Privacy

Purpose and legal basis

We use your details to answer your request and prepare a possible stay. Booking requests are processed under Article 6(1)(b) GDPR (steps before a contract at your request). Other messages are handled under Article 6(1)(f) GDPR, based on our legitimate interest in responding. Acknowledging the privacy notice in the form is not consent to marketing.

Contacting us is voluntary. We cannot process a form request without its required details. Additional information in the message is optional; please do not send payment details, identity documents or health information. You can also email us directly.

Hosting, email and spam protection

Cloudflare (Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA) provides the website and request form. It processes connection data such as your IP address, requested URL, time, and technical browser and response information. The IP address is also used to limit form requests and reduce spam. Observability is enabled in the Worker configuration. Cloudflare says Free-plan Worker Logs are retained for three days; this period does not describe all Cloudflare network and security data. The website code does not deliberately write form message contents to its own logs. Cloudflare processes requests on its global network, and the Free plan does not guarantee EU-only processing. This supports safe, reliable operation under Article 6(1)(f) GDPR.

Resend receives the request content, receipt and email addresses needed for delivery. Resend says its Free plan stores email and log data in the United States for 30 days; an EU sending region changes where email is sent from, not where it is stored. The service is operated by Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. The receiving mailbox is GMX FreeMail, operated by 1&1 Mail & Media GmbH; GMX says emails are stored exclusively in German data centres. Provider information: Cloudflare privacy policy, Cloudflare Workers Logs, Resend security and retention and GMX privacy notice.

Processing is described in separate agreements: the Cloudflare DPA and the Resend DPA. Cloudflare incorporates its DPA in section 6.1 of its Self-Serve Subscription Agreement. Resend states that its DPA takes effect on signup without a separate countersignature. Further providers are listed as Cloudflare subprocessors and Resend subprocessors. The relationship between the accounts used and the data controller still needs confirmation.

Storage and deletion

The website has no booking database. Daniel keeps enquiry and booking emails in GMX, invoice PDFs on his computer and payment records at his bank. An accountant prepares the tax return. These records are not currently deleted on a routine schedule.

The personal records shared with the accountant and the bank's and accountant's own retention periods still need confirmation. Storage with these parties does not replace checking Daniel's own record-keeping obligations. The enquiry form does not send data directly to the bank or accountant.

Provider retention also applies: up to three days for Cloudflare Workers Logs and 30 days for Resend email and log data on its Free plan.

Resend also states that backups persist for seven days and remaining customer data is deleted within 90 days of account termination. These periods do not replace deletion from Daniel's mailbox or the guest's email provider. Source: Resend privacy and retention information.

Proposed deletion routine, not yet implemented: review the mailbox monthly and delete closed enquiries that did not lead to a booking where the last contact was at least six months ago. Deletion at the next monthly review can therefore take place up to seven months after the last contact. This is a proposed period, not a statutory requirement. Contract, invoice and payment records must be handled separately.

A tax professional must confirm the applicable retention periods and their starting points for Daniel's rental. Section 14b UStG generally requires invoices in the entrepreneurial sphere to be retained for eight years from the end of the year of issue. Where Section 147 AO applies, it distinguishes, in particular, six years for business correspondence, eight years for accounting vouchers and ten years for books and records. This does not set a blanket period for every email; unresolved tax matters can extend retention. For a specific legal dispute, the intended rule is to retain only relevant data with restricted access for as long as it is needed or a statutory retention duty applies.

Legally required retention is based on Article 6(1)(c) GDPR. Where records are needed to pursue or defend specific legal claims, the basis is Article 6(1)(f) GDPR; the legitimate interest is pursuing or defending those claims.

Cookies and local content

The website application sets no analytics or advertising cookies and uses neither local storage nor session storage. Photos and fonts are served with the website. The application does not store its own cookie or privacy-notice preference in your browser.

Cloudflare Web Analytics / Real User Measurements is disabled for this domain. Zaraz, its consent management and Google tag gateway are inactive. The account settings were checked on 31 October 2026: Bot Fight Mode and continuous script monitoring are disabled; browser integrity checking and managed attack protection remain enabled. Cloudflare may use security cookies during protective challenges, for example to remember a successful challenge. Ordinary page requests checked during this review returned no Set-Cookie header; this does not exclude cookies in a challenge flow. Storage and access without consent are permitted only where the conditions of Section 25(2) TDDDG are met; an informational cookie notice does not replace any required consent. Cookie purposes and lifetimes are described in Cloudflare's cookie information. External pages such as Google Maps open only when you follow their links.

Browser network-error reports (NEL)

Cloudflare Network Error Logging (NEL) was disabled for this domain on 31 October 2026. Fresh page responses no longer send NEL or Report-To headers. Browsers that received the previous reporting policy may retain it until its expiry, previously up to seven days, and may still send network-error reports to a.nel.cloudflare.com during that time. Disabling NEL does not delete earlier reports or disable the hosting and security logs described above.

Provider information: Cloudflare Network Error Logging.

International processing

Cloudflare may process technical data outside the European Economic Area, including in the United States, through its global network. For transfers without an applicable adequacy decision, section 6 of the Cloudflare DPA describes Standard Contractual Clauses. Resend stores email and log data in the United States and describes Standard Contractual Clauses and the EU-U.S. Data Privacy Framework as transfer mechanisms in sections 6 and 11 of its DPA. The clauses and safeguards are available in these publicly linked documents; information about the transfers can be requested using the contact address above. GMX says it stores emails in Germany. We do not promise exclusively European processing of all data.

Right to object under Article 21 GDPR

You may object at any time to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation. We may then continue processing only if compelling legitimate grounds override your interests, rights and freedoms or processing is needed to establish, exercise or defend legal claims. Send your objection to Daniel.brunner01@gmx.de.

Your rights

Subject to the legal conditions, you can request access, correction, erasure, restriction and data portability. Where processing relies on consent, you can withdraw it for the future without affecting the lawfulness of processing before withdrawal. Contact: Daniel.brunner01@gmx.de.

You can complain to a data protection authority, such as the LfDI Baden-Württemberg. These rights are governed by the GDPR. We review booking enquiries personally; the form does not make automated booking decisions.

Draft updated: 31 October 2026.