Privacy Policy
Last updated: September 10, 2026
1. Who We Are
One Coworking GmbH ("One Coworking", "we", "us", or "our") operates the One Coworking platform at www.onecoworking.com and associated mobile applications (together, the "Platform"). We are the controller responsible for your personal data unless we process it on behalf of an enterprise client (in which case we act as a processor — see Section 10).
Contact details:
One Coworking GmbH Rudi-Dutschke-Straße 23, 10969 Berlin, Germany Email: privacy@onecoworking.com
2. What Data We Collect
We collect the following categories of personal data when you use the Platform:
| Category | Examples |
|---|---|
| Identity Data | First name, last name, profile picture |
| Contact Data | Email address, phone number |
| Account Data | User ID, login credentials (stored as hashed values only), role and permissions, account preferences, team memberships |
| Booking Data | Booking history, workspace preferences, check-in and check-out records, cancellations |
| Usage & Behavioral Data | Pages visited, features used, booking frequency, engagement metrics |
| Device & Technical Data | IP address, browser type and version, device type, operating system, app version |
| Payment Data | Credit purchase records, transaction history, Stripe customer ID. We do not store credit card numbers — all card data is handled directly by our payment processor, Stripe. |
| Communication Data | Content of transactional emails we send you (booking confirmations, invitations), customer support chat history |
| Diagnostic Data | Error logs and performance data used to maintain and improve the Platform |
We do not collect special categories of personal data (e.g., health data, biometric data, political opinions) as defined under Article 9 GDPR.
3. How We Collect Your Data
We collect personal data in the following ways:
- Directly from you — when you create an account, make a booking, contact support, or update your profile.
- Automatically — when you use the Platform, we collect technical and usage data through cookies, server logs, and similar technologies (see Section 7).
- From your employer — if you are an Authorized User under an enterprise account, your employer may provide us with your name and email address to set up your account.
4. Why We Process Your Data and Legal Basis
| Purpose | Legal Basis (GDPR) |
|---|---|
| Providing the Platform and processing bookings | Performance of a contract (Art. 6(1)(b)) |
| Managing your account and authentication | Performance of a contract (Art. 6(1)(b)) |
| Processing payments and managing credits | Performance of a contract (Art. 6(1)(b)) |
| Sending transactional emails (booking confirmations, receipts, invitations) | Performance of a contract (Art. 6(1)(b)) |
| Customer support via in-app chat | Legitimate interest (Art. 6(1)(f)) — providing effective user support |
| Error monitoring and platform stability | Legitimate interest (Art. 6(1)(f)) — maintaining a reliable service |
| Analytics, session recordings and campaign measurement (Google Analytics, Microsoft Clarity, Sentry Session Replay, Google Ads, HubSpot tracking) | Consent (Art. 6(1)(a); § 25(1) of the German TDDDG) — only once you opt in; you can withdraw it at any time |
| Cookieless usage statistics (Vercel Web Analytics, our own page-event log) | Legitimate interest (Art. 6(1)(f)) — improving our product; nothing is stored on your device |
| Marketing communications | Consent (Art. 6(1)(a)) — you can withdraw consent at any time |
| Compliance with legal obligations (e.g., tax records) | Legal obligation (Art. 6(1)(c)) |
| Automated classification and drafting of enquiry and support messages | Legitimate interest (Art. 6(1)(f)) — responding to enquiries accurately and quickly |
5. Who We Share Your Data With
We share personal data only with service providers who process data on our behalf (processors), or where otherwise required. We do not sell your personal data.
Service Providers (Sub-Processors)
| Provider | Location | Purpose |
|---|---|---|
| Supabase Inc. | Frankfurt, Germany (EU) | Database hosting, user authentication, file storage |
| Vercel Inc. | United States / Global Edge | Application hosting, content delivery, scheduled jobs |
| Stripe Inc. | United States | Payment processing |
| Resend Inc. | United States | Transactional email delivery |
| Functional Software Inc. (Sentry) | Germany (EU) | Error monitoring and diagnostics; session replay only with your consent |
| Intercom Inc. | United States | Customer support messaging and in-app communication |
| Google LLC / Google Ireland Ltd. | United States / Ireland | Platform analytics and advertising measurement via Google Tag Manager (only with your consent), mapping services, and Google Workspace (business email, calendar, file storage) |
| Microsoft Corporation (Clarity) | United States | Session analytics and heatmaps (only with your consent) |
| Anthropic PBC (via the Vercel AI Gateway) | United States | Automated classification and drafting of enquiry and support text |
| Slack Technologies LLC (Salesforce) | United States | Internal operational notifications |
| HubSpot Inc. | United States | CRM records for business enquiries and deals; website tracking only with your consent |
| Make.com (Celonis SE) | European Union (eu2 cluster) | Workflow automation for enquiry intake and booking processes |
| Formagrid Inc. (Airtable) | United States | Operational tables behind those workflows |
| Apollo.io | United States | B2B contact enrichment for business enquiries |
| Granola AI | United States | Meeting transcription and notes |
| Olinda SA (Qonto) | France (EU) | Business banking and invoicing |
| Firecrawl (Mendable) | United States | Website content extraction (no customer personal data) |
Automated Processing
We use large language models, provided by Anthropic via the Vercel AI Gateway, to classify incoming enquiries and support messages and to draft internal summaries and replies. This helps us respond accurately and quickly. These models do not make decisions that produce legal effects concerning you or similarly significantly affect you within the meaning of Art. 22 GDPR — a person reviews every reply before it is sent. Under our agreement with the provider, this data is not used to train their models.
