This is a translation for convenience. Only the German version is legally binding; in case of doubt, the German version prevails.
In this privacy policy we inform you, in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR), which personal data we process when you visit hausbergsuite.com, send an enquiry or book the holiday flat “Hausberg Suite”, for what purposes, on what legal basis, to whom we pass it on and how long we keep it.
1. Controller
Felix and Claudia Hummel
Wankstraße 6
82340 Feldafing
Germany
Email: info@hausbergsuite.com
Phone: +49 176 19259723
The flat is looked after and managed on our behalf by Lea Bauer, zweiseenfewo, Mittenwalder Straße 47b, 82431 Kochel am See, Germany (phone +49 152 0307 2845). She receives the data required to handle your enquiry and your stay (name, contact details, travel dates, number of guests) on the basis of Art. 6(1)(b) GDPR and is bound by our instructions under a data processing agreement.
Further details are given in the legal notice. We have not appointed a data protection officer, as we are not legally required to do so. For any questions about data protection, please use the contact details above.
2. In brief
- No analytics or statistics services, no advertising or tracking cookies, no social media plug-ins.
- No cookies and nothing stored in your browser: the website leaves nothing on your device. That is why there is no cookie banner (section 4).
- Fonts are served from our own server; neither Google Fonts nor Google Maps are loaded.
- We use data from enquiries and bookings solely to answer your enquiry and to handle your stay.
3. Hosting and server log files
This website is hosted by Netlify, Inc., 512 2nd Street, Suite 200, San Francisco, CA 94107, USA. Whenever a page is requested, your browser necessarily transmits data to the server, which is recorded in log files:
- IP address of the requesting device,
- date and time of access,
- requested address (URL) and HTTP status code,
- referrer URL (the page previously visited), if sent by the browser,
- browser type, operating system and language setting (user agent).
The purpose is to deliver the website, to keep it stable and secure and to prevent misuse. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in operating the website securely and without errors. Netlify keeps the log data only as long as necessary for secure operation and error analysis and then deletes it automatically. We do not evaluate it ourselves, do not combine it with other sources and do not create user profiles.
Other domains pointing to this website redirect directly to hausbergsuite.com; the same log data is generated.
We have concluded a data processing agreement with Netlify under Art. 28 GDPR. The website’s server-side functions (page rendering, enquiry and booking forms) run in a Netlify data centre in the USA (Ohio); static content is delivered via Netlify’s global network. The log data described in this section and the details from your enquiries and bookings are therefore processed in the USA. Netlify, Inc. is certified under the EU-US Data Privacy Framework (European Commission adequacy decision, Art. 45 GDPR); the European Commission’s standard contractual clauses apply in addition (Art. 46(2)(c) GDPR). Netlify’s privacy policy: netlify.com/privacy.
4. No cookies, nothing stored on your device
The website sets no cookies and stores nothing in your browser, not even in local storage or session storage. Whether you see the summer or the winter version depends on the date; the switch at the bottom of the page lets you view the other version. This choice only lives in the address of the page you open and is not stored. There is no access to your device within the meaning of § 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG), so we need no consent and show no cookie banner.
Only on Stripe’s payment page, to which we redirect you for a booking, does Stripe set its own cookies (section 8).
5. Fonts
All fonts are loaded from our own server. No connection to third-party servers is made.
6. Interactive map
We show the location of the flat on a map. The map is only loaded once it scrolls into view. Your browser then requests map tiles from the OpenFreeMap service (openfreemap.org), operated by Hyperknot Software Kft., Hungary. In doing so, your IP address, date and time, the tiles requested and browser details are transmitted. According to the provider’s privacy policy, no cookies are set and no usage profiles are created; access logs contain no IP addresses, and error logs containing an IP address are deleted after seven days.
The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in presenting the location clearly and attractively without embedding an advertising-funded map service. Map data comes from OpenStreetMap (© OpenStreetMap contributors, ODbL).
7. Enquiries and contact
If you contact us via the enquiry form or by email, we process the details you provide: first and last name, email address, phone number (optional), requested dates, number of guests and your message. The form is sent to our server and forwarded to us by email; you receive an acknowledgement by email.
The purpose is to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a booking (pre-contractual measures), otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries). Required fields are marked; without them we cannot answer your enquiry.
Enquiries that do not lead to a booking are deleted six months after the last message. If an enquiry leads to a booking, the periods in section 11 apply.
8. Booking and payment
Booking data
For a booking we process your first and last name, email address, phone number, postal address (where required), dates of stay, number of adults and children, your message to us, the price and the payment status. The legal basis is Art. 6(1)(b) GDPR (conclusion and performance of the contract) and Art. 6(1)(c) GDPR where we are legally obliged to retain data.
Booking management with Smoobu
We manage availability, prices and bookings with software from Smoobu GmbH, Berlin, Germany. Smoobu stores your booking data and the related correspondence on our behalf; we have concluded a data processing agreement with Smoobu under Art. 28 GDPR. Via Smoobu, bookings are also synchronised with our calendars on other platforms so the flat is not double-booked; only the occupied dates are transferred. Smoobu’s privacy policy: smoobu.com.
Payment with Stripe
After you click “Book with obligation to pay” (in German: „Zahlungspflichtig buchen“), we redirect you to a Stripe page for payment. The provider is Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. We send Stripe the amount, the booking reference, your name and your email address. You enter your payment details (e.g. card number) directly with Stripe; we do not receive them, only confirmation of the payment and technical details such as the payment method.
