Privacy notice

This English translation is provided for your convenience. In the event of any differences, the German version takes precedence.

Last updated: October 2026

The essentials at a glance

  • This website uses no cookies, no web analytics and no tracking or advertising services.
  • It loads no content from third-party servers: fonts and images come from our own server, and maps are not embedded.
  • If you only visit our website, we keep the technical access logs needed to run it for 14 days.
  • If you phone us, write to us or use the contact form, we use your details to respond to your enquiry.
  • If you make an enquiry or a booking, we use your details to deal with it. We must keep some records for longer to meet legal requirements.
  • We do not sell your data. We use it for advertising in one case only: after your stay, we send you one email asking you to review your stay. You can object to this at any time. We only share data where necessary to run the website, handle bookings or meet legal obligations. We explain below which organisations are involved.

1. Who is responsible for your data?

The landlords of Schwanenvilla Kitzeberg are responsible for processing personal data on this website:

Thomas and Lydia Bahn
Prof.-Dr.-Weigmann-Weg 10
24226 Heikendorf
Germany

Phone: +49/173/935 79 16
Email: schwanenvilla@schwanenvilla-kitzeberg.de

We have not appointed a data protection officer. If you have any questions about data protection, you can contact us directly.

2. Hosting and access logs

Our website runs on virtual servers that we operate ourselves. The server hardware is provided by assono GmbH. We have a data processing agreement with the company under Article 28 GDPR. We do not use any other hosting provider. All servers are located in Germany.

Whenever you open a page, the web server automatically records the following information in an access log:

  • IP address of your device
  • Date and time of the request
  • Address of the page requested (URL) and the result (status code and amount of data transferred)
  • The page you came from (referrer), if your browser provides this information
  • Browser and operating system (user agent)

Why? To keep the website secure and running reliably, detect and prevent attacks, and identify errors. Legal basis: Article 6(1)(f) GDPR (our legitimate interest in operating a secure website). How long? Access logs are automatically deleted after 14 days. If we need to investigate a specific security incident, we keep the relevant entries for as long as necessary to investigate it.

Your connection to the website is encrypted (HTTPS).

3. No cookies or tracking

This website does not use cookies or store anything else on your device. We do not use web analytics, advertising or social media services, or embed content from third-party providers (such as maps, videos or fonts hosted on other servers). That is why there is no cookie notice.

4. Contact by email, phone or contact form

If you contact us by email or phone, we use the information you give us (such as your name, email address, phone number and travel dates) to respond to your enquiry. You decide what information to provide, although we cannot reply without an email address or phone number. Emails sent to us arrive in a mailbox on assono GmbH’s mail server. The data processing agreement described in section 2 also covers these emails.

Contact form: When you use the form on our contact page, we process the information you enter: your name, email address and message (required fields), the subject you select and, if you choose to provide them, your phone number and travel dates. We also record the time and the language of the page. Your enquiry is stored in the website’s database on our own server. We receive a notification through assono GmbH’s mail server (data processing agreement, see section 2). We do not send you an automatic confirmation.

Protection against spam: To prevent mass misuse of the contact form, we count how many messages are sent from the same IP address within a short period. We do not store the IP address itself for this purpose. Instead, we store a verification value calculated from it using a secret key. This value is deleted no later than 24 hours after your last message and is not linked to your enquiry. We do not use a CAPTCHA or any third-party service for this. Legal basis: Article 6(1)(f) GDPR. Our legitimate interest is to protect the form against spam.

Why are we allowed to use your details? If your enquiry concerns a possible stay with us, the legal basis is Article 6(1)(b) GDPR (taking steps at your request before entering into a rental agreement). For other enquiries, it is Article 6(1)(f) GDPR: we have a legitimate interest in answering your enquiry.

When do we delete your details? We delete enquiries that do not lead to a booking no later than six months after our last contact. The website automatically deletes contact-form enquiries six months after they were last dealt with. If there is a specific dispute about an enquiry, we may need to keep the information required to resolve the dispute or establish, exercise or defend legal claims for longer. We delete it as soon as it is no longer needed for those purposes. If an enquiry leads to a booking, the retention rules in section 5 apply.

5. Reservations and bookings through our website

What information do we store?

When you send a reservation request or a non-binding enquiry through our booking page, we process:

  • Your travel dates and the number of adults, children and infants (age groups only, not dates of birth)
  • Your name, email address and, if you provide it, your phone number
  • Your message, preferred form of address and the language of the page
  • The calculated price

For a reservation request, we also record when you agreed to the rental terms and house rules, and which version of each applied. We do not store your IP address together with this agreement.

We also record the date and time of each step in processing your request, such as changes, confirmation or cancellation, and which emails we sent and when. This information is stored in the website’s database on our own server. We protect against misuse in the same way as for the contact form (section 4).

