Privacy Policy – “Wald & Wind” Apartment Marburg

1. Controller
The controller responsible for data processing is:
Dennis Weihl
Am Buchenwald 10
35043 Marburg
Germany
Email: [please insert]
Phone: [please insert]

2. General information on data processing
We process personal data relating to you (for example as an interested party, guest or visitor of our website) only within the scope permitted by law, in particular for providing the website, handling enquiries, processing and fulfilling bookings, and complying with legal obligations.[web:3][web:30]
Personal data means any information relating to an identified or identifiable natural person (for example, name, contact details, booking data).[web:3][web:30]

3. Data processing when visiting our website
(1) When you access our website, the browser used on your device automatically sends information to the server of our website. This information is temporarily stored in so‑called log files. The following information may be collected in particular: IP address, date and time of access, name and URL of the file accessed, website from which access is made (referrer URL), browser used, and operating system.[web:4][web:30]
(2) Data processing is carried out to ensure a smooth connection to the website, to evaluate system security and stability, and for administrative purposes. The legal basis is Art. 6 para. 1 lit. f GDPR (legitimate interest in the secure and functional provision of our online offer).[web:4][web:30]

4. Cookies and similar technologies
If cookies or similar technologies are used on our website, we will inform you about this in the cookie banner. There, you can – where required by law – give or refuse your consent. The legal basis is Art. 6 para. 1 lit. a GDPR (consent) for optional cookies and Art. 6 para. 1 lit. f GDPR for technically necessary cookies.[web:1][web:4]
You can withdraw or adjust your consent at any time with future effect via the settings in the cookie banner.[web:1][web:4]

5. Contact (e.g. by email or contact form)
If you contact us (for example by email or via a contact form), we process the data you provide (such as name, email address, phone number, and the content of your enquiry) for the purpose of handling your request and any follow‑up questions.[web:30]
The legal basis is Art. 6 para. 1 lit. b GDPR where the enquiry is related to a booking or stay, otherwise Art. 6 para. 1 lit. f GDPR (legitimate interest in answering enquiries).[web:30]

6. Bookings and guest management
(1) For processing and fulfilling bookings we process, in particular, the following data:
Name, address, contact details (email, phone number), travel dates (arrival and departure dates, number of guests), payment information (e.g. payment method, payment status – no full credit card details where external payment providers are used), as well as communication related to your booking and your stay.[web:25][web:30]
(2) The legal basis is Art. 6 para. 1 lit. b GDPR (performance of a contract and pre‑contractual measures) and Art. 6 para. 1 lit. c GDPR (legal obligations, for example commercial and tax record‑keeping duties).[web:25][web:30]

7. Services and platforms used
We use the following services for providing, managing and marketing our accommodation as well as for automation and communication:

a) Website hosting – IONOS
Our website is hosted by a service provider (IONOS SE, Germany). This provider processes server log data and, where applicable, further technical data on our behalf. The legal basis is Art. 6 para. 1 lit. f GDPR (legitimate interest in secure and stable website provision). We have concluded a data processing agreement pursuant to Art. 28 GDPR.[web:24][web:25]

b) Guest and property management – Smoobu
For managing bookings and guests we use the software of Smoobu GmbH, Wönnichstr. 68/70, 10317 Berlin, Germany. Via Smoobu we process booking data, contact details and stay‑related data of our guests. Smoobu acts as a data processor. The legal basis is Art. 6 para. 1 lit. b GDPR (performance of contract) and Art. 6 para. 1 lit. f GDPR (efficient management of the accommodation).[web:25][web:24]

c) Booking platforms – Airbnb, Booking.com
Bookings can be made via platforms such as Airbnb and Booking.com. For the data processing carried out on those platforms, the respective platform operators act as independent controllers under GDPR. We receive booking and contact details from the platforms in order to perform your stay. The legal basis is Art. 6 para. 1 lit. b GDPR. The privacy policies of the respective platforms apply in addition.[web:30][web:28]

d) Dynamic pricing – PriceLabs
For automated price management we use PriceLabs. For this purpose, booking and occupancy data may be processed in order to calculate dynamic prices. The legal basis is Art. 6 para. 1 lit. f GDPR (legitimate interest in economic management of the accommodation).[web:30]

