Privacy policy

3. Privacy Policy

The protection of your personal data is important to us. The following information explains which personal data we process when you visit our website, submit an enquiry, make a booking, complete a payment or stay in one of our apartments, for which purposes such processing takes place, the legal bases on which it is carried out and the rights available to you.

Personal data means any information relating to an identified or identifiable natural person. This includes, for example, names, addresses, contact details, booking information, payment information, communication content and technical usage data.

3.1 Controller

The controller responsible for the processing of personal data is:

Altstadt Apartments Verden
Owner: Max Wittig
Klein Hutberger Weg 42D
27283 Verden (Aller)
Germany

Email: info@apartmentsverden.de
Telephone: +49 160 7010210

3.2 General legal bases

We process personal data in particular on the basis of the following legal provisions:

• Article 6(1)(b) GDPR, where processing is necessary in order to take steps prior to entering into a contract or to perform an accommodation contract or another contract;
• Article 6(1)(c) GDPR, where processing is necessary to comply with legal obligations, particularly commercial, tax, registration or official requirements;
• Article 6(1)(f) GDPR, where processing is necessary for the purposes of our legitimate interests or the legitimate interests of a third party, provided that these interests are not overridden by the interests, fundamental rights or freedoms of the data subject;
• Article 6(1)(a) GDPR, where you have given us your consent.

3.3 Provision of the website and server log data

When you access our website, the web server automatically processes technical data. This may include in particular:

• the IP address of the device used
• the date and time of access
• the page or file accessed
• the amount of data transferred
• the referring URL
• the browser type and browser version
• the operating system
• the hostname of the accessing device
• the HTTP status code

This processing is carried out in order to provide the website technically, ensure its stability and security, detect technical errors and prevent abusive or unauthorised access.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the secure, reliable and technically error-free operation of our website.

Server log data is generally stored only for as long as is necessary to ensure secure and trouble-free operation. Data may be stored for a longer period where there are specific indications of misuse, a security incident or an infringement of the law.

3.3a Hosting of the website

Our website is operated by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. When you visit the website, Vercel processes technical access data (including IP address, date and time, page requested, browser type) in order to deliver the website and keep it secure. The legal basis is Art. 6(1)(f) GDPR. Vercel is certified under the EU-U.S. Data Privacy Framework.

3.4 Booking system provided by Smoobu

The booking system embedded in our website and essential booking-management functions are provided using services supplied by Smoobu GmbH, Pappelallee 78/79, 10437 Berlin, Germany.

Smoobu may process technical usage data and the information you enter when submitting an enquiry or making a booking. This may include your name, address, contact details, dates of stay, number of guests, booked apartment, booked additional services, price and payment information, messages and other information you provide voluntarily.

Processing is carried out to provide the booking system, process and administer bookings, synchronise availability, communicate with guests and technically provide booking-related functions.

The legal bases are Article 6(1)(b) GDPR and, with regard to technical operation, Article 6(1)(f) GDPR.

Where Smoobu processes personal data exclusively on our behalf, this is carried out on the basis of a data processing agreement pursuant to Article 28 GDPR.

Further information is available in the Smoobu Privacy Policy.

3.5 Cookies and comparable technologies

Our website uses cookies and, where applicable, comparable technologies. Cookies are small files that may be stored on or read from your device.

Technically necessary cookies and technologies may be used where they are required to provide the website, the booking process, language settings, security functions or other functions expressly requested by you.

Where personal data is processed through technically necessary cookies, the legal basis is Article 6(1)(b) or Article 6(1)(f) GDPR, depending on the purpose.

Technically non-essential cookies, analytics, marketing or other technologies requiring consent are used only after you have given your consent through the consent management system provided on the website. The legal basis for the subsequent processing of personal data is Article 6(1)(a) GDPR.

You may withdraw or change your consent at any time with effect for the future through the cookie settings. The lawfulness of processing carried out before the withdrawal remains unaffected.

You may also delete or block cookies through your browser settings. Fully disabling cookies may restrict individual functions of the website or online booking system.

3.5a Google Analytics

With your consent we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies and processes usage data (for example pages viewed, time spent, approximate location, device) in order to provide us with reports on how the website is used. Data may be transferred to Google LLC in the USA.

Google Analytics is only loaded after you have agreed in the cookie notice. The legal basis is Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time via “Cookie settings” at the bottom of every page.

