Privacy policy

This Privacy Policy is intended to inform you about the nature, scope, and purpose of the processing (collection, storage, use) of personal data (any information relating to an identified or identifiable natural person) within the meaning of the General Data Protection Regulation (GDPR) on the website bed-and-breakfast.de by the agency at your chosen destination as well as the B&B headquarters.

I. Name and contact details of the controller

The data controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws of the member states, as well as other data protection regulations, is either the agency located at your chosen destination or the b&b headquarters, depending on the nature of the data processing. The data controller is identified in this Privacy Policy in connection with the respective data processing activity.

Please click here for contact details of the b&b head office and the agencies

II. Processing of personal data

We will only process your data (collection, storage, disclosure to third parties) if

• you have given your express consent, or
• it is permitted by law and necessary for the performance of contractual relationships with you, or
• there is a legal obligation to disclose the data, or
• the disclosure is necessary to assert, exercise, or defend legal claims, and there is no reason to assume that you have an overriding legitimate interest in the non-disclosure of your data.

1. Provision of the website and creation of log files:

When you visit the website, the browser on your device automatically sends information to the website’s server (host). This information is temporarily stored by the host in a so-called log file. The following information is collected automatically and stored until it is deleted:

• IP address of the requesting computer,
• Date and time of access,
• Name and URL of the file accessed,
• Website from which access to our website is made (referrer URL),
• Website accessed by the user’s system via our website,
• Browser used and, if applicable, your computer’s operating system, as well as the name of your Internet service provider.

The data is also stored in our system’s log files. This data is not stored together with other personal data of the user. The legal basis for the temporary storage of the data is Article 6(1)(f) of the GDPR.

The temporary storage of the aforementioned data is necessary to enable the website to be delivered.
Storage in the log files is necessary to ensure the functionality of the website. This allows us to identify and resolve technical errors on our website. Logging therefore ultimately serves to improve the technical quality of our website.

These purposes also constitute our legitimate interest in data processing pursuant to Article 6(1)(f) of the GDPR.
A contract for data processing has been concluded with the hosting provider and the b&b headquarters. The data stored by the hosting provider is deleted after 72 days at the latest. The collection of data for the provision of the website and the temporary storage of data in the log files are absolutely necessary for the operation of the website. Consequently, the user has no right to object.

2. Booking enquiry

When you request accommodation via the website, the agency at your destination collects and stores the data necessary to process your request. Required fields are marked. Additional information may be provided on an optional basis.
Required information includes:

• First and last name
• City
• Phone number and email address
• Check-in/check-out dates
• Number of travelers (adults and children)
• Destination, accommodation, category

Data processing is carried out at your request and is necessary under Article 6(1)(b) of the GDPR for the stated purposes of processing your request to implement pre-contractual measures.

If no booking is made, the data processed in connection with the inquiry will be deleted as soon as it is no longer necessary for the processing and follow-up of the inquiry, typically no later than twelve months after receipt of the inquiry. Data will only be stored for a longer period if there are legal retention obligations or if the data is necessary for the assertion, exercise, or defense of legal claims.

As a user, you also have the option to request the deletion of the data at any time. You may have the data stored about you modified at any time. If the data is necessary for the performance of a contract or for the implementation of pre-contractual measures, early deletion of the data is only possible to the extent that no contractual or legal obligations or retention requirements preclude such deletion.

3. Reservation

In response to your booking request, the agency will send you an email containing a quote for the accommodation you requested or one or more suggestions for available accommodations in the city you specified. A booking confirmation form is attached to this email. If you accept an offer, please return the completed booking confirmation to the agency. The agency will store the data required for the booking.

These are:

• Company name
• First and last name
• Address
• Phone number and email address
• Check-in/check-out dates
• Number of travelers (adults and children)
• Destination and accommodation

Data processing is necessary for the conclusion of the accommodation contract and the processing of your booking. Data processing is carried out at your request and is required under Article 6(1)(b) of the GDPR for the stated purposes of processing your booking and for the mutual fulfillment of obligations arising from the contract.
The data will be deleted by the agency as soon as it is no longer required for the conclusion of the contract and the processing of your order, and statutory (commercial and tax law) retention and documentation obligations have expired.

As a user, you also have the option to request the deletion of the data at any time. You may have the data stored about you modified at any time. If the data is necessary for the performance of a contract or for the implementation of pre-contractual measures, early deletion of the data is only possible to the extent that no contractual or legal obligations or retention requirements preclude such deletion.

