1. Data Controller

LohApartments
Sabrina Wauker and Christian Herbst
Zum Loh 13
21274 Undeloh
Germany
Email: info@lohapartments.de

2. Data Protection Officer

There is no legal obligation to appoint a data protection officer.

3. Purposes, Legal Bases and Mandatory Information

• Initiation and performance of contracts (Art. 6(1)(b) GDPR)
• Compliance with legal obligations (Art. 6(1)(c) GDPR)
• Protection of legitimate interests (Art. 6(1)(f) GDPR)
• Processing based on your consent (Art. 6(1)(a) GDPR)

Certain information is required to fulfil the booking contract. Without this data, such as your name, contact details and payment information, a booking cannot be completed.

4. Website Hosting

This website is hosted by:
IONOS SE
Elgendorfer Straße 57
56410 Montabaur
Germany

A data processing agreement pursuant to Art. 28 GDPR is in place with IONOS. Server log files, including IP address, date, time and browser type, are processed for security purposes. Legal basis: Art. 6(1)(f) GDPR. Retention period: log files are anonymised or deleted after 90 days.

5. Booking Management via Smoobu

Provider: Smoobu GmbH
Pappelallee 78/79, 10437 Berlin, Germany

Categories of data processed: master data, contact details, booking and travel data, and billing data.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract). Data processing agreement pursuant to Art. 28 GDPR.

6. Your Rights

You have the following rights:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR)

You may lodge a complaint with the competent supervisory authority:

State Commissioner for Data Protection of Lower Saxony
Prinzenstraße 5, 30159 Hanover, Germany

7. Cookies

Technically necessary cookies: Art. 6(1)(f) GDPR.

Other cookies and external services are used only after prior consent via our consent management tool (Art. 6(1)(a) GDPR).

Tool: Cookiebot (consent and resource management).

8. Web Analytics with Plausible Analytics

Provider: Plausible Insights OÜ, Estonia.

Processing is based on legitimate interests (Art. 6(1)(f) GDPR).

Plausible does not store full IP addresses and operates without cookies.

9. Use of the Elfsight Chatbot

Provider: Elfsight LLC, Paronyana 19/3, 0015 Yerevan, Armenia.

Data processed:

• IP address – legal basis: consent (Art. 6(1)(a) GDPR)
• Browser type – legal basis: consent (Art. 6(1)(a) GDPR)
• Time of interaction – legal basis: consent (Art. 6(1)(a) GDPR)
• Content entered by users – legal basis: consent (Art. 6(1)(a) GDPR)

Third-country transfer: Armenia – standard contractual clauses pursuant to Art. 46 GDPR. The use of these clauses has been verified.

Further information:
Elfsight Privacy Policy

10. External Links to Medium

Provider: A Medium Corporation, San Francisco, USA.

Data processed when a link is clicked:

• IP address – legal basis: adequacy decision or standard contractual clauses (Art. 44 et seq. GDPR)
• User interaction/referrer information – legal basis: adequacy decision or standard contractual clauses (Art. 44 et seq. GDPR)

Privacy Policy:
Medium Privacy Policy

11. Data Retention

Data is stored only for as long as necessary to fulfil contractual obligations or comply with statutory retention requirements.

Examples:

• Log files: 90 days
• Chat content: 6 months
• Analytics reports: 12 months
• Tax records: up to 10 years

12. Automated Decision-Making

No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place.

13. Data Security

We implement technical and organisational measures pursuant to Art. 32 GDPR. Data is transmitted using SSL/TLS encryption.

14. Changes to This Privacy Policy

We reserve the right to amend this Privacy Policy to reflect changes in legislation or technical developments.