Privacy policy

1. Who is responsible?

Janine Kahl
Bielsteiner Straße 92, 51674 Wiehl
Phone 02262 79 76 59 8
Email janine@ferienwohnung-wiehl.de

A data protection officer is not required by law and has therefore not been appointed.

2. When you visit this page

When you open the page, our web host automatically stores what are called server log files. They record: the page you opened, the date and time, the amount of data transferred, browser type and operating system, the page you came from and your IP address in shortened form: for IPv4, the last block of digits is set to 0; for IPv6, only the first three blocks are kept.

We need this data for the page to reach you at all, and to fend off attacks. The legal basis is our legitimate interest in a secure, working website, Art. 6 Abs. 1 lit. f DSGVO (the German name of the GDPR). For security reasons, our web host also keeps IP logs for a short time. Under the data processing agreement, logs are either kept with a shortened IP address or deleted after seven days.

Visitor statistics: We also analyse the log files statistically to see how many visitors come, where from (for example via a search engine) and which pages they open. To do this, we download the log files from our web host and count them on our own computer – without cookies, without any additional program on this site and without further service providers. We delete the downloaded log files after the analysis, at the latest after six weeks; only figures without IP addresses remain. The legal basis is our legitimate interest in improving our offer, Art. 6 Abs. 1 lit. f DSGVO. We do not merge the log files with other data and we do not try to find out who you are. So that nobody is counted twice, requests with the same shortened IP address and the same browser type on one day count as one visit; this grouping exists only during the analysis and is not stored.

Hosting: This page is hosted by united-domains GmbH, Gautinger Straße 10, 82319 Starnberg, Germany. There is a data processing agreement with united-domains under Art. 28 DSGVO. united-domains uses further service providers for this; the web servers are run by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. In the event of overload (DDoS) attacks on the servers, traffic may be rerouted via Akamai Technologies GmbH, Parkring 20–22, 85748 Garching, Germany. united-domains and its service providers process this data exclusively within the European Union.

3. Fonts

The fonts are stored on our own server. When this page loads, no connection is made to Google Fonts or to any other outside server. Your IP address only goes to our web host (see section 2).

4. The booking calendar (Smoobu)

For availability and bookings we use the booking tool from Smoobu GmbH, Pappelallee 78/79, 10437 Berlin, Germany.

On the Availability & booking page the calendar is built straight into the page and loads with it. In the process a connection to booking.smoobu.com is established and your IP address is transmitted there. This does not happen on any other page – elsewhere there is only a button that brings you here.

The legal basis is Art. 6(1)(b) GDPR. You open this page to see whether your dates are free and, if so, to book – and showing the calendar is precisely what that requires. Real availability cannot be displayed without a connection to the booking system; there is no less intrusive way of doing it.

If the booking tool sets a session cookie to hold your entries together during the booking process, that is permitted without consent under § 25(2)(2) TDDDG (the German telecommunications and digital services data protection act): it is strictly necessary for the service you explicitly asked for. It is not used for advertising or analytics.

The helper library that makes the embedded window adjust to the screen size sits on our own server. It is not pulled in from a third-party provider. The embedded Smoobu window itself, however, connects to further providers:

Cloudflare: As soon as the calendar loads, the Smoobu window loads a measurement script from static.cloudflareinsights.com. It comes from Cloudflare, Inc. in the USA, a service provider of Smoobu. In the process your IP address and technical details about your visit to the booking window go to Cloudflare.

Stripe: As soon as the booking form appears, it loads Stripe's payment technology (js.stripe.com) – even if you later pay with PayPal. Stripe receives your IP address, technical details about your device and key details of the booking such as travel dates and number of guests. Stripe may set two cookies: __stripe_mid (one year) and __stripe_sid (30 minutes). They serve to prevent fraud. The legal basis is our legitimate interest in a secure, fraud-free payment, Art. 6(1)(f) GDPR. For the cookies, § 25(2)(2) TDDDG applies. The provider is Stripe Payments Europe, Limited, Dublin, Ireland (see section 7).

If you book through the calendar, Smoobu processes the data you enter – name, address, email, phone number, travel dates and number of guests – on our behalf. The basis is the initiation and performance of the rental contract, Art. 6(1)(b) GDPR. Smoobu's privacy policy: smoobu.com/de/datenschutz

You do not have to use the calendar. A phone call or an email is enough – here is how to reach us.

5. When you write to us or call

If you get in touch by email, phone or WhatsApp, we store your details so that we can reply. The legal basis is Art. 6 Abs. 1 lit. b DSGVO when it is about a booking, otherwise our legitimate interest in replying, Art. 6 Abs. 1 lit. f DSGVO. We delete enquiries that do not turn into a booking after six months at the latest.

About WhatsApp: WhatsApp is not embedded on this page – there is only a link to it. Only when you click that link does WhatsApp open, and a connection to WhatsApp Ireland Limited, a company in the Meta group, is made. If you write to us on WhatsApp, WhatsApp Ireland Limited processes your phone number and connection data (for example the time of the message) under its own terms. The contents are end-to-end encrypted. Data may end up in the USA in the process. If you would rather not, simply send us an email or give us a call – for us it makes no difference.

The request form for the contractor week

On the page Contractor accommodation there is a form. When you send it, we process the names of the guests staying, arrival and departure, the number of people, your email address and – if you enter them – company or name for the invoice, invoice address and phone number.

We use this to check automatically whether the apartment is free for your dates and send you the matching email – with discount code and booking link if it is free. For the check, our server sends only arrival, departure, the number of people and the apartment to Smoobu (see section 4), no names and no email address. A copy of the request and of the email goes to our mailbox. The emails are sent by our web host united-domains.