4. Cookies

The website www.bed-and-breakfast.de, its subpages, and the respective subpages of the agencies (bed-and-breakfast.de/CITY) use cookies. Cookies are text files that are stored in the web browser or by the web browser on the user’s device, such as a computer, laptop, smartphone, or tablet. When a user visits a website, a cookie may be stored on their device. Cookies may contain characteristic strings of characters or other information that enable the browser or device used to be recognized when the user visits our website again. This may include, in particular, cookie identifiers, technical usage data, device and browser information, and IP addresses. Under the GDPR, this information may constitute personal data, particularly if it is combined with other information, thereby enabling identification or profiling. To the extent that we use cookies, we process the information collected through them only for the purposes specified in each case. The cookies we use are generally not intended to directly identify you. To the extent that usage information is analyzed, this is done—where technically possible and sufficient for the respective purpose—in a pseudonymized or anonymized manner. A combination with directly identifying data occurs only if there is a legal basis for doing so or if you have previously given your valid consent.

The storage of information on the user’s end devices (e.g., via cookies) as well as access to information already stored on end devices is generally permitted only with the user’s prior consent. Consent is not required in exceptional cases if the sole purpose of the storage or access is absolutely necessary to provide a digital service expressly requested by the user (Section 25 TDDDG).

We use a session cookie for the “Wishlist” feature you have expressly requested so that items you select are saved during your visit and your search criteria are applied when you submit a form. The storage/reading of this cookie is absolutely necessary to provide the Wishlist and therefore takes place without consent in accordance with § 25(2)(2) TDDDG. The legal basis for the processing of personal data (e.g., session ID, selected items, applied search criteria) in this context is Article 6(1)(b) of the GDPR, as the processing is necessary to provide the Wishlist you have requested.

When visiting our website, the user is informed about the use of cookies, and their consent for the use of non-technically necessary cookies and for the processing of any personal data used in this context is obtained via a consent management tool. In this context, a reference to this privacy policy is also provided. Consent to all cookies is granted by clicking the “Accept” button. You can view and change your current cookie settings and revoke your consent at any time with future effect by clicking the “Custom Selection” button. Clicking the “Reject” button allows you to reject all non-technically necessary cookies.

You can access the consent management tool via this link or under “Cookies” on our website.

5. Consent Management Tool

We use a consent management tool developed by Papoo Software & Media GmbH on our website. This tool allows you to grant consent for data processing via the website—in particular, the use of cookies—and to exercise your right to withdraw consent that has already been granted. The purpose of data processing is to obtain and document the necessary consents for data processing and thereby comply with legal obligations. Cookies may be used for this purpose.
In doing so, the following information, among other things, is collected and transmitted to an external server operated by elbgraphen Werbeagentur GmbH:
Date and time of the page visit,

a random ID,

consent status.

Papoo Software & Media and/or the elbgraphen advertising agency do not process the data themselves; the data is stored as a log file. Access to the log files is granted only upon prior consultation and consent of the customer. This data is not disclosed to any other third parties. Data processing is carried out to fulfill a legal obligation based on Article 6(1)(c) of the GDPR.

6. Contact form: Feedback

On the website www.bed-and-breakfast.de, there is a contact form under “Feedback” that can be used to contact b&b headquarters electronically and send messages. If a user makes use of this option, the data entered in the form is transmitted to b&b headquarters and stored.

This data includes:

• First name, last name
• Email address
• Message

At the time the message is sent, the following data is also stored:

• The user’s IP address
• Date and time of the request

Your consent is obtained for the processing of this data as part of the submission process, and reference is made to this privacy policy. 
The legal basis for processing the data, provided the user has given consent, is Art. 6(1)(a) GDPR.

Alternatively, you may contact us via the provided email address. In this case, the user’s personal data transmitted with the email will be stored. In this context, the data will not be disclosed to third parties. The data is used exclusively for the purpose of handling the correspondence. The legal basis for processing the data transmitted when sending an email is Article 6(1)(f) of the GDPR. If the email contact is aimed at concluding a contract, the additional legal basis for processing is Article 6(1)(b) of the GDPR. 
We process the personal data from the input form solely for the purpose of handling the contact request. In the case of contact via email, this also constitutes the necessary legitimate interest in processing the data. The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. For personal data from the input fields of the feedback form and data sent via email, this is the case once the respective conversation with the user has ended or the inquiry has been processed. You have the option to revoke your consent to the processing of personal data at any time. If the user contacts us via email, they may object to the storage of their personal data at any time by email. In such a case, however, the conversation cannot be continued. All personal data stored in the course of the contact will be deleted in these cases.

