Privacy Policy

1. Controller

The following operator is the controller responsible for processing personal data on this website within the meaning of Art. 4(7) GDPR. For data protection questions, please use these contact details:

VacApps L.E.
Owner: Dipl.-Ing. Jürgen Bodenstab
Hermann-Liebmann-Str. 21
04315 Leipzig
Germany
Phone: 0341 / 3196200
Email: bodenstab@ihreferien.de

2. General information and legal bases

We process personal data only where this is necessary to provide a working website, to answer enquiries and to prepare and perform your booking.

The legal bases are Art. 6(1)(b) GDPR (contract and pre-contractual steps), Art. 6(1)(c) GDPR (legal obligations such as tax record-keeping) and Art. 6(1)(f) GDPR (legitimate interest in secure and reliable operation). We only ask for consent where we expressly say so.

3. Hosting and server log files

This website and its database run on a self-managed server rented from NovaCloud-Hosting (Portugal) and located in a data centre in the EU. A data processing agreement under Art. 28 GDPR is in place with the provider.

Each time the site is accessed, the server processes technically necessary data: IP address, date and time, page requested, amount of data transferred, referrer URL, browser and operating system. This data is used to deliver the website, analyse errors and fend off attacks (Art. 6(1)(f) GDPR). It is not combined with other data and is only stored for as long as these purposes require.

Data is transmitted in encrypted form via TLS (recognisable by “https://” in the address bar).

4. Cookies and local storage

We do not use analytics, advertising or tracking cookies and do not embed any tracking services. That is why this website has no cookie banner.

Technically necessary and permitted without consent (§ 25(2) no. 2 TDDDG) are: the “NEXT_LOCALE” cookie, which stores your language choice for up to 12 months, and, during a booking, an entry in your browser's session storage holding a random request reference. This entry contains no guest details, prevents accidental double bookings and is deleted when you close the browser window.

5. Fonts

The fonts used are delivered from our own server. No connection is made to servers of Google or other font providers.

6. Apartment photos

The apartment photos are loaded into your browser directly from the content delivery network images.hrs-ds.com of our booking system provider (HRS Group, see section 7). In the process, your IP address and technical browser data are transmitted to its operator. The legal basis is our legitimate interest in presenting our accommodation reliably (Art. 6(1)(f) GDPR).

7. Availability, prices and booking

For availability, prices and bookings we use the booking system of DS Destination Solutions GmbH, Breslauer Platz 4, 50668 Cologne, Germany (“Destination Solutions”). Calendar and price requests are made by our server; your IP address is not transmitted to Destination Solutions in the process.

When you complete a booking, we transmit your details (first and last name, address, country, email address, phone number, travel dates, number of guests, selected extras and payment method) via our server to Destination Solutions. The booking is created there and the booking confirmation including payment information is sent by email. The legal basis is Art. 6(1)(b) GDPR. Without these details we cannot conclude a rental contract.

Destination Solutions processes the data as our technical service provider. Further information: www.ds-destinationsolutions.com/datenschutz.

8. Storage in our database

So that your booking status is shown reliably and no double booking occurs, we store the first and last name, email address, apartment, travel dates, number of guests, status and booking number of each booking attempt in our own database. Destination Solutions automatically notifies us of bookings, changes, cancellations and availability (webhook); we store these notifications for traceability and error analysis. The legal basis is Art. 6(1)(b) and (f) GDPR.

Unconfirmed booking attempts are deleted after 90 days, all other entries and notifications automatically after 24 months at the latest. Statutory retention obligations for booking and invoice records (in particular § 147 AO, § 257 HGB) remain unaffected.

9. Contacting us and contact form

If you contact us by email or phone, we process your details to handle your enquiry and any follow-up questions.

If you use the contact form, your browser transmits your name, email address, selected apartment, your message and the page language to our server. From there we send the enquiry to ourselves by email, with your email address set as the reply-to address. The enquiry is not stored in our database. To protect against automated submissions (spam), our server checks an invisible form field and the time taken to fill in the form and limits the number of enquiries per IP address; for this purpose the IP address is only held briefly in memory.

To send the email we use our self-operated email service useSend (usesend.cwcodes.de). useSend delivers emails technically via Amazon Simple Email Service (Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg); the content and the sender and recipient addresses of the email are processed for delivery. A data processing agreement under Art. 28 GDPR is in place with the provider. A transfer to the USA cannot be ruled out; it is based on the provider's certification under the EU-US Data Privacy Framework and additionally on the European Commission's standard contractual clauses.

The legal basis is Art. 6(1)(b) GDPR where your enquiry concerns a booking, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries and secure operation). We delete the data once the enquiry has been dealt with and no retention obligation applies.

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw any consent given at any time with effect for the future (Art. 7(3) GDPR). An informal message to the contact details above is sufficient.

Right to object: where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).

You may lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Saxon Data Protection and Transparency Commissioner (www.datenschutz.sachsen.de).

11. No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.