1. Privacy at a glance

 General information
The following information provides an overview of what happens to your personal data when you visit our website, enquire about holiday accommodation or make a booking.
Personal data is any information that can be used to identify you personally. This includes, for example, your name, address, email address, telephone number, IP address, booking details and payment data.

Controller
The controller responsible for data processing on this website is:
Martin Gattung
trading as Apartments Harzgrün / Crucinius
Zum Rosengarten 29
55595 Weinsheim
Germany
Telephone: +49 176 55165614
Email: info@crucinius.de

How do we collect your data?
Some data is collected when you provide it to us, for example when you:
• complete a contact or enquiry form,
• book holiday accommodation,
• contact us by email or telephone,
• provide information about fellow travellers or pets,
• make a payment.

Other data is collected automatically when you visit the website or after you have given your consent, either by our technical systems or by service providers used by us. This may include your IP address, date and time of access, pages and files viewed, browser type, operating system, device information, referrer URL and technical session and log data.

What do we use your data for?
• to provide and secure the website technically,
• to process enquiries, • to initiate and manage bookings,
• to communicate with guests,
• to process payments and invoices,
• to organise and provide the stay,
• to comply with statutory registration, tax and retention obligations,
• to analyse and improve our online services where you have consented,
• to establish, exercise or defend legal claims.


2. Controller

The controller within the meaning of Article 4(7) GDPR is:
Martin Gattung
trading as Apartments Harzgrün / Crucinius
Zum Rosengarten 29
55595 Weinsheim
Germany
Telephone: +49 176 55165614
Email: info@crucinius.de

No data protection officer has been appointed.


3. Legal bases for processing

We process personal data in particular on the following legal bases:
• Article 6(1)(a) GDPR, where you have given consent,
• Article 6(1)(b) GDPR, where processing is necessary for pre-contractual measures or performance of a contract,
• Article 6(1)(c) GDPR, where processing is necessary to comply with a legal obligation,
• Article 6(1)(f) GDPR, where processing is necessary for our legitimate interests or those of a third party and no overriding interests or rights of the data subject apply.

 Where information is stored on or accessed from your device, this is also carried out in accordance with section 25 TDDDG. Cookies and comparable technologies that are not strictly necessary are used only after your prior consent.


4. Storage period

Unless a more specific storage period is stated in this Privacy Policy, we store personal data only for as long as necessary for the relevant purpose.
If you submit a justified request for deletion or withdraw your consent, the data concerned will be deleted unless statutory retention obligations, legitimate interests or other lawful grounds require continued storage.
Booking, contract, payment and invoice documents may be retained for the periods required by tax and commercial law.


5. Recipients of personal data

Where necessary and legally permissible, personal data may be disclosed in particular to:
• Smoobu as provider of the website, booking and property-management system,
• the relevant owner or landlord of accommodation arranged by us,
• payment service providers and banks,
• booking platforms,
• cleaning, property-management or guest-support service providers,
• municipalities, tourism offices and guest-card providers,
• tax advisers and other professionally bound advisers,
• public authorities where required by law,
• IT, hosting and technical service providers.

Where service providers process personal data on our behalf, this is generally based on a data processing agreement under Article 28 GDPR.


6. Website provision and server log data

When you access our website, technically necessary data is processed so that the website can be provided securely and without errors.
• IP address,
• date and time of access,
• page or file requested,
• browser type and version,
• operating system,
• referrer URL,
• host name of the accessing device,
• amount of data transferred,
• status and error messages.

Processing is based on Article 6(1)(f) GDPR. Our legitimate interest is the secure, stable and technically fault-free provision of the website.


7. Smoobu

For the creation and provision of our website, booking management, availability calendars, guest communication and further administration functions, we use services provided by:
Smoobu GmbH
Pappelallee 78/79
10437 Berlin
Germany

When Smoobu is used, data such as names and contact details, addresses, booking and stay details, fellow-traveller data, pet information, messages and special requests, invoice and payment information, and technical usage and log data may be processed.
Processing is based in particular on Article 6(1)(b) GDPR for pre-contractual measures and performance of the contract.
Where Smoobu processes data on our instructions, a data processing agreement pursuant to Article 28 GDPR is in place.


8. Online bookings and booking enquiries

If you check availability, submit an enquiry or make a booking via our website, we may process in particular:
• first and last name,
• address,
• email address and telephone number,
• arrival and departure dates,
• accommodation booked,
• number of guests,
• details of fellow travellers, children and pets,
• messages and special requests,
• booking number,
• price, invoice and payment data,
• booking and payment status,
• registration-form data where required.

Processing is carried out under Article 6(1)(b) GDPR for pre-contractual measures and performance of the contract. Where statutory registration, tax or retention obligations apply, processing is also based on Article 6(1)(c) GDPR.



