Privacy Policy

PRIVACY POLICY Last updated: 26 August 2026 This is a courtesy translation of our German-language privacy policy ("Datenschutzerklärung"). The German version is legally authoritative for this German business; in case of any discrepancy, the German text applies. 1. Controller The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is: Norbert Winkel Annaberger Str. 231 53175 Bonn, Germany Email: info@luxury-apartments-bonn.com Further details can be found in this website's legal notice ("Impressum"). 2. General Information on Data Processing We generally only process personal data of our users to the extent necessary to provide a functioning website along with our content and services, or where we have obtained explicit consent. Processing takes place based on user consent (Art. 6(1)(a) GDPR), for the performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR), or on the basis of a legitimate interest (Art. 6(1)(f) GDPR). Any consent given may be withdrawn at any time with future effect. 3. Provision of the Website and Server Log Files Each time this website is accessed, our hosting provider automatically collects data in server log files, which may include: – IP address of the accessing device – date and time of access – browser type and version, operating system – referrer URL (previously visited page) – requested file/page, amount of data transferred, access status This data is processed to ensure smooth operation of the website and the security of our IT systems (Art. 6(1)(f) GDPR, legitimate interest). This data is not combined with other data sources. The IP address is stored only for the duration of the session or for the short retention periods customary with our hosting provider. 4. Hosting and Technical Infrastructure This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA (or Vercel B.V. for EU customers). Vercel processes the access data described in section 3 on our behalf. We have entered into a data processing agreement with Vercel pursuant to Art. 28 GDPR. Where data is transferred to the USA, this transfer relies on appropriate safeguards, in particular standard contractual clauses and/or Vercel's certification under the EU-U.S. Data Privacy Framework. We use the "Neon" database (provided via the Vercel Marketplace) to store apartment listing data (descriptions, amenities) and website settings (contact details, legal notice and privacy policy text). This database contains only content maintained by us — no personal data of website visitors. Photos of the apartments are stored using "Vercel Blob", an object storage service provided by Vercel. This, too, contains only image files provided by us, not personal visitor data. 5. Fonts (Google Fonts) This website uses web fonts from Google ("Google Fonts") for a consistent typographic appearance. However, these fonts are not loaded from Google's servers when you visit the site: the font files are downloaded once, at build time, and are served exclusively from our own server/Vercel as part of this website. As a result, visiting this website does not establish any connection to Google's servers, and no data is transmitted to Google for this purpose. 6. Cookies and Local Storage Cookies are small text files stored on your device. We distinguish between technically necessary and non-necessary cookies or comparable storage technologies (e.g. local storage). a) Technically necessary storage (Art. 6(1)(f) GDPR, § 25(2) no. 2 German TTDSG) – Language setting: a cookie stores whether you would like to view the website in German or English. This serves solely to display the website correctly. – Admin login: for this website's password-protected admin area (not accessible to regular visitors), a session cookie is set that technically enables the login. – Your cookie preference itself (see below) is stored in your browser (local storage) so we don't have to ask again on every visit. This storage is strictly necessary for the website to function and cannot be disabled. b) Content requiring consent: Google Maps On the "Contact" and "Region" pages, we offer the option to display an interactive map from the Google Maps service, operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (or Google LLC, USA). The map is not loaded automatically; it is only loaded after you have explicitly consented via our cookie banner or the corresponding button on the relevant page (Art. 6(1)(a) GDPR, § 25(1) German TTDSG). Only once the map is loaded is a connection established to Google's servers; your IP address and possibly other device information may be transmitted to Google, including to the USA. We have no influence over the scope and further processing of the data collected by Google. Information on Google's data protection practices can be found at: https://policies.google.com/privacy You can withdraw your consent at any time, with future effect, via the "Cookie Settings" link in this website's footer. 7. Contact and Booking Form If you send us an enquiry via the contact or booking form, we process the data you provide there (name, email address, optionally phone number, requested travel dates, number of guests, and your message) in order to handle your enquiry. Technically, this is transmitted either – via the form service provider Formspree (Formspree, Inc., USA), once it is actively configured for the relevant website, or – as long as that is not the case, directly via your own, locally installed email program, which opens with a pre-filled email addressed to us. In this case, the data is not routed through our servers or any third party, but sent directly by your email program. The legal basis for this processing is Art. 6(1)(b) GDPR (performance of pre-contractual measures or a contract regarding the holiday apartment), supplemented by Art. 6(1)(a) GDPR where you have consented to being contacted. Your details are used exclusively to handle your enquiry and any related follow-up questions, and are not shared with third parties other than the form service provider mentioned above, if used. Your data is deleted as soon as it is no longer required to process your enquiry, and at the latest after statutory retention periods have expired (e.g. under commercial or tax law for confirmed bookings). 8. Disclosure of Data Your personal data is not transferred to third parties for purposes other than those stated in this policy. We only share your data with third parties where necessary to fulfil a contract (e.g. with the processors named above), where we are legally obliged to do so, or where you have given prior consent. 9. SSL/TLS Encryption For security reasons and to protect the transmission of confidential content, this website uses SSL/TLS encryption. You can recognise an encrypted connection by the padlock icon in your browser's address bar and by the address beginning with "https://". 10. Automated Decision-Making No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place on this website. 11. Your Rights as a Data Subject You have the following rights with respect to your personal data: – Right of access (Art. 15 GDPR) – Right to rectification of inaccurate data (Art. 16 GDPR) – Right to erasure (Art. 17 GDPR) – Right to restriction of processing (Art. 18 GDPR) – Right to data portability (Art. 20 GDPR) – Right to object to processing (Art. 21 GDPR) – Right to withdraw consent given, with future effect (Art. 7(3) GDPR) You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, place of work, or the place of the alleged infringement. 12. Contact for Privacy Questions For questions about the collection, processing, or use of your personal data, for information requests, correction, blocking, or deletion of data, or to withdraw consent given, please contact the email address listed in the legal notice. 13. Changes to This Privacy Policy We reserve the right to amend this privacy policy so that it always complies with current legal requirements, or to reflect changes to our services. Your next visit will then be subject to the then-current privacy policy. Note: This privacy policy was prepared based on the technology actually used on this website and covers the usual statutory requirements. It does not replace individual legal advice — please have the text reviewed by a qualified professional (e.g. a lawyer specialising in data protection), especially after filling in the bracketed placeholders and before activating a live form service provider.