Privacy policy
Ferienwohnung am Skihang Rehefeld · Last updated: September 2026
1. Introduction
Protecting your personal data matters to us. On this page we explain, in plain language, what data we process, why we do so, and what rights you have.
The essentials first:
- We process your data mainly for your booking and your stay.
- We use no analytics, tracking or advertising services. We keep no visitor statistics and build no user profiles.
- If you only read our pages and do not send an enquiry, no lasting record of you is created.
- We do not sell data, and we pass it on only where this is necessary to run our business – for example to our payment service provider.
2. Controllers
The joint controllers for data processing within the meaning of the General Data Protection Regulation (GDPR) are:
Thomas Bernhardt & Sabine Herdzin
Am Donnerberg 3
01773 Altenberg OT Rehefeld-Zaunhaus, Germany
Email: info@fewo-am-skihang.de
Phone: +49 35057 580001
Please direct all questions about data protection, requests to exercise your rights, and objections to this address. Contacting either one of us is sufficient. We are not required to appoint a data protection officer.
3. What data we process
3.1 When you visit our website
Each time a page is called up, our server automatically records your IP address, the date and time, which page was requested and whether the request succeeded, together with general information about your browser and operating system. This is technically necessary in order to deliver pages and to detect faults or attacks.
After seven days, the IP address is truncated so that it can no longer be linked to you. The remaining entries are deleted automatically after 30 days. The data is not evaluated for advertising or statistical purposes.
3.2 When you send a booking enquiry
Through the booking form we collect your first and last name, email address, phone number (optional), the dates and number of guests you would like, and your voluntary answer as to how you found us (see section 5).
We do not collect payment details ourselves. You enter these later, on a secure payment page operated by our payment service provider (see section 7.3).
Without this information we cannot process your enquiry. You are under no legal obligation to provide it – the only consequence is that no contract comes about.
3.3 During your stay
To perform the rental agreement we continue to process your booking data, send confirmations by email and, where necessary, operationally required text messages (SMS) – for example the access code for the apartment. We do not send advertising by SMS. Where a regional guest card is issued, we process the information needed to produce it and to provide it to you as a PDF.
3.4 In the digital guest folder
Once payment has been received, we provide you with a digital guest folder (“GuestApp”) containing information about your stay and, depending on the property, digital door access. Access is via a personal, non-public link. Anyone holding that link has access, so please share it only with the people travelling with you.
| Activity | Data |
|---|---|
| Access to the guest folder | name, email address, the associated booking and apartment, arrival and departure dates, and an encrypted check value derived from your access link (the link itself is not stored by us in plain text) |
| Door openings and security-relevant events | time, outcome, IP address and browser identifier – so that damage, loss or misuse can be traced |
| Reporting your arrival time (optional) | estimated arrival time, vehicle registration number, requests and notes |
| Message to us | category and your text |
| Push notifications (only at your request) | the push address issued by your browser, the associated encryption keys, and the browser identifier so that you can tell several devices apart |
| Your own photos (only after you expressly release them) | the image, its link to your booking, the time of release, and the wording of the consent you gave |
| Using the guest guide | how often and in which way you open it |
What never leaves your device: your location, if you use the location button on a map. The same applies to the content the guest folder stores locally when you add it to your home screen – including your door code and your progress through the checklists. This data is not transmitted to us and disappears when you clear the website data or remove the app. Sharing a recommendation through your device's share menu also happens entirely on your device: we do not learn whether, when, what or to whom you send anything. The link you pass on contains a short code that is identical for all guests – it tells us only that a visit came through this route, not who made the recommendation.
Your own photos: the release is switched off by default. Only when you switch it on are the selected images uploaded to us; as they are uploaded we automatically remove the capture data contained in the image (including location, time and device). We use the images on our website and in our listings on booking portals. We look at every image before publishing it; nothing is published automatically. If you switch the release off again, we delete the images – once your access has expired, a short message to us is enough. Copies already published on booking portals will be removed as soon as we are able to arrange this there.