7. Contact form: Contact and Becoming a host

If you are interested in becoming a host or have a general inquiry, you can contact the relevant agency or, if your region is not represented by an agency, the b&b headquarters using the contact form available on the website under “Become a Host” or “Contact.” If you take advantage of this option, the data entered in the form will be transmitted to the agency or the b&b headquarters and stored.

This data includes:

• First name, last name
• Email address
• Message

At the time the message is sent, the following data is also temporarily stored:

• The user’s IP address
• Date and time of the inquiry

Your consent is obtained for the processing of the data as part of the submission process, and reference is made to this privacy policy. The legal basis for the processing of the data is Article 6(1)(a) of the GDPR, provided the user has given consent. If the purpose of the contact is to conclude a contract, the additional legal basis for the processing is Article 6(1)(b) of the GDPR. The data will be deleted by the agency or the b&b headquarters as soon as the purpose for data storage no longer applies (after your inquiry has been processed) and provided that no legal (commercial and tax law) retention and documentation obligations preclude this.

As a user, you also have the option to request the deletion of the data at any time. You may have the data stored about you modified at any time. If the data is necessary for the performance of a contract or for the implementation of pre-contractual measures, early deletion of the data is only possible to the extent that no contractual or legal obligations or retention requirements preclude such deletion.

8. Google Analytics

The b&b headquarters has integrated the Google Analytics component into this website.

The operator of the Google Analytics component is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and in the United States of America, Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”).

Google uses cookies or similar technologies to analyze the use of our website, compile reports on website activity, and provide other services related to website and internet usage. b&b Zentrale has enabled IP anonymization (IP masking) on this website. As a result, the IP address is truncated within the EU/EEA and is only transmitted to a Google LLC server in the U.S. and truncated there in exceptional cases. In particular, online identifiers (e.g., cookie IDs), device and browser data, an anonymized IP address, interaction data, and—depending on the device—approximate location data are processed.

When accessing this website, the user is informed about the use of cookies in connection with Google Analytics, and their consent for the use of technically non-essential cookies and for the processing of the personal data used in this context is obtained via a consent management tool. In this context, a reference to this privacy policy is also provided. Consent is granted by clicking the “Accept” button.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR; access to device information is permitted pursuant to § 25(1) TDDDG only with your prior consent. 
You may revoke your consent at any time with future effect via the consent management tool, which is accessible under “Cookies” in this privacy policy or on our website.   
In addition, Google offers a browser add-on https://tools.google.com/dlpage/gaoptout?hl=de  to deactivate Google Analytics.
We have entered into a data processing agreement with Google pursuant to Article 28 of the GDPR.

To the extent that data is transferred to Google LLC in the U.S., we base this on the EU-U.S. Data Privacy Framework Adequacy Decision (you can find the current status here: https://www.dataprivacyframework.gov/list) or on standard contractual clauses pursuant to Article 46 of the GDPR; in addition, we implement appropriate technical and organizational measures.

9. Google Ads Conversion Tracking

The b&b headquarters uses Google Ads Conversion Tracking on its website to measure the effectiveness of its ads and optimize campaigns.

The operator of Google Ads Conversion Tracking is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

If you visit our website via a Google ad, Google will place a so-called conversion cookie on your device. The cookie ID, conversion status, timestamp, and pages visited are processed. This processing is carried out for the purpose of determining and improving the reach and effectiveness of our ads. 

When visiting our website, users are informed about the use of cookies in connection with Google Ads conversion tracking, and their consent to the use of non-technically necessary cookies and to the processing of personal data collected in this context is obtained via a consent management tool. In this context, a reference is also made to this Privacy Policy. 

Consent is given by clicking the “Accept” button.

The legal basis is your consent pursuant to Article 6(1)(a) of the GDPR; access to your device is permitted only with your consent pursuant to Section 25(1) of the TDDDG.
You may revoke your consent at any time with future effect using the Consent Management Tool, which is accessible under “Cookies” in this Privacy Policy or on our website. 

You can also disable third-party cookies in your browser.
We have entered into a data processing agreement with Google in accordance with Article 28 of the GDPR.