3.6 Contacting us

If you contact us by contact form, email, telephone, SMS, messenger, post or another communication channel, we process the data you provide in order to deal with your enquiry.

This may include in particular:

• your name and contact details
• the content and time of your message
• your booking or invoice number
• information about your stay
• documents, files or photographs you provide

Where your contact relates to a booking, pre-contractual steps or an existing contract, processing is based on Article 6(1)(b) GDPR.

In other cases, processing is based on Article 6(1)(f) GDPR. Our legitimate interest lies in the proper handling of enquiries and the documentation of business communications.

3.5b Our own anonymous counting

Independently of Google Analytics, we count how often certain steps on our website are reached – for example how often a search is submitted, an apartment is selected, or the Google Analytics question is answered with yes or no. Only a daily counter per step is increased by one. No cookies are set, no IP addresses or other details about you or your device are stored, and no data is passed on to third parties. It is not possible to identify individual visitors.

3.6a Contact form

If you write to us using the contact form, we process your name, your email address and your message in order to answer your enquiry. The message is sent to us by email and is also stored in our database (Supabase, server location Ireland). The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract, and otherwise Art. 6(1)(f) GDPR. We delete the enquiry once it has been dealt with and no retention obligations apply.

3.7 Bookings and performance of the stay

When you book an apartment, we process the data required to handle, manage and perform the booking. This may include in particular:

• the name and address of the booking person
• email address and telephone number
• arrival and departure dates
• the number and, where applicable, names of accompanying guests
• the apartment booked
• additional services booked
• price, invoice, payment and transaction information
• information about pets, cots or special requests
• communications relating to the booking
• information concerning changes, cancellations, complaints, damage or special incidents

Processing is carried out for the initiation, performance, administration and invoicing of the accommodation contract on the basis of Article 6(1)(b) GDPR.

Where certain information must be collected, disclosed or retained due to legal requirements, processing is additionally based on Article 6(1)(c) GDPR.

If you make a booking for other people or provide us with personal data relating to accompanying guests, please inform those persons about the processing of their data and only provide information that you are entitled to disclose.

3.8 Bookings through external booking platforms

If you book through an external booking platform such as Booking.com, Airbnb, Expedia or a comparable intermediary, we receive from the respective platform the data required to process and perform the booking.

This may include your name, contact details, booking period, number of guests, payment status, booking number, messages and other booking-related information.

Processing by us is based on Article 6(1)(b) GDPR.

The respective booking platform also processes personal data under its own responsibility. The privacy information of the relevant platform applies to such processing.

3.9 Payment processing

Depending on the selected payment method, we use external payment service providers to process payments. The information required for payment is transmitted to or collected directly by the respective payment service provider.

This may include in particular:

• name and billing address
• email address
• payment amount and currency
• booking or transaction number
• payment status
• technical transaction information
• depending on the payment method, card, bank account or PayPal details

Complete credit-card or bank-account details are generally processed directly by the relevant payment service provider and are usually not displayed to us in full.

The legal basis is Article 6(1)(b) GDPR. Where data is processed to prevent payment fraud, misuse or payment default, processing may additionally be based on Article 6(1)(f) GDPR.

3.9.1 Stripe

For credit-card payments or other payment methods offered through Stripe, payment processing is carried out by companies belonging to the Stripe group.

Further information is available in the Stripe Privacy Policy.

3.9.2 PayPal

When you select PayPal as the payment method, the information required to process the payment is transmitted to companies belonging to the PayPal group.

Further information is available in the PayPal Privacy Statement.

3.10 Communication through WhatsApp

We use WhatsApp to communicate with guests, particularly for booking-related information, enquiries, arrival information and guest services.

If you communicate with us through WhatsApp or provide your telephone number for booking-related communication through WhatsApp, your telephone number, profile name, messages, transmitted files and communication-related metadata may be processed.

For users within the European Economic Area, the provider of the service is generally WhatsApp Ireland Limited. When the service is used, data may also be processed by other companies within the Meta group and by technical service providers. Processing outside the European Union or European Economic Area cannot be completely excluded.

Communication through WhatsApp is not mandatory. You may alternatively contact us by email, telephone or post.

Processing is carried out for the performance of your booking and the provision of booking-related information on the basis of Article 6(1)(b) GDPR. Where communication is not directly necessary for the performance of the contract, processing is based on Article 6(1)(f) GDPR. Our legitimate interest lies in fast, efficient communication requested by many guests.