Time limits: the door functions can be used from the day of arrival until two days after departure. The content of the guest folder remains available from receipt of payment until 14 days after departure – so that you can look something up again at home or write a review. After that, your personal access is deactivated.
3.5 Reviews
After your departure we invite you by email to review your stay. The invitation link is valid only for your booking; leaving a review is voluntary.
We process your name, email address, your ratings in several categories, your text and – if you upload any – images. We also store the wording of the consent you gave when submitting. Only your name, in the form you provide, is published, together with your rating, text and images. Your email address remains internal and is never shown publicly. At your request we will remove the review from our website at any time.
We do not offer anything in return for a review – no discount, prize draw or similar – and we do not select who is invited.
3.6 When you write to us or call
If you contact us by email, phone or WhatsApp, we process your information solely in order to deal with your request.
4. Cookies and storage on your device
We use only the cookies listed below. We do not use cookies from tracking, analytics or marketing providers.
| Cookie | When is it set? | Content and lifetime | Legal basis |
|---|---|---|---|
fewo_lang |
only if you select a language yourself from the menu | language code (e.g. “en”), one year | Section 25(2) no. 2 TDDDG |
fewo_lang_hinweis_zu |
only if you dismiss the notice offering the page in another language | the value 1, one year | Section 25(2) no. 2 TDDDG |
fewo_h |
only if you reached us via a link, an advertisement or a QR code | source code, expires with your browser session | Section 25(2) no. 2 TDDDG |
PHPSESSID |
only if you open the “Contact & enquiry” page | technical session identifier protecting the form against misuse (CSRF protection and rate limiting), expires with your browser session | Section 25(2) no. 2 TDDDG |
| Cookies set by our payment service provider | only once you actively proceed to payment during checkout | technical identifiers for fraud prevention | Art. 6(1)(b) GDPR |
The fewo_h cookie does not recognise you on a later visit and serves solely the booking process you initiated (see section 5). If you call up our pages directly, or only read them, no cookie is created.
You can delete or block cookies in your browser settings at any time. You may then need to select your language again.
TDDDG = German Telecommunications Digital Services Data Protection Act.
5. How your booking enquiry reached us
We want to know which of our own channels work – that is, whether an enquiry came about through a search engine, an AI assistant, a directory, a flyer with a QR code, or a recommendation.
The following is stored only against a booking enquiry you have actually submitted:
- the channel identified (e.g. “search engine”) and, if present, the campaign code of a flyer or QR code,
- the name of the referring website – not its full address, since search terms may appear there,
- the page you entered on, the number of pages visited, and a rough device class (mobile or desktop),
- your voluntary answer to the question “How did you hear about us?”.
Expressly not stored: your IP address (not even truncated), your browser identifier, any characteristics used to recognise your device (“fingerprint”), the full referring address, or any identifier that would connect several visits.
Objection: you may object to this processing at any time, informally (contact details in section 2). We will then delete the source information attached to your booking without delay. Your booking is unaffected.
6. Purposes and legal bases
| What we do | Why | Legal basis |
|---|---|---|
| Process booking enquiries, perform the contract, handle payment, send confirmations by email and operationally required SMS, provide the guest folder, handle arrival notifications and your messages | initiating and performing the rental agreement | Art. 6(1)(b) GDPR |
| Keep server log files | secure and uninterrupted operation of the website, detecting and repelling attacks | Art. 6(1)(f) GDPR |
| Embed maps, weather, snow conditions, trail status and the webcam | providing our guests with current information on getting here and on their stay | Art. 6(1)(f) GDPR |
| Log door openings | security of the property and its guests, traceability in cases of damage, loss or misuse | Art. 6(1)(f) GDPR |
| Analysing use of the guest guide | developing our services to meet guests’ needs | Art. 6(1)(f) GDPR |
| Synchronise occupancy with booking portals | avoiding double bookings | Art. 6(1)(f) GDPR |
| Record how a booking enquiry reached us (section 5) | knowing which of our own channels are effective | Art. 6(1)(f) GDPR |
| Send push notifications, publish reviews and guest photos | only at your express request | Art. 6(1)(a) GDPR; where individuals are depicted, additionally Section 22 KunstUrhG |
| Retain accounting records, remit the local visitor's tax | compliance with legal obligations | Art. 6(1)(c) GDPR |
| Store and read the cookies listed in section 4 | necessary for the service you requested | Section 25(2) no. 2 TDDDG |
No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place.
