Privacy Policy

Note: This English version is provided for convenience only. In the event of any discrepancies, inconsistencies, or differences in interpretation, the German version shall prevail.

Last updated: April 2026

The protection of your personal data is important to us. Below we inform you about which personal data we process in connection with the use of our website as well as inquiries and bookings.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Spalter EINSER – Owner Swen Deobald

Schnittling 26

91174 Spalt

Germany

Email: [email protected]

Phone: +49 9175 9072984

2. General information on data processing

Personal data means any information relating to an identified or identifiable natural person, such as name, address, telephone number, email address, payment data, or IP address.

We process personal data only to the extent necessary to provide our website, handle inquiries, carry out bookings, comply with legal obligations, or on the basis of your consent.

3. Processing in connection with bookings and inquiries

3.1 Booking data

If you book a holiday apartment with us, we process the data required for handling the booking. This includes in particular:

First and last name
Address
Telephone number
Email address
Booking data
Payment information
where applicable, further information required for contract performance

Processing is carried out for the purpose of handling the booking, communicating with you, performing the accommodation contract, and fulfilling statutory retention and documentation obligations.

Legal bases:

Art. 6(1)(b) GDPR (performance of a contract and pre-contractual measures)

Art. 6(1)(c) GDPR (legal obligations)

Storage period:

We store booking and billing data for the duration of the contractual relationship and subsequently within the scope of statutory retention periods, generally 10 years.

3.2 Contact by email or contact form

If you contact us by email or via a contact form, we process your information for the purpose of handling your inquiry. This includes in particular your name, contact details, and the content of your message.

Legal bases:

Art. 6(1)(b) GDPR, insofar as your inquiry is aimed at concluding a contract or relates to an existing booking

Art. 6(1)(f) GDPR, insofar as processing is necessary for handling other inquiries

Our legitimate interest:

Efficient handling of contact inquiries and communication with interested parties and guests.

Storage period:

Inquiries are deleted once processing has been completed and no statutory retention obligations or legitimate interests in further storage apply. Where commercial or tax-relevant documents are concerned, the statutory retention periods apply. Otherwise, the storage period is based on statutory limitation periods.

3.3 Bookings via third-party platforms

Bookings may also be made via external booking platforms, such as booking or intermediary portals. In these cases, we receive from the relevant platform the data required to carry out the booking.

Please note that the respective platforms’ own privacy policies also apply to data processing on those platforms. Insofar as the platforms process personal data independently, they act as independent controllers under data protection law.

4. Legal bases of processing

Unless a more specific legal basis is stated in this privacy policy, we rely on the following legal bases for the processing of personal data:

Art. 6(1)(a) GDPR – consent
Art. 6(1)(b) GDPR – performance of a contract and pre-contractual measures
Art. 6(1)(c) GDPR – compliance with legal obligations
Art. 6(1)(f) GDPR – legitimate interests

5. Recipients and categories of recipients

We transfer personal data only to the extent permitted by law or required to fulfill our contractual or legal obligations.

Recipients or categories of recipients may include in particular:

Service providers for website hosting, booking systems, and consent management
Payment service providers for payment processing
IT and support service providers insofar as they may have access to personal data in the course of their activities
Tax advisors, banks, authorities, or other bodies insofar as this is required for contract performance or due to legal obligations

Where we use external service providers within the framework of data processing on our behalf, this is done on the basis of a data processing agreement pursuant to Art. 28 GDPR.

Where personal data is transferred to recipients in third countries outside the European Union or the European Economic Area, this is done only if the legal requirements are met. If there is no adequacy decision, the transfer is generally based on appropriate safeguards, in particular standard contractual clauses, where applicable.

6. Payment processing

We use external payment service providers to process payments. The specific payment methods available to you are shown during the booking process.

Only the data required for payment processing is processed. Payment data is processed directly by the respective payment service provider in accordance with its own data protection provisions, insofar as it acts as an independent controller.

Legal basis:

Art. 6(1)(b) GDPR

7. Video surveillance

Video surveillance systems are used in the outdoor areas of the building and in the hallways. Video surveillance serves to protect persons and property, control access, and safeguard our house rules. There is no video surveillance inside the rented apartments.

Legal basis:

Art. 6(1)(f) GDPR in conjunction with Section 4 BDSG

Our legitimate interest:

Protection of our property, protection of our guests and staff, prevention and investigation of incidents, and control of unauthorized access.

