FDH Guard Resident verification

Privacy Notice

This notice describes how FDH Guard collects, uses, stores, and deletes personal data in connection with the resident verification process for the Frankfurt student residence.

Controller

The data controller for this service is:
Studentische Vertretung beim FDH, unter Bauverein
Friedrich-Wilhelm-von-Steuben-Straße 90, 60488 Frankfurt am Main

Contact:

Data we collect

When you submit a residency application we collect the following:

  • Full name
  • Email address
  • Phone number
  • The room code you enter and the resolved unit identifier
  • A photograph of the internal intercom nameplate outside your WG or apartment door (the proof photo)
  • The date and time you gave consent
  • The date and time of submission

We do not collect data from third parties or from publicly available sources. We do not use cookies or tracking technologies on this site.

Purpose and legal basis

We process this data to verify that an applicant genuinely lives in the Frankfurt student residence, and to supervise the resident WhatsApp group by ensuring only verified residents are admitted.

The legal basis is your consent under GDPR Article 6(1)(a). You give consent explicitly by ticking the consent checkbox before submitting the form. Ticking that box is voluntary; you can withdraw consent at any time (see the Rights section below). We do not process your data for any purpose other than those described here.

Recipients of personal data

Your data is not sold or shared with third parties. If your application is approved, you receive a WhatsApp group invite link by email; no personal data is transmitted to WhatsApp beyond what you share when you join the group yourself.

Volunteer administrators who operate this service can view applications, including the proof photograph, for the purpose of verification.

Storage and processors

Cloudflare, Inc. acts as a data processor for this service.

Proof photographs are held in Cloudflare R2 object storage created under the EU jurisdiction restriction, which keeps those objects within the European Union.

The database is Cloudflare D1. Its primary currently runs in Cloudflare’s Western Europe region, but that is a placement hint rather than a jurisdictional restriction: no EU jurisdiction is set on the database, so processing outside the European Union cannot be ruled out. Any such transfer relies on the Data Processing Agreement and the standard contractual clauses between the operator and Cloudflare. The operator has not yet confirmed that such an agreement is in place.

Retention and deletion

Approved residents
Your name, email address, and phone number in the residents table are erased 6 calendar months after your move-out date. The proof photograph is deleted from object storage in the same sweep.
Rejected applications
Name, email address, phone number, any reviewer notes, and the proof photograph are erased 6 calendar months after the date of rejection.
Pending applications (submitted but not yet reviewed)
The automated retention sweep currently covers only applications that have been explicitly rejected and residents who have moved out. An application that is submitted and never reviewed is not automatically swept. If you submit an application and wish your data to be deleted before a review decision is made, contact us using the address below and we will erase it manually.
Email outbox
The body of outbound email messages is cleared 30 days after the message is sent.
Audit log
System audit log entries are retained for 24 calendar months from the date they were created, then deleted. Audit details that reference your personal data are redacted before the entry reaches the 24-month limit if your data is erased earlier.

Your rights

Under the GDPR you have the following rights. To exercise any of them, contact us by email at the address in the Controller section. Erasure is performed by a human administrator; there is no self-service route. We will respond within one month.

Right of access (Art. 15)
You may ask what personal data we hold about you.
Right to rectification (Art. 16)
You may ask us to correct inaccurate data.
Right to erasure (Art. 17)
You may ask us to erase your personal data. We will do so unless we have a legitimate reason to retain it under applicable law.
Right to restriction of processing (Art. 18)
You may ask us to restrict processing while a dispute about accuracy or legitimate grounds is being resolved.
Right to data portability (Art. 20)
You may ask for a copy of the personal data you provided to us in a structured, machine-readable format.
Right to object (Art. 21)
You may object to processing based on our legitimate interests. Where processing is based solely on consent, this right takes effect as withdrawal of consent (see below).
Withdrawal of consent (Art. 7(3))
Because we process your data on the basis of consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. After withdrawal we will erase your personal data.
Right to lodge a complaint (Art. 77)
You have the right to lodge a complaint with a supervisory authority. The competent authority for Frankfurt am Main is in Hessen: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Wilhelmstraße 7, 65185 Wiesbaden, poststelle@datenschutz.hessen.de.

Contact for data protection enquiries

Email:

Responsible person: Abrorkhon Azimov