Privacy Policy

Privacy Policy of CoStore Holding GmbH

CoStore appreciates your interest in our company and our services. We want you to feel comfortable when contacting us. Therefore, the security of your personal data that arises when you contact CoStore – such as name, address, phone number, or email address – is an important concern for us.

This privacy notice is addressed to all persons with whom CoStore (“we” or “us”) interacts, including customers, potential customers, prospects, visitors to our websites, users of our apps/applications, other users of our products or services, and visitors to our locations (“you” or “your”). It contains the information required under Articles 13 and 14 of the GDPR.

Definitions

The processing of personal data is carried out in accordance with statutory provisions. Personal data means any information relating to an identified or identifiable natural person. Processing includes any operation related to personal data – such as collection, recording, storage, adaptation, use, transmission, or deletion. Further terms correspond to the definitions in Article 4 of the GDPR.

Name and Address of the Controller

CoStore Holding GmbH
Große Rheinstrasse 22
76661 Philippsburg, Germany

1. General Processing Purposes and Legal Bases

We collect and process your personal data in particular in the following cases:

• When you contact us directly – for example via our website, our customer service, or during on-site visits.
• When you participate in surveys, promotions, or competitions.
• When you are interested in our storage solutions or other services.
• When you or your company rent storage space or use additional services.
• When you or your company request information about our offerings.
• When you or your company use or promote our services.

Please keep your information up to date and inform us of any changes – particularly your contact details.

We process the following data in particular: name, address, phone number, email address, company name (if applicable), role, business contact details, as well as contract and transaction data, insofar as they are necessary for the business relationship.

Processing for Contractual Purposes and Website Use

We process personal data for the reservation, rental, and management of storage spaces as well as for the execution of rental agreements and additional services, in particular:

• Booking enquiries and quotation preparation
• Creation and management of rental agreements
• Access control and use of rented spaces
• Customer service and support
• Invoicing, payment processing, dunning
• Handling of complaints and damage claims
• Technical provision of the website

Data Categories

• Contact data: Name, address, phone, email
• Business information: Company name, role, VAT ID
• Booking data: Rented space, rental start date
• Payment data: Payment status, references, transaction data
• Access data: Digital codes, key management
• Communication data: Support histories

Email Dispatch via Kinnovis

Booking, management, and cancellation are processed through our partner Kinnovis. You will receive transaction-related emails (e.g., contract documents, direct debit information, invoices) pursuant to Art. 6(1)(b) GDPR. These are necessary for contract performance and cannot be unsubscribed from.

More information: https://kinnovis.com/privacy-policy/

Data Sharing with Service Providers

• Kinnovis – Booking and contract platform
• Stripe – Payment service provider. Privacy policy: stripe.com/de/privacy
• Debt collection agencies or lawyers – in the case of outstanding claims

Central Registration Service

User registration is carried out via Kinnovis (www.kinnovis.com). The data processed includes name, email address, phone number, and company name (if applicable).

Debt Management

In the event of payment arrears, data (name, address, contract and invoice data) may be transmitted to debt collection agencies or lawyers. Legal basis: Art. 6(1)(f) GDPR (legitimate interest).

Storage and Deletion

Personal data is stored for as long as it is necessary for contract processing. Statutory retention periods apply thereafter. Enquiries are deleted no later than 12 months after completion, unless statutory obligations require otherwise.

Data Processing Agreements

Data processing agreements pursuant to Art. 28 GDPR are in place with all service providers to ensure data protection and data security.

2. Participation in Events and On-Site Visits

We process personal data for the organisation, execution, and follow-up of visits and events.

Purposes of Data Processing

• Planning and execution of site visits and events
• Provision of information and materials
• Admission control and visitor management
• Creation of photo and video recordings for documentation and public relations

Processed Data Categories

• Contact data: Name, address, phone number, email
• Company data: Company name, position
• Visit information: Date, time, purpose
• Photo and video recordings (if taken)

Coordination and Planning

We use Microsoft services for scheduling and coordination. Legal basis: Art. 6(1)(b) GDPR. Privacy notice: microsoft.com/de-de/privacy/privacystatement

Participation Without Registration

At publicly accessible events, photo and video recordings may be made for documentation and public relations purposes. Signs on-site inform visitors about photo and video recordings. If you do not wish to be recorded, please speak to the event team.

Right to Object

You may object to the processing of photo and video data for personal reasons. Please inform us or the photographers on-site.