Storage period:

Recordings are generally overwritten automatically after 7 days, unless longer storage is required in individual cases, for example to investigate a specific incident or for the establishment, exercise, or defense of legal claims.

Video surveillance is indicated on site by appropriate signage.

Right to object:

You have the right, on grounds relating to your particular situation, to object to the processing of personal data based on Art. 6(1)(f) GDPR.

8. Cookies and consent management

Our website uses cookies and comparable technologies.

We distinguish between:

Technically necessary cookies and technologies

These are necessary to provide the website, its basic functions, and consent management.

Optional cookies and technologies

These are used in particular for statistical evaluations or reach measurement and are only used if you have expressly consented to them.

When you first visit our website, you can use the displayed consent banner to choose whether to allow only necessary technologies or also consent to optional technologies. You may withdraw or adjust your consent at any time with effect for the future via the relevant settings on our website.

Legal bases:

For technically necessary technologies: Section 25(2) TDDDG, Art. 6(1)(f) GDPR

For optional technologies: Section 25(1) TDDDG, Art. 6(1)(a) GDPR

9. Hosting and server log files

When our website is accessed, technically necessary information is processed by the hosting provider in so-called server log files. This includes in particular:

IP address
Date and time of access
Pages or files accessed
Browser type and browser version
Operating system used
Referrer URL
Access status / HTTP status code

Processing is necessary to technically provide the website, ensure stability and security, and detect and prevent misuse.

Legal basis:

Art. 6(1)(f) GDPR

Our legitimate interest:

Secure, stable, and functional operation of our website.

Storage period:

Server log files are generally stored for a limited period and then deleted unless longer retention is necessary for security reasons.

10. Web analytics with Google Analytics

Provided that you have expressly consented, we use Google Analytics, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics enables us to analyze the use of our website in order to improve content, user guidance, and reach. In particular, information about your usage behavior, technical devices, page views, session duration, interactions, and approximate location data may be processed.

Google Analytics is activated on our website only after your express consent. Without your consent, no such analysis takes place.

According to Google, for users from the EU, IP addresses are discarded before logging and are not stored in the course of collection via EU domains and servers. Regardless of this, further usage data may be processed by Google.

Legal basis:

Art. 6(1)(a) GDPR

Section 25(1) TDDDG

Recipients:

Google Ireland Limited and, where applicable, affiliated Google companies

Transfer to third countries:

It cannot be ruled out that, in connection with the use of Google Analytics, personal data may be transferred to companies located in third countries, in particular the United States. Such transfer takes place only if the legal requirements are met. Where applicable, we rely on an adequacy decision or appropriate safeguards, in particular standard contractual clauses.

Withdrawal of your consent:

You may withdraw or adjust any consent already granted at any time with effect for the future via the settings of the cookie banner or consent management tool.

Storage period:

The storage period of data processed in connection with Google Analytics depends on the retention settings stored in our Analytics account and ends at the latest when the data is automatically deleted or anonymized there.

11. Your rights

Within the framework of the applicable legal provisions, you have the following rights:

Right of access under Art. 15 GDPR
Right to rectification under Art. 16 GDPR
Right to erasure under Art. 17 GDPR
Right to restriction of processing under Art. 18 GDPR
Right to data portability under Art. 20 GDPR
Right to object under Art. 21 GDPR
Right to withdraw consent with effect for the future under Art. 7(3) GDPR

To exercise your rights, an informal notification to the contact details given above is sufficient.

12. Right to lodge a complaint with a supervisory authority

You also have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data.

The supervisory authority responsible for our company is:

Bavarian State Office for Data Protection Supervision (BayLDA)

Promenade 18

91522 Ansbach

Germany

13. General storage period

We store personal data only for as long as necessary for the respective purposes or as long as statutory retention obligations exist. Thereafter, the data is deleted or its processing is restricted.

The specific storage period depends in particular on:

the type of the respective contractual relationship
statutory retention obligations
tax and commercial law requirements
possible limitation periods
legitimate interests in pursuing or defending legal claims

14. Changes to this privacy policy

We reserve the right to amend this privacy policy if this becomes necessary due to legal, technical, or organizational changes. The version published on our website at the time of your visit shall apply.