Workspace Hosts
When you book a workspace, we share your name and booking details with the relevant workspace host so they can provide access to the booked space. The host processes your data as an independent controller subject to their own privacy policies.
6. International Data Transfers
Your personal data is primarily stored and processed within the European Economic Area (EEA). Where we use service providers located outside the EEA (see Section 5), we ensure appropriate safeguards are in place:
- EU-U.S. Data Privacy Framework (DPF): Stripe, Google and Intercom are certified under the DPF, which the European Commission has recognized as providing an adequate level of data protection.
- Standard Contractual Clauses (SCCs): For providers not covered by an adequacy decision, we use EU Standard Contractual Clauses as adopted by the European Commission to ensure an equivalent level of protection.
7. Cookies and Tracking Technologies
The Platform uses cookies and similar technologies. Cookies are small text files stored on your device. Apart from what is strictly necessary, nothing is stored on or read from your device until you agree: on your first visit we ask which categories you accept, and “Reject all” is as easy as “Accept all”.
| Category | Purpose | Examples | Legal basis |
|---|---|---|---|
| Strictly necessary | Essential for the Platform to function (authentication, session management, remembering your cookie choice) | Supabase auth cookies, oc_consent |
§ 25(2) no. 2 TDDDG |
| Analytics (only with your consent) | Help us understand how the Platform is used so we can improve it, including recordings of how pages are used (mouse movement, clicks, scrolling) to find usability problems | Google Analytics via Google Tag Manager, Microsoft Clarity, Sentry Session Replay (records a 10% sample of sessions and sessions in which an error occurs; all text is masked and media is blocked) | Consent — § 25(1) TDDDG, Art. 6(1)(a) GDPR |
| Marketing (only with your consent) | Measure which campaigns bring visitors to the Platform | Google Ads via Google Tag Manager, HubSpot tracking code | Consent — § 25(1) TDDDG, Art. 6(1)(a) GDPR |
| Customer support | Our support chat. On our public website it loads only when you open the chat; in your account it loads with the page | Intercom | § 25(2) no. 2 TDDDG — a service you request or use |
Cookieless measurement. Vercel Web Analytics, Vercel Speed Insights and our own page-event log count visits and measure page performance without storing or reading anything on your device. Our own log uses a pseudonymous identifier for this that changes every day.
You can change or withdraw your choice at any time via “Cookie settings” in the footer of our website or in the menu of your account. Withdrawing does not affect the lawfulness of processing before the withdrawal; when you withdraw, we remove the cookies these tools set and reload the page without them.
8. How Long We Keep Your Data
We retain your personal data only for as long as necessary to fulfill the purposes described in this policy:
| Data Type | Retention Period |
|---|---|
| Account data | For the duration of your account, plus 30 days after deletion |
| Booking and transaction data | Up to 10 years after the transaction (German tax law, §§ 147 AO, 257 HGB) |
| Support chat history | Up to 2 years after your last interaction |
| Error logs and diagnostics | Up to 90 days |
| Analytics data | Aggregated and anonymized after 26 months |
When data is no longer needed, we delete it or anonymize it so it can no longer be linked to you.
9. Your Rights
Under the GDPR, you have the following rights regarding your personal data:
- Access (Art. 15) — request a copy of the personal data we hold about you.
- Rectification (Art. 16) — request correction of inaccurate data.
- Erasure (Art. 17) — request deletion of your data ("right to be forgotten"), subject to legal retention obligations.
- Restriction (Art. 18) — request that we limit how we process your data.
- Data Portability (Art. 20) — receive your data in a structured, machine-readable format.
- Objection (Art. 21) — object to processing based on legitimate interests, including profiling.
- Withdraw Consent (Art. 7(3)) — where processing is based on your consent, you can withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, contact us at privacy@onecoworking.com. We will respond within one month as required by law.
You also have the right to lodge a complaint with your local data protection supervisory authority. For Berlin, this is:
Berliner Beauftragte für Datenschutz und Informationsfreiheit Friedrichstr. 219, 10969 Berlin https://www.datenschutz-berlin.de
10. Enterprise Accounts
If you use the Platform as an Authorized User through your employer's enterprise account, your employer is the data controller and One Coworking acts as a data processor on their behalf. In this case, your employer's privacy policy governs the processing of your personal data, and any data subject requests should be directed to your employer in the first instance.
11. Children's Privacy
The Platform is not directed at individuals under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has provided us with personal data, please contact us at privacy@onecoworking.com and we will delete it promptly.
12. Links to Third-Party Websites
The Platform may contain links to websites operated by third parties (e.g., workspace host websites). We are not responsible for the privacy practices of these websites and encourage you to review their privacy policies.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised "Last updated" date. For significant changes, we may also notify you by email or through the Platform.
14. Contact Us
If you have questions about this Privacy Policy, want to exercise your data rights, or have concerns about how we handle your data:
One Coworking GmbH Rudi-Dutschke-Straße 23, 10969 Berlin, Germany Email: privacy@onecoworking.com