9. Own and arranged holiday accommodation

Apartments Harzgrün / Crucinius offers both its own holiday accommodation and accommodation belonging to other owners.
For accommodation arranged on behalf of another owner, the data required to initiate and perform the booking is transferred to the landlord or owner named in the booking confirmation. This may include contact details, booking period, accommodation, number of guests, pet information, payment status and special booking arrangements.
The transfer is based on Article 6(1)(b) GDPR. Where the relevant landlord subsequently determines the purposes and means of further processing, that landlord acts as an independent controller.

10. Bookings through external booking platforms
If you book through an external booking platform, personal data is initially processed by the platform operator.
The information necessary to process the booking is then transferred to us and/or via an interface to Smoobu. This may include bookings via Booking.com, Airbnb, Vrbo/FeWo-direkt, Holidu, HomeToGo or other platforms used by us.
The platform’s own privacy policy applies to its processing. We process the transferred data under Article 6(1)(b) GDPR to manage the booking and stay.


11. Contact form

If you contact us through a contact or enquiry form, we process the information you enter, including your contact details, to deal with your enquiry and any follow-up questions.
Processing is based on Article 6(1)(b) GDPR where the enquiry relates to entering into or performing a contract. Otherwise, processing is based on Article 6(1)(f) GDPR, our legitimate interest being the efficient handling of enquiries.
The data is deleted once the enquiry has been fully dealt with, unless statutory or other lawful grounds require continued storage.


12. Contact by email or telephone

If you contact us by email or telephone, we process the information you provide in order to handle your request. This may include your name, email address, telephone number, content of the enquiry, booking or contract details and other information voluntarily provided.
Processing is based on Article 6(1)(b) GDPR where it relates to a booking, contract or pre-contractual measures, and otherwise on Article 6(1)(f) GDPR.


13. Payment processing

For paid bookings, we offer payment by invoice or bank transfer, PayPal and credit card via Stripe.
We process in particular your name and address, booking and invoice number, invoice amount, payment method, payment status and transaction and billing data.
Processing is based on Article 6(1)(b) GDPR for performance of the contract and Article 6(1)(c) GDPR for compliance with tax and retention obligations.

Payment by invoice or bank transfer
When paying by invoice or bank transfer, the payment data required for processing is handled by us and the banks involved. This may include the account holder’s name, IBAN, BIC where applicable, invoice or booking number, amount, payment reference and date of payment. The legal basis is Article 6(1)(b) GDPR.

PayPal
We offer payments through PayPal. The provider for users in Germany is:
PayPal (Europe) S.à r.l. et Cie, S.C.A.
22–24 Boulevard Royal
L-2449 Luxembourg

If you select PayPal, the information required to process the payment is transferred to PayPal. This may include your name, email address, address, invoice amount, booking number, payment status, transaction data, device and IP data, and where applicable bank or card information.
Processing is based on Article 6(1)(b) GDPR. PayPal processes certain data under its own responsibility, including for payment processing, fraud prevention and compliance with legal obligations.

Credit-card payment via Stripe
For credit-card payments, we use Stripe or Stripe Connect. Depending on the specific service, the following Stripe entities may be involved:
Stripe Payments Europe Limited
1 Grand Canal Street Lower
Grand Canal Dock
Dublin
Ireland

and/or

Stripe Technology Europe, Limited
3 Dublin Landings
North Wall Quay Dublin 1
Ireland

When credit-card payment is selected, the data required to process the payment is transferred to Stripe. This may include the cardholder’s name, card number, expiry date, security code, billing address, email address, booking and invoice number, amount, IP address, device data and transaction data.
We generally do not receive complete card details, but only information about the payment status and transaction.
Processing is based on Article 6(1)(b) GDPR. Stripe may process data under its own responsibility for payment processing, authentication, fraud prevention and compliance with legal obligations.

14. Cookies and comparable technologies

Our website uses cookies and comparable technologies. Cookies are small data records stored on your device. They may be necessary for basic website and booking-system functions or used for analytics, convenience and presentation purposes.

Strictly necessary cookies
Strictly necessary cookies and access to information on your device are used on the basis of section 25(2) TDDDG. Related processing of personal data is based in particular on Article 6(1)(f) GDPR. Our legitimate interest is the secure and functional provision of the website and booking system.

Consent-based cookies and technologies
Cookies and technologies that are not strictly necessary, in particular for audience measurement, analytics or external media, are used only after your prior consent.
The legal bases are section 25(1) TDDDG for storing or accessing information on your device and Article 6(1)(a) GDPR for the subsequent processing of personal data. You can change or withdraw your consent at any time with future effect through the cookie settings provided on the website.


15. Consent management

We use a consent or cookie solution that allows visitors to decide which non-essential services may be loaded.
The selected preferences are stored so that they can be taken into account on subsequent visits.
Processing is carried out to comply with legal documentation obligations and manage consent choices, based on Article 6(1)(c) and (f) GDPR.
You may change your decision at any time through the cookie settings.


