Privacy Policy

Controller

The controller responsible for the processing of personal data under the General Data Protection Regulation (GDPR) is: workish Spaces GmbH Harzer Str 39 12059 Berlin Germany Registered with: Amtsgericht Charlottenburg (Berlin) Handelsregister: HRB 284737 B VAT ID: DE461733318 Email: hello@workish.berlin For questions regarding data protection or the processing of your personal data, please contact: Email: hello@workish.berlin

Scope of this Privacy Policy

This Privacy Policy explains how workish Spaces GmbH (“Workish”, “we”, “us”) processes personal data when you:

visit our website;
contact us;
become a member of our coworking community;
use our member platform;
book coworking spaces, meeting rooms, events or other services;
receive communications from us;
interact with our marketing, analytics or cookie technologies.

This Privacy Policy applies to:

https://workish.berlin
https://members.workish.berlin
related Workish services and platforms.

Personal Data We Collect

Depending on how you interact with us, we may process the following categories of personal data. 3.1 Website visitors When you visit our website, we may process:

IP address;
browser type and version;
device information;
operating system;
referring website;
pages visited;
date and time of access;
technical usage information.

This information is used to operate, secure and improve our website. 3.2 Contact enquiries When you contact us, we may process:

name;
email address;
telephone number (if provided);
company name (if provided);
contents of your message;
communication history.

We use this information to respond to enquiries and manage communication. 3.3 Membership and account information If you create an account or become a Workish member, we may process:

full name;
email address;
phone number;
company information;
membership information;
account details;
booking history;
invoice and billing information;
communication history;
preferences relating to your membership.

Our membership management, booking and invoicing services are provided through Cobot. 3.4 Bookings and coworking services When you book rooms, desks, events or other Workish services, we may process:

name;
contact details;
booking details;
date and time of bookings;
service history;
membership status;
invoice-related information.

3.5 Payment and billing information To provide paid services, memberships, bookings and other Workish services, we process payment and billing-related information. Depending on the payment method used, payments may be processed through the following providers:

Stripe – for credit card payments;
GoCardless – for SEPA direct debit mandates and payments;
SumUp – for in-person contactless (“tap to pay”) transactions;
Qonto – for business banking services, including receiving customer bank transfers.

These providers process payment-related personal data according to their own privacy policies and security practices. workish does not store full credit card numbers or security codes. Payment card details are handled directly by Stripe or SumUp where applicable. For SEPA direct debit payments, GoCardless processes the necessary mandate and payment information. For bank transfer payments, customers may transfer funds directly to our business bank account held with Qonto. In these cases, we may receive and process information included in the bank transfer, such as:

payer name;
IBAN or account-related information where provided through the banking system;
payment reference;
transaction date;
payment amount.

Membership invoices and billing records are generated and managed through Cobot, our membership and booking platform. Depending on the service provided and payment method used, we may process and store:

customer name;
contact details;
billing address;
company details;
VAT information (where provided);
membership details;
invoice details;
payment status;
transaction references;
payment history.

We process this information for:

providing memberships and services;
managing bookings;
issuing invoices;
confirming payments;
accounting and tax compliance;
handling payment-related enquiries.

Payment and billing records are retained according to applicable legal and accounting requirements.

Purposes and Legal Bases for Processing

We process personal data for the following purposes:

Purpose	Legal basis under GDPR
Providing coworking memberships and services	Art. 6(1)(b) GDPR – performance of contract
Managing bookings and accounts	Art. 6(1)(b) GDPR – performance of contract
Processing payments and invoices	Art. 6(1)(b) and Art. 6(1)(c) GDPR – contract and legal obligations
Responding to enquiries	Art. 6(1)(b) or Art. 6(1)(f) GDPR
Website security and operation	Art. 6(1)(f) GDPR – legitimate interest
Improving our website and services	Art. 6(1)(f) GDPR or Art. 6(1)(a) GDPR where consent is required
Marketing communications	Art. 6(1)(a) GDPR – consent
Legal compliance	Art. 6(1)(c) GDPR

5.2 Analytics cookies With your consent, we use: Google Analytics 4 (GA4) Google Analytics 4 helps us understand how visitors use our website and improve our services. We use GA4 to collect information such as:

pages visited;
interactions with our website;
device and browser information;
traffic source information;
approximate location information;
usage patterns.