To the extent that data is transferred to Google LLC in the United States, we base this on the EU-U.S. Data Privacy Framework Adequacy Decision (you can find the current status here: https://www.dataprivacyframework.gov/list) or on standard contractual clauses pursuant to Article 46 of the GDPR; in addition, we implement appropriate technical and organizational measures.

10. Google Ads Remarketing

The b&b headquarters uses Google Ads Remarketing on its website to show interest-based ads to website visitors during subsequent searches or on partner sites.
The operator of Google Ads Remarketing is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google uses cookies and similar identifiers to analyze user behavior and create target audiences so that personalized ads can be delivered. In particular, it processes advertising IDs, visited pages, and interaction data, which constitutes a form of profiling for direct marketing.

When visiting our website, users are informed about the use of cookies in connection with Google Remarketing, and their consent to the use of non-technically necessary cookies and to the processing of personal data collected in this context is obtained via a consent management tool. In this context, users are also directed to this Privacy Policy. Consent is granted by clicking the “Accept” button.

The legal basis is your consent pursuant to Article 6(1)(a) of the GDPR; the access to your device required for this purpose is based on Section 25(1) of the TDDDG.
In addition, you have the right to object to direct marketing at any time pursuant to Article 21(2) of the GDPR, which you may exercise in addition to the settings available in your Google Account. 

You may revoke your consent at any time with future effect using the Consent Management Tool, which is available under “Cookies” in this Privacy Policy or on our website.   
We have entered into a data processing agreement with Google in accordance with Article 28 of the GDPR.

11. Google Global Site Tag

The b&b headquarters uses Google Global Site Tag on its website to utilize Google Analytics, Google Ads conversion tracking, and Google Ads remarketing. 
This integration takes place exclusively with your consent via the consent management tool. The legal bases are Section 25(1) of the German Telemedia Act (TDDG) for the storage and retrieval of information on your device, and Article 6(1)(a) of the General Data Protection Regulation (GDPR) for the subsequent processing of personal data.

You may revoke your consent at any time with future effect using the Consent Management Tool, which is available under “Cookies” in this Privacy Policy or on our website. 

12. Google reCaptcha

The b&b headquarters uses Google reCAPTCHA to prevent the misuse of forms and services (e.g., by bots) and thus ensure IT security and the proper functioning of the website. The operator of Google reCAPTCHA is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

To do this, reCAPTCHA analyzes user interactions to distinguish between human and automated use, processing data such as IP addresses, time settings, browser and device information, and—depending on the implementation—mouse or keyboard interactions. 

To the extent that reCAPTCHA is technically essential for the secure provision of a digital service you have expressly requested, we base access to your device on Section 25(2)(2) of the TDDDG and data processing on Article 6(1)(f) of the GDPR.

To the extent that data is transferred to Google LLC in the United States, we base this on the EU-U.S. Data Privacy Framework Adequacy Decision (you can find the current status here: https://www.dataprivacyframework.gov/list) or on standard contractual clauses pursuant to Article 46 of the GDPR; in addition, we implement appropriate technical and organizational measures. 

13. OpenStreetMap

The b&b headquarters uses the OpenStreetMap (OSM) mapping service. 
The service is provided by the OpenStreetMap Foundation (OSMF), St John’s Innovation Centre, Cowley Road, Cambridge, UK.

When you visit a website that uses OpenStreetMap, your IP address and other information about your activity on that website are transmitted to the OSMF. To do this, the OSMF may store cookies in your browser or use similar tracking technologies. In addition, your location may be tracked if you have enabled this in your device settings—for example, on your mobile phone. 

If the use is strictly necessary from a technical standpoint to provide the map view you have expressly requested, we base the access to your device on Section 25(2)(2) of the TDDDG; otherwise, access and further processing are based on your consent in accordance with Section 25(1) of the TDDDG and Article 6(1)(a) of the GDPR. 

You may revoke your consent at any time with future effect using the Consent Management Tool, which is available under “Cookies” in this Privacy Policy or on our website.   
The recipient is the OSMF in the United Kingdom; data transfers to the UK are made on the basis of the European Commission’s adequacy decision pursuant to Article 45 of the GDPR.