The legal basis is Art. 6 Abs. 1 lit. b DSGVO, as this is about preparing a rental contract. We delete requests that do not turn into a booking after six months at the latest; the list of requests on our server is cleaned up automatically for this.

To prevent misuse, the server counts how often requests come from one connection. For this it does not store the IP address in plain text, only as a pseudonymised check value created with a secret key. The check value is used for no more than 24 hours and is then deleted. The legal basis is our legitimate interest in a form that is not misused for spam, Art. 6 Abs. 1 lit. f DSGVO.

News by email – only if you want it

The form has an optional tick box for occasional emails about free dates and offers. Your request works just the same without it.

If you tick the box, we first send you an email with a confirmation link. Only once you confirm do we add you to the list (double opt-in). If you do not confirm within seven days, we delete the details again. The list contains your email address, company or name from the form, the language and the time of sign-up and confirmation – so that we can prove that you agreed.

The legal basis is your consent, Art. 6 Abs. 1 lit. a DSGVO. You can withdraw it at any time: a short email to janine@ferienwohnung-wiehl.de is enough, and every newsletter tells you how to unsubscribe. We then remove your address from the list. We keep proof of your earlier consent until the end of the third calendar year after your withdrawal (standard limitation period, §§ 195, 199 BGB, the German Civil Code) and then delete it.

6. When you stay with us

For the booking and for billing we process your name, address, contact details, travel dates, the number and ages of the guests and the payment details. Legal basis: Art. 6 Abs. 1 lit. b DSGVO. We need the details marked with * in the booking form to conclude the contract; without them we cannot accept the booking.

Registration requirement: Since 1 January 2025 the registration form is no longer required for guests with German citizenship. Guests with a foreign nationality are legally obliged to sign a registration form on the day of arrival (§ 29 Abs. 2 Bundesmeldegesetz, BMG, the German federal registration act). It contains the details listed in § 30 Abs. 2 BMG, such as name, date of birth, nationality, address and passport number. Accompanying spouses or partners and minor children are recorded only by number. We keep the registration form for one year from the day of departure and destroy it within three months after that (§ 30 Abs. 4 BMG). The legal basis is Art. 6 Abs. 1 lit. c DSGVO.

Invoices and other booking records are kept for eight years (§ 147 Abs. 1 Nr. 4, Abs. 3 Abgabenordnung, the German fiscal code, § 14b Abs. 1 Umsatzsteuergesetz, the German VAT act), business letters and emails about the booking for six years (§ 147 Abs. 1 Nr. 2 and 3, Abs. 3 Abgabenordnung), in each case from the end of the calendar year. The legal basis is Art. 6 Abs. 1 lit. c DSGVO. We delete the remaining booking data as soon as we no longer need it for the contract and possible claims, at the latest three years after the end of the year in which your stay ended (§§ 195, 199 BGB).

7. When you pay

During the booking process you can choose between PayPal, credit card and SEPA direct debit. There are two service providers behind these. Your payment details only go to the provider whose payment method you choose. Stripe's payment technology, however, is already loaded when the booking form opens (see section 4).

• PayPal – PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, 2449 Luxembourg.
• Stripe (credit card, SEPA direct debit) – Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.

What gets passed on is the data needed for the payment: name, amount, booking number and the payment details you enter at the service provider. We never see your credit card number – it is entered directly at the service provider. The legal basis is the performance of the contract, Art. 6 Abs. 1 lit. b DSGVO.

8. If you booked through a portal

If you did not book directly with us but through a booking portal, we receive your data from there. The portal itself is responsible for the processing that happens there, not us. Once the data reaches us, this policy applies.

9. Passing data on

We do not sell data and we do not pass it on for advertising purposes. Data is passed on only to our web host, to our email provider, to Smoobu and its service providers such as Cloudflare, to PayPal and Stripe for payment processing, to our tax advisers, to our bank – and to public authorities when we are legally obliged to do so.

Transfers to countries outside the EU: Smoobu uses subcontractors based in the USA (including Cloudflare, Amazon Web Services, Google and Microsoft; the list is in Smoobu's privacy policy). Stripe and PayPal may also transfer data to group companies in the USA. The basis is the European Commission's adequacy decision on the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795) where the recipient is certified, and otherwise standard contractual clauses (Art. 46 Abs. 2 lit. c DSGVO).

10. Your rights

You have the following rights at any time:

• access to the data we hold about you (Art. 15 DSGVO)
• rectification if something is wrong (Art. 16 DSGVO)
• erasure, as far as no retention period stands in the way (Art. 17 DSGVO)
• restriction of processing (Art. 18 DSGVO)
• data portability (Art. 20 DSGVO)
• objection to processing based on legitimate interest (Art. 21 DSGVO)
• withdrawal of a consent you have given, with effect for the future (Art. 7 Abs. 3 DSGVO)

An informal email to janine@ferienwohnung-wiehl.de is enough. It does not cost you anything.

Your right to object: Where we process data on the basis of our legitimate interest (Art. 6 Abs. 1 lit. f DSGVO: server log files and their statistical analysis, replies to general enquiries, protecting the form against misuse, Stripe's payment technology in the booking form), you can object at any time on grounds relating to your particular situation (Art. 21 Abs. 1 DSGVO). An email to janine@ferienwohnung-wiehl.de is enough.

11. Complaints

If you think we are handling your data wrongly, you can complain to the supervisory authority. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (the data protection and freedom of information commissioner of North Rhine-Westphalia), Kavalleriestraße 2–4, 40213 Düsseldorf.

12. Changes

We update this policy whenever something changes on the site or in the law. Last updated: October 2026.