Privacy Policy

1. Controller

Holiday apartment “Chalet SonnEck 69”
Owner: Laurent Mander
Auf der Ritschlay 8
54669 Bollendorf
Rhineland-Palatinate, Germany
E-mail: mail@chalet-sonneck.de

Below we inform you, pursuant to Articles 13 and 14 of the General Data Protection Regulation (GDPR), about the processing of your personal data when you visit and use this website.

2. What data we process

a) Server log files

When you access our website, the web host automatically stores information in so-called server log files that your browser transmits. This includes:

• Browser type and version
• Operating system used
• Referrer URL (previously visited page)
• Host name of the accessing computer
• Time of the server request
• IP address (anonymised or full, depending on the hosting configuration)

This data is not merged with other data sources. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the secure and fault-free operation of the website).

b) Online booking, non-binding enquiry and contact form

When you book directly via our website, send a non-binding enquiry or use our contact form, we store the following information for the initiation and performance of the accommodation contract:

• First and last name
• E-mail address
• Phone number (optional)
• Arrival and departure date
• Number of adults, children (6–18), infants (0–5) and, where applicable, pets
• Chosen payment method (bank transfer or cash on arrival) and – for bank transfers – the chosen payment option (deposit or full amount)
• Content of your message (optional)
• Language preference (DE/EN/FR)
• A snapshot of the calculated total price
• For spam prevention: the IP address at the time of submission, stored for a maximum of 24 hours

We automatically send you a confirmation e-mail containing an activation link (double opt-in). Only after you click this link is your booking or enquiry set to the status “awaiting confirmation by the operator”. A binding contract is only concluded in accordance with Section 2 of our T&Cs — for direct bookings through our confirmation e-mail, for enquiries through your acceptance of our offer.

Purpose: processing your booking or enquiry and establishing contact.
Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures / contract performance).

Storage period:

• Requests without a contract: 6 months after the last correspondence, then deletion.
• Confirmed bookings: until the end of the statutory retention periods (generally up to 10 years pursuant to Section 147 AO / Section 257 HGB for records).
• The content of free-text fields (“message”) is deleted at the latest 24 months after arrival.

c) Hosting (Plesk)

This website is hosted on a virtual server (Plesk hosting) located in a data centre within the European Union. When the website is accessed, the host processes the technical log data referred to under section 2a). A data-processing agreement pursuant to Art. 28 GDPR is in place with the host.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure operation of the site).
Storage period: Log files are deleted or anonymised automatically after no more than 14 days.
Host: Fam. Mander-Schmit (privately operated server, data centre in the EU).

3. Cookies and similar technologies (Section 25 TDDDG)

We use cookies and storage mechanisms only to the extent that they are strictly necessary for the operation of the website and the booking flow (in particular: a session cookie for an ongoing booking request, a cookie storing your language preference and a cookie storing your cookie decision cs_consent). These cookies do not require consent under Section 25(2)(2) TDDDG. No tracking cookies, no analytics tools (such as Google Analytics) and no advertising cookies are used.

Third-party content that might transmit personal data to third parties (in particular Google Maps to show the location) is loaded only after you have explicitly given your consent through our cookie banner. You may withdraw your consent at any time by reopening the selection via the “Cookie preferences” link in the footer.

Legal basis: Section 25(2)(2) TDDDG in conjunction with Art. 6(1)(f) GDPR (strictly necessary cookies) and Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR (consent-requiring content).

4. Web fonts

For a consistent visual experience we use web fonts (Google Fonts, self-hosted). The font files are served exclusively from our own server; no connection to third-party servers is established and, in particular, no IP address is transmitted to Google.

5. Date picker / Flatpickr calendar

On our booking page we use the Flatpickr date picker. The library is provided locally from our own server. No data is transmitted to external servers and no connection to third-party providers is established.

6. Google Maps

On our home page a map provided by Google Maps (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) may be embedded to show you the location of the holiday apartment. The map is loaded only after your explicit consent via our cookie banner.

When Google Maps is used, data (in particular your IP address and location data, if you have permitted this) is transmitted to Google servers, which may also be located in the USA. Google is certified under the EU-US Data Privacy Framework. Details can be found in Google’s privacy policy.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in clearly presenting the location). Where corresponding consent has been requested, processing takes place exclusively on the basis of Art. 6(1)(a) GDPR; consent can be withdrawn at any time.

