Privacy policy

Privacy Policy

We, 2nd home GmbH (hereinafter also referred to as "2nd home" or "we"), take the protection of your personal data very seriously. We treat personal data confidentially and in accordance with the applicable data protection regulations and on the basis of these data protection notices.

With these data protection notices, we would like to inform you about the personal data we collect in the course of using our services and for what purpose the data is processed and used. Additionally, we will inform you about your rights under the applicable data protection law and provide guidance on whom to contact if you have any questions.

These notices neither exempt you from complying with the requirements of the respective applicable law nor do they replace it. In case of a conflict between a provision or regulation of an applicable law and a provision of these data protection notices, the former takes precedence.

1. Name and Address of the Data Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws as well as other data protection provisions is:

2nd home GmbH

Ravensberger Str. 20

33602 Bielefeld

Germany

Email: support@2nd-home.io

2. General Information on Data Processing

2.1 Scope of Processing Personal Data

We process personal data of our users only to the extent necessary to provide a functional website and our content and services. Personal data is generally processed only with the user’s consent. An exception applies in cases where prior consent cannot be obtained for factual reasons and the processing of data is permitted by law.

2.2 Legal Basis for the Processing of Personal Data

Where we obtain consent from the data subject for processing operations involving personal data, Art. 6(1)(a) GDPR serves as the legal basis.

Where processing of personal data is necessary for the performance of a contract to which the data subject is a party, Art. 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations required to carry out pre-contractual measures.

Where processing is necessary for compliance with a legal obligation to which our company is subject, Art. 6(1)(c) GDPR serves as the legal basis.

Where processing is necessary to protect vital interests of the data subject or another natural person, Art. 6(1)(d) GDPR serves as the legal basis.

If processing is necessary for the purposes of legitimate interests pursued by our company or a third party and these interests are not overridden by the interests, fundamental rights and freedoms of the data subject, Art. 6(1)(f) GDPR serves as the legal basis.

2.3 Data Deletion and Storage Period

Personal data will be deleted or blocked as soon as the purpose of storage no longer applies. Storage may also take place if this has been provided for by European or national legislation in EU regulations, laws or other provisions to which the controller is subject. Data will also be blocked or deleted when a storage period prescribed by such regulations expires, unless further storage is necessary for the conclusion or performance of a contract.

3. Collection and Use of Personal Data

3.1 When Visiting the Website

When you access our website, information is automatically sent by your browser to our website server. This information is temporarily stored in a log file. The following information is collected without any action on your part and stored until automatically deleted:

IP address of the requesting computer
Date and time of access
Name and URL of the retrieved file
Website from which access is made (referrer URL)
Browser used and, if applicable, the operating system of your computer and the name of your access provider

This data is processed for the following purposes:

Ensuring a smooth connection setup of the website
Ensuring comfortable use of our website
Evaluating system security and stability
Further administrative purposes

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest follows from the purposes listed above. Under no circumstances do we use the collected data to draw conclusions about your person.

3.2 When Using Our Contact Form or Support System

For questions of any kind, we offer you the opportunity to contact us via a form provided on the website. A valid email address is required so that we know who the request is from and can respond to it. Further information may be provided voluntarily.

Data processing for the purpose of contacting us is carried out in accordance with Art. 6(1)(a) GDPR on the basis of your voluntarily given consent.

The data collected in this context will be deleted once storage is no longer necessary, or processing will be restricted if statutory retention obligations exist.

3.3 When Using Our AI-Powered Design Advisor

On our website you can ask questions to an AI-powered advisor that suggests pieces from our current stock. The answers are generated automatically. Use is voluntary and possible without registration.

What data: the text of your questions, a random session identifier and your IP address. Before further processing, we automatically remove email addresses, phone numbers, postal addresses, bank and card details, order numbers and your name, if you introduce yourself, from your questions. Please nevertheless do not enter any personal data.

Session identifier: It is only created when you open the advisor, stored in the storage of your browser tab (sessionStorage) and deleted when you close the tab. Storing it is strictly necessary so that the advisor you have called up can keep track of the conversation (Section 25 (2) No. 2 TDDDG).

IP address: We use it exclusively to prevent misuse (limiting the number of requests per period) and delete it after 20 minutes at the latest.

Purposes and legal bases: Answering your request and suggesting products (Art. 6 (1) (b) GDPR, pre-contractual measures at your request). Analysis of the cleaned requests without names and contact details, linked only to the random session identifier, to improve our range and our search (Art. 6 (1) (f) GDPR, our legitimate interest in a suitable offer). You can object to this analysis at any time (Art. 21 GDPR), for example by email to support@2nd-home.io.

