Privacy Policy
1. Controller
Jürgen Lammers
Windmühlenstr. 10, 48619 Heek, Germany
E-mail: max@madayo.de
Phone: +49 2568 9349339
2. Hosting and server logs
The website is operated by hosttech GmbH, Brunnenstraße 196, 10119 Berlin, Germany; the server location is Switzerland. When you access the site, access data is automatically processed in server log files: IP address, date and time, page accessed, amount of data transferred, browser type and version, operating system, and the previously visited page (referrer). The legal basis is Art. 6(1)(f) GDPR (legitimate interest in security, stability and preventing misuse). Log files are deleted after 14 days. A data processing agreement under Art. 28 GDPR is in place with the hosting provider.
To prevent misuse (e.g. mass reservations, login attempts), IP addresses are counted in memory for a maximum of 60 minutes (rate limiting); no permanent storage takes place.
3. Exploring the city without ordering
The city can be explored without registering. In doing so, no personal data is collected beyond the access data named under 2. Reach measurement and advertising conversion measurement (both under 4.) take place only if you have actively consented to them. Without your consent, no cookie is set for advertising or analytics purposes and no third-party script is loaded.
4. Reach measurement and conversion measurement (consent only)
4.1 Microsoft Clarity
Current status: Clarity is not currently active. As long as this is the case, no script from Microsoft is loaded, no cookie is set, and no consent banner appears. The information below will apply once we switch Clarity on; the banner will then appear before it first loads.
To understand which parts of the city are actually used, we use Microsoft Clarity, a service of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Clarity creates anonymised click and scroll analyses ("heatmaps") as well as recordings of session activity (mouse movements, clicks, scrolling, pages visited).
Clarity is only loaded after you click "Accept" in the consent banner. Without your consent, no script from Microsoft is loaded, no cookies are set, and no data is transmitted to Microsoft. The legal basis for storing and reading information on your device is Section 25(1) TDDDG (German Telecommunications Digital Services Data Protection Act); the legal basis for the subsequent processing is Art. 6(1)(a) GDPR (consent).
The following is processed: IP address, device and browser information, screen resolution, referrer, pages accessed, time spent, and interaction events (mouse movements, clicks, scrolling, keyboard events without content). The IP address is transmitted to Microsoft and, according to Microsoft, is processed there to determine an approximate location and to prevent misuse, but is not stored permanently in plain text. Entries in form fields (in particular your e-mail address during checkout) are always masked by Clarity and not transmitted. In addition, our project is set to the strictest masking level, so that the remaining page content is masked as well. For this, Clarity may set the cookies _clck (retention period 1 year) and _clsk (retention period 1 day); whether and which of these cookies are set depends on the configuration and on your browser. Depending on configuration, Clarity may additionally access identifiers from Microsoft's advertising network (_uetvid, _uetmsclkid). We do not run advertising through Microsoft and do not use these identifiers.
Microsoft also processes the data in the USA. A data processing agreement (Microsoft Data Protection Addendum) under Art. 28 GDPR is in place with Microsoft; Microsoft Corporation is certified under the EU-US Data Privacy Framework, for which an adequacy decision by the EU Commission exists. The EU Standard Contractual Clauses apply in addition. More information: privacy.microsoft.com.
4.2 Conversion measurement with the X Ads tag (Twitter)
Current status: Conversion measurement via X is not currently active. As long as this is the case, no script from X is loaded and no data is transmitted to X. The information below will apply once we switch it on; the consent banner will then appear before it first loads.
We run advertisements on X (formerly Twitter). To measure whether such an advertisement actually led to someone building a Building, we use the conversion tag ("Universal Website Tag") of Twitter International Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland. For users outside the EU, X Corp., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA, is responsible.
The tag is only loaded after you click "Accept" in the consent banner. Without your consent, no script from X is loaded and no data is transmitted to X. The legal basis for storing and reading information on your device is Section 25(1) TDDDG; the legal basis for the subsequent processing is Art. 6(1)(a) GDPR (consent).
The following is processed: IP address, device and browser information, page accessed, referrer, timestamp, and the advertising click identifier that X appends to this page's address when an advertisement is clicked (the twclid parameter). This identifier is stored by the tag on this domain (_twclid). X itself may set its own cookies on its domains when the tag loads. If a Building is purchased, we additionally transmit an event with the order value, currency and order number. We do not transmit any e-mail address, name or payment data to X.
The event is triggered only at the moment a purchase is completed, not on every page view.
Data is transferred to the USA. The transfer is based on the EU Standard Contractual Clauses used by X under Art. 46(2)(c) GDPR, as well as your express consent under Art. 49(1)(a) GDPR. A level of data protection equivalent to European law cannot be guaranteed in the USA in every case; in particular, access by US authorities is possible. According to X, it also processes the transmitted data for its own purposes, for example to build audiences. Details can be found in X's privacy policy at x.com/en/privacy.
4.3 Withdrawing consent
Withdrawal: You can withdraw your consent at any time with effect for the future. This deletes the identifiers set on this domain by Clarity and the X tag (_clck, _clsk, _twclid).
