Legal notice

Information pursuant to § 5 DDG (German Digital Services Act)

Liability

We take great care with our content but cannot guarantee that it is correct, complete or up to date. Advertisers are responsible for their listings. Please report unlawful listings; we remove them promptly. We are not responsible for the content of external websites we link to.

Dispute resolution

We are neither willing nor obliged to take part in dispute resolution proceedings before a consumer arbitration board (§ 36 VSBG).

Privacy policy

Last updated: 02.11.2026

1. Controller

The provider named above. Privacy requests: datenschutz(at)studyaccommodation.com

2. What we process and why

Website access: the web server processes technically necessary data (IP address, time, page, browser) to deliver the site securely (Art. 6(1)(f) GDPR). We do not run visitor statistics or analytics.

Your account: first name, last name, email, password and optional profile details, so we can provide your account and listings (Art. 6(1)(b) GDPR). Passwords are stored only as Argon2id hashes. Your profile data and email address are stored encrypted (XSalsa20-Poly1305). Sign-in uses two-factor confirmation with an email code.

Security log: security events (sign-ins, password changes) with truncated IP address, kept for 90 days and visible in your account (Art. 6(1)(f) GDPR).

Email delivery: system emails are sent via Brevo (Sendinblue GmbH, Köpenicker Str. 126, 10179 Berlin, Germany) as our processor under Art. 28 GDPR. Open and click tracking is disabled.

3. Recipients

Only authorised staff, our hosting provider and Brevo as processors. We do not share data for advertising.

4. Retention

Until you delete your account. Unconfirmed sign-ups are deleted after 7 days, one-time links and codes expire within 24 hours, security logs after 90 days, session data after 2 days of inactivity.

5. Your rights

Access, rectification, erasure, restriction, portability and objection (Art. 15–21 GDPR). You can export your data and delete your account directly in your account. You may lodge a complaint with a supervisory authority, e.g. the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, Germany.

6. Cookies

We only use strictly necessary cookies, so there is no cookie banner: __Host-sa_sess (session and CSRF protection, ends when you close the browser) and __Host-sa_dev (only if you choose “trust this device”, 30 days). No analytics, tracking or advertising cookies, no external fonts or scripts.