b) GDPR (implementation of pre-contractual measures); Art. 6(1)(f) GDPR, insofar as our legitimate interest lies in conducting the application process efficiently.
Storage period: We store your personal data until the application process has been completed. If your application is unsuccessful, your data will be stored for a further six months after notification of the decision. In the event of a legal dispute, the data may be retained for longer until the matter has been finally resolved. If you are hired, your application documents will be stored in your personnel file for the duration of the employment relationship. You can withdraw your application or object to the processing at any time; in this case, your data will be deleted and your application will no longer be considered.
Further information: https://www.personio.de/datenschutzerklaerung/

3.5 Linked portals and forms

Our website links to our customer portals (dashboard.zenveo.de and app.zenveo.de) and, via short links (e.g. /kontaktdaten or /lastschrift), to forms on the DocuSeal service (docuseal.eu). When you open these services, you leave this website; their own privacy notices apply there.

4. Audience measurement, cookies and local storage

Cookies are small text files that your browser stores on your device. Comparable technologies include the browser's local storage. Our website does not set any cookies itself and does not use any advertising or tracking services. For audience measurement we use a method that works without cookies and without user profiles.

4.1 Plausible Analytics

Purpose: Statistical evaluation of the use of our website (e.g. which pages are viewed and where visitors come from) in order to improve content and usability. Measurement is only active on the public website zenveo.de.

Recipient: Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia.

Data processed:

• Page viewed and referring website (referrer)
• Browser, operating system and device type
• Country or region, derived from the IP address

Plausible does not set cookies, does not read any information from your device and does not create user profiles. Your IP address is not stored. In order to count visits, a hash is generated from the IP address and browser information using a random value (salt) that changes daily; as a result, visits cannot be attributed to a person across several days.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in improving our website on the basis of anonymous statistics. Consent is not required because no information is stored on or read from your device (§ 25 TDDDG does not apply).
Storage period: Only aggregated statistics without any personal reference are stored. The salt is discarded daily.
Transfer to third countries: None. The data is hosted in the EU.
Further information: https://plausible.io/data-policy

4.2 Overview of cookies and local storage

We do not show our privacy note again once you have closed it. To do so, we store the entry zv-privacy-note-v1 in your browser's local storage. It contains no personal data and is not transmitted to us. Storing it is strictly necessary to provide this function you have requested (§ 25(2) no. 2 TDDDG). You can delete the entry at any time via your browser settings.

5. Contact by email

Purpose: Handling of and responding to your enquiry.

Data processed:

• Name
• Email address
• Content of your message

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in communicating with you). If your enquiry is aimed at the conclusion or performance of a contract, processing is carried out on the basis of Art. 6(1)(b) GDPR.
Storage period: Your data will only be stored for as long as is necessary to conclude the handling of your enquiry.

6. Social media presences

Purpose: Communication with interested parties, information about products and services, and analysis of the use of our online presences.

Recipients:

• LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland
• New Work SE, Am Strandkai 1, 20457 Hamburg (“Xing”)

Data processed:

• Demographic information (e.g. age, gender)
• Professional information (e.g. industry, professional experience)
• Interaction data (e.g. likes, shares)
• Usage statistics (e.g. page views, video views)
• Content preferences (e.g. popular topics, interests)

Joint controllership with LinkedIn: With regard to the processing of statistical usage data relating to our LinkedIn company page (so-called “Page Insights”), we and LinkedIn Ireland Unlimited Company are joint controllers within the meaning of Art. 26 GDPR. A corresponding agreement has been concluded.

Legal basis:

• Art. 6(1)(b) GDPR (performance of a contract and pre-contractual measures)
• Art. 6(1)(f) GDPR (legitimate interest in effective information and communication)

Storage period: In accordance with the privacy policies of the respective platforms
Transfer to third countries: Possible transfer to the USA and other third countries, depending on the respective platform
Further information:

• LinkedIn: https://legal.linkedin.com/pages-joint-controller-addendum
• LinkedIn: https://www.linkedin.com/legal/privacy-policy
• Xing: https://privacy.xing.com/de/datenschutzerklaerung

Note: We have no influence on the independent data processing carried out by the platform operators. When you visit our online presences, usage data may be transmitted to the operators, who use it for their own purposes. Data subject rights can be asserted directly against the platform operators.

