Privacy Policy – w724 UG (haftungsbeschränkt), N824 Apartments Waldbronn

This Privacy Policy explains how N824 Apartments Waldbronn (w724 UG (haftungsbeschränkt)) processes personal data in connection with our website, enquiries, bookings and stays at our serviced apartments and holiday apartments in Waldbronn.

1. Controller and Scope

The controller within the meaning of the General Data Protection Regulation (GDPR) and other applicable data protection laws is:

w724 UG (haftungsbeschränkt)
Ettlinger Str. 22
76337 Waldbronn
Germany

represented by the managing director.

This Privacy Policy applies to:

Further legal information (e.g. commercial register, VAT ID, contact details) can be found in our Imprint.

2. Categories of Data Processed

We in particular process the following categories of personal data at N824 Apartments Waldbronn:

Master and contact data
Name, address, email address, telephone number, where applicable company details.

Booking and contract data
Apartment/accommodation, travel dates (arrival and departure), number and names of guests, price, booked additional services, payment status, cancellation data.

Payment data
Billing data, payment method, payment service provider, transaction data (no full credit card details where external payment providers are used).

Communication data
Contents of enquiries sent by email, contact form or telephone, correspondence in the context of bookings, complaints and service requests.

Registration and identification data
Any data required for the legally mandated registration form (Meldeschein) (e.g. name, address, nationality, travel document for foreign guests) under applicable registration laws.

Technical and usage data
IP address, date and time of access, pages visited, browser type, operating system used, referrer URL, and where applicable cookies and similar identifiers.

3. Purposes of Processing

We process personal data at N824 Apartments Waldbronn for the following purposes:

Initiation and performance of accommodation contracts
Processing enquiries, preparing offers, reservations, booking confirmations, check‑in/check‑out, invoicing.

Provision of our website
Technical operation, stability, security and optimisation of our website.

Communication with guests and prospective guests
Responding to enquiries, providing information regarding the stay, service communication.

Compliance with legal obligations
In particular registration obligations (Meldeschein), tax and commercial law retention obligations.

Establishment, exercise or defence of legal claims
Enforcing and defending claims, e.g. in connection with damage, cancellations and outstanding payments.

Optional marketing purposes (only if permitted or with consent)
For example, sending information about offers at our apartments (not mandatory; can be withdrawn at any time).

4. Legal Bases for Processing

The processing of personal data is based on the following legal bases:

Article 6(1)(b) GDPR
for the performance of a contract or pre‑contractual measures (e.g. processing enquiries, bookings, accommodation contracts).

Article 6(1)(c) GDPR
for compliance with legal obligations (e.g. registration form obligations, tax and commercial law retention obligations).

Article 6(1)(f) GDPR
based on our legitimate interests, such as:

  • operation of a secure and functional website,
  • ensuring IT and data security,
  • prevention of payment defaults,
  • establishment, exercise and defence of legal claims.

Article 6(1)(a) GDPR
where we obtain your consent in individual cases (e.g. newsletter, certain cookies or tracking tools). You may withdraw your consent at any time with effect for the future.

5. Booking via Our Website, Email or Telephone

If you make a booking or enquiry directly via our website, by email or by telephone, we process your personal data in order to handle your enquiry and perform the accommodation contract.

This in particular includes:

  • collecting your contact and booking data,
  • confirming, amending or cancelling the booking,
  • communication relating to your stay (e.g. check‑in information, information on the accommodation),
  • invoicing and payment processing.

The processing is based on Article 6(1)(b) GDPR.

6. Booking via Third‑Party Platforms (e.g. Airbnb, Booking.com, FeWo‑Direkt/VRBO, Expedia)

If you book via third‑party booking platforms, the respective platform providers initially process your data. The privacy policies of the platforms apply in addition.

We receive from the platforms the data required to process the booking and your stay, in particular:

  • your master and contact data,
  • booking data (apartment/accommodation, travel period, number of persons),
  • selected payment method,
  • where applicable communication content, insofar as communication takes place via the platform.

We use this data solely to perform the contract, to communicate with you and to comply with legal obligations. The processing is based on Article 6(1)(b) and (c) GDPR and, in individual cases, Article 6(1)(f) GDPR (e.g. in the event of disputes).

7. Payment Processing and Payment Service Providers

To process payments we use various payment service providers depending on the booking method (e.g. credit card providers, PayPal, payment processors of third‑party platforms).

The processing of personal data in connection with payments is carried out:

  • to process the payment and allocate it to your booking,
  • to prevent fraud and misuse,
  • to comply with statutory documentation and retention obligations.

The legal bases are in particular Article 6(1)(b), (c) and (f) GDPR.
In addition, the privacy policies of the relevant payment service providers and platforms apply, which you can view during the payment process.

8. Registration Form and Statutory Obligations

For overnight guests we may be legally obliged to collect certain registration data (Meldeschein). This generally includes:

  • first name and surname,
  • date of birth,
  • nationality,
  • address,
  • travel document for foreign guests,
  • dates of arrival and departure.

Processing is carried out solely to comply with statutory registration obligations and is based on Article 6(1)(c) GDPR.
The retention period is determined by the legal requirements; thereafter the data is deleted or destroyed.