3. Use of Service Offerings (Consultation)

In addition to our products, we offer service and consultation via phone, email, contact form, WhatsApp Business, chatbot (JaneGPT by Kinnovis), our own AI-powered website chatbot, or on-site. Bookings or contract conclusions are made exclusively via Kinnovis.

Purposes of Data Processing

• Processing of enquiries regarding our services
• Technical consultation and customer service
• Assistance with booking and management (without contract conclusion)
• Documentation of customer enquiries for service quality

Processed Data Categories

• Contact data: Name, address, phone number, email
• Company data: Company name, position
• Communication data: Content of customer enquiries

AI-Powered Processing of Customer Enquiries

We use AI services to support our customer communication. This includes the automated analysis and, where applicable, response to customer enquiries across various communication channels (email, contact form, WhatsApp, website chatbot, phone). Processing is based on our legitimate interest in efficient customer service (Art. 6(1)(f) GDPR). When using our website chatbot, processing is additionally based on your consent (Art. 6(1)(a) GDPR).

As part of this automated processing, the content of your enquiries and associated contact data are transmitted to the following AI service providers:

Service Provider	Purpose	Server Location	Privacy Notice
OpenAI (ChatGPT)	AI-powered analysis and response to customer enquiries	USA	openai.com/policies/privacy-policy
Anthropic (Claude)	AI-powered analysis and response to customer enquiries, website chatbot	USA	anthropic.com/privacy
Make (Celonis SE)	Automation platform for routing and processing of enquiries	EU	make.com/en/privacy-notice

The use of OpenAI and Anthropic may involve the transfer of personal data to the USA. The transfer is based on Standard Contractual Clauses (Art. 46(2)(c) GDPR) and/or the EU-US Data Privacy Framework. Your messages are stored for quality improvement purposes for up to 30 days. You have the right to object to AI-powered processing and to request that your enquiry is handled exclusively by our staff.

Website Chatbot

We operate our own AI-powered chatbot on our website. This chatbot uses the automation platform Make (EU servers) and the AI service Claude by Anthropic to process your enquiries. When using the chatbot, you will be informed about the AI processing beforehand and asked for your consent. Without your consent, no AI-powered processing takes place. You can leave the chatbot at any time and contact us alternatively by phone, WhatsApp, or email.

Data Sharing with Service Providers

• Kinnovis (JaneGPT chatbot) – Automated processing of customer enquiries
• WhatsApp Business – Communication with our support. Privacy policy: whatsapp.com/legal/privacy-policy. A data processing agreement pursuant to Art. 28 GDPR is in place with WhatsApp Business. Please note that data may be processed outside the EU.

Storage and Deletion

Service enquiries are stored for up to 12 months after processing and then deleted, unless statutory retention periods apply. AI-processed messages are deleted by the AI service providers after a maximum of 30 days.

4. Newsletter

We offer newsletter services to regularly inform you about products, services, and offers.

Purposes of Data Processing

• Sending email newsletters with current offers
• Personalisation of content based on your interests (with consent)
• Statistical analysis (open and click rates, if consented to)

Processed Data Categories

• Contact data: Email address, optionally name
• Interaction data: Open rates, clicks (with consent)

Registration and Double Opt-In Procedure

We use a double opt-in procedure for newsletter registration:

• After registration, you will receive a confirmation email with a link.
• Only after confirmation will your email address be added to our mailing list.
• If no confirmation is received, the registration is automatically deleted after 30 days.

Unsubscribing from the Newsletter

You can unsubscribe from the newsletter at any time via an unsubscribe link in each email or by contacting us directly.

Data Sharing and Mailing Service Provider

We use the email marketing service provider Klaviyo to send our newsletters. Your data is processed exclusively on our behalf. More information: https://www.klaviyo.com/legal. Klaviyo acts as a data processor pursuant to Art. 28 GDPR.

Storage and Deletion of Data

We store your email address and preferences for as long as you are subscribed. After unsubscribing, the data is deleted within 30 days.

5. CRM System and Data Storage (Twenty)

To manage our customer relationships and centrally store communication data, we use the CRM system Twenty in its cloud version.

