Privacy Policy
Information on the processing of personal data on our website in accordance with the General Data Protection Regulation (GDPR).
Controller
Controller
Urlaub an der Ostsee GmbHLienaustraße 8
23730 Neustadt, Germany
+49 (0) 45 61 - 61 39 39 0
info@urlaubanderostsee.de
Data Protection Officer
DATENDO GmbHHohenzollernring 55
50672 Köln, Germany
dsgvo@datendo.de
www.datendo.de
General Information on Data Processing
We only process personal data insofar as necessary to provide a functional website and our services.
Legal bases:
- Art. 6(1)(a) GDPR – Consent
- Art. 6(1)(b) GDPR – Contract fulfilment
- Art. 6(1)(c) GDPR – Legal obligation
- Art. 6(1)(f) GDPR – Legitimate interest
We implement comprehensive technical and organisational security measures in accordance with Art. 32 GDPR (SSL/TLS encryption, regular reviews).
Web Hosting and Server Provision
Operated on Google Cloud Platform (Google Ireland Limited, Dublin, Ireland). Transfer to the USA secured by the EU-US Data Privacy Framework. Legal basis: Art. 6(1)(f) GDPR. Data processing agreement in place.
Access Data and Server Log Files
Automatically collected when visiting our website:
- IP address
- Date and time of access
- Name and URL of retrieved file
- Amount of data transferred
- Browser type/version, operating system
- Referrer URL and requesting provider
Legal basis: Art. 6(1)(f) GDPR. Deleted after 7 days.
Contact
When you contact us by form, email, or telephone, we process your data to handle the enquiry. Legal basis: Art. 6(1)(b) or (f) GDPR. Deleted after processing unless retention obligations apply.
Booking a Holiday Accommodation
Booking data (name, address, email, phone, travel dates) processed via vOffice (vOffice GmbH, Germany). Legal basis: Art. 6(1)(b) GDPR. Stored for 10 years (statutory retention).
External Services
Adobe Fonts (Typekit)
Font service by Adobe Inc. (EU-US Data Privacy Framework). Legal basis: Art. 6(1)(f) GDPR.
Mapbox (Map Service)
We use Mapbox (Mapbox, Inc., 740 15th Street NW, 5th Floor, Washington, DC 20005, USA) to display interactive maps and static map images. When the map loads, your IP address is transmitted to Mapbox; depending on interaction, further data (e.g. the map view location) may be processed.
Maps are only embedded after your consent via the cookie banner (category "External media"). Legal basis: Art. 6(1)(a) GDPR. Before your consent, the map is not loaded and no data is transmitted. The transfer to the USA is secured by the EU-US Data Privacy Framework; Standard Contractual Clauses (Art. 46(2)(c) GDPR) apply additionally.
vOffice (vOffice GmbH)
Booking platform. Legal basis: Art. 6(1)(b)/(f) GDPR. Data processing agreement in place.
Google Cloud
Accommodation data stored in anonymised form. Legal basis: Art. 6(1)(f) GDPR. Data processing agreement in place.
Data Transfer to Third Countries
USA: EU-US Data Privacy Framework (Google, Adobe, Mapbox certified). Without DPF certification: Standard Contractual Clauses (Art. 46(2)(c) GDPR).
Storage Duration
- Server log files: 7 days
- Booking data: 10 years (statutory retention)
- Contact enquiries: after processing
- Cookie consents: 1 year
- Newsletter: immediately upon unsubscription
Your Rights
- Right of access (Art. 15 GDPR)
- Right to rectification (Art. 16 GDPR)
- Right to erasure (Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to object (Art. 21 GDPR)
- Right to withdraw consent (Art. 7(3) GDPR)
- Right to lodge a complaint (Art. 77 GDPR)
Right to Object (Art. 21 GDPR)
Where processing is based on legitimate interests, you may object. We will then cease processing unless we can demonstrate compelling legitimate grounds.