KunstUrhG = German Act on the Protection of Copyright in Works of Art and Photography.
7. Recipients and embedded services
Your data is received only by parties we need in order to operate. Service providers acting on our behalf are bound by a contract under Art. 28 GDPR.
7.1 Overview
| Recipient | Purpose | Location |
|---|---|---|
| our hosting provider | operation of the website | Germany |
| OpenStreetMap Foundation, OpenSnowMap, OpenTopoMap, Waymarked Trails | map display | UK / EU |
| SnowOnline (TouriSpo GmbH & Co. KG) | snow and trail report | Germany |
| Winterwelt Rehefeld | live webcam image | Germany |
| Stripe | card payment, fraud prevention | USA / EU |
| PayPal (Europe) S.à r.l. et Cie, S.C.A. | payment via PayPal | Luxembourg |
| seven communications GmbH & Co. KG | sending SMS | Germany |
| WhatsApp Ireland Ltd. | only if you write to us there | Ireland |
| the push service of your browser or device manufacturer | delivery of push notifications | USA / EU |
| booking portals (e.g. Airbnb, Booking.com) | synchronising occupied dates | various |
Some content is retrieved and cached by our own server: the weather display, the cross-country, hiking and cycling route data, the elevation profiles, the older webcam archive images, and the publicly visible Google reviews of our listing. Your device makes no connection to these services, and no data about you is transmitted. The website's design elements – fonts, icons, program libraries and the QR codes in the guest folder – are held exclusively on our own server; we do not use an external content delivery network.
7.2 Maps, webcam and snow report
On the pages Getting here, Trail map, Trail status, Hiking & cycling map and Winter holiday, as well as in the guest folder, we embed maps, a snow report widget and the current webcam image. This content is loaded directly into your browser from the respective providers' servers. In doing so, the provider learns your IP address and general technical information about your browser; the snow report provider may also set its own cookies. The map services do not set tracking cookies.
Further information: OpenStreetMap · SnowOnline · Winterwelt Rehefeld
7.3 Payment processing
Payment only takes place after we have confirmed your booking enquiry. You then receive a personal, secure payment link by email. Only when this payment page is opened is a connection established to our payment service provider Stripe; at that point your payment details and your IP address are transmitted to Stripe. Until then, no transmission occurs.
Stripe acts for us as a processor. We do not store credit card details ourselves – they are processed exclusively by Stripe, which meets the payment card industry's security standards (PCI DSS).
PayPal is available as a payment method within the Stripe checkout. If you choose PayPal, the data required for the payment is transmitted to Stripe and to PayPal. We do not embed any PayPal software of our own on our website.
Further information: Stripe · PayPal
7.4 Email and SMS
For sending SMS we use seven communications GmbH & Co. KG, Bonn, Germany, with whom a processing agreement is in place. Your mobile number and the message text are transmitted; processing takes place within the EU or the EEA. If you reply to such a message, we process your reply solely in order to deal with your request.
7.5 WhatsApp
On our website, in the guest folder and on printed materials you will find a link allowing you to message us on WhatsApp. Use is voluntary – you can reach us equally well by email and phone. If you click the link, your phone number and your message are transmitted to WhatsApp Ireland Ltd. and processed there; transmission to the USA cannot be ruled out. We have no influence over the extent and duration of that processing. We use WhatsApp solely to reply to your messages; we send no advertising by this route.
