Privacy notice

1. Controller

John Pierre Galrao, Hafenstraße 7c, 27711 Osterholz-Scharmbeck, Germany. Telephone: 0172 5355397. Email: haus.von.opa.klaus@gmail.com.

2. Website and hosting

The website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin. The web server processes, in particular, your IP address, the requested page, the time and browser information to deliver the website securely. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is to provide a reliable and secure service.

According to STRATO, IP addresses are stored for no more than seven days to detect and defend against attacks. These must be distinguished from the access logs made available to hosting customers: they can be accessed for the previous six weeks; according to the provider, IP addresses and hostnames in these logs are anonymised. Error logs can be accessed for the previous 24 hours. The graphical statistics supplied by the provider may remain available for several years. For details, see STRATO’s information on logs and statistics.

3. Availability and price

To perform the check, we process travel dates, the apartment and the numbers of adults, children and infants. Our server imports occupancy calendars from Airbnb; your browser does not connect to Airbnb for this purpose. Only blocked periods are displayed publicly, never other guests’ names. Price calculations and calendar information do not make a reservation. Legal basis: Article 6(1)(b) GDPR, to prepare for your requested stay.

4. Enquiries, email and host area

The form requires your name, email address, apartment, travel dates and guest numbers. Your telephone number and message are optional. We also process your chosen reply language and the calculated price proposal. The form cannot be used without the required details; you can call us instead. The purpose is to handle your enquiry and prepare for a stay, under Article 6(1)(b) GDPR. We handle other contact requests under Article 6(1)(f) GDPR, based on our interest in responding to you. Marketing consent is not required.

The data is sent to our server and then by email to haus.von.opa.klaus@gmail.com. After handover to the mail server, the enquiry, contact details, price proposal and prepared reply are also stored in the protected host area. No automatic reply is sent to guests, and no booking or payment is made.

We use Gmail for the recipient mailbox. For users in the European Economic Area, Google identifies Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google processes message contents and communication data during email communication; processing outside the European Economic Area is possible. Google describes the EU-US Data Privacy Framework for transfers to appropriately certified US recipients and, where necessary, standard contractual clauses. Details of the processing and these arrangements can be found in Google’s privacy policy and its information on international data transfers.

5. Retention

The additional enquiry archive on the web server contains no more than 200 entries. Entries older than 90 days are removed on the next access, on a new enquiry or during maintenance. If there is no use or maintenance run, data may remain longer. This cleanup does not include the email mailbox.

As part of a monthly review, we delete correspondence about an enquiry that does not result in a contract once the enquiry has been dealt with and the requested travel period has passed. For other contact requests, completion of their handling is the relevant criterion. If a contract is concluded, further retention follows the statutory obligations applicable to the particular document. Where specific documents are needed to resolve a particular legal dispute, we retain them until that dispute has been finally resolved. They are deleted once the relevant reason for retention no longer applies. These rules also apply to WhatsApp correspondence handled by us.

6. Necessary cookies and security

We do not use analytics or advertising cookies. OPAKLAUSWEB is a technically necessary session cookie that protects the enquiry form. OPAKLAUSADMIN is used only when the host area is accessed; its login expires after 30 minutes of inactivity and after eight hours at the latest. The cookies contain random identifiers, not guest data. They last for the browser session; browser session restoration may extend this. HTTPS, HttpOnly and SameSite Strict protect the cookies. The legal basis for necessary storage is Section 25(2), point 2 TDDDG; for security processing, Article 6(1)(f) GDPR.

To limit misuse, an identifier is derived from the IP address using a secret key. Technical verification values and enquiry numbers prevent duplicate sending. The application does not store the IP address in plain text for this purpose. Security records are removed in subsequent cleanups once they are more than 48 hours old; without further access or maintenance, this may take longer. Server logs are separate. Our legitimate interest is protection against spam and overload.

7. Links and language selection

Fonts, photos and program files are loaded locally. There are no embedded maps, videos, WhatsApp widgets or analytics tools. External links to Airbnb, WhatsApp, Google Maps and tourist information services open those services only after you click. Their privacy notices then apply.

WhatsApp and email links may contain the apartment, travel dates, guest numbers and displayed price; Airbnb links may contain travel dates. Details from the contact form, such as your name, email address or message, are not included. Opening WhatsApp sends the link data to that service. You send the prepared message yourself. If you contact us through WhatsApp, we process your telephone number and messages to handle your enquiry under Article 6(1)(b) GDPR; for other matters, under Article 6(1)(f) GDPR based on our interest in responding to you. Information about processing by WhatsApp and international transfers can be found in WhatsApp’s privacy policy. Email links open your email program. WhatsApp is optional; telephone, email and the form are also available.

Language selection uses neither cookies nor persistent browser storage. Travel selections and guest numbers may be retained in the internal page address when switching languages, but contact details are not.

8. Your rights

Within the limits provided by law, you have rights of access, rectification, erasure, restriction of processing and data portability. Where processing is based on legitimate interests, you may object on grounds relating to your particular situation. You may withdraw any separately given consent at any time with effect for the future. Please use the contact details above.

You may lodge a complaint with a data protection supervisory authority, in particular the State Commissioner for Data Protection of Lower Saxony, Prinzenstraße 5, 30159 Hannover. No solely automated decision with legal effects or corresponding profiling takes place here. A binding offer is made personally.