Privacy policy

Last updated: October 2026

Thank you for your interest in MACHWERK. This policy explains which personal data we process when you visit our website, contact us or book something with us, why we do it and what rights you have. The German version of this policy is legally binding.

1. Controller

MACHWERK GmbH
Holzmarktstraße 66
10179 Berlin, Germany
Represented by the managing director Rami Gramelsberger Alsaleh
Phone: +49 (0) 176 588 836 76
Email: [email protected]

We have not appointed a data protection officer because we are not legally required to. If you have questions about data protection, just write to [email protected].

2. Legal bases

We only process data where the General Data Protection Regulation (GDPR) allows it, in particular:

  • Art. 6(1)(a) GDPR – you have given consent (e.g. to statistics cookies),
  • Art. 6(1)(b) GDPR – processing is necessary for a contract or a pre-contractual enquiry (e.g. a booking or membership),
  • Art. 6(1)(c) GDPR – we are legally obliged to (e.g. keeping invoices),
  • Art. 6(1)(f) GDPR – we have a legitimate interest (e.g. running the website securely and reliably).

Storing and reading information on your device is also governed by Section 25 of the German TDDDG: we only set cookies that are not technically necessary with your consent.

3. Hosting and server logs

Our website is hosted by Raidboxes GmbH, Hafenstraße 32, 48153 Münster, Germany, on servers in the EU. When you visit the website, the server automatically stores technical data in log files: IP address, date and time, page requested, amount of data transferred, browser and operating system, and the previously visited page. This is necessary to deliver the website and detect attacks (Art. 6(1)(f) GDPR). The logs are deleted after 7 days at the latest. We have a data processing agreement with Raidboxes.

4. Cloudflare

To protect against attacks and to load faster, our website runs through the Cloudflare network (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). Connection data such as your IP address is routed through Cloudflare. The legal basis is our legitimate interest in a secure and fast website (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-US Data Privacy Framework; standard contractual clauses also apply. Cloudflare protects email addresses on our website against automated harvesting.

5. Cookies and consent (consentmanager)

On your first visit, a banner asks which cookies and services you agree to. We use consentmanager for this (consentmanager AB, Stockholm, Sweden). Your choice, a banner ID, date and time and technical details about your device are stored so that we can prove your decision and respect it on your next visit (Art. 6(1)(c) and (f) GDPR). You can change or withdraw your choice at any time via the cookie icon in the bottom left corner of every page. Services that require consent are only loaded after you have agreed.

6. Contact form, email and phone

If you contact us via the contact form, by email or by phone, we process your details (e.g. name, email address, phone number, message) to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where a contract is concerned, otherwise our legitimate interest in answering your enquiry (Art. 6(1)(f) GDPR). The form contains an invisible anti-spam field but no third-party captcha. For our emails we use Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) as a processor. Data may also be transferred to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework. We delete enquiries once they have been dealt with, unless statutory retention obligations apply.

7. Bookings, membership and events (Cobot)

Memberships, day passes, room bookings, the member login and the event list on our “Community & events” page run via Cobot, a service of Upstream – Agile GmbH, Harzer Str. 39, 12059 Berlin, Germany. Cobot stores the data on servers in the EU. When you click a booking button, you go to Cobot’s pages, where you enter the data needed for the booking (e.g. name, email, billing address, payment details). The legal basis is the performance of a contract (Art. 6(1)(b) GDPR). The event list is loaded directly from Cobot when you open the page; your IP address is transmitted to Cobot (Art. 6(1)(f) GDPR). Cobot processes the data on our behalf (Art. 28 GDPR).

If a company books desks for its team (e.g. Team Desks), we receive the team members’ names and email addresses not from them directly but from the person making the booking. We only use these details to give team members access and to inform them about running the coworking space (Art. 6(1)(b) and (f) GDPR).

If you pay via Cobot, Cobot passes the data needed for this to the respective payment provider, depending on the payment method you choose. The payment provider is itself responsible for this data, and its privacy policy applies. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR).

8. Tour appointments (YouCanBook.me)

We use YouCanBook.me (AI Software (Capacity) UK Ltd, Bedford Heights, Brickhill Drive, Bedford, MK41 7PH, United Kingdom) for tour appointments. When you book an appointment, YouCanBook.me processes your name, email address and the chosen time and adds the appointment to our calendar (Art. 6(1)(b) GDPR). The European Commission has issued an adequacy decision for the United Kingdom. YouCanBook.me also stores data with Amazon Web Services in the USA; the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses apply.

