Privacy policy

Our web server (Contabo VPS, data centre in Germany, operated behind nginx) automatically stores the following information in a so-called server log file every time a page is accessed:

• IP address of the requesting device
• Date and time of the request
• Requested URL and HTTP method
• Amount of data transferred
• HTTP status code
• Referrer URL (if sent by the browser)
• User agent (browser type, operating system)

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing the service securely and without errors). Storage period: log files are deleted after 14 days at the latest, unless the investigation of a security incident requires them to be kept longer.

Visitor statistics: In addition, the web server keeps a second, reduced log file for page views only, in which the IP address is already shortened when it is written (the last octet for IPv4 or the trailing blocks for IPv6 are discarded). From this log, the GoAccess software installed on the server creates aggregated statistics (page views, visitor numbers, referrers, browser types). No cookies are set for this, no script is run in the browser and no data is passed on to third parties; because of the shortening, the data cannot be attributed to individual persons. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in analysing the use of our website).

WorkationBase uses Supabase (Supabase Inc., San Francisco, USA) as a backend-as-a-service. The data (destinations, providers, trips, etc.) is stored on PostgreSQL instances in the EU (region: Western Europe / Frankfurt). Supabase acts as a processor under a data processing agreement (DPA) in accordance with Art. 28 GDPR.

The data of registered users (see section 2.3) is also stored there. Requests to the database are mostly made server-side via our own server.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating the platform) or Art. 6(1)(b) GDPR for account data.

For some features (travel buddy listings, messages, reviews, provider dashboard, job listings) you can create a user account. You sign in without a password using a magic link: you enter your email address and receive a sign-in link. This involves processing your email address, the times you sign in and an account ID. The sign-in email is sent via our processor Supabase.

After you sign in, the website sets technically necessary cookies (session token, prefix sb-) so that you stay logged in. These cookies are required for the login service and therefore do not require consent under § 25 (2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act); they are not used for tracking or advertising.

Legal basis: Art. 6(1)(b) GDPR (providing the user account). Storage period: until the account is deleted; you can ask us by email to delete it at any time.

The information in your profile (e.g. name, profile picture, travel preferences) and your travel buddy listings (destination, period, budget, description, optional cover image) are provided voluntarily. Listings and the related profile information are publicly visible on the website, so please only publish what others may see. You can edit or delete listings and profile information yourself at any time.

Messages you send to other members via the platform are stored in order to deliver them to the recipient; they are visible only to the sender and the recipient.

Legal basis: Art. 6(1)(b) GDPR.

Companies can place paid job ads. Payment is processed by Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland). Payment details are entered directly on Stripe's checkout page; we do not receive or store any credit card or bank account details, only the payment status and a transaction ID. Stripe may also transfer data to the USA; Stripe is certified under the EU-US Data Privacy Framework and additionally uses EU standard contractual clauses. Details: stripe.com/de/privacy.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(c) GDPR (retention obligations under commercial and tax law, § 257 HGB (German Commercial Code), § 147 AO (German Fiscal Code)).

WorkationBase uses the fonts Bricolage Grotesque, Hanken Grotesk and IBM Plex Mono. They are delivered directly from our own server via next/font. There is no connection to Google Fonts or other external font services; your IP address is not passed on to third parties to load the fonts.

For interactive maps we use the open-source library Leaflet together with map tiles from OpenStreetMap (OpenStreetMap Foundation, St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom).

When a map is loaded on the page, your browser sends requests to the OpenStreetMap tile servers (*.tile.openstreetmap.org). In doing so, your IP address is transmitted to OpenStreetMap. OpenStreetMap processes this data in accordance with its own privacy policy.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing interactive map features).

Some photos (e.g. destination images) are loaded directly from servers of the Wikimedia Foundation (upload.wikimedia.org, USA) or of Unsplash Inc. (USA). When these images are loaded, your browser necessarily transmits your IP address to the respective image server. No cookies are set in the process and we do not transmit any other data.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in illustrating the content with freely licensed images).

If you switch the website between light and dark theme, we store your preference in your browser's localStorage (key: theme). This value stays on your device only and is not transmitted to us or to third parties. Storing it is necessary for this feature you have requested and therefore does not require consent under § 25 (2) no. 2 TDDDG.