The legal basis is Art. 6(1)(b) GDPR and, for legal obligations (e.g. anti-money-laundering, retention), Art. 6(1)(c) GDPR. Stripe processes some data under its own responsibility for fraud prevention and to meet its own legal obligations. On the payment page, Stripe sets its own cookies required for secure payment and fraud detection; Stripe is responsible for these. Stripe also transfers data to Stripe, Inc. in the USA; Stripe is certified under the EU-US Data Privacy Framework and additionally uses standard contractual clauses. Stripe’s privacy policy: stripe.com/privacy.
Email delivery with Resend, mailboxes
Booking confirmations, acknowledgements of enquiries and the forwarding of enquiries to us are sent via Resend (Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA) from the address info@hausbergsuite.com. Your email address, your name and the content of the message are processed; emails are sent through servers in the EU (Ireland region). The legal basis is Art. 6(1)(b) GDPR. We have concluded a data processing agreement with Resend under Art. 28 GDPR including the European Commission’s standard contractual clauses; Resend is certified under the EU-US Data Privacy Framework (section 12). Resend’s privacy policy: resend.com/legal/privacy-policy.
Enquiries and copies of bookings go to the mailbox of our management company zweiseenfewo at STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, and, in copy, to a mailbox of Felix Hummel at Google (Gmail), provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We receive your emails to info@hausbergsuite.com in a mailbox at STRATO. Google may transfer data to the USA; Google LLC is certified under the EU-US Data Privacy Framework. Privacy policies: strato.de/datenschutz, policies.google.com/privacy.
Registration form and visitor’s tax
As an accommodation provider we are required under §§ 29 and 30 of the German Federal Registration Act (BMG) to complete a registration form for each stay, with name, address, date of birth, nationality, dates of arrival and departure and, for foreign guests, the serial number of their identity document. For accompanying spouses, partners and minor children, the number of persons is sufficient. We also report your stay under the visitor’s tax by-law of the municipality of Garmisch-Partenkirchen so that the visitor’s tax (Kurbeitrag) can be levied. The legal basis is Art. 6(1)(c) GDPR. Registration forms are kept for one year from the day of departure and destroyed within three months thereafter. Our property manager zweiseenfewo submits the registration forms online to the municipality of Garmisch-Partenkirchen on our behalf, usually in batches once or twice a month. The visitor’s tax is included in the price of your stay and is paid by us.
9. Links to other websites
The website contains simple links, for example to our listing on Airbnb. The other website is only accessed when you click such a link; from then on, that provider’s privacy policy applies. No data is transmitted to these providers beforehand. Bookings via Airbnb are subject to Airbnb’s terms and privacy policy.
10. Recipients at a glance
- Netlify, Inc., USA: hosting, server log files, booking functions – processor
- Smoobu GmbH, Berlin: availability, prices, booking and guest data – processor
- Stripe Payments Europe, Ltd., Dublin: payment processing – partly processor, partly independent controller
- Resend, Inc., USA (sending via EU servers): sending of confirmation and enquiry emails – processor
- STRATO GmbH, Berlin: mailboxes – processor
- Google Ireland Limited, Dublin: copy of enquiries and bookings in Felix Hummel’s mailbox (Gmail) – processor
- Hyperknot Software Kft., Hungary (OpenFreeMap): map tiles when the map is shown (IP address)
- Municipality of Garmisch-Partenkirchen: registration form and visitor’s tax – legal obligation
- Tax adviser, tax office: invoices and booking records, where required by law
We do not pass on data for advertising purposes and do not sell data.
11. Retention periods
- Server log files: see section 3
- Enquiries without booking: six months after the last message
- Booking and invoice data: until the statutory retention periods under § 147 of the German Fiscal Code (AO) and § 257 of the German Commercial Code (HGB) expire – six, eight or ten years from the end of the calendar year, depending on the document
- Registration forms: one year from departure, destroyed within a further three months
Data not subject to a retention obligation is deleted as soon as it is no longer needed for its purpose. Where statutory retention obligations apply, we restrict processing instead of deleting.
12. Transfers to third countries
Data may be transferred to the USA by Netlify, Stripe, Resend and Google. For companies certified under the EU-US Data Privacy Framework, the European Commission has issued an adequacy decision (Art. 45 GDPR); Netlify, Inc., Stripe, LLC, Resend and Google LLC are listed there. In addition, the European Commission’s standard contractual clauses safeguard the transfer (Art. 46(2)(c) GDPR). You can obtain a copy of these safeguards from us on request.
13. Your rights
You have the following rights regarding your personal data:
- access to the data stored (Art. 15 GDPR),
- rectification of inaccurate data (Art. 16 GDPR),
- erasure (Art. 17 GDPR), unless a retention obligation applies,
- restriction of processing (Art. 18 GDPR),
- data portability (Art. 20 GDPR),
- withdrawal of consent with effect for the future (Art. 7(3) GDPR).
Right to object (Art. 21 GDPR): Where we process data on the basis of Art. 6(1)(f) GDPR, you may object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.
An informal message to the contact details in section 1 is sufficient to exercise your rights.
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, place of work or place of the alleged infringement. The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany, lda.bayern.de.
14. Obligation to provide data; no automated decisions
You do not have to provide any data to visit the website, apart from what is necessarily transmitted (section 3). For an enquiry or booking we need the details marked as required; without them we cannot conclude a contract. The details for the registration form are required by law. There is no automated decision-making, including profiling (Art. 22 GDPR).
15. Security
The website is delivered exclusively via encrypted HTTPS (TLS). Access keys for Smoobu, Stripe and Resend are kept on the server only and are never sent to your browser.
16. Changes
We update this privacy policy when the website, our service providers or the law change. The version published here applies.