Privacy policy
Below we inform you about the processing of personal data when you visit this website, in accordance with the General Data Protection Regulation (GDPR). This English text is a non-binding convenience translation; the German version is authoritative. This draft must be adapted to the services and periods actually used and legally reviewed before publication.
This text is a draft. Before publication, every detail marked [PLACEHOLDER] must be completed with the real operator data, and the whole text must be legally reviewed and approved.
Legal review required
Controller
The controller within the meaning of Art. 4 (7) GDPR is the operator named in the legal notice: [PLACEHOLDER: name/company, address, email]. [PLACEHOLDER: contact details of a data protection officer, if appointed – otherwise omit].
Contact and reservation form
When you use the contact or reservation form, we process the data you provide (in particular name, email address, phone number, requested period, number of guests, and your message) in order to handle your enquiry and contact you. Mandatory fields are marked as such. The legal basis is Art. 6 (1) (b) GDPR (pre-contractual measures) and our legitimate interest in handling enquiries under Art. 6 (1) (f) GDPR.
Email delivery (SMTP)
To send confirmation and notification emails we use an SMTP service: [PLACEHOLDER: name and address of the email/SMTP provider]. The data required for delivery (including email address and message content) is processed. The legal basis is Art. 6 (1) (b) and (f) GDPR. A data processing agreement pursuant to Art. 28 GDPR is in place with the provider.
Spam protection (Cloudflare Turnstile)
To protect our forms against automated misuse we use Cloudflare Turnstile, a service of Cloudflare, Inc. Technical information (including IP address and browser information) is transmitted to and evaluated by Cloudflare; according to the provider, no user-tracking cookies are set for this purpose. The legal basis is our legitimate interest in preventing spam and abuse under Art. 6 (1) (f) GDPR. Any transfer to third countries is based on the EU Standard Contractual Clauses. Further information: [PLACEHOLDER: link to the Cloudflare privacy policy].
Server log files and security
When the website is accessed, the hosting provider automatically processes server log files (including IP address, date and time, requested resource, referrer, browser type). This data serves secure operation, error analysis, and defence against attacks, including measures such as rate limiting. The legal basis is Art. 6 (1) (f) GDPR. Log data is deleted or anonymised after [PLACEHOLDER: log retention period].
Retention period
We store personal data only for as long as necessary for the stated purposes. Enquiry and contract data is retained for the duration of processing and beyond, within the scope of statutory retention obligations (under commercial and tax law generally up to six or ten years), and then deleted. [PLACEHOLDER: specific project deletion periods].
Your rights
Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and a right to object (Art. 21). You may withdraw any consent given at any time with effect for the future (Art. 7 (3)). You also have the right to lodge a complaint with a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.
Hosting
This website is hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. The provider processes, on our behalf, the data required to operate the website (in particular server log files), based on a data processing agreement pursuant to Art. 28 GDPR. [PLACEHOLDER: further processors, if any].
Map (OpenStreetMap) and external links
In the "Directions" section we embed a map from OpenStreetMap (provider: OpenStreetMap Foundation, St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom). When the map loads, your IP address is transmitted to the OpenStreetMap Foundation; no user-tracking cookies are set. The legal basis is our legitimate interest in presenting the location attractively under Art. 6 (1) (f) GDPR. The operators of linked external sites are solely responsible for their content.
Legal review required
This draft does not replace individual legal advice. Before publication, complete all [PLACEHOLDER] entries and have the text legally reviewed.