5. Orders and contract processing
When you place an order, we process: e-mail address, company/project name, website address, short text, logo, favicon, chosen building type and colour, plot address, order number, prices, timestamps, processing status, and the transaction identifiers provided by PayPal (order ID, capture ID). When booking an advertising board in Web Square, we process, correspondingly, e-mail address, company/project name, website address, short text, logo, the advertising board number, and order and payment data. We do not receive any bank details or card data from PayPal.
The purpose is performance of the contract (display of the Building, sending confirmation, owner link and receipt, content review, processing of refunds). The legal basis is Art. 6(1)(b) GDPR. Order and payment data is additionally retained for ten years to comply with statutory retention obligations under commercial and tax law (Art. 6(1)(c) GDPR, Sections 147 AO, 257 HGB).
Only the following is publicly visible: company/project name, website address, short text, logo, favicon, building type, colour, address in the city, and move-in date; for advertising boards, the company/project name, website address, short text and logo on the booked board. The e-mail address and payment data are never published.
6. Referral programme
If you take part in the referral programme (Section 14 of the Terms and Conditions), we process your e-mail address, your referral code, the Building you named, the time of your confirmation, and the number of orders placed through your link and the floors granted as a result. The legal basis is Art. 6(1)(b) GDPR (performance of the participation arrangement).
The confirmation e-mail serves as proof that participation is genuinely wanted by you; the additional legal basis for this is Art. 6(1)(f) GDPR (legitimate interest in preventing abusive sign-ups).
No tracking, no cookies. When a person opens WEBHATTAN via a referral link, the code it contains is held only in the browser's memory for the duration of that page visit, and is only transmitted to us if that person places an order during the same visit. No cookies are set, nothing is stored in the device's local storage, and there is no cross-device recognition. Consent under Section 25(1) TDDDG is not required for this. We do not learn who viewed your link but did not order anything.
We only ever show the referring person the number of successful referrals. The identity, e-mail address and order data of the referred person are not disclosed to them.
7. Payment processing via PayPal
Payment is made via PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. During checkout you are redirected to PayPal; you enter your payment details directly with PayPal there. We transmit the amount, currency, an order reference and a description of the service to PayPal. PayPal transmits the payment status and transaction identifiers to us. The legal basis is Art. 6(1)(b) GDPR. PayPal's privacy policy applies: paypal.com/en/legalhub/privacy-full.
8. Sending e-mails
We send confirmations, owner links, receipts and moderation notices by e-mail to the address given at the time of the order. Delivery is handled via Brevo SA, France. The legal basis is Art. 6(1)(b) GDPR. We only send marketing e-mails with separate consent (Art. 6(1)(a) GDPR), which can be withdrawn at any time.
9. Owner area, storage in the browser
The owner area is accessed via a personal link. The key it contains is stored on our server exclusively in hashed form. In the customer's browser, the key is stored in local storage (localStorage) so the owner area can be opened without entering it again. This is technically necessary for the service (Section 25(2) No. 2 TDDDG). No further cookies or storage access take place. A password may optionally be set; it is stored exclusively as a hash (scrypt).
10. Uploaded images
Logos and favicons are checked on our server, stripped of metadata (e.g. EXIF data), converted to fixed sizes, and stored for display. Original files are not served. Storage takes place on our own server at hosttech GmbH (server location Switzerland).
11. Recipients and transfers to third countries
Recipients of personal data are the hosting provider (hosttech GmbH), the e-mail service provider (Brevo SA), PayPal and — only where consent has been given — Microsoft and X/Twitter (both under 4.). Because our server is located in Switzerland, the data processed there is stored in a country outside the EU/EEA. An adequacy decision by the EU Commission exists for Switzerland, so its level of data protection is treated as equivalent to that of the EU. A transfer to further third countries only takes place where an adequacy decision or appropriate safeguards (EU Standard Contractual Clauses) are in place.
12. Retention period
Order and payment data: ten years (statutory retention). Public building data: for the duration of display, then deleted within 30 days. Server logs: see 2. Clarity and X identifiers: see 4. Reservations without an order: deleted automatically once they expire.
13. Your rights
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing based on Art. 6(1)(f) GDPR (Art. 21). You can withdraw any consent given at any time with effect for the future. Please contact us using the details given under 1. You also have the right to lodge a complaint with a data protection supervisory authority, in particular the authority responsible for us: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2-4, 40213 Düsseldorf, Germany.
14. Automated content review
Company name, short description, website link, and uploaded logos and favicons are automatically checked for obvious legal violations (e.g. offensive, discriminatory or unlawful content). If a violation is detected, the order cannot be completed, or the file cannot be uploaded. If a submission passes this automated check, the Building is published without any further manual step. We may review, block or remove published content at any later time if we become aware of a violation. No profiling in the sense of an evaluation of your person takes place.
15. Security
The website is served exclusively over TLS-encrypted connections (HTTPS). Access keys and passwords are stored only as hashes. Prices are calculated exclusively server-side, and payments are confirmed server-side with PayPal.
Last updated: 14 September 2026.