Purposes of Data Processing

• Central storage and management of customer data and communication histories
• Tracking of enquiries and service processes
• Improvement of service quality and customer care
• Analysis and documentation of customer interactions

Processed Data Categories

• Contact data: Name, email address, phone number, address
• Company data: Company name, position
• Communication data: Emails, chat histories, enquiries, notes
• Interaction data: Timestamps and channels of contact

Hosting and Data Transfer

Twenty is operated as a cloud service. Data is hosted on Amazon Web Services (AWS) servers in the USA. The data transfer to the USA is based on Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR and, where applicable, the EU-US Data Privacy Framework. More information: https://twenty.com/legal/privacy

Legal Basis

Processing is based on our legitimate interest in efficient customer management (Art. 6(1)(f) GDPR) and for contract performance (Art. 6(1)(b) GDPR).

Storage and Deletion

Customer data is stored in Twenty for the duration of the business relationship or as required by statutory retention periods. After the purpose of processing ceases, data is deleted or anonymised.

6. Access to Premises and Video Surveillance

In connection with the use of our storage spaces and access to our locations, we process personal data for access control, security, and surveillance:

• Recording of access data when using our digital access systems
• Surveillance of locations via video monitoring to protect against theft or vandalism
• Identification of vehicles and relevant image recordings in the event of a security issue
• Sharing of relevant data with law enforcement authorities
• Evidence preservation in cases of violations of our Terms and Conditions

Video Surveillance

Our locations are equipped with visible video surveillance. Video surveillance is carried out in particular:

• For burglary prevention and investigation of theft or vandalism
• To ensure compliance with the terms of use of our storage spaces
• For evidence preservation in security-related incidents
• To control and ensure orderly operations
• To document and address violations of our Terms and Conditions

Video recordings are generally stored for a maximum of 14 days and then automatically deleted, unless security-related incidents require longer storage.

Surveillance by Third-Party Providers

For enhanced security, we work with external security service providers who monitor the video surveillance in real-time outside our business hours (10:00 PM – 8:00 AM).

Video Surveillance Notices

Video surveillance is indicated by appropriate signs at our locations. You have the right to request information about stored recordings or to object to the processing.

7. Corporate Communications and Public Relations

As part of our corporate communications, we process personal data for event documentation, press work, and digital media appearances:

• Creation and publication of photo and video recordings
• Provision of company information on our website and social media
• Communication with customers, business partners, and the public
• Use of testimonials or experience reports for marketing purposes

Photo and Video Recordings at Events

Recordings may be published on the CoStore website, social media (LinkedIn, Facebook, Instagram), and in print or online publications. If you do not wish recordings of you to be published, you may object at any time.

8. Compliance, Legal Enforcement, and Crime Prevention

We process personal data for the assertion, exercise, or defence of legal claims:

• Investigation, prevention, and resolution of fraud or legal violations
• Enforcement of our Terms and Conditions
• Fulfilment of statutory requirements (tax and commercial retention obligations)
• Cooperation with law enforcement authorities and courts

Promotional Communication and Market Research

Where legally permissible or with your consent, we process data for promotional communication, customer satisfaction surveys, promotions, and competitions.

Fulfilment of Legal Obligations (Art. 6(1)(c) GDPR)

We are subject to statutory obligations for processing and retaining personal data, e.g., under the German Commercial Code (HGB) and the German Fiscal Code (AO).

Further Processing Purposes

Data processing also takes place for quality management, improvement of customer satisfaction, development of products and services, and improvement of IT security.

9. Technologies on Our Website

Essential Technologies

We use the following service providers for the technical provision and security of our website:

Service	Purpose	Privacy Notice
Amazon Web Services (AWS)	Hosting and cloud services	aws.amazon.com/privacy
Webflow	Web design and hosting platform	webflow.com/legal/privacy
Stripe	Payment service provider (incl. fraud prevention)	stripe.com/de/privacy
Kinnovis	Booking and contract management platform	kinnovis.com/privacy-policy
Consentmanager	Cookie consent management (GDPR)	consentmanager.de/datenschutz
Cloudflare	Security and performance service (DDoS protection, CDN)	cloudflare.com/privacypolicy
Amazon CloudFront	Content Delivery Network (CDN)	aws.amazon.com/cloudfront
Google Maps	Map service for location display, navigation, and location analysis	policies.google.com/privacy
OpenStreetMap	Map service for location analysis and partner properties (IP address transmitted)	osmfoundation.org/Privacy_Policy
Google Fonts	Provision of fonts (IP addresses may be processed)	fonts.google.com/about
jsDelivr	Provision of icons and libraries	jsdelivr.com/privacy-policy
Unpkg	Provision of static files	unpkg.com
Sipgate (Satellite)	Online telephony for receiving calls	sipgate.de/datenschutz
ClickSend	Sending SMS notifications (phone number and message content)	clicksend.com/privacy-policy
Microsoft Outlook / Microsoft 365	Email communication and calendar management (cloud)	privacy.microsoft.com

