Privacy information

Scope

This notice describes the processing of personal data on this website and in the associated booking and operational processes.

1. Controller

The controller is Sandro Fuchs, Ferienhaus “Zur schönen Aussicht”, Hermann-Schulze-Straße 12, 01824 Königstein, Germany, email: info@ferien-in-koenigstein.de, telephone: +49 35021 160005. You may use these details for any privacy enquiry.

2. Hosting and website access

The website and its database are hosted by IONOS. When the website is accessed, the hosting service processes connection data required for technical delivery, in particular the IP address, time, requested address, amount of data transferred, response status and browser/device information. This is used for secure delivery, fault analysis and protection against attacks. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is secure and reliable operation. For our webhosting contract concluded before 18 September 2025, IONOS makes webspace access logs available for a maximum of eight weeks; according to IONOS, IP addresses in those log files are anonymised.

2a. IONOS WebAnalytics

We use IONOS WebAnalytics to evaluate the use of our website statistically and to optimise our service technically. This includes information about pages or files accessed, the previously visited website (referrer), the time of access, and the browser, operating system and device used. The IP address is technically transmitted when a page is requested. According to IONOS, it is anonymised immediately after transmission and then processed without reference to an individual. IONOS WebAnalytics does not use cookies. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the statistical evaluation, technical optimisation and improvement of our website. According to IONOS, the underlying webhosting access data is retained for no more than eight weeks. Statistical analyses in WebAnalytics may remain available for a longer period. Further information about processing by IONOS is available in IONOS's privacy information. IONOS: data processing by WebAnalytics.

3. Strictly necessary sessions and device access

We use strictly necessary session and security cookies for availability and booking functions. They enable the requested steps and protect your details. The legal bases are Article 6(1)(b) or (f) GDPR and section 25(2)(2) TDDDG.

4. Cloudflare Turnstile

We use Cloudflare Turnstile to protect the contact form and booking requests against automated abuse. Cloudflare processes information including the IP address, browser and connection characteristics, and the page visited. According to Cloudflare, form contents are not transmitted to Turnstile. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is protecting your details and our forms. This security access is strictly necessary under section 25(2)(2) TDDDG. Cloudflare may also process data outside the European Economic Area; see section 14 for the transfer mechanisms. Cloudflare Turnstile privacy information.

5. Contact enquiries

For a contact enquiry we process your name, email address, optional telephone number and message in order to respond and handle follow-up questions. The form sends the details to the operator’s central mailbox; it does not create an additional contact copy in the website database. The legal basis is Article 6(1)(b) GDPR for pre-contractual enquiries and otherwise Article 6(1)(f) GDPR, based on our legitimate interest in appropriate communication. Required fields are necessary to process the enquiry; without them the form cannot be submitted. Contact enquiries without a booking are deleted six months after processing is completed, unless a specific dispute or claim requires separate retention.

6. Booking requests and accommodation contracts

For requests, offers, bookings and stays we process title, names, contact details, travel dates, accommodation, number and composition of travellers, information about dogs, messages, address, contract status and the prices and terms applying to your booking. The legal basis is Article 6(1)(b) GDPR. Some data may also be required under statutory record-keeping and tax obligations pursuant to Article 6(1)(c) GDPR. No decision with legal or similarly significant effects is made solely by automated means; requests are reviewed by the operator. Finally rejected or unsuccessful requests are deleted after six months, except where a specific dispute or claim requires retention.

7. Traveller data, registration form and municipal guest tax

Before arrival we collect the actual travellers’ names and dates of birth and the booking address. Arrival, departure, address and birth dates are transferred to the municipal AVS system. There, the applicable guest tax is determined and the registration form to be signed by guests is created. Any calculation on our website is only provisional. For the guest-tax evidence needed later, we store the assessed amount, any exemption or reduction, a reference, the booking reference, stay dates and number of travellers separately from registration data; names, address and birth dates are not carried over to this evidence. Suitable documents supporting exemptions or reductions are checked but not stored. The legal basis is Article 6(1)(c) GDPR together with the applicable registration and municipal rules. Special registration data under the Federal Registration Act must be retained for one year from departure and destroyed within the following three months. Under Königstein’s 2026 guest-tax by-law, the municipal original registration form has a one-year period from arrival and must be destroyed within the following three months. Reusable traveller profiles are removed no later than three months after departure without deleting records required by law.

8. Prices, payments, cancellations and tax records

We process prices, payment status, incoming payments, payment references, refunds and cancellations for contract performance, bookkeeping and compliance with tax obligations. The legal bases are Article 6(1)(b) and (c) GDPR. Necessary booking and accounting vouchers are generally retained for eight years from the legally applicable start date; additional personal data is not retained wholesale. Other document classes may have different statutory periods.

9. Email communications

We send emails about enquiries, offers, payments, cancellations, traveller details and arrival through IONOS. After a completed stay, we may send one brief request for feedback. This email may contain a link to Google reviews; a connection to Google is established only if you open it. We do not assume marketing consent for this request. We store the details needed for communication and proof of delivery, in particular recipient, subject, message content, time and delivery status. This supports contract performance, follow-up and traceable communication. The legal bases are Article 6(1)(b), (c) and, for delivery and security evidence and the one-off feedback request, (f) GDPR. Necessary business and contractual correspondence is retained for six years according to its document class; purely technical delivery errors are deleted after 30 days.