Further information is available in the WhatsApp Privacy Policy.

3.11 Digital guest directory and additional services

We provide guests with a digital guest directory containing information about their stay, arrival, use of the apartment, house rules and bookable additional services.

When it is used, technical access data and information concerning accessed content, submitted enquiries or booked additional services may be processed.

If an additional service is requested, booked or paid for through the digital guest directory, we also process the contact, booking, service and payment information required for this purpose.

The legal basis is Article 6(1)(b) GDPR where processing is necessary for the performance of the stay or the booking of an additional service. Technical provision is based on Article 6(1)(f) GDPR.

3.12 Electronic door locks and access codes

Our apartments are equipped with electronic door locks and/or time-limited access codes. In this connection, the following data may be processed in particular:

• the assignment of an access code to the relevant booking
• the validity period of the access code
• technical status and log data of the locking system
• times of locking or unlocking events, where these are recorded
• information about technical faults or failed access attempts

Processing serves to provide access to the booked apartment, control access authorisation for the relevant period, maintain system security, remedy faults and prevent unauthorised access.

The legal basis is Article 6(1)(b) GDPR where processing is necessary to provide access to the booked apartment. Where processing serves system security, the prevention of misuse or fault analysis, it is based on Article 6(1)(f) GDPR.

Services supplied by Nuki Home Solutions GmbH or other technical service providers connected with the locking system may be used for technical provision.

Further information is available in the Nuki Privacy Policy.

3.13 Cleaning, organisation and guest services

Where necessary for the preparation and performance of a stay, selected booking-related information may be disclosed to employees or commissioned service providers.

This may include, for example, the apartment booked, the period of stay, the number of guests, additional services booked, cleaning requirements or special information required to perform the relevant task.

Information is disclosed only to the extent necessary for the respective task. The legal basis is Article 6(1)(b) GDPR or Article 6(1)(f) GDPR.

3.14 Invoices, accounting and statutory retention

Data from bookings, payments, invoices and business communications is processed where this is required for invoicing, bookkeeping, tax declarations, audits or compliance with statutory documentation and retention obligations.

The legal basis is Article 6(1)(c) GDPR. Where data is additionally retained for the establishment, exercise or defence of legal claims, processing is based on Article 6(1)(f) GDPR.

Recipients may include tax advisers, accounting service providers, tax authorities, auditors, lawyers or other legally authorised bodies.

3.15 Complaints, damage and legal defence

In the event of complaints, payment disputes, cancellations, damage, breaches of the house rules or other legal disputes, we may process and retain the associated booking, communication, payment and evidence data.

This may include photographs, condition reports, cleaning reports, witness statements, technical logs and other documents suitable for clarifying the facts.

Processing is based on Article 6(1)(f) GDPR. Our legitimate interest lies in clarifying the facts, preventing misuse and establishing, exercising or defending legal claims.

Where necessary, data may be disclosed to lawyers, courts, insurers, payment service providers, booking platforms, debt-collection service providers, authorities or other bodies authorised to handle the matter.

3.16 Video surveillance at the apartment locations

Where indicated by appropriate signs, outdoor, entrance, access, bicycle-storage or communal areas at the apartment locations may be monitored by video surveillance.

No video surveillance takes place inside the private living, sleeping or bathroom areas of the apartments.

Video surveillance serves in particular:

• to protect guests, employees and other persons
• to protect property and buildings
• to prevent and investigate theft, vandalism and unauthorised access
• to exercise and enforce our property rights
• to secure entrance and bicycle-storage areas

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in protecting persons and property, preventing and investigating security-related incidents and exercising our property rights.

Video recordings are generally stored only for the period necessary to achieve the purposes described above and are then automatically deleted. In the event of a specific security-related incident, the relevant recordings may be retained for a longer period until the matter has been fully clarified, evidence has been secured or legal proceedings have been completed.

Recordings are disclosed only where this is necessary to investigate an incident, establish or defend claims or comply with a legal obligation, for example to the police, courts, insurers or lawyers.

3.17 Recipients of personal data

We disclose personal data only where this is legally permissible and necessary for the relevant purpose.

