Privacy Policy

Server log files: When you visit our website, our hosting and CDN provider Cloudflare (Cloudflare, Inc., San Francisco, USA) automatically processes technical data including your IP address, browser type, referring URL, and time of access. This is necessary to deliver the site and to protect it against attacks and abuse.

Contact form: When you submit our contact form, we collect the data you provide (name, email address, phone number, travel status, number of guests, check-in date and your message). The submission is handled by a function on our hosting provider Cloudflare and delivered to our booking inbox by our email provider Resend (Plus Five Five, Inc., San Francisco, USA), which also sends you a short confirmation that we received it. We do not store your inquiry anywhere else, and we use it solely to answer you and to prepare a possible booking.

Abuse protection: To stop spam and automated misuse of the contact form, we use Cloudflare Turnstile to tell people from bots (see section 3). We also keep a shortened, one-way hash of your IP address for one hour to limit how many messages can be sent. For each delivered message we also keep a technical record (time, delivery ID and that hash) for 90 days, with no name, email or message content. The legal basis is our legitimate interest in keeping the form secure (Art. 6(1)(f) GDPR).

Booking by WhatsApp: If you choose to contact us via the WhatsApp buttons on this site, your message and phone number are processed by WhatsApp Ireland Ltd. under its own privacy policy. Using WhatsApp is entirely optional — email works just as well.

Analytics: We use Cloudflare Web Analytics. It sets no cookies, does not fingerprint visitors and does not track you across websites. It reports aggregate page views only.

When your browser loads content from the providers below, your IP address is necessarily transmitted to them. We keep this list as short as we reasonably can.

• Fonts: All fonts are hosted on our own server. No data is sent to Google Fonts.
• Map: The map on our contact page, its map data (© OpenStreetMap contributors) and its code are all hosted on our own server. Viewing or using it sends no data to any other provider.
• Cloudflare Turnstile (challenges.cloudflare.com): Loads only once you start filling in our contact form, to check that a person and not a bot is sending it. It processes your IP address and technical browser signals for bot detection only, not to identify, profile or track you, and it replaces a puzzle-style CAPTCHA.
• YouTube (youtube-nocookie.com): The video preview image is hosted on our own server, so nothing is sent to Google until you press play. Only then is the player loaded, in privacy-enhanced mode.

Inquiries that do not lead to a booking: deleted within 12 months of the last contact.

Inquiries that lead to a booking: kept for the duration of the stay and afterwards for as long as German commercial and tax law requires (up to 10 years under § 147 AO and § 257 HGB).

Server log data: processed by Cloudflare for a short period for security purposes; we do not store it ourselves.

Under the GDPR, you have the right to:

• Access your personal data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object to processing (Art. 21 GDPR)

To exercise these rights, contact us at [email protected].

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for our business is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz (LfDI), Postfach 30 40, 55020 Mainz — datenschutz.rlp.de.