14. YouTube 

The b&b website and the respective agency subpages (bed-and-breakfast.de/CITY) use plugins from YouTube, a service operated by Google.
The operator of the YouTube service is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

When you visit a page with embedded YouTube content—provided you have given your consent and even in “enhanced privacy mode”—cookies and pixels are set, and data is transmitted to Google. In particular, the following data is processed: IP address, device and browser data, the referrer URL, the video you are watching, and session data; if you are logged into your Google account, this data may be associated with your account. 

When visiting the website, users are informed about the use of cookies in connection with YouTube, and their consent to the use of these non-technically necessary cookies and to the processing of the personal data collected in this context is obtained via the consent management tool. In this context, a reference is also made to this Privacy Policy. Consent is given by clicking the “Accept” button. The player will not load and no access to your device will occur until you have given your consent.

The legal basis is your consent pursuant to Article 6(1)(a) of the GDPR; the necessary access to your device is provided in accordance with Section 25(1) of the TDDDG.

You may revoke your consent at any time with future effect using the Consent Management Tool, which is available under “Cookies” in this Privacy Policy or on our website.   

To the extent that data is transferred to Google LLC in the United States, we base this on the EU-U.S. Data Privacy Framework Adequacy Decision (you can find the current status here: https://www.dataprivacyframework.gov/list) or on standard contractual clauses pursuant to Article 46 of the GDPR; in addition, we implement appropriate technical and organizational measures. 

15. Matomo

The b&b headquarters uses the web analytics service Matomo. We host Matomo on our own servers. The analytics data collected in this process is not transmitted to Matomo or any other third parties.

We use Matomo to analyze the use of our website in order to improve its technical aspects and content. In particular, the following data may be processed: the pages visited, the time and duration of the visit, the referrer URL, the browser used, the operating system, device information, and the truncated IP address. The IP address is truncated before analysis, making it difficult to directly link it to individual users.

Matomo is used without cookies or similar tracking technologies. Data processing is based on our legitimate interest pursuant to Article 6(1)(f) of the GDPR. Our legitimate interest lies in statistical analysis, measuring reach, and improving our online services. You may object to this processing pursuant to Article 21 of the GDPR.

16. Matomo Tag Manager

The b&b headquarters uses Matomo Tag Manager to centrally manage and control certain website features and services. Matomo Tag Manager is self-hosted. The Tag Manager itself does not transmit any data to Matomo or any other third parties.

However, additional services can be integrated or triggered via the Matomo Tag Manager. To the extent that this involves setting cookies, using comparable technologies, or reading information from your device, this is done only with your consent in accordance with Section 25(1) of the TDDDG. Any subsequent processing of personal data is carried out, where necessary, on the basis of your consent in accordance with Article 6(1)(a) of the GDPR.

Provided that the Matomo Tag Manager controls only technically necessary functions, its use is based on Section 25(2) of the German Telemedia Act (TDDDG) and Article 6(1)(f) of the General Data Protection Regulation (GDPR). Our legitimate interest lies in the secure, efficient, and consistent technical management of our website.

III. Rights of data subjects

If your personal data is processed, you are a data subject within the meaning of the GDPR, and you have the following rights vis-à-vis us as the data controller:

1. Right of access

If your personal data is processed, you are a data subject within the meaning of the GDPR, and you have the following rights vis-à-vis us as the data controller:

You have the right, pursuant to Article 15 of the GDPR, to request information about the personal data we process about you. In particular, you may request information regarding
•    the purposes of the processing,
•    the categories of personal data,
•    the categories of recipients to whom your data has been or will be disclosed,
•    the planned storage period,
•    the existence of a right to rectification, erasure, restriction of processing, or objection,
•    the existence of a right to lodge a complaint,
•    the source of your data, if it was not collected by us,
•    as well as information regarding the existence of automated decision-making, including profiling, and, where applicable, meaningful information about its details.

2. Right to rectification

Under Article 16 of the GDPR, you have the right to request, without undue delay, the rectification of inaccurate personal data or the completion of incomplete personal data that we have stored about you, provided that the personal data we process concerning you is inaccurate or incomplete.