If you contact us by email, we process your email address and the content of your message in order to handle your enquiry. The data is deleted once the enquiry has been fully dealt with and no statutory retention obligations prevent deletion.

The same applies to the contact form in the legal notice: we process your name (optional), your email address and your message. The form does not store anything in our database; it forwards the message by email via Resend (see sections 2.13 and 4) to our mailbox. To prevent misuse, your IP address is kept briefly, only as a hash value, in the server's memory in order to limit too many requests in a short time; it is not stored permanently.

Legal basis: Art. 6(1)(b) GDPR (enquiries relating to contracts) or Art. 6(1)(f) GDPR (other enquiries).

WorkationBase contains links to external booking and provider websites. Some of them are affiliate links: if you book or buy through such a link, we receive a commission from the provider. The processing of data after you click such a link is subject to the privacy policy of the respective provider, over which we have no influence. Partner links are labelled accordingly on the page.

We participate in the Amazon EU Associates programme (Amazon Europe Core S.à r.l., Luxembourg). Amazon links in our guides contain our partner ID so that Amazon can attribute a purchase to us. Amazon only sets its own cookies for this once you are on amazon.de; this is governed by Amazon's privacy notice. On WorkationBase we count clicks on these links anonymously: we store only the article, link, language and time, no IP address, no user ID and no cookie.

WorkationBase uses no browser-based analytics system (no Google Analytics, no Matomo, no tracking pixels) and sets no cookies that require consent. Visitor numbers are measured exclusively server-side and anonymised from the log files (see section 2.1). No cross-device tracking takes place. The only cookies used are the technically necessary login cookies from section 2.3, which are only set when you sign in. A cookie banner is therefore not required (§ 25 (2) no. 2 TDDDG).

You subscribe to our newsletter using the double opt-in procedure: after entering your email address, you receive a confirmation email with a link. Your subscription only becomes active once you click this link. We store your email address, the time of subscription and of confirmation, the IP address and the browser (user agent) used to subscribe or confirm, and your language setting. This data serves as proof of your consent.

The newsletter emails are sent via Resend Inc. (2261 Market Street #5039, San Francisco, CA 94114, USA) as a processor. The emails are sent via servers in the EU (region Ireland); a data processing agreement (DPA) based on EU standard contractual clauses is in place with Resend.

We use no tracking pixels and measure neither opens nor clicks in newsletter emails.

Optionally, you can state preferences (language, regions, topics, sending frequency) so that the content suits you better. You can change or delete these preferences at any time via the settings link in every email.

Legal basis: Art. 6(1)(a) GDPR (consent). You can withdraw your consent at any time, via the unsubscribe link in every email or informally by email to the address given in section 1.

Storage period: until you withdraw consent. After that, the email address is put on a block list to prevent it from being sent emails again by mistake.

Our directory lists workation, coworking and coliving providers. We create some of these listings ourselves, including without prior contact. For this we only use publicly available information, mainly the provider's website and public profiles (e.g. Instagram): name of the offer, website, public business contact details (email, phone), locations, description, dates and logo. We only show photos if the provider uploads them or we are in contact with them. This data is personal data mainly when an offer is run by an individual or a contact address contains a name.

Purpose: a directory where remote workers can find suitable offers. Links to providers are regular links; we do not charge for listings.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a complete directory; the provider's interest in having their publicly advertised offer found points the same way). You can object to the processing at any time (Art. 21 GDPR).

Information under Art. 14 GDPR: when we contact a provider, we refer to this section. The data comes from the public sources named above; recipients are the visitors of the website and our service providers listed in section 4.

Claiming or removing a listing: providers can claim their listing and maintain it themselves (account with magic link, see section 2.3) or remove it at any time: in the provider dashboard, without logging in via the access link from our message, or informally by email to the address given in section 1. Removing means deleting: the listing disappears together with its locations, dates, images and access. We receive a short notification (name, website, contact email of the listing) so that we do not add the provider again. We keep this notification for as long as we run the directory.

Storage period: as long as the listing exists, i.e. until the provider removes it, until an objection, or until we find that the offer has been discontinued.