10. Arrival documents and access code

For confirmed stays we send appropriate arrival information and documents. An individual access code is processed only for arrival and the stay. The legal basis is Article 6(1)(b) GDPR. The code is scheduled for deletion seven days after departure; if evidence is required for a specific security incident, only the necessary evidence is kept separately protected.

11. Availability calendars

To prevent double bookings, we use Google Calendar to manage and synchronise occupancy. From other calendar entries, we retain only the periods and occupancy details needed for availability, not descriptive content. For regular direct website bookings, we transfer the booking number, booker’s first and last name, accommodation, travel period with arrival and departure times, and total number of guests to our Google Calendar as soon as the offer has been accepted with binding effect. When complete and reliable traveller details become available later, the numbers of adults and children are reflected; the number of booked dogs is included if greater than zero. Dates of birth, address, email address, telephone number, payment details, access code and guest messages are not transferred to the Google Calendar entry. The legal bases are Article 6(1)(b) and (f) GDPR; our legitimate interest is reliable availability. Guests do not connect directly to Google Calendar.

12. Security and operational logs

To prevent abuse and resolve faults, we process necessary access and security data, such as IP addresses, timestamps and error information. Public form-attempt records are removed after one day. Security data is generally retained for 90 days, full IP addresses contained in it for 30 days and other necessary operational data for no more than 180 days. The legal basis is Article 6(1)(f) GDPR; our legitimate interests are access protection, fault detection and evidence of security-relevant actions.

13. Recipients

Only the operator and necessary service providers receive access to the extent required: IONOS for hosting, WebAnalytics and email delivery; Cloudflare Turnstile to protect public forms; Google for occupancy management and voluntarily opened reviews; and Microsoft OneDrive for backup copies. Authorities receive data only where required by law, in particular for registration and guest-tax purposes. External map, review or tourism websites are contacted only when you deliberately follow a link. We use no advertising or social-media pixels or externally loaded fonts.

14. International transfers

IONOS processing is governed by the hosting and mail contract in use. With Cloudflare Turnstile, Google and Microsoft OneDrive, processing by group companies or subprocessors outside the European Economic Area cannot be ruled out. Cloudflare's current data-processing addendum provides for the EU-U.S. Data Privacy Framework for applicable transfers and, in addition, EU Standard Contractual Clauses (SCCs). For details of Google's processing when you voluntarily open a review link, see Google's privacy information.

15. Retention and deletion

Personal data is deleted or irreversibly anonymised according to its purpose; specific statutory evidence duties or disputes may require longer, purpose-bound retention. Necessary booking and accounting vouchers are kept for eight years, and necessary business and contractual correspondence for six years. Contact enquiries without booking and finally rejected requests are deleted after six months, technical mail errors after 30 days and past calendar events after 24 months unless a specific evidence reason applies. Access codes are scheduled for deletion seven days after departure. Reusable traveller profiles are removed no later than three months after departure. Federal registration data is retained for one year from departure and destroyed within the following three months; the municipal original for one year from arrival and destroyed within the following three months. Longer guest-tax evidence is reduced to the necessary minimal record. The periods for access and security data are set out in section 12. Backup copies follow a separate, limited retention plan; the deletion periods apply again after a restore.

16. Your rights

Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction, data portability and objection to processing based on legitimate interests. Consent may be withdrawn for the future; however, the core processing described here is based primarily on contract, legal obligation or legitimate interests. Statutory retention duties may prevent immediate erasure. To exercise your rights, contact the controller using the details above.

17. Right to lodge a complaint

You have the right to lodge a complaint with a data-protection supervisory authority. For a non-public controller established in Saxony, the Saxon Data Protection and Transparency Commissioner, Maternistraße 17, 01067 Dresden, Germany, will generally be competent Lodge a complaint with the Saxon supervisory authority.

Historical guest reviews

We display selected historical guest reviews from our former Lodgify collection with data-minimised display names, original text, individual rating and review month/year. This does not establish a connection to Lodgify. You can request correction of a public display name or removal of a review from public display using the contact details above.

New guest reviews on our website

A voluntary website review process is planned for future stays. After the actual end of a stay has been confirmed, a one-off invitation may include personal website access and the independent Google review link. The required approval will be checked separately before any real invitation is sent. The website process uses the necessary booking and invitation relationship, time-limited access permissions and security information. Guests choose their public display name, enter a star rating and original review text, and see a preview before submitting. Separate express permission for publication is recorded together with its wording and timestamp. Only after operator moderation may the display name, stars, original text and the month and year of the end of the stay appear; exact travel dates are not published. Corrections and removal can be requested using the contact details above. Earlier versions and necessary permission, moderation and security records remain private and purpose-bound. Removal from public display does not automatically mean complete internal deletion. Internal links that are no longer needed are reviewed under the existing deletion and minimisation process; no additional retention period is specified here for this new process.

18. Date and changes

Date: 4 October 2026. This notice will be updated if the law, service providers or functions change.