Recipients: Anthropic, PBC, USA, generates the answers as a processor. The transfer to the USA is based on the EU Standard Contractual Clauses. Anthropic does not use the data to train AI models and generally deletes it after 30 days; content that Anthropic's systems classify as violating its usage policies may be retained for up to two years. Cloudflare, Inc., USA, operates the technical interface as a processor and stores the cleaned requests; Cloudflare is certified under the EU-US Data Privacy Framework. Google provides the database for the analysis as a processor; this data is stored in the EU.

Storage period: We store the cleaned requests and the characteristics derived from them (for example the type of furniture, style or budget searched for) for 13 months, after which they are deleted automatically.

Clicks on suggestions: If you have consented to analytics, we count clicks on the suggested links in Google Analytics (see section 6.1 Google Analytics).

Note: The answers may be incomplete. The information on the respective product page is authoritative.

4. Use of Gorgias for Support Communication

To manage and process support inquiries, we use Gorgias, a customer service platform provided by Gorgias Inc., 34 Harriet St, San Francisco, CA 94103, USA. Gorgias enables us to consolidate support inquiries from various channels such as email and chat into one central system.

When you use our contact form or send an email to support@2nd-home.io, your message is transmitted to and processed by Gorgias. The following personal data may be affected:

Name
Email address
Message content
Technical metadata such as IP address and browser information

The legal basis is Art. 6(1)(f) GDPR, based on our legitimate interest in efficient and structured customer communication. If your request relates to the conclusion or performance of a contract, Art. 6(1)(b) GDPR applies.

Data processing is carried out under a Data Processing Agreement with Gorgias. For EU customers, hosting takes place on servers within the European Union.

Further information can be found in Gorgias’ EU Privacy Policy and their current list of subprocessors.

5. Cookies and Analysis Tools

We use cookies on our website. Cookies are small files automatically created by your browser and stored on your device when you visit our site. Cookies do not cause damage to your device and do not contain viruses or other malware.

Cookies serve to make the use of our website more pleasant. We use session cookies to recognize that you have already visited individual pages. These are automatically deleted after you leave our site.

We also use temporary cookies to optimize user-friendliness. When you revisit our site, it is automatically recognized that you have been here before and which entries and settings you made.

In addition, we use cookies to statistically record the use of our website and evaluate it for the purpose of optimizing our offer.

The data processed by cookies is necessary for the purposes mentioned above in order to safeguard our legitimate interests pursuant to Art. 6(1)(f) GDPR.

Most browsers automatically accept cookies. However, you can configure your browser so that no cookies are stored or so that a notice always appears before a new cookie is created. Completely disabling cookies may mean that you cannot use all website functions.

6. Analysis Tools and Advertising

6.1 Google Analytics

We use Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics uses cookies that enable analysis of your website usage. Information generated by cookies is usually transmitted to a Google server in the USA and stored there.

We have activated IP anonymization. Your IP address is shortened within the EU or EEA before transmission. Only in exceptional cases is the full IP address transmitted to a server in the USA and shortened there.

On our behalf, Google uses this information to evaluate website usage, compile reports and provide further services.

Your IP address transmitted by your browser will not be merged with other Google data.

You can prevent cookie storage through browser settings. You can also prevent Google from collecting and processing data by installing the browser plugin available at:

https://tools.google.com/dlpage/gaoptout

Further information is available at:

https://support.google.com/analytics/answer/6004245

6.2 Microsoft

We work with Microsoft Clarity and Microsoft Advertising to understand how users interact with our website using behavioral data, heatmaps and session recordings. This helps improve and market our products and services.

Website usage data is collected using first and third party cookies and other tracking technologies. We also use this information for optimization, fraud prevention and advertising purposes.

Further information can be found in Microsoft’s Privacy Statement.

7. Data Subject Rights

You have the right:

to request access pursuant to Art. 15 GDPR
to request rectification pursuant to Art. 16 GDPR
to request erasure pursuant to Art. 17 GDPR
to request restriction of processing pursuant to Art. 18 GDPR
to receive your data in a structured, commonly used and machine-readable format pursuant to Art. 20 GDPR
to withdraw consent at any time pursuant to Art. 7(3) GDPR
to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR

8. Right to Object

If your personal data is processed based on legitimate interests pursuant to Art. 6(1)(f) GDPR, you have the right to object pursuant to Art. 21 GDPR.

To exercise your right of objection, simply send an email to support@2nd-home.io.

9. Data Security

We use SSL encryption with the highest encryption level supported by your browser, typically 256 bit encryption.

You can recognize encrypted transmission by the closed lock symbol in your browser.

We also use appropriate technical and organizational measures to protect your data against manipulation, loss, destruction or unauthorized access. Our measures are continuously improved in line with technological developments.

10. Updates and Changes to This Privacy Policy

This Privacy Policy is currently valid as of 18 September 2025 and was last updated regarding the use of Gorgias.

Due to further development of our website or legal changes, it may become necessary to amend this Privacy Policy. The current version can be accessed and printed at any time at: