Privacy Policy

Data Controller

Data Protection Officer

General Information on Data Processing

We only process personal data of our users to the extent necessary to provide a functional website and our content and services. Processing only takes place on the basis of legal permission or with the consent of the data subject. Where we obtain consent for processing operations, Art. 6(1)(a) GDPR serves as the legal basis. For processing necessary for the performance of a contract, Art. 6(1)(b) GDPR applies. For processing to comply with legal obligations, Art. 6(1)(c) GDPR applies. For processing based on our legitimate interests, Art. 6(1)(f) GDPR applies.

Security Measures

We implement extensive technical and organizational security measures pursuant to Art. 32 GDPR to protect your personal data against loss, destruction, unauthorized access, modification, or distribution. We use modern encryption methods, particularly SSL/TLS, for data transmission. Our security measures are regularly reviewed and adapted to technological progress.

Web Hosting and Server Provision

This website is operated via Google Cloud Platform. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you visit our website, your data is processed on Google servers. Personal data may also be transferred to the parent company Google LLC in the USA. The transfer to the USA is secured by the EU-US Data Privacy Framework, for which Google is certified. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the secure and efficient provision of our online services). We have concluded a data processing agreement (DPA) with Google.

Access Data and Server Log Files

When you visit our website, your browser automatically sends information to the server, which is temporarily stored in server log files. The following data is collected: IP address of the requesting device, date and time of access, name and URL of the accessed file, amount of data transferred, notification of successful retrieval, browser type and version, operating system, referrer URL (the previously visited page), and the requesting provider. Storage is based on our legitimate interest pursuant to Art. 6(1)(f) GDPR to ensure system security and technical administration. Log files are automatically deleted after 7 days at the latest, unless longer retention is required for evidence purposes in the event of security incidents.

Contact

When you contact us via a contact form, email, or telephone, we process the data you provide (e.g., name, email address, phone number, message content) to handle your inquiry. The legal basis is Art. 6(1)(b) GDPR for contract-related inquiries, otherwise Art. 6(1)(f) GDPR (legitimate interest in efficient communication). Through our callback form, we also collect information about your property (property type, location). Your data will be deleted after your inquiry has been fully processed, unless statutory retention obligations apply.

Booking a Holiday Accommodation

When making a booking, we process your personal data such as title, name, address, email address, phone number, and travel dates to process the booking. This data is processed via the booking platform vOffice (provider: vOffice GmbH, Germany) and shared with the respective owner or operator of the accommodation. The legal basis is Art. 6(1)(b) GDPR (contract fulfillment). Booking data is stored for the duration of statutory retention periods (generally 10 years pursuant to the German Commercial Code/Fiscal Code).

Data from Landlords and Property Owners

When landlords or property owners offer their vacation property through our website, we process their personal data (name, contact details, bank details, property data) for the presentation and management of the property and to provide our rental services. The legal basis is Art. 6(1)(b) GDPR. Data is stored for the duration of the business relationship and beyond in accordance with statutory retention periods.

Newsletter

When you subscribe to our newsletter, we process your email address to send the newsletter. Registration uses a double opt-in procedure: after signing up, you will receive a confirmation email in which you must confirm your registration. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. You can unsubscribe from the newsletter at any time via the unsubscribe link in each newsletter email or by emailing info@urlaubanderostsee.de. Your email address will be deleted immediately upon unsubscription.

Cookies and Tracking

Local Storage (localStorage)

Our website uses your browser's localStorage technology to provide certain features. Unlike cookies, this data is not transmitted to our servers but remains exclusively on your device. We store the following information: your favorites list (saved accommodations), your cookie consent decision, and an anonymous visitor ID to prevent multiple counting of page views. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in providing user-friendly features). You can delete localStorage data at any time via your browser settings.

External Services and Content

Social Media

We maintain company profiles on Facebook and Instagram. Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, is responsible for data processing on these platforms. Regarding the Facebook fan page, there is joint controllership pursuant to Art. 26 GDPR. Meta only provides us with anonymized statistics on page views and interactions (so-called Page Insights). For more information about data processing by Meta, please refer to Meta's privacy policy: https://www.facebook.com/privacy/policy/. Our website only contains links to our social media profiles. When you click on these links, you are redirected to the respective platform; only then does data processing by Meta take place.

Data Transfers to Third Countries

Some of the services we use are based in the USA (Google, Adobe, CARTO). The USA has had an adequacy decision from the EU Commission since July 10, 2023 (EU-US Data Privacy Framework). Google and Adobe are certified under the Data Privacy Framework, ensuring an adequate level of data protection. For services without DPF certification, we use Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR as a safeguard. The OpenStreetMap Foundation is based in the United Kingdom, for which an adequacy decision from the EU Commission exists.

Data Retention

We store personal data only for as long as necessary for the respective processing purpose or as required by statutory retention periods. Specifically: Server log files are deleted after 7 days. Booking data is retained for 10 years (commercial and tax law retention obligations). Contact inquiries are deleted after processing is complete, unless retention obligations apply. Cookie consents are stored for 1 year. Newsletter data is deleted immediately upon unsubscription.

Your Rights

You have the following rights regarding your personal data processed by us:

• Right of access to your data stored by us (Art. 15 GDPR)
• Right to rectification of inaccurate data (Art. 16 GDPR)
• Right to erasure of your data (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability in a machine-readable format (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to withdraw consent with effect for the future (Art. 7(3) GDPR)
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

Competent Supervisory Authority

Last updated: February 2026