Privacy Policy

Controller

Bröckel Grundbesitz eGbR
Partners authorised to represent the company: Gerry Bröckel and Jennifer Bröckel
Weimarer Weg 2
34393 Grebenstein
Germany

Phone: +49 172 6666 720
Email: anfrage@ferien-burguffeln.de

Hosting and server log files

This website is operated on Vercel; the server code runs in Frankfurt am Main, and pages are delivered through a worldwide delivery network. When you open a page, the host technically processes what your browser transmits: IP address, date and time, the page requested, the referring page where there is one, and the browser and operating-system identifier. These logs serve solely the secure and stable operation of the site — fending off attacks and diagnosing faults — and are deleted again after a short time.

The legal basis is our legitimate interest in operating the website securely (Art. 6(1)(f) GDPR). The logs are not combined with other data and not evaluated for advertising.

No cookies — nothing on your device

The public part of this website sets no cookies and places no identifiers in local storage or anywhere else on your device. That is why you see no cookie banner here: there is nothing we would need your consent for, because nothing is stored on or read from your device.

Only the internal administration area, used exclusively by us as operators, sets technically necessary session cookies at login. Visitors to the website are not affected.

Counting visits without storing anything on your device

We count page views to know which pages are read. So that the same visit is not counted twice on the same day, our server derives a checksum from the IP address and browser identifier using a secret key that changes every day. The IP address itself is not stored for this; the checksum cannot be traced back to you and cannot be linked beyond that day.

All that is stored is the page requested, the time, the referring page where there is one, and this daily checksum. The legal basis is our legitimate interest in privacy-preserving reach measurement (Art. 6(1)(f) GDPR).

External links

Our website contains links to external websites. When you click such a link, you leave our website and are taken to the website of the respective provider.

Only when you open the external website are the technically required connection data, in particular your IP address, transmitted to its operator. We have no influence over the processing of personal data there. The operator of the respective external website is responsible for the data processing carried out on it; the privacy information published there applies.

Enquiry form (booking enquiry)

When you enquire about a stay through our enquiry form, we process the details you provide: preferred house, arrival and departure dates, number of guests, name, email address, phone number if you wish, and your message. We use these details solely to handle and answer your enquiry and to prepare the accommodation contract you are asking about. The legal basis is Art. 6(1)(b) GDPR (pre-contractual steps taken at your request).

Your enquiry is stored in our database; you receive a confirmation of receipt by email, and we are notified by email to our mailbox. Your details go exclusively to the people who handle your enquiry. We do not pass them to third parties unless we are legally obliged to.

If no booking comes about, we delete the enquiry once it is dealt with — at the latest three years after it arrived. If a contract comes about, we retain the data required for it under the statutory commercial and tax retention periods (§ 257 HGB, § 147 AO — up to ten years).

Contact by email or phone

If you contact us directly by email or phone, we process your details to handle and answer your matter. The legal basis is Art. 6(1)(b) GDPR where a possible booking is concerned, and otherwise our legitimate interest in answering you (Art. 6(1)(f) GDPR). The same retention rules apply as for the enquiry form.

Newsletter

For our newsletter we store your email address and your chosen language. Signup uses double opt-in: you first receive a confirmation email, and only your click on the confirmation link subscribes you. We log the times of signup and confirmation as evidence of your consent. The legal basis is your consent (Art. 6(1)(a) GDPR).

You can unsubscribe at any time — every email contains an unsubscribe link that works with one click. Doing so withdraws your consent with effect for the future. After you unsubscribe, we keep the address on an internal suppression list so it is not accidentally written to again (Art. 6(1)(f) GDPR).

Review request after your stay

When you accept an offer online, you can voluntarily allow us to email you once after your stay to ask for a review on Google. The box is not pre-ticked, and the booking goes through without it. We store the time of your consent with the booking as evidence. The legal basis is your consent (Art. 6(1)(a) GDPR).

We send the request exactly once, a few days after your departure, to the email address of your booking; it carries no benefit and no reward. You can withdraw your consent at any time with effect for the future — a short email to the address above is enough. Whether you write a review is entirely your decision; the review itself is submitted on Google, where Google’s privacy policy applies.

Protecting the forms against abuse

Our forms are protected by a self-hosted security check (ALTCHA): your browser solves a small computing task that our own server issues and verifies. No external service is involved, and nobody is identified in the process.

In addition, we limit how often requests can be made from the same IP address in a short time. For this, the IP address is processed briefly in a technical access counter and removed again after 24 hours at the latest. The legal basis is our legitimate interest in protecting the website against abuse (Art. 6(1)(f) GDPR).

Service providers (processors)

To run the website we use the following service providers, which process personal data on our behalf and on our instructions:

• Vercel Inc. (USA) — website hosting; server location Frankfurt am Main
• Supabase, Inc. (USA) — database and file storage; Frankfurt am Main region
• Amazon Web Services (AWS) — dispatch of our emails (confirmations, newsletter); Frankfurt am Main region
• ALL-INKL.COM – Neue Medien Münnich (Germany) — the email mailbox where enquiries arrive

Processing in the EU

Processing takes place in the European Union (Frankfurt am Main). Where providers are based in the USA, data-processing agreements including the EU standard contractual clauses (Art. 46 GDPR) are in place with them.

Retention

We store personal data only for as long as the respective purpose requires or statutory retention periods demand. The specific periods are stated with the individual procedures in this policy.

Your rights

You have the following rights towards us. An informal email to the contact details above is enough:

• Access to the data stored about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawal of consent you have given, with effect for the future (Art. 7(3) GDPR)

No automated decision-making

No automated decision-making, including profiling, takes place.

Providing data is voluntary

You are neither legally nor contractually obliged to provide us with personal data. Without the details in the enquiry form, however, we cannot answer your enquiry.

Right to complain to a supervisory authority

You have the right to lodge a complaint with a data-protection supervisory authority (Art. 77 GDPR). The authority responsible for us is: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (the Hessian Commissioner for Data Protection and Freedom of Information), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.

datenschutz.hessen.de