Privacy policy

In brief

We do not use any analytics or tracking tools or advertising cookies on this website. We only process personal data where it is needed to run the website, handle your booking or answer your enquiries. Your data stays with us and is only passed to the service providers listed below, if you have agreed to it or if we are legally required to do so.

Controller

Oliver Hehr
Freiherr-vom-Stein-Str. 26
35447 Reiskirchen, Germany
Email: info.entfernen@nospam.casakaren.de
Phone: +49 (0) 6408 969-0-7873

Hosting and server log files

This website and our email account are hosted by STRATO in Berlin. When you visit the pages, the server automatically records technical data sent by your browser: IP address, date and time, the page visited, browser and operating system, and the previously visited page.

We need this data to provide the website securely and reliably. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR. The log files are deleted automatically after a short time. We have a data processing agreement with STRATO. The connection to our website is encrypted via SSL/TLS.

Cookies and fonts

Our website itself does not set any cookies or store any data in your browser. The fonts are loaded from our own server; there is no connection to Google Fonts.

Availability calendar and online booking (Smoobu)

For the availability calendar and online booking we use Smoobu, software provided by Smoobu GmbH, Berlin. When you open the home page, the calendar and booking form are loaded from Smoobu's servers, and your IP address and technical data are transmitted to Smoobu.

Smoobu sets a session cookie that is technically necessary for the calendar and booking to work and is deleted when you close your browser. No consent is required for technically necessary cookies (Section 25(2) no. 2 of the German TDDDG).

When you book, we use Smoobu to process the details you enter in the form, such as your name, address, email address, phone number, travel dates and number of guests. The legal basis is the performance of the rental contract (Art. 6(1)(b) GDPR), and for displaying the calendar our legitimate interest in offering simple online booking (Art. 6(1)(f) GDPR). We have a data processing agreement with Smoobu.

Cloudflare (cdnjs)

Smoobu's booking form loads a small script via the cdnjs service of Cloudflare, Inc., San Francisco, USA. Your IP address is transmitted to Cloudflare in the process. Cloudflare is certified under the EU-US Data Privacy Framework, which ensures an adequate level of data protection. The legal basis is Art. 6(1)(f) GDPR.

Payment

You can pay for your booking by bank transfer, with Stripe or with PayPal.

If you pay by bank transfer, you will find our bank details on the invoice you receive by email after booking. We then process the information that reaches our bank with your payment, such as your name, IBAN, the amount and the payment reference, in order to match the payment to your booking. The legal basis is Art. 6(1)(b) GDPR; statutory tax retention obligations apply to the records (Art. 6(1)(c) GDPR).

If you choose Stripe or PayPal, the data needed for the payment, such as your name, the amount and your payment details, is transmitted to the provider you choose: Stripe Payments Europe, Ltd., Dublin, Ireland, or PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg. The providers also process some data under their own responsibility, for example to prevent fraud. The legal basis is Art. 6(1)(b) GDPR. Further details can be found in the privacy notices of Stripe and PayPal.

Guest registration under Spanish law

Spanish law (Real Decreto 933/2021) requires holiday rental hosts to record certain details of their guests and report them to the competent authorities, including name, date of birth, nationality and the type and number of identity document. For this purpose, you will receive a registration form by email via Smoobu after booking.

The legal basis is compliance with a legal obligation (Art. 6(1)(c) GDPR). The data is used for this purpose only.

Contact by email or phone

If you contact us by email or phone, we process your details in order to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where it concerns a booking, and otherwise our legitimate interest in responding (Art. 6(1)(f) GDPR). Emails are stored in our mailbox at STRATO.

AI assistant in the chat window and Telegram bot

On our website you can ask an AI assistant questions about Casa Karen and Lanzarote. The chat window only loads when you open it and does not set any cookies. Your messages and the conversation so far are transmitted via our server at STRATO to the AI provider Anthropic, whose AI “Claude” generates the replies. Processing may take place in the USA. We have a data processing agreement with Anthropic that includes the EU Standard Contractual Clauses. Anthropic does not use the data to train its AI models and only retains it for a limited period, for example to detect misuse. We do not store the content of your conversation with the assistant on our server (for the live chat with Oliver, see below). To prevent misuse, we only store an encrypted check value (hash) of your IP address for a maximum of two days. If the assistant cannot answer a factual question, we store that question in a neutral, general form without any personal details (e.g. “Is there a hairdryer?”) for no more than 90 days in order to improve our information. Nothing linking it to you, your IP address or your conversation is stored. Please do not enter sensitive data in the chat. The legal basis is Art. 6(1)(b) GDPR (enquiries before a booking) or Art. 6(1)(f) GDPR (our legitimate interest in answering guests’ questions quickly).

If you would like to contact Oliver personally via the chat window, your message, your email address, your name (if provided) and the conversation are sent to us by email with your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future.

During the day you can also chat live with Oliver in the chat window. If you start the live chat, your messages, your name (if given) and your conversation with the assistant so far are forwarded via our server to Oliver on Telegram, and his replies are shown in the chat window. For this purpose we store the messages of this conversation on our server for no more than 24 hours. For the duration of the session your browser only remembers a random conversation number (sessionStorage, not a cookie) so that the chat continues when you move to another page. The legal basis is Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR (see above). The information on Telegram below applies accordingly.

You can also write to us via our Telegram bot. Telegram processes your messages and profile data in accordance with its own privacy policy. Chats with Telegram bots are not end-to-end encrypted. Your messages are transmitted via our server to Anthropic (see above). So that the assistant understands the context, we store the conversation on our server for a maximum of 24 hours. If you would like to speak to Oliver personally, or if the assistant cannot answer a question, your message is forwarded to Oliver together with your Telegram name. The link needed for his reply is deleted after 30 days at the latest.

Disclosure to third parties

Your data stays with us. Beyond the service providers named above, we only pass it on if you have agreed to this beforehand, for example to a tradesperson if a repair is needed during your stay, or to a translator, or if we are legally required to do so. Your data is never sold or used for advertising.

Links to other websites

Our website contains links to route planning in Google Maps and links to other websites, such as the official sites of the attractions or photo-maiwald.de. No map is embedded. Google or the respective provider only receives data once you click a link, from which point their privacy policy applies.

Storage period

We only store personal data for as long as is necessary for the purpose in question. Booking and invoice data is kept for up to ten years because of tax obligations. Guest registration data is kept for as long as Spanish law requires. Enquiries that do not lead to a booking are deleted once they have been dealt with.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You may object to processing based on our legitimate interest (Art. 21 GDPR). You can withdraw any consent you have given at any time with effect for the future. Simply write to us at info.entfernen@nospam.casakaren.de.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.

We do not make any automated decisions or create profiles.