Privacy notice

1. Controller

Thomas Bräse
Villa Östersjön – private holiday home rental
Alte Försterei 1
06895 Zahna-Elster
Germany
Email: info@villa-oestersjoen.eu · Phone: +46 737779197

2. Purposes, legal bases, data categories

• Hosting / server log files (IONOS)
  Our website is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. When you access the website, IONOS processes technical access data in server log files (e.g. IP address, date/time of access, page/file accessed, referrer URL, browser/operating system information, status/error messages). This processing serves technical provision, security (e.g. defence/analysis of attacks) and troubleshooting. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation). Log files are stored by the hosting provider only for a limited period (typically up to about 8 weeks).
• Booking request / contact
  Processed data: travel dates, number of guests, optional firewood units, name, email, phone, message.
  Purpose: handling your request, preparing an offer, preparing and (if applicable) performing the contract.
  Important: this information is transmitted to us exclusively by email and used there for processing.
  Legal basis: Art. 6(1)(b) GDPR.
• External maps (Google Maps)
  On the “Arrival” page we provide a link to the “Google Maps” map service operated by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). The map is not embedded automatically on our website; it is only loaded after you click the link and open Google Maps in a new window/tab.
  At that moment, data (e.g. IP address, any location data, device and browser information) is transmitted to Google and processed there under Google’s own responsibility. The legal basis for accessing Google Maps is your consent provided by clicking the link (Art. 6(1)(a) GDPR). For more information on data processing, please refer to Google’s privacy information.
• Counting booking requests
  Purely statistical counts (e.g. number of requests per period) may be kept without personal reference. No IP addresses, session IDs or other identifiers are evaluated for this purpose.
  Legal basis: Art. 6(1)(f) GDPR.
• Invoicing / tax
  If a booking is concluded, we process the data required for invoicing and legal obligations (e.g. name, address, service period, amount).
  Legal basis: Art. 6(1)(c) GDPR.

3. Cookies / similar technologies

• Language cookie: We use a cookie called to remember your selected language (German/English/Swedish) for future visits. This cookie is technically necessary so that the site can be delivered in your preferred language and is normally stored for up to one year.
• Form/session cookies: When you use individual forms (e.g. the contact form), a short-lived session cookie may be used to handle your request securely (e.g. preventing accidental double submissions, enabling redirect after sending). These cookies are automatically deleted when you close your browser or after a short time.
• No analytics, tracking or marketing cookies are used on the public website.

4. Video surveillance (outdoor area & utility room)

For security reasons, outdoor areas of the property and the utility room are video-monitored (no audio). Legal basis: Art. 6(1)(f) GDPR (legitimate interest).

• Data: image data, timestamps.
• Area: only our own property/utility room; no public areas or neighbouring properties.
• Retention: 10 days, extended only in case of incidents.

5. Recipients / processors

IONOS SE is used as hosting provider under a processing agreement pursuant to Art. 28 GDPR. Other IT service providers receive access only where necessary and are contractually bound. No third-country transfer takes place unless explicitly stated otherwise.

6. Storage periods

• Booking requests / contact: We store your information as long as necessary to handle your request, communicate with you, and prepare or perform a booking. Beyond that, data is stored only to protect our legitimate interests (e.g. clarifying follow-up questions or asserting/defending claims) or due to legal obligations. Afterward, data is deleted or anonymised.
• If a booking is concluded: Contract and invoicing documents as well as legally relevant correspondence are stored in accordance with statutory retention periods (especially tax and commercial law periods).
• Pure count values for booking requests are stored without personal reference and are cleaned up regularly.
• Server log files: limited storage by the hosting provider (typically up to about 8 weeks).

7. Mandatory information

Certain information is required to process requests/bookings; without it, processing is not possible.

8. Data subject rights

Right of access, rectification, erasure, restriction, data portability, objection (Arts. 15–21 GDPR) and the right to lodge a complaint with a supervisory authority.

9. Security

Technical and organisational measures in line with the state of the art (e.g. access control, encryption, logging).

10. Changes

The current version is published here.