7.6 Push notifications
We set up push notifications only if you expressly activate them in the guest folder; your browser will additionally ask for your permission. Technically, every push message travels through the push service of your browser or operating system manufacturer – Google for Chrome and Android, Apple for Safari, iPhone and iPad, Mozilla for Firefox. Your push address and the encrypted message content are transmitted to that service; only your device can read it. We do not embed any software from these providers. You can switch the notifications off at any time, in the guest folder or in your browser settings; the stored push address is then deleted.
7.7 Synchronisation with booking portals
To avoid double bookings, we synchronise occupied dates with external booking portals. Only date ranges are transferred – no names and no other guest data. Occupancy taken from those portals is deleted automatically after 60 days.
7.8 External links
Our website contains links to third-party sites, including Google Maps on the Getting here page and links to regional providers and leisure destinations. A connection to those providers is established only when you click the link. The same applies to the suggestion that you additionally leave a review on Google. The operators of the linked sites are responsible for data protection there; we have no influence over their content or their practices.
8. Transfers to third countries
Most of the services named above process data within the EU or the EEA. Data may reach a third country in the following cases:
| Recipient | Country | Basis for the transfer |
|---|---|---|
| Stripe | USA | European Commission Standard Contractual Clauses (Art. 46(2)(c) GDPR) |
| PayPal (onward transfer to PayPal Inc.) | USA | European Commission Standard Contractual Clauses |
| Google, Apple (push services) | USA | European Commission adequacy decision (EU-US Data Privacy Framework) |
| WhatsApp Ireland Ltd. | Ireland; transfer to the USA cannot be ruled out | the provider's Standard Contractual Clauses |
| OpenStreetMap Foundation | United Kingdom | European Commission adequacy decision |
9. Retention periods
We store your data only for as long as it is needed for the relevant purpose or as long as statutory retention obligations require.
| Data | Period |
|---|---|
| Server log files | IP address truncated after 7 days, deletion after 30 days |
| Booking and contract data | 10 years from the end of the booking year (Section 147 AO, Section 257 HGB), then anonymised; the information on how your enquiry reached us is deleted immediately upon objection |
| Data relating to your stay – guest folder, arrival notification, messages, push | until 14 days after departure. Exceptions: door opening logs 12 months, email and SMS delivery logs 2 years, occupancy taken from portals 60 days |
| Data based on your consent – reviews, released photos | until you withdraw consent; unused images after 24 months at the latest |
AO = German Fiscal Code; HGB = German Commercial Code.
10. Your rights
You have the following rights in relation to us:
- Access (Art. 15 GDPR) – what data we hold about you.
- Rectification (Art. 16 GDPR) – correction of inaccurate data.
- Erasure (Art. 17 GDPR) – provided no statutory retention obligation prevents it.
- Restriction of processing (Art. 18 GDPR).
- Data portability (Art. 20 GDPR) – release in a commonly used format.
- Objection (Art. 21 GDPR) – against processing based on legitimate interests.
- Withdrawal of consent (Art. 7(3) GDPR) – at any time with effect for the future; processing carried out up to that point remains lawful.
How to exercise your rights: an informal message to info@fewo-am-skihang.de is sufficient. You can also withdraw consent directly where you gave it – in the guest folder or in your browser settings.
Complaint to a supervisory authority
Independently of the above, you may lodge a complaint with a data protection supervisory authority at any time. The authority responsible for us is:
Die Sächsische Datenschutz- und Transparenzbeauftragte (Saxon Commissioner for Data Protection and Transparency)
Maternistraße 17, 01067 Dresden, Germany
Phone: +49 351 85471-101 ·
Email: post@sdtb.sachsen.de
www.datenschutz.sachsen.de
11. Data security
We take technical and organisational measures to protect your data against loss, manipulation and unauthorised access. These include end-to-end encrypted delivery of all pages (shown by the padlock symbol in your browser), not storing credit card details on our systems, and limiting the group of people with access to booking and guest data to what is necessary. We keep our measures under review in line with technical developments.
12. Changes to this privacy policy
We update this privacy policy when our services or the legal requirements change. The current version is always available on this page.
Last updated: September 2026