Your personal guest page

You receive a personal link to a status page. There you can check the progress of your reservation request, change or withdraw a request that has not yet been confirmed and, after booking confirmation, cancel your booking or ask us to change it. After a cancellation, you can also see the cancellation breakdown there.

Once your booking is confirmed, the same link also takes you to your guest area with everything you need for your arrival: the exact address of the property, directions to the key, information about the house and the area and, where applicable, a personal message from us. The guest area shows the key safe code and the Wi-Fi details from 5 pm on the day before arrival until the end of your departure day. The guest area remains available until 14 days after your departure; after a cancellation it is no longer visible.

We do not store the link itself, only a verification value calculated from it that cannot be used to reconstruct the link. Anyone who has your link can see your details and can even cancel your booking, potentially incurring cancellation charges. Please do not share it. Search engines are instructed not to index the status page.

If you request a change through your guest page, we receive your message by email. The website only records that you made the request and when.

Booking confirmations and contract records

The rental agreement is formed when we confirm your booking by email. So that we can later establish what was agreed, we store the text of each booking confirmation we send in the website’s database, along with PDF copies of the rental terms and house rules in the versions agreed at the time.

We also keep emails relating to a cancellation with the contract records, particularly the cancellation notice and the cancellation breakdowns. When a booking is cancelled, we record when and how we received the cancellation and the booking details that applied at that time (dates, prices and payments). These determine the cancellation charges.

Emails and notifications

We send automated emails about your enquiry or booking, for example to acknowledge receipt of your request, confirm a booking (with PDF copies of the rental terms and house rules), decline a request, notify you that the acceptance period has expired, or provide information about changes, payment reminders, payments received, cancellations and cancellation breakdowns. Before your arrival we also send you the link to your guest area, the key safe code on the day before you arrive and, if anything changes, a new code or an updated message from us. On the day after your departure we ask you for a review (see below). These emails are sent via assono GmbH’s mail server (data processing agreement, see section 2).

For each email, we also record when it was sent, who it was sent to and what type of message it was. This sending log is deleted after 90 days. We only keep the content of an email if it forms part of the contract records (see above).

We receive a notification by email and a short push notification on our phone. The push notification contains no information about you.

Bookings through Airbnb and FeWo-direkt

To avoid double bookings, we synchronise our availability calendar with Airbnb and FeWo-direkt. We send the platforms only the dates that are booked and our booking reference, not guests’ names or contact details.

If you book through one of these platforms, the calendar synchronisation gives us the dates and the platform’s booking reference. With FeWo-direkt, we may also receive the first name shown in its calendar. If necessary, we manually transfer further details, such as an email address or phone number, from messages on the relevant platform. Once we have added your email address, we send you a personal link to your guest area and the key safe code before your arrival (see above), and on the day after your departure a request for a review (see below); the guest area link only shows the guest area and is valid until 14 days after your departure. The platform’s own privacy notice also applies to bookings made through it.

Payments and refunds

You pay the total price by bank transfer to our account. Your name, bank details and payment reference appear on our bank statement. We keep bank statements outside the website together with the booking records.

On the website, we record the date and amount of each payment and refund. We do not store your bank details there.

Asking for a review and handling your review

On the day after your departure, we send you one email asking you to review your stay. This also applies to bookings through Airbnb or FeWo-direkt if we have added your email address. The email contains a personal link linked to your booking, valid for 30 days and usable only once. We store only a verification value derived from the link.

In legal terms, this request is advertising. We base it on Section 7(3) of the German Act against Unfair Competition (UWG) and Article 6(1)(f) GDPR; our legitimate interest is to learn how your stay went, to improve what we offer and to receive reviews. You can object to this at any time – via the unsubscribe link in the email or by sending us an informal message, without incurring any costs other than the usual transmission costs. So that we can respect your objection permanently, including for later bookings, we store an encrypted verification value of your email address, not the address itself. You will still receive emails about your bookings.

If you review your stay, we store your stars and your text together with your booking. Without your consent to publication, only we read the review, in order to improve what we offer (Article 6(1)(f) GDPR).

With your consent (Article 6(1)(a) GDPR), we may publish your star rating, review text, chosen name display (first name, initials or no name), travel group and age (if provided), and the month of your stay on our website. Before publication, apart from correcting typos, we only remove content that does not belong on the website, clearly marking any omissions with “[…]”. We decide whether to publish a review. You can withdraw your consent at any time by sending us an informal message; we will then remove the review from our website immediately and delete it. This does not affect the lawfulness of publication before withdrawal.

Reviews from Airbnb, FeWo-direkt or by email: If you have reviewed us on Airbnb or FeWo-direkt (Vrbo) or sent us your review by email, we only add it to our website if you allow us to (Article 6(1)(a) GDPR). We then store the star rating, the text, the name display you want, your travel group and age if you gave them, the month of your stay, where the review comes from, and when and how you gave your consent – not your full name and no link to your booking. Editing, publication, withdrawal and storage period follow the rules for reviews with consent.