e) Process automation – Make (formerly Integromat)
We use Make for automating processes (for example, sending emails or synchronising booking data between systems). In this context, personal data (such as name, email address, booking details) may be processed by Make as a data processor and transferred to the services involved. The legal basis is Art. 6 para. 1 lit. b and lit. f GDPR.[web:25][web:28]

f) Email communication – Gmail
For email communication we use Gmail (Google). Emails containing personal data are processed on the provider’s servers. The legal basis is Art. 6 para. 1 lit. b GDPR (performance of contract) and Art. 6 para. 1 lit. f GDPR (efficient communication).[web:25]

8. Data transfers to third countries
Some of the above‑mentioned providers (for example Airbnb, Booking.com, Google/Gmail, Make and possibly PriceLabs) may transfer data to countries outside the EU/EEA. Where no adequacy decision by the European Commission exists, such transfers generally take place on the basis of so‑called Standard Contractual Clauses (Art. 46 para. 2 lit. c GDPR) or equivalent safeguards intended to ensure an adequate level of data protection.[web:25][web:29]
Nevertheless, risks in third countries (for example broader access rights for authorities) cannot be completely excluded. Further information is provided in the privacy notices of the respective providers.[web:25][web:29]

9. Video surveillance of the outdoor area
(1) The outdoor area of the “Wald & Wind” apartment (for example entrance area, driveway) may be monitored by video cameras. The interior living area is not subject to video surveillance.[web:6][web:32]
(2) The purpose of the video surveillance is to exercise our property rights, protect our property, prevent and investigate criminal offences (such as vandalism or burglary) and, where applicable, establish, exercise or defend legal claims. The legal basis is Art. 6 para. 1 lit. f GDPR (legitimate interest).[web:6][web:32]
(3) The cameras are aligned in such a way that, as far as possible, adjacent properties and public areas are not recorded. Recordings are generally deleted automatically after no more than 30 days, unless they are required for longer in connection with a specific incident (such as a damage event).[web:6][web:34]
(4) The video surveillance is indicated on site by clearly visible signs. Access to the recordings is restricted to authorised persons only. The recordings are not used for any other purposes. You have the right to object to this processing of your personal data for reasons relating to your particular situation (Art. 21 GDPR).[web:6][web:34]

10. Storage period
We store personal data only for as long as necessary to fulfil the respective purposes or as we are legally obliged to do so. Afterwards, the data will be deleted or its processing restricted (for example by blocking).[web:25][web:3]
In particular, commercial and tax retention periods may require that certain documents (such as invoices) are kept for 6 to 10 years.[web:25][web:3]

11. Obligation to provide data
The provision of certain data (for example name, contact details, travel dates) is necessary for entering into and performing the rental contract. Without this data, a booking is generally not possible. The provision of data for purely voluntary services is not mandatory.[web:3][web:31]

12. Your rights as a data subject
Within the scope of the statutory provisions, you have the following rights:
– Right of access to the personal data stored about you (Art. 15 GDPR)
– Right to rectification of inaccurate data and completion of incomplete data (Art. 16 GDPR)
– Right to erasure (“right to be forgotten”), where no statutory retention obligations apply (Art. 17 GDPR)
– Right to restriction of processing (Art. 18 GDPR)
– Right to data portability (Art. 20 GDPR)
– Right to object to processing based on Art. 6 para. 1 lit. e or lit. f GDPR (Art. 21 GDPR)
– Where processing is based on your consent, the right to withdraw consent at any time with effect for the future (Art. 7 para. 3 GDPR).[web:3][web:31]

To exercise your rights, you can contact us at any time using the contact details provided above.

13. Right to lodge a complaint with a supervisory authority
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR (Art. 77 GDPR).[web:3][web:31]

14. Changes to this privacy policy
We reserve the right to adapt this privacy policy so that it always complies with current legal requirements or to reflect changes to our services (for example the introduction of new tools or platforms).
The current version published on our website applies.

Status: December 2025
“Wald & Wind” Apartment – Marburg