Privacy Policy
Datenschutzerklärung: how Migrapal collects, uses, and protects your personal data.
Last updated: October 13, 2026
1. Data controller
The controller responsible for data processing on this website is Migrapal UG (haftungsbeschränkt), [TODO: registered address]. You can reach us at info@migrapal.com or via the contact details in our Impressum.
2. What data we collect
Depending on which services you use, we process: (a) data you provide directly, such as your name, email address, and message when you use our contact form or the onboarding questionnaire (e.g. your relocation track, city, and timeline); (b) identity and travel documents needed for visa assistance and travel assistance, such as passport or ID copies, visa application details, and booking or itinerary data; (c) housing data, such as lease documents, landlord correspondence, and deposit details, for our housing search and lease-review services; (d) education and employment data, such as your CV, academic transcripts, course preferences, and work history, for job, course, and training placement coordination; (e) registration-support data, such as your address for Anmeldung support and the name of the health insurer and Hausarzt (GP) practice you choose, for Anmeldung and Hausarzt registration coordination; (f) technical data collected automatically, such as your IP address, browser type, and pages visited, for the operation and security of this site; and (g) authentication data (a session token) once you create an account.
3. Health-related data
We do not collect or process your medical records, diagnoses, or health history. For Hausarzt registration coordination we process only administrative details (e.g. your chosen health insurer and GP practice) needed to book and confirm the registration appointment. In the rare case that processing any health-related data becomes unavoidable, we rely on your explicit consent under Art. 9(2)(a) GDPR, which you may withdraw at any time.
4. Purpose of processing
We use this data to respond to your enquiries, match you with the right advisor, provide our relocation services (visa and travel assistance, housing search, Anmeldung and Hausarzt registration coordination, and job, course, and training placement), operate and secure this website, and comply with legal obligations (e.g. bookkeeping).
5. Legal basis
Processing is based on Art. 6(1)(b) GDPR (performance of a contract or steps leading to one, e.g. your enquiry or service agreement), Art. 6(1)(f) GDPR (our legitimate interest in operating a secure, functioning website), Art. 6(1)(c) GDPR (compliance with legal obligations), and, where applicable, Art. 6(1)(a) GDPR (your consent, e.g. for any future non-essential cookie or for any health-related data as described above).
6. Cookies
We use one strictly necessary cookie, migrapal-consent, to remember your cookie choice, and a secure, httpOnly session cookie for signed-in users to keep you authenticated. Neither requires consent under TTDSG § 25(2). We do not currently use any analytics, advertising, or tracking cookies. If we introduce any in the future, we will ask for your consent first via the cookie banner before they are set. Our anonymous reach measurement (section 7) uses no cookies either.
7. Anonymous reach measurement and guide feedback
To understand which pages and guides are useful, we count visits to our public pages and the "helpful / not helpful" ratings on our guides. We do this without cookies and without storing anything on your device or reading anything from it. For each visit, our server briefly derives a one-way hash from your IP address and browser details, combined with the current date and a secret key, solely so that the same visitor is not counted twice on one day. The hash cannot be reversed, is never combined with other data, and is deleted automatically when the day ends; your IP address and browser details themselves are not stored. We keep only aggregate figures (for example, how many visitors and page views a page had on a given day). Pages inside your account are not measured, and guide ratings are anonymous. If your browser sends a Do Not Track or Global Privacy Control signal, your visits are not counted at all. The legal basis is our legitimate interest in improving our content (Art. 6(1)(f) GDPR); because nothing is stored on or read from your device, no consent under § 25 TDDDG is required. You can object at any time under Art. 21 GDPR by sending one of the signals above or by contacting us. The data is processed on our own servers and is not shared with third parties.
8. Data retention
We retain personal data only as long as necessary for the purposes described above, or as required by statutory retention periods (e.g. German commercial and tax law, typically 6–10 years for business records). Documents such as passport copies and lease or booking confirmations are deleted once the relevant service is complete, unless a longer retention period applies by law.
9. Sharing with third parties
We do not sell your personal data. Depending on the service you use, we may share relevant data with: landlords and letting agents (housing search); travel agencies and carriers (travel assistance); employers, universities, and training providers (job, course, and training placement); health insurers and Hausarzt practices, limited to the administrative details needed to register you (Hausarzt registration); and public authorities such as the Bürgeramt, Ausländerbehörde, or Jobcenter, where required for your case. We also share data with processors who act on our behalf under a data processing agreement (e.g. our hosting provider), and with public authorities where legally required. We do not currently use any third-party analytics or advertising services.
10. International data transfers
Our travel assistance service may involve coordinating with travel partners outside the European Economic Area (e.g. for bookings originating in India). Where this requires transferring your data outside the EEA, we rely on appropriate safeguards under Art. 44–49 GDPR, such as the European Commission's standard contractual clauses. [TODO: confirm and list specific travel partners and transfer safeguards once finalized.]
11. Your rights
Under the GDPR, you have the right to access (Art. 15), rectify (Art. 16), erase (Art. 17), restrict (Art. 18), and port (Art. 20) your data, and to object to processing (Art. 21). You also have the right to withdraw consent at any time and to lodge a complaint with a data protection supervisory authority.
12. Contact
For any privacy questions or to exercise your rights, contact us at info@migrapal.com.