Where applicable, we may use User-ID functionality to better understand interactions with our services and provide more accurate usage analysis across sessions. User-ID identifiers are used for analytics purposes and are not intended to directly identify individuals within Google Analytics reports. Google Analytics is provided by Google. Google may process collected information in accordance with its own privacy policy and may process data outside the European Economic Area. Where required, appropriate safeguards are used for international transfers. You can manage or withdraw your consent for analytics cookies at any time through our CookieYes cookie banner. 5.3 Advertising and marketing technologies We use advertising and marketing measurement technologies to understand and improve our marketing activities. These may include: Google Ads We use Google Ads for online advertising and may use advertising-related measurement features connected with Google Analytics. Depending on your consent and configuration, Google Ads technologies may process information such as:

website interactions;
advertising campaign performance;
device information;
online identifiers;
interactions with advertisements.

We may use these technologies to measure the effectiveness of advertising campaigns and improve the relevance of our marketing activities. Meta We may use Meta technologies for analytics, advertising measurement and campaign optimisation. Meta technologies may process information such as:

website interactions;
device information;
online identifiers;
advertising interactions.

These technologies are only activated where appropriate consent has been obtained. You can manage your preferences through our CookieYes cookie banner.

Service Providers and Processors

We use trusted third-party service providers to support the operation of our website, coworking services, payments, communications and business administration. Where required under GDPR, we enter into appropriate data processing agreements with these providers. Our service providers include:

Provider	Purpose
SiteGround	Website hosting
WordPress	Website content management
Cobot	Membership management, bookings, customer accounts and invoicing
Stripe	Credit card payment processing
GoCardless	SEPA direct debit payment processing
SumUp	In-person payment processing
Qonto	Business banking and receiving bank transfers
Google Workspace	Business email, file storage, calendars and collaboration tools
Google Analytics 4	Website analytics
Google Ads	Advertising services where applicable
Meta	Website analytics and marketing services where applicable
Mailchimp	Newsletter and marketing communications
CookieYes	Cookie consent management
Lexoffice	Accounting and financial administration
Google Forms	Event registrations and contact forms
Sensorberg	Mobile access to Workish spaces
Slack	Community communication

These providers may process personal data only to the extent necessary to provide their services to Workish.

Newsletter and Marketing Communications

If you subscribe to our newsletter or marketing communications, we process:

name;
email address;
subscription preferences;
engagement information such as whether emails are opened or links are clicked.

Our newsletter provider is: Mailchimp You may unsubscribe from marketing communications at any time using the unsubscribe link in our emails.

International Data Transfers

Some of our service providers may process personal data outside the European Economic Area (EEA). Where personal data is transferred outside the EEA, we ensure that appropriate safeguards are in place in accordance with the GDPR. These safeguards may include an adequacy decision by the European Commission, Standard Contractual Clauses approved by the European Commission, or other legally recognised transfer mechanisms.

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, to provide our services, to comply with legal obligations, and to protect our legitimate interests. Retention periods vary depending on the type of data and the reason it is processed. In determining retention periods, we consider factors such as legal requirements, contractual obligations, business needs and security considerations. Examples include:

Membership, account and booking information: retained for the duration of your membership or business relationship and for a reasonable period afterwards where necessary for legal, accounting or dispute-resolution purposes.
Invoice and financial records: retained for the periods required under applicable German commercial and tax laws.
Payment records: retained as necessary for accounting, fraud prevention and legal compliance.
Contact enquiries: retained for as long as necessary to handle your request and maintain relevant communication records.
Marketing communications data: retained until you withdraw your consent or request removal.
Website and technical data: retained only for as long as necessary for security, analytics and operational purposes.

When personal data is no longer required, we securely delete or anonymise it.

Data Security

We use appropriate technical and organisational measures to protect personal data against:

unauthorised access;
accidental loss;
misuse;
alteration;
disclosure.

However, no internet-based service can guarantee complete security.

Your Rights Under GDPR

You have the right to:

request access to your personal data;
request correction of inaccurate data;
request deletion of your data where applicable;
request restriction of processing;
object to certain processing activities;
request data portability;
withdraw consent at any time where processing is based on consent.

To exercise your rights, please contact: hello@workish.berlin You also have the right to lodge a complaint with a data protection supervisory authority. The competent supervisory authority for workish Spaces GmbH is: Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit) Friedrichstr. 219 10969 Berlin Germany Website: https://datenschutz-berlin.de

Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices, content or security of external websites. We recommend reviewing their privacy policies before providing personal information.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements or data processing practices. The latest version will always be available on our website. Contact If you have questions about this Privacy Policy or our processing of personal data, please contact: workish Spaces GmbH Harzer Str 39 12059 Berlin Germany hello@workish.berlin