Privacy policy

1. General information

The protection of your personal data is important to us. We process your personal data exclusively within the framework of the statutory provisions, in particular the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

2. Controller

The controller responsible for data processing on this website is:

3. Hosting and technical provision

Masaro Media operates this website on our behalf as a processor. It runs on a server of Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen) in Germany; the application and booking data of the website are stored there.

To protect against attacks and to deliver the website, the Cloudflare service (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA) is placed in front of it as a content delivery network and web application firewall; all requests to the website pass through Cloudflare. In the process, Cloudflare processes connection data, e.g. your IP address. Data may be transferred to the USA. The basis for this is the European Commission’s adequacy decision on the EU-US Data Privacy Framework, insofar as the provider is certified under it; otherwise, it is standard contractual clauses (Art. 46(2)(c) GDPR).

Insofar as these service providers process data on our behalf, the processing takes place on the basis of Art. 28 GDPR. The processing serves the purpose of providing the website and the associated functions securely, stably and efficiently.

Legal basis: Art. 6(1)(f) GDPR
Our legitimate interest lies in the technically secure and efficient provision of our online services.

4. Access data and server log files

When this website is accessed, the hosting provider or the technical platform automatically collects information. This may include in particular:

• IP address
• Date and time of access
• Page or file accessed
• Referrer URL
• Browser type and browser version
• Operating system used
• Host name of the accessing computer

This data is processed in order to ensure the functionality, stability and security of the website and to detect and prevent misuse.

Legal basis: Art. 6(1)(f) GDPR.

5. Contacting us

If you contact us by email, via the contact form or via any other enquiry form, we process the information you provide in order to handle your enquiry and in case of follow-up questions.

In particular, the following data may be processed:

• Name
• Email address
• Phone number
• Travel dates
• Number of guests
• Content of your message
• Other voluntary information

Legal basis:

• Art. 6(1)(b) GDPR, insofar as your enquiry is aimed at the conclusion or performance of a contract
• Art. 6(1)(f) GDPR for general enquiries.

6. Booking requests and contract processing

If you submit a booking request or make a booking via our website, we process the personal data required to handle, review, perform and settle the accommodation contract.

This may include in particular:

• First and last name
• Address
• Phone number
• Email address
• Dates of stay
• Number of fellow travellers
• Any special notes on the booking
• Payment information or payment status

The processing serves the purpose of initiating and performing the contract.

Legal basis: Art. 6(1)(b) GDPR.

7. Sending emails

We send the emails of this website via the Resend service (Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA): messages to you, for example about your booking, your stay or signing in to the guest area, and notifications to us, for example about your booking or your enquiry. The emails are sent via servers in the EU (Ireland). In the process, Resend processes your email address and the content of the email. Data may be transferred to the USA. The basis for this is the European Commission’s adequacy decision on the EU-US Data Privacy Framework, insofar as the provider is certified under it; otherwise, it is standard contractual clauses (Art. 46(2)(c) GDPR).

Legal basis: the same as for the enquiry or booking to which the email relates.

8. Cookies and similar technologies

Cookies or comparable technologies may be used on this website.

Insofar as cookies are technically necessary, they are used on the basis of our legitimate interest in a functional and secure website.

Insofar as cookies or similar technologies are not technically necessary, for example for analysis, tracking or marketing purposes, we only use them with your consent.

Legal bases:

• Art. 6(1)(f) GDPR for technically necessary services
• Art. 6(1)(a) GDPR in conjunction with Section 25 TDDDG for cookies or access to terminal equipment that require consent.

9. Storage period

We only store personal data for as long as is necessary for the respective purposes or as statutory retention obligations exist.

As a rule, we only store data from enquiries for as long as is necessary to process and follow up on the enquiry. We store data relevant to contracts and invoicing in accordance with the statutory retention obligations.

10. Recipients of data

Your personal data is only passed on if this is permitted by law or you have given your consent. Recipients may include in particular:

• Hosting and infrastructure service providers
• Technical service providers for operating the website
• Other processors within the meaning of Art. 28 GDPR.

11. Your rights

Within the framework of the statutory provisions, you have in particular the following rights:

• Right of access
• Right to rectification
• Right to erasure
• Right to restriction of processing
• Right to data portability
• Right to object to processing based on Art. 6(1)(f) GDPR
• Right to withdraw consent given, with effect for the future
• Right to lodge a complaint with a data protection supervisory authority.

12. Objection to advertising emails

The use of the contact details published under the obligation to provide an imprint for sending advertising that has not been expressly requested is hereby objected to.

13. Obligation to provide data

Insofar as personal data is required for a booking or enquiry, the provision of this data is necessary. Without this data, it may not be possible to process the enquiry or perform the contract.

14. No automated decision-making

Automated decision-making or profiling within the meaning of Art. 22 GDPR does not take place unless we state this separately.