Why are we allowed to process this information?

We need your details to deal with your enquiry or reservation request and to manage the rental agreement, including payment, cancellation and refunds. Legal basis: Article 6(1)(b) GDPR.

Where we are required to keep booking and payment records for tax purposes, Article 6(1)(c) GDPR applies together with the relevant tax record-keeping rules, particularly section 147 of the German Fiscal Code (Abgabenordnung).

We also rely on Article 6(1)(f) GDPR for calendar synchronisation and for keeping records of booking agreements and cancellations. Our legitimate interests are to prevent double bookings and to be able to show what was agreed if a dispute arises.

We cannot process your booking request without your name and email address.

How long do we keep your data?

  • Enquiries and reservation requests that do not lead to a booking: The website automatically deletes them six months after they were last dealt with. A reservation request that was never confirmed is deleted no later than six months after the requested arrival date. If there is a specific dispute, we may keep the information needed for as long as necessary to resolve it or to establish, exercise or defend legal claims.
  • Personal access to your guest page and review link: We delete the verification values stored for these links three months after your departure. This makes your personal access link invalid. At the same time we delete any personal message to you in the guest area and the record of which key safe code we sent you.
  • Review without consent to publication: three months after your departure.
  • Review with consent to publication: until you withdraw your consent or we delete the review – whether or not we publish it, and even if we later remove it from the website. If the booking is deleted at the end of its retention period, the review remains stored without a link to the booking.
  • Objection to the review request: We keep the encrypted verification value of your email address permanently so that we continue to respect your objection.
  • Bookings, including cancelled bookings and bookings through platforms: As a general rule, we keep the related booking details and records in our booking system for eight years after the end of the year in which you departed. These include contract records, payments, cancellations and cancellation breakdowns. We have set this common period for automatic deletion from our booking system. Statutory retention periods may differ depending on the type of record. Where records are needed for longer because of outstanding tax proceedings or legal obligations, we keep them for the additional time required. After your stay, we use this information only for necessary records, tax purposes and resolving possible disputes.

6. Links to other websites

Our pages contain links to other websites, including Google Maps, Apple Maps and OpenStreetMap for directions, Airbnb and FeWo-direkt for bookings, and websites for restaurants and local attractions. No data is transferred to these providers merely because a link is shown on our website. If you follow one of these links, you leave our website and the relevant provider’s privacy notice also applies.

7. Outdoor CCTV

We use five CCTV cameras on our property. They cover the driveway along the private road, the parking spaces and the path around the house. They do not cover public roads or footpaths. The guest terrace is not covered by the cameras. The cameras record only when motion is detected. We do not monitor the footage live on a continuous basis. A sign at the entrance to the private road indicates that CCTV is in operation and refers to this privacy notice.

Why do we use cameras? To exercise our right to control access to our property, protect our property and our guests’ vehicles and bicycles, help prevent crime and investigate incidents where necessary. Recordings may also be used to establish, exercise or defend legal claims where necessary. Legal basis: Article 6(1)(f) GDPR (our legitimate interests in these purposes).

How long do we keep recordings? Recordings are stored on a device in the house, not with a cloud provider. They are deleted promptly once they are no longer needed for these purposes.

Who receives recordings? If we suspect a criminal offence, we may share recordings with law enforcement authorities. We only share recordings with anyone else if there is a legal basis for doing so.

8. Your rights

Under the GDPR, you have the following rights, subject to the relevant legal conditions:

  • Access (Article 15 GDPR): You can ask what personal data we process about you.
  • Rectification (Article 16 GDPR): You can ask us to correct inaccurate information.
  • Erasure (Article 17 GDPR): You can ask us to delete your data unless we still need to keep it for legal reasons.
  • Restriction of processing (Article 18 GDPR): In certain circumstances, you can ask us to restrict how we use your data for a period of time.
  • Data portability (Article 20 GDPR): In certain circumstances, you can receive your data in a format that allows it to be transferred, or ask us to send it to another provider.

You can contact us informally to exercise these rights. Our contact details are in section 1.

Right to object: Where we process your data on the basis of our legitimate interests (Article 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation (Article 21(1) GDPR). You may object to receiving review requests by email at any time, without giving a reason (Article 21(2) GDPR). We will then stop sending them.

Withdrawing consent: You may withdraw your consent at any time, for example consent to publish your review. The withdrawal takes effect from that point onwards (Article 7(3) GDPR).

Right to lodge a complaint: You can complain to a data protection supervisory authority (Article 77 GDPR). The authority responsible for us is the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany, www.datenschutzzentrum.de.

9. What we do not do

We do not sell your data. We use it for advertising only for the request for a review after your stay (see section 5). We do not use automated decision-making with legal or similarly significant effects, and we do not carry out profiling. Under our current operating arrangements, we do not transfer personal data to recipients outside the European Union or the European Economic Area.