7. External booking platforms

We link to external booking platforms (Booking.com, Airbnb). When you use these links, you leave our website. The processing of your data on these platforms is subject solely to their respective privacy policies. We have no influence on this processing.

8. Calendar synchronisation with booking platforms (iCal import)

To prevent double bookings, our server periodically reconciles the availability calendar of our holiday apartment with the following platforms:

• Airbnb Ireland UC, The Watermarque Building, Ringsend, Dublin 4, Ireland
• Booking.com B.V., Herengracht 597, 1017 CE Amsterdam, The Netherlands

For this purpose we regularly fetch a so-called iCal file from each platform. This file contains only technical occupancy periods (arrival and departure dates and a platform-internal booking reference). We do NOT process any names, addresses or contact details of you or the guests through this channel.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in avoiding parallel bookings across distribution channels).
Storage period: occupancy entries are automatically deleted 24 months after the departure date.
Recipients: the fetched occupancy data is stored exclusively on our own server and is not passed on to third parties.

9. Internal calendar server (CalDAV / Baikal)

Confirmed bookings as well as occupancies fetched from the platform calendars are additionally written to our own CalDAV calendar server (Baikal), operated on a subdomain under our control (dav.chalet-sonneck.de). This allows us a consolidated view of all occupancies. Access is password-protected and limited to the operators of the apartment. No data is forwarded to third parties.
Legal basis: Art. 6(1)(f) GDPR.
Storage period: as under section 8.

10. E-mail processing and mailbox

Our mailbox mail@chalet-sonneck.de is hosted by Networkx S.A. (box.networkx.eu, Luxembourg). Confirmation and reply e-mails are sent to you via the same provider.

Incoming mail originating from our booking platforms (Airbnb, Booking.com) is additionally read by an automated process (the “mail parser”) that extracts the arrival, departure and guest-count information contained therein and feeds it into our calendar. Personal data of guests (name, platform username) is stored only where strictly required for assigning a specific booking and is deleted after 12 months.

Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(f) GDPR (efficient processing of bookings).
Data processing: a data-processing agreement under Art. 28 GDPR is in place with the mail host Networkx S.A.

11. Withdrawal of consent given

Where the processing of your data is based on consent (e.g. cookie settings for Google Maps), you may withdraw that consent at any time with effect for the future, without affecting the lawfulness of the processing carried out up to that point. Please address your withdrawal informally to mail@chalet-sonneck.de or via the “Cookie preferences” link in the footer of every page.

12. Overview of storage periods

Data category	Storage period
Server log files	max. 14 days
Spam-prevention IP for booking requests	24 hours
Requests without a contract	6 months
Free-text messages in confirmed bookings	24 months after arrival
Confirmed bookings / records (tax and commercial law)	up to 10 years (Section 147 AO, Section 257 HGB)
Occupancy entries from Airbnb/Booking iCal	24 months after departure date
CalDAV calendar (Baikal)	as for iCal entries
Mailbox “mail@chalet-sonneck.de”	ongoing; at the latest 36 months after receipt
Cookie consent cookie cs_consent	12 months

13. Your rights as a data subject

Under the GDPR (Art. 15–21) you have the following rights:

• Right of access (Art. 15 GDPR): you may request information about the data stored about you.
• Right to rectification (Art. 16 GDPR): you may request the correction of inaccurate or incomplete data.
• Right to erasure (Art. 17 GDPR): under certain conditions you may request the deletion of your data.
• Right to restriction of processing (Art. 18 GDPR): you may request the restriction of the processing of your data.
• Right to data portability (Art. 20 GDPR): you may request that we transmit your data in a structured, machine-readable format.
• Right to object (Art. 21 GDPR): you may object at any time to the processing of your data based on Art. 6(1)(f) GDPR.

To exercise your rights, please contact: mail@chalet-sonneck.de

14. Right to lodge a complaint with the supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of personal data relating to you infringes the GDPR (Art. 77 GDPR).

The competent supervisory authority for Rhineland-Palatinate is:

15. Data security

For security reasons and to protect the transmission of confidential content, this website uses SSL encryption (recognisable by the “https://” in your browser’s address bar). When SSL encryption is active, the data you transmit to us cannot be read by third parties.

As at: 9 July 2026