3. Right of erasure

You may request that we erase your personal data without delay in accordance with Article 17 of the GDPR, and we are required to erase such data without delay, provided that

- The personal data concerning you is no longer necessary for the purposes for which it was collected or otherwise processed.
- You withdraw your consent to the processing of your data and there is no other legal basis for the processing
- You object to the processing pursuant to Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2) of the GDPR
- your personal data has been processed unlawfully
- the erasure of your personal data is necessary to comply with a legal obligation under Union law or the law of the Member States to which we are subject
- the personal data concerning you has been collected in connection with information society services offered pursuant to Article 8(1) of the GDPR.
The right to erasure does not apply if the processing is necessary
- for the exercise of the right to freedom of expression and information,
- for compliance with a legal obligation,
- for reasons of public interest, or for the establishment, exercise, or defense of legal claims

4. Right to restriction of processing

Under Article 18 of the GDPR, you have the right to request the restriction of the processing of your personal data if
- you contest the accuracy of the data,
- the processing is unlawful, but you oppose its erasure and we no longer need the data, yet you require it to establish, exercise, or defend legal claims, or
- You have objected to the processing pursuant to Article 21 of the GDPR, and it has not yet been determined whether our legitimate grounds override your interests.

5. Right to receive notifications

If you have exercised your right to rectification, erasure, or restriction of processing with us, we are required to notify all recipients to whom your personal data has been disclosed of such rectification, erasure, or restriction of processing, unless this proves impossible or involves disproportionate effort. You have the right to be informed by us about these recipients.

6. Right to data portability

Under Article 20 of the GDPR, you have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format.
You also have the right to transmit this data to another controller without hindrance from us, provided that the processing is based on your consent or on the performance of a contract and is carried out by automated means.

In exercising this right, you also have the right to request that we transfer your personal data directly to another controller, provided that this is technically feasible. This must not infringe upon the rights and freedoms of others.

7. Right to withdraw consent to data processing

Pursuant to Article 7(3) of the GDPR, you have the right to withdraw your consent at any time. As a result, we will no longer be permitted to process your data on the basis of that consent in the future.

8. Right to lodge a complaint

Without prejudice to any other administrative or judicial remedy, you have the right under Article 77 of the GDPR to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or the place where the alleged infringement occurred, if you consider that the processing of personal data concerning you infringes the GDPR.

The supervisory authority to which the complaint was submitted shall inform the complainant of the status and outcome of the complaint, including the possibility of seeking judicial remedy under Article 78 of the GDPR.

9. Right to object

If your personal data is processed on the basis of legitimate interests pursuant to Article 6(1)(f) of the GDPR, you have the right, pursuant to Article 21 of the GDPR, to object to the processing of your personal data if there are grounds for doing so arising from your particular situation; this also applies to profiling based on these provisions.

Once you have objected, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims. 

If your personal data is processed for the purpose of direct marketing, you have the right to object at any time to the processing of your personal data for such marketing purposes; this also applies to profiling to the extent that it is related to such direct marketing. If you object to the processing for direct marketing purposes, your personal data will no longer be processed for those purposes.

If you wish to exercise your right of withdrawal or objection, simply send an email to the data controller responsible for the relevant data processing, i.e., the agency at your chosen destination ([location]@bed-and-breakfast.de) or the B&B headquarters (This email address is being protected from spambots. You need JavaScript enabled to view it.).

10. Automated individual decision-making, including profiling

You have the right not to be subject to a decision based solely on automated processing—including profiling—that produces legal effects concerning you or similarly significantly affects you.
This does not apply if the decision

(1) is necessary for the conclusion or performance of a contract between you and the controller,
(2) is permitted by Union or Member State law to which the controller is subject, and such law provides for appropriate safeguards to protect your rights and freedoms as well as your legitimate interests, or
(3) is based on your explicit consent.

However, these decisions may not be based on special categories of personal data as defined in Article 9(1) of the GDPR, unless Article 9(2)(a) or (g) of the GDPR applies and appropriate measures have been taken to protect your rights and freedoms as well as your legitimate interests. 

With regard to the cases referred to in (1) and (3), the controller shall take appropriate measures to safeguard your rights and freedoms as well as your legitimate interests, including, at a minimum, the right to obtain human intervention on the part of the controller, to present your point of view, and to challenge the decision. We do not engage in automated decision-making or profiling.

11. Data security

When you visit our website, we use SSL (Secure Sockets Layer) or TLS in conjunction with the highest encryption level supported by your browser. This is typically 256-bit encryption. If your browser does not support 256-bit encryption, we will use 128-bit v3 technology instead.

You can recognize an encrypted connection by the fact that the browser’s address bar changes from “http://” to “https://” and by the padlock icon in your browser’s address bar.
We also use appropriate technical and organizational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction, or unauthorized access by third parties.We are constantly improving our security measures in line with technological advancements.

Privacy policy version: June 2026