Privacy notice
This notice explains how we process personal data when you visit our website or send virtual office enquiries. It applies to virtual-office-hannover.com.
1. Controller and privacy contact
OCW - Marketing & Management GmbH
Vahrenwalder Straße 269 A
30179 Hannover, Germany
Managing director: Oliver Lieckfeld
Telephone: +49 511 9666 6
Email: hannover-nord@ecos-workspaces.com
Please contact us at the email address above with privacy questions or to exercise your rights.
Data protection officer
Protekto Gruppe · Kent Schwirz
Wendenstraße 279
20537 Hamburg, Germany
Telephone: +49 40 40 422 369 24
Email: datenschutz@protekto.de
2. Visiting and hosting this website
This website is hosted by statichost.eu, provided by Variable Object Assignment, c/o Knackeriet, Sankt Paulsgatan 25, 118 48 Stockholm, Sweden. Your IP address is processed as technically necessary to deliver the website. According to the provider, visitor IP addresses are processed temporarily and are not stored in access logs. The provider states that hosting takes place within the European Union or European Economic Area.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to provide a secure, stable and accessible website. For operation and billing, the provider collects technical logs which it describes as non-personal, such as transferred data volume and response status. According to the provider, these are deleted within 7 days at the latest, usually sooner. See the statichost.eu privacy notice.
3. Contact forms and enquiries
You can send an enquiry using the contact form. Your name, email address and message are required. You may also provide your company, telephone number and requirements, such as preferred start date, package preference and company formation stage. Location, service, page address and language are also transmitted so that we can assign your enquiry correctly. We use this information to respond, prepare an offer and arrange an appointment. Please do not send sensitive information that is unnecessary for your request.
The form is sent over an encrypted connection to Form.taxi, operated by wrkt*biz Reinhard Söllradl in Austria, for technical receipt, spam filtering, storage and delivery to our location team. Form.taxi acts as our processor. According to the provider, form submissions are processed and stored within the EU, with hosting at ALL-INKL.COM in Dresden, Germany, and EU-based email delivery through Mailjet. The provider also records the sender’s IP address, browser user-agent and submission timestamp for delivery, spam prevention and traceability. The website uses a hidden honeypot field and the provider’s spam filter and IP blacklist, without loading external CAPTCHA scripts.
Form.taxi states that submissions are stored in its archive for no more than one year and then deleted automatically; submissions classified as spam are deleted after one month. We delete enquiries held by the service earlier when they are no longer required, unless a further legitimate retention reason applies. Messages forwarded to our email accounts are subject to the retention rules in section 6.
Where you initiate your own contract, the legal basis is Article 6(1)(b) GDPR. For requests on behalf of a company and other enquiries, the basis is Article 6(1)(f) GDPR, reflecting our legitimate interest in handling business enquiries. Necessary spam prevention is based on Article 6(1)(f) GDPR and our legitimate interest in protecting our communications from abuse.
You may also contact us directly by email. A mailto link opens your email app; no message is sent until you send it yourself. The same purposes and legal bases apply to the information you provide by email.
Further information: Form.taxi privacy and processing information
4. Email, forwarding and telephone
Form.taxi delivers form enquiry notifications directly to the responsible location mailbox in Microsoft 365. This involves the form information and technical delivery data.
We use Microsoft 365 / Exchange Online from Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, to process and store email correspondence. This includes message content, sender and recipient details, and technical delivery and security data.
Microsoft 365 processing may also take place outside the EEA, particularly in connection with operations, support and subcontractors. Microsoft’s data protection terms provide safeguards for necessary third-country transfers, including European Commission Standard Contractual Clauses and, where applicable, adequacy decisions. Actual storage locations and processing depend on the configured Microsoft 365 environment. See the Microsoft Data Protection Addendum, or contact our privacy contact for information about our processing.
For telephone enquiries, we process the contact information and conversation details necessary to handle your request. This website does not record calls. The purposes and legal bases in section 3 also apply to email and telephone enquiries.
5. Recipients and processing outside the EU
Form.taxi also receives the data described in section 3 for processing contact forms. Hosting and email providers remain as described below.
Access is provided to the people responsible for handling your request and to our hosting and communications providers as required for their tasks. We do not sell your information for advertising purposes. Further disclosure may be necessary to perform a contract, meet legal obligations or establish, exercise or defend legal claims.
statichost.eu states that hosting processing takes place within the EU or EEA. Its data processing agreement lists Hetzner Online GmbH and BunnyWay d.o.o. as subprocessors. Form enquiry delivery and email processing use Form.taxi and Microsoft 365 as described in sections 3 and 4, including the possible third-country processing explained there. Please contact our privacy contact for information about applicable safeguards.
Further information: statichost.eu data processing agreement.
6. Retention
We retain enquiries and correspondence for as long as needed to handle the request, prepare an offer or arrange an appointment. When the matter is complete and there is no further legitimate reason to keep the information, it is deleted. This also applies to unnecessary copies in the relevant mailboxes.
If a contract is concluded, required information is transferred to contract administration. Statutory retention duties and the establishment, exercise or defence of legal claims may require longer retention; use is then restricted to that purpose. The relevant period depends on the document type, legal requirement and any pending proceedings. Statutory retention is based on Article 6(1)(c) GDPR; necessary retention for legal claims is based on Article 6(1)(f) GDPR. Technical backup copies are replaced according to the applicable backup and overwrite cycles.
7. Cookies, local content and external links
The pages we provide do not use analytics or marketing tools, external fonts, embedded maps or videos. Images and styling are delivered with the website. The page code does not set cookies or store data in your browser’s local storage. Technically necessary processing by hosting and email services is unaffected.
External services, such as further location information, are provided as links only. Following a link takes you to the relevant provider, where that provider’s privacy information applies. Our language selector uses ordinary links and does not store a language preference in a cookie or browser storage.
8. Your rights
Subject to the relevant legal conditions, you have rights of access, rectification, erasure, restriction of processing and data portability under Articles 15–20 GDPR. You may withdraw consent at any time with future effect; processing before withdrawal remains lawful.
Right to object: You may object at any time, on grounds relating to your particular situation, to processing based on Article 6(1)(f) GDPR. We will then stop processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or processing is needed for legal claims. You may object to direct marketing at any time without giving a reason.
You may also complain to a data protection supervisory authority under Article 77 GDPR, particularly in the country of your habitual residence or workplace or where an alleged infringement occurred. The authority responsible for our registered office is the State Commissioner for Data Protection of Lower Saxony.
We do not make decisions based solely on automated processing with legal or similarly significant effects, or carry out corresponding profiling, in connection with your enquiry.
9. Version
5 November 2026. We update this notice when our services or processing change.