Possible recipients or categories of recipients include in particular:

• website, hosting and IT service providers
• Smoobu and associated technical service providers
• booking and intermediary platforms
• payment service providers and banks
• communication service providers
• service providers for electronic locking systems
• employees and service providers responsible for cleaning, organisation and guest services
• tax advisers and accounting service providers
• insurers, lawyers, courts and debt-collection service providers
• authorities and other public bodies where required by law

Service providers that process personal data exclusively on our behalf are contractually bound in accordance with the applicable legal requirements.

We do not sell personal data.

3.18 Transfers outside the European Union

Some service providers used by us or their subcontractors may process personal data outside the European Union or the European Economic Area.

Such transfers take place only where the legal requirements are met, particularly on the basis of an adequacy decision by the European Commission, appropriate safeguards such as the European Commission’s Standard Contractual Clauses or a statutory exception.

Despite appropriate safeguards, it cannot always be completely excluded that authorities in certain third countries may access personal data under their national laws.

3.19 Storage period

We store personal data only for as long as is necessary for the relevant processing purpose or for as long as statutory retention obligations apply.

When determining the storage period, we consider in particular:

• the duration of pre-contractual steps and contract performance
• statutory commercial and tax retention periods
• statutory limitation periods
• the handling of complaints, damage or disputes
• the need to establish or defend legal claims
• the withdrawal of consent or a valid objection
• technical and security-related requirements

Once the relevant purpose no longer applies and statutory retention periods have expired, the data is deleted or anonymised unless another legal basis permits continued processing.

3.20 Obligation to provide personal data

The provision of certain personal data is necessary in order to process an enquiry, conclude and perform a booking, process payments and provide access to the apartment.

Without the required information, we may be unable to process an enquiry, conclude an accommodation contract, allocate a payment or provide access to the apartment.

Where the provision of information is legally required, we may not be permitted to provide the requested service without that information.

3.21 Automated decision-making

We do not generally carry out exclusively automated decision-making within the meaning of Article 22 GDPR that produces legal effects concerning you or similarly significantly affects you.

Payment service providers or booking platforms may use their own automated procedures for fraud and misuse prevention. The privacy information of the respective provider applies to those procedures.

3.22 Your rights

Subject to the applicable legal requirements, you have in particular the following rights:

• the right of access under Article 15 GDPR
• the right to rectification under Article 16 GDPR
• the right to erasure under Article 17 GDPR
• the right to restriction of processing under Article 18 GDPR
• the right to data portability under Article 20 GDPR
• the right to object under Article 21 GDPR
• the right to withdraw consent under Article 7(3) GDPR
• the right to lodge a complaint with a supervisory authority under Article 77 GDPR

To exercise your rights, you may contact us at info@apartmentsverden.de.

3.23 Right to object

Where we process your personal data on the basis of Article 6(1)(e) or Article 6(1)(f) GDPR, you have the right, on grounds relating to your particular situation, to object to such processing at any time.

We will then no longer process the personal data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.

Where personal data is processed for direct marketing purposes, you may object to such processing at any time without giving reasons.

3.24 Withdrawal of consent

You may withdraw consent at any time with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected.

You may withdraw your consent in particular by sending an email to info@apartmentsverden.de.

3.25 Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority concerning the processing of your personal data.

The supervisory authority responsible for our business is in particular:

Der Landesbeauftragte für den Datenschutz Niedersachsen
Postfach 221
30002 Hannover
Germany

Visitor address:
Prinzenstraße 5
30159 Hannover
Germany

Telephone: +49 511 120-4500
Email: poststelle@lfd.niedersachsen.de
Website: www.lfd.niedersachsen.de

You may also contact any other data protection supervisory authority with jurisdiction under the applicable legal provisions.

3.26 Data security

We use appropriate technical and organisational measures to protect personal data against loss, manipulation, unauthorised disclosure and unauthorised access.

Depending on the nature and scope of the processing, these measures include access restrictions, authorisation systems, encrypted data transmission, secure passwords, backups, updates to the systems used and limiting access to those persons who require it.

Please note that data transmission over the internet, particularly unencrypted email communication, may involve security risks despite all protective measures.

3.27 Data relating to minor guests

Our apartments are generally booked by adults. We process data relating to minor accompanying guests only where this is necessary for the performance of the booking, compliance with legal obligations or on the basis of information voluntarily provided by the booking person or a person with parental responsibility.

3.28 Updates to this Privacy Policy

We may amend this Privacy Policy if legal requirements, our services, our website, the technical systems used or our service providers change.

The version published on this website at the relevant time shall apply.

Last updated: 14 November 2026