7. International data transfers

Personal data is processed primarily within the EU/EEA. Transfers to so-called “third countries” take place only in compliance with the requirements of the GDPR and where appropriate safeguards are in place. Before data is transferred to a service provider in a third country, the level of data protection is reviewed. A transfer only takes place if sufficient protection mechanisms exist. All service providers must conclude a data processing agreement. Additional measures are required for providers outside the EEA. Pursuant to Art. 44 et seq. GDPR, a transfer is permitted if at least one of the following conditions is met:

• The European Commission has determined that an adequate level of data protection exists.
• Standard contractual clauses have been agreed with the recipient.
• Other appropriate safeguards pursuant to Art. 46 GDPR exist.
• In certain exceptional cases pursuant to Art. 49 GDPR.

8. Recipients

As a matter of principle, the personal data we collect is only passed on if:

• you have given us your express consent to do so pursuant to Art. 6(1)(a) GDPR,
• the disclosure is necessary to safeguard our legitimate interests or to establish, exercise or defend legal claims and there is no reason to assume that your interests or fundamental rights and freedoms requiring the protection of personal data override them (Art. 6(1)(f) GDPR),
• we are legally obliged to disclose the data (Art. 6(1)(c) GDPR), or
• this is legally permissible and necessary for the performance of a contract with you or for the implementation of pre-contractual measures at your request (Art. 6(1)(b) GDPR).

Possible recipients are:

• Processors: Group companies or external service providers (e.g. in the areas of technical infrastructure and processing, maintenance, payment processing) that are carefully selected and monitored. Processors may process the data only in accordance with our instructions.
• Public bodies: Authorities and state institutions (e.g. tax authorities, public prosecutors, courts) to which we must transmit personal data, for example to fulfil legal obligations or to protect legitimate interests.

9. Data security and protective measures

We use appropriate technical and organisational measures to ensure the security and confidentiality of your personal data. These measures serve to protect against unauthorised access, manipulation, loss or misuse. Our security precautions are regularly reviewed and adapted to the state of the art and current industry standards.

Please note that, despite extensive protective measures, data transmission over the internet may in principle have security gaps. In particular with unencrypted communication (e.g. standard email), there is a risk that data may be read by third parties. We have no influence on the behaviour of external parties. We therefore recommend using encryption or other protective measures when transmitting sensitive information electronically in order to minimise potential risks.

10. Storage period and deletion/blocking of data

Personal data is deleted or blocked as soon as the purpose of storage ceases to apply. Storage beyond this only takes place if this is required by EU or national regulations to which the controller is subject. The data is also deleted or blocked as soon as a statutory retention period expires, unless further storage is necessary for the performance of a contractual relationship.

11. Rights of data subjects

You have the following rights with regard to your personal data:

• Right of access (Art. 15 GDPR, § 34 BDSG): You can request information as to whether and which personal data we process, for what purpose, to which recipients or categories of recipients the data is transferred, and how long the data is stored.
• Right to rectification (Art. 16 GDPR): You can request the immediate rectification of inaccurate personal data or the completion of incomplete personal data.
• Right to erasure (Art. 17 GDPR): You can request the erasure of your personal data, in particular if it is no longer required, you withdraw your consent or the data has been processed unlawfully.
• Right to restriction of processing (Art. 18 GDPR): You can request the restriction of the processing of your data, e.g. if the accuracy of the data is contested.
• Right to data portability (Art. 20 GDPR): You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format or, where technically feasible, to request its transmission to another controller.
• Right to withdraw consent (Art. 7(3) GDPR): You can withdraw consent you have given at any time with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected.
• Right to object (Art. 21 GDPR): You can object at any time to the processing of your personal data on grounds relating to your particular situation, in particular in connection with direct marketing or related profiling.
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR): You have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes data protection law.