16. Google Analytics 4

After you have given consent, this website uses Google Analytics 4, a web analytics service provided by:
Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

Google Analytics enables us to evaluate website usage statistically and improve our online services.
We use Google Analytics measurement ID: G-MDBR6VBOT5
Data processed may include IP address, date and time of access, pages and content viewed, referrer URL, browser type and version, operating system, device information, approximate location, time spent, click and navigation behaviour, and event, session and interaction data.
The service is used only on the basis of your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. You may withdraw your consent at any time through the cookie settings.
Google may also process data on servers outside the European Union or European Economic Area. The retention period is determined by the settings of our Google Analytics property.


17. Google Tag Manager

After you have given consent, we use Google Tag Manager, provided by:
Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

Google Tag Manager is used to centrally manage and trigger website tags, including analytics or other services.
Google Tag Manager does not generally create its own comprehensive usage profiles. However, technical data, particularly the IP address, may be transmitted to Google, and services triggered through Tag Manager may themselves process personal data.
Use is based on your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG unless it performs exclusively technically necessary functions.
You may withdraw your consent at any time through the cookie settings. Tag Manager may trigger analytics and marketing tags only in accordance with your consent choice.


18. Mapbox

Our website includes a Mapbox mapping service provided by:
Mapbox, Inc.
740 15th Street NW, 5th Floor
Washington, DC 20005
USA

The map is used to show the location of our holiday accommodation and help guests find their way.
When the map is loaded, data such as IP address, date and time, browser and device information, map areas viewed, location and usage data, technical identifiers, session data and log data may be processed.
Personal data may be transferred to Mapbox and/or to the United States.
Where the map is not strictly necessary, it is loaded only after your consent. The legal bases are Article 6(1)(a) GDPR and section 25(1) TDDDG. You may withdraw consent at any time through the cookie settings.


19. Links to social networks

Our website may contain links to profiles on social networks and platforms such as Facebook, Instagram, X, LinkedIn or YouTube.
A simple link does not normally establish a connection to the relevant platform’s servers merely by visiting our website.
Only when you click the relevant icon or link do you leave our website and access the platform. From that point, the platform operator processes personal data under its own responsibility, which may include your IP address, device information and details of the link clicked.
The platform operator’s privacy policy applies to that processing.


20. Data relating to fellow travellers

If you provide personal data relating to fellow travellers during a booking, you are responsible for ensuring that you are authorised to provide the data and that the persons concerned have been informed about the processing.
The data is processed only insofar as necessary to manage the booking, organise the stay or comply with legal obligations. The legal bases are Article 6(1)(b) and (c) GDPR.


21. Statutory registration forms, visitor taxes and guest cards

Where statutory or local rules require registration forms, visitor taxes or tourist charges to be collected, or guest cards to be issued, we process the data necessary for these purposes.
This may include name and address, date of birth, nationality, travel dates, number and age of fellow travellers and grounds for exemptions or reductions.
Processing is based on Article 6(1)(c) GDPR in conjunction with the applicable statutory or municipal provisions.
Where necessary, the required data is transferred to municipalities, tourism associations or technical service providers.


22. SSL or TLS encryption

This website uses SSL or TLS encryption to protect confidential information during transmission.
You can recognise an encrypted connection because the browser address begins with “https://” and displays a padlock symbol.
When encryption is active, data transmitted to us cannot easily be read by third parties.


23. Your rights

Access
Under Article 15 GDPR, you have the right to request information about the personal data we process about you.

Rectification
Under Article 16 GDPR, you have the right to have inaccurate data corrected and incomplete data completed.

Erasure
Under Article 17 GDPR, you have the right to request erasure of your personal data where the statutory conditions are met.

Restriction of processing
Under Article 18 GDPR, you have the right to request restriction of processing where the statutory conditions are met.

Data portability
Under Article 20 GDPR, you have the right to receive data that you have provided to us and that we process automatically on the basis of consent or a contract in a structured, commonly used and machine-readable format, or to request transfer to another controller where technically feasible.

Withdrawal of consent
You may withdraw consent at any time with future effect. The lawfulness of processing carried out before withdrawal remains unaffected.

Right to object
Where we process personal data on the basis of Article 6(1)(e) or (f) GDPR, you may object at any time for reasons arising from your particular situation.
Where personal data is processed for direct marketing, you may object at any time. In that case, the data will no longer be used for direct marketing.


24. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or the alleged infringement.
The supervisory authority responsible for our registered office is:
The State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate
Hintere Bleiche 34
55116 Mainz Germany

Postal address:
Postfach 30 40
55020 Mainz
Germany
Telephone: +49 6131 8920-0
Email: poststelle@datenschutz.rlp.de


25. Objection to promotional emails

We object to the use of contact details published as part of our legal-notice obligations for sending unsolicited advertising or information materials. We reserve the right to take legal action in the event of unsolicited advertising, particularly spam emails.


26. Updates and amendments

We reserve the right to amend this Privacy Policy where the services used, legal requirements or the nature of data processing change. The version published on our website at the relevant time is authoritative.