9. Server Log Files and Hosting

When you visit our website, server log files are automatically recorded by the web server operated by us or our hosting provider, such as:

  • IP address of the requesting device,
  • date and time of the request,
  • pages/files accessed,
  • volume of data transferred,
  • notification of successful retrieval,
  • browser type and version,
  • operating system used,
  • referrer URL (previously visited page).

This data is technically necessary to provide the website in a stable and secure manner and to detect possible attacks.

The processing is based on Article 6(1)(f) GDPR (legitimate interest in the operation, security and optimisation of the website). As a rule, log data is automatically deleted after a short period, unless longer storage is required for security reasons (e.g. to investigate attacks).

10. Cookies and Similar Technologies

Our website may use cookies or similar technologies to enable certain functions or analyse usage. These may include:

  • technically necessary cookies (e.g. for session control, language settings, form protection),
  • optional cookies (e.g. for statistics, reach measurement or marketing), where used.

Where cookies are not strictly technically necessary, we use them only with your consent. We inform you about the type, purpose and storage period of cookies.

Legal bases:

  • technically necessary cookies: Article 6(1)(f) GDPR,
  • optional cookies/tracking: Article 6(1)(a) GDPR (consent).

You can adjust your cookie settings in your browser and – where available – via our cookie banner.

11. Contact Form, Email and Other Communication

If you contact us via a contact form, email or telephone, we process the information you provide in order to handle your request and any follow‑up questions.

Data processed may include:

  • name,
  • email address, telephone number,
  • content of your message,
  • reference to a booking or stay.

The processing is based on Article 6(1)(b) GDPR (contract‑related enquiries) or Article 6(1)(f) GDPR (general enquiries, legitimate interest in efficient communication).

12. Recipients of Personal Data

We only disclose personal data to third parties where this is necessary for the purposes described or where a legal obligation exists. Potential recipients are:

Internal units
Management, staff responsible for booking, customer service, billing, technical support or administration.

Service providers and processors
e.g. hosting providers, IT service providers, external accounting or tax advisors, cleaning and maintenance services, where required.

Payment service providers and banks
to process payments.

Booking platforms
where necessary for handling bookings via third‑party portals.

Authorities and public bodies
within the framework of legal obligations (e.g. registration authorities, tax authorities).

Legal advisors and courts
in connection with the establishment, exercise or defence of legal claims.

Transfers to third countries (outside the EU/EEA) only take place where required, for example when using international platforms or payment service providers, or where appropriate data protection safeguards are in place (e.g. EU Standard Contractual Clauses, adequacy decision).

13. Storage Period

We process and store personal data only for as long as necessary to achieve the respective processing purpose or for as long as we are legally obliged to do so.

This in particular includes:

Contract and booking data
Retention generally for the duration of the contractual relationship and thereafter within the framework of statutory retention periods (in particular 6 or 10 years under commercial and tax law).

Registration forms
Retention in accordance with statutory requirements, followed by deletion/destruction.

Communication data
Storage for the duration of processing and, where necessary, beyond (e.g. to document processes or defend claims).

Server log files
Regular automatic deletion after a short period, unless security reasons require longer storage.

Cookies
Storage period depending on the type of cookie; detailed information can be found in the cookie notices and in your browser or cookie banner settings.

Once the processing purpose no longer applies and statutory retention periods have expired, the data will be deleted or anonymised.

14. Your Rights as a Data Subject

As a data subject, you have the following rights regarding the processing of your personal data:

Right of access (Article 15 GDPR)
You may request information as to whether we process personal data relating to you and, if so, which data.

Right to rectification (Article 16 GDPR)
You may request the rectification of inaccurate data and the completion of incomplete data.

Right to erasure (Article 17 GDPR)
You may request the erasure of personal data, provided there are no statutory retention obligations or other legal grounds to the contrary.

Right to restriction of processing (Article 18 GDPR)
You may request the restriction of processing in certain circumstances.

Right to data portability (Article 20 GDPR)
You may receive personal data you have provided to us in a structured, commonly used and machine‑readable format or request its transmission to another controller.

Right to object (Article 21 GDPR)
You may object at any time, on grounds relating to your particular situation, to processing based on Article 6(1)(e) or (f) GDPR.
Where data is processed for direct marketing purposes, you have the right to object to such processing at any time.

Right to withdraw consent (Article 7(3) GDPR)
You may withdraw consent given at any time with effect for the future, without affecting the lawfulness of processing based on consent before its withdrawal.

Right to lodge a complaint with a supervisory authority (Article 77 GDPR)
You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR.

15. Data Security

We take appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration and unauthorised disclosure. These in particular include:

  • limiting access to personal data to those persons who need it to perform their tasks,
  • using suitable security and protection mechanisms (e.g. secure passwords, up‑to‑date systems, data backups),
  • careful selection of service providers and processors.

Despite all measures, absolute protection during data transmission over the internet (e.g. when communicating by email) cannot be guaranteed.

16. Changes to This Privacy Policy

We reserve the right to adapt this Privacy Policy if the legal situation, our data processing activities or technical framework conditions change. The current version is available at any time on our website.

17. Contacting the Controller

For information, requests regarding your data subject rights or other questions about data protection at N824 Apartments Waldbronn, please contact the controller:

w724 UG (haftungsbeschränkt)
N824 Apartments Waldbronn
Ettlinger Str. 22
76337 Waldbronn
Germany

Please use the contact details provided in the Imprint for data protection enquiries.

Scroll to Top