9. Google Analytics and Google Tag Manager

Only if you agree in the banner, we use Google Analytics 4 via the “Site Kit by Google” plugin and Google Tag Manager (both provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). This shows us, for example, which pages are visited and how often, so we can improve the website. Cookies are set and usage data such as a shortened IP address, pages visited, time spent, device and approximate location are processed. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time with effect for the future. Data may be transferred to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework. Event data is deleted after 2 months, user-level data after 14 months.

10. Script library from cdnjs

For the event list, our website loads a small script library (Handlebars) from cdnjs, a service of Cloudflare, Inc. (see section 4). Your IP address is transmitted to Cloudflare. The legal basis is our legitimate interest in the page working correctly (Art. 6(1)(f) GDPR).

11. Fonts

All fonts are hosted on our own server. No connection to Google Fonts is made when you visit the website.

12. Links to social networks and Google Maps

Our website links to our profiles on Instagram, Facebook and LinkedIn, to Google Maps and to our Google reviews. These are plain links: only when you click one do you go to the respective provider, whose privacy policy then applies. No data is sent to these providers before that.

13. Encryption

For security reasons, our website uses SSL/TLS encryption. You can recognise it by “https://” and the padlock symbol in your browser’s address bar. This means that data you send to us cannot be read by third parties.

14. Our profiles on social networks

We have our own profiles on Instagram and Facebook (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland) and on LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland). When you visit or interact with these profiles, the respective operator processes your data under its own privacy policy, including in the USA; Meta and LinkedIn are certified under the EU-US Data Privacy Framework for this. For the statistics on our pages (“Insights”), we are joint controllers with Meta or LinkedIn respectively (Art. 26 GDPR); the operators provide agreements for this and take primary responsibility, including for fulfilling your rights. We process messages and comments you send us there in order to reply and run our profiles (Art. 6(1)(f) GDPR). You can exercise your rights most effectively directly with the respective operator, but you can also contact us.

15. Job applications

If you apply to us, for example by email, we process your details and documents to decide on an employment relationship (Art. 6(1)(b) GDPR). If we do not end up working together, we delete your documents no later than six months after the end of the process, unless you have agreed to longer storage.

16. Obligation to provide data and automated decisions

You are under no legal or contractual obligation to provide us with personal data. However, for a booking, a membership or a reply to your enquiry we need certain details (e.g. name and email address); without them we cannot conclude a contract or reply to you. For a business address, we are also obliged under the German Money Laundering Act (GwG) to verify your identity (Art. 6(1)(c) GDPR). There is no automated decision-making, including profiling (Art. 22 GDPR).

17. Retention

We only keep personal data for as long as is necessary for the respective purpose. We then delete it, unless statutory retention periods require otherwise (under German commercial and tax law six, eight or ten years depending on the document, e.g. eight years for invoices and accounting records).

18. In the coworking space: door access, video surveillance and internal organisation

Digital door access (AirKey): Members open the doors with their smartphone via the AirKey system of EVVA Sicherheitstechnologie GmbH, Wienerbergstraße 59–65, 1120 Vienna, Austria. For this we process your name, phone number or device, your access rights and a log of which door was opened when. This is necessary to give you access (Art. 6(1)(b) GDPR) and to protect the space and your property (Art. 6(1)(f) GDPR). EVVA processes the data on our behalf. Your name is automatically removed from the access logs after 90 days.

Video surveillance: To protect against burglary, theft and vandalism, the entrance areas are under video surveillance. Desks and screens are not captured, and no audio is recorded. Signs at the entrances point this out. The legal basis is our legitimate interest in protecting people and property (Art. 6(1)(f) GDPR, Section 4 BDSG). Recordings are overwritten automatically and deleted after 7 days at the latest unless we need them to investigate an incident.

Internal organisation: To manage memberships and communicate within our team, we use Google Workspace (see section 6), Trello (Atlassian; transfers to the USA under the EU-US Data Privacy Framework or standard contractual clauses) and Slack (Slack Technologies Limited, One Park Place, Upper Hatch Street, Dublin 2, Ireland; transfers to the USA under the EU-US Data Privacy Framework). Your name, contact details and information about your membership may be stored there. The providers process the data on our behalf (Art. 6(1)(b) and (f) GDPR, Art. 28 GDPR).

19. Recipients

Apart from the service providers named above, we only pass on personal data where necessary: to our tax advisers and accountants, to banks for payments, to authorities where we are legally obliged to, and to IT service providers who support us with maintenance and operation and are bound by our instructions. We do not sell data.

20. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)). Just write to [email protected].

Right to object (Art. 21 GDPR): Where we process your data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims. You can object to processing for advertising purposes at any time without giving reasons.

You can also lodge a complaint with a data protection supervisory authority, for example the authority responsible for us: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, Germany.

21. Changes

If our website or the services we use change, we will update this privacy policy. The version published here applies.