Additional Technologies (Analytics, Marketing, Communication)

Service	Purpose	Privacy Notice
Google Analytics	Web analytics (IP anonymisation enabled)	policies.google.com
Google Tag Manager	Management of marketing and tracking tags	policies.google.com
Google Ads Remarketing	Interest-based advertisements	policies.google.com/technologies/ads
Facebook Plugin	Integration of Facebook features	facebook.com/about/privacy
Facebook Remarketing	Personalised advertisements (Custom Audiences)	facebook.com/about/privacy
Facebook Lead Ads	Capture of user enquiries via Facebook ad forms	facebook.com/about/privacy
Klaviyo	Email marketing for newsletters and communication	klaviyo.com/legal/privacy-policy
Microsoft Booking Tool	Online appointment booking	privacy.microsoft.com
Microsoft Forms	Online forms for customer enquiries and feedback	privacy.microsoft.com
WhatsApp Business	Customer communication (GDPR-compliant)	whatsapp.com/legal

10. Data Transfers to Third Countries

In the course of our business activities, personal data may be transferred to countries outside the EU/EEA, in particular to the USA. This applies to the following services, among others:

• OpenAI (ChatGPT) – USA
• Anthropic (Claude) – USA
• Twenty CRM (hosted on AWS) – USA
• ClickSend – Australia
• Stripe – USA
• Google Services (Analytics, Maps, Fonts, Ads) – USA
• Meta/Facebook – USA
• WhatsApp/Meta – USA
• Amazon Web Services (AWS) – worldwide
• Cloudflare – USA/worldwide
• Microsoft 365 – USA/EU

Transfers are based on adequacy decisions by the European Commission, Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR, and/or the EU-US Data Privacy Framework.

11. Legal Bases for Processing

• Art. 6(1)(a) GDPR (Consent): E.g., AI processing in the website chatbot, cookies, marketing, surveys.
• Art. 6(1)(b) GDPR (Contract Performance): Provision of our services, processing of enquiries.
• Art. 6(1)(c) GDPR (Legal Obligation): Tax or accounting obligations.
• Art. 6(1)(f) GDPR (Legitimate Interest): Optimisation, security measures, direct marketing, efficient customer service, AI-powered processing of email and telephone enquiries.

When sharing data with service providers, we ensure compliance with data protection requirements (data processing agreements, Standard Contractual Clauses).

12. Storage Duration and Deletion of Data

We store personal data only for as long as necessary. The following periods apply:

• Communication data (emails, enquiries): Maximum 12 months after completion.
• AI-processed messages: Maximum 30 days with the AI service providers.
• CRM data (Twenty): For the duration of the business relationship, then in accordance with statutory retention periods.
• Contract-related data: 6 years (commercial law), 10 years (tax law).
• Marketing and analytics tools: Maximum 24 months.
• Cookies: Up to 12 months.
• Video recordings: Maximum 14 days.

If deletion is not possible, processing will be restricted.

13. Your Rights as a Data Subject

• Right of access (Art. 15 GDPR): Information about processed data.
• Right to rectification (Art. 16 GDPR): Correction of inaccurate data.
• Right to erasure (Art. 17 GDPR): Deletion of your data (unless retention obligations apply).
• Right to restriction of processing (Art. 18 GDPR): Restriction under certain circumstances.
• Right to data portability (Art. 20 GDPR): Receive data in a machine-readable format.
• Right to object (Art. 21 GDPR): Object on grounds relating to your particular situation.
• Right to withdraw consent (Art. 7(3) GDPR): At any time with effect for the future (e.g., AI processing, newsletter, cookies).
• Right to lodge a complaint (Art. 77 GDPR): Complaint with a data protection supervisory authority, in particular with the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg).

14. Data Security

We implement technical and organisational measures:

• Encrypted data transmission (SSL/TLS)
• Access and authorisation concepts
• Regular security updates
• Data minimisation

When using third-party services (social media, cloud services, AI services), additional security risks may exist.

15. Data Protection Contact

For all questions regarding the processing of personal data:

Marcel Philipp Lang
Email: datenschutz@costore.de

As of: 03.03.2026