Privacy Policy
Last updated: 20 September 2026
1. Controllers
The controllers responsible for the processing of personal data in connection with this website and our holiday accommodation business are:
Brigitte Orth-Jordan and Michael Jordan
Zum Waldrand – Holiday Accommodation
Winterbergstraße 80
66996 Erfweiler
Germany
Telephone: +49 6391 5802
Email:
2. General Information
We take the protection of personal data seriously and process personal data confidentially and in accordance with the applicable data protection laws, in particular the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).
Personal data means any information relating to an identified or identifiable natural person.
We process personal data only insofar as this is necessary for the operation of our website, the handling of enquiries, the processing of bookings and stays, the fulfilment of legal obligations or on the basis of a legitimate interest.
3. Hosting and Server Log Files
When you visit our website, technically necessary data is processed by the web server or by the hosting service provider we use.
This may include in particular:
- IP address
- date and time of access
- page or file accessed
- referrer URL
- browser type and browser version
- operating system used
- hostname of the accessing device
- amount of data transferred
- HTTP status code
The data is processed for the technical provision of the website, to ensure the stability and security of our systems and to detect and prevent misuse or attacks.
The legal basis for this processing is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and functional operation of our website.
The data will be deleted as soon as it is no longer required for these purposes, unless longer storage is necessary due to a security incident or legal obligations.
Where necessary, the hosting service provider processes data on our behalf.
4. SSL or TLS Encryption
Our website uses SSL or TLS encryption.
You can recognise an encrypted connection in particular by the fact that the address of the page you are visiting begins with “https://”.
Encryption is used to protect transmitted data from access by unauthorised third parties during transmission.
5. Cookies and Similar Technologies
Our website may use technically necessary cookies or similar technologies.
Technically necessary cookies are used, for example, to provide basic website functions or to technically maintain a session.
Where the storage of information on your terminal device or access to information already stored on your terminal device is strictly necessary in order to provide a digital service expressly requested by you, this is carried out on the basis of Section 25(2) TDDDG.
Where personal data is processed in this context, the processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and functional operation of the website.
Where cookies or similar technologies requiring consent are used, they will only be used after you have given your consent in accordance with Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR.
Consent that has been granted may be withdrawn at any time with effect for the future.
6. Contact Form
If you contact us via the contact form provided on our website, we will process the data you enter in order to handle your inquiry.
This may include, in particular:
- Name
- Email address
- Phone number
- Content of the message
- Date and time of the inquiry
If the inquiry relates to a potential reservation or an existing lodging contract, processing is based on Article 6(1)(b) of the GDPR for the purpose of taking pre-contractual measures or fulfilling the contract.
For other inquiries, processing is based on Article 6(1)(f) of the GDPR. Our legitimate interest lies in processing and responding to the inquiry directed to us.
The data will be deleted as soon as the inquiry has been fully processed and there are no legal retention requirements or other legitimate reasons for further storage.
To protect our contact form from automated submissions and spam, we use ALTCHA, a locally operated CAPTCHA solution within Convert Forms. In this process, your browser automatically solves a mathematical problem in the background (proof-of-work procedure). The result is verified on our web server.
No external CAPTCHA service is used for this verification. No data is transmitted to an external CAPTCHA provider during this process.
To the extent that personal data is processed in connection with technical provision and verification, this is done on the basis of Article 6(1)(f) of the GDPR. Our legitimate interest lies in preventing automated abuse and ensuring the proper functioning of our contact form. In addition, the information regarding hosting and server log files in Section 3 applies.
7. Contact by Email or Telephone
If you contact us by email or telephone, we process the data you provide in order to handle your enquiry.
For enquiries concerning a booking or stay, the legal basis is Art. 6(1)(b) GDPR.
For other enquiries, the processing is carried out on the basis of Art. 6(1)(f) GDPR.
The data will be deleted as soon as it is no longer required for handling the enquiry, unless statutory retention obligations or other lawful reasons require further storage.
Please note that normal unencrypted email communication may generally involve security risks.
8. Bookings and Accommodation Contracts
If you enquire about or book one of our holiday accommodations, we process the data required to handle the booking and provide the accommodation.
This may include in particular:
- first name and surname
- postal address
- email address
- telephone number
- arrival and departure dates
- accommodation booked
- number of guests
- price and payment information
- invoice details
- special requests communicated to us
- communications relating to the booking and stay
The legal basis for this processing is Art. 6(1)(b) GDPR.
Where we are required to process data due to tax, registration or other legal requirements, the processing is additionally based on Art. 6(1)(c) GDPR.
9. Booking Management with Smoobu
We use the booking and property management software Smoobu to manage bookings, availability and guest data.
The provider is:
Smoobu GmbH
Pappelallee 78/79
10437 Berlin
Germany
Smoobu may process, in particular, names, contact details, length of stay, number of guests, accommodation booked, price and payment information as well as communications relating to the booking.
The processing is carried out for the handling and administration of bookings, the synchronisation of availability and communication with guests.
The legal basis is Art. 6(1)(b) GDPR insofar as the processing is necessary for the performance of a booking or accommodation contract.
Where Smoobu processes personal data on our behalf, this is carried out in accordance with the applicable data protection provisions governing commissioned data processing.
10. Bookings via Booking and Intermediary Platforms
Our accommodation may also be offered via external booking and intermediary platforms.
If you make an enquiry or booking directly via such a platform, the respective platform operator initially processes your data under its own responsibility under data protection law.
We receive from the respective platform the data necessary to process and fulfil your booking.
This may include, in particular, your name, contact details, travel dates, number of guests, accommodation booked, price and payment information as well as messages relating to the booking.
In these cases, the source of the data is the respective booking or intermediary platform used by you.
Our processing is based on Art. 6(1)(b) GDPR.
The respective platform's own privacy policy additionally applies to the processing of data by that platform.
11. Payment Processing and Invoicing
For payment processing and the preparation of invoices, we process the booking, contact and payment data required for these purposes.
In the case of bank transfers, the necessary payment data is processed by the financial institutions involved.
The legal basis for payment processing is Art. 6(1)(b) GDPR.
Where we are required to retain invoice and payment data due to tax or commercial law requirements, the processing is based on Art. 6(1)(c) GDPR.
12. Statutory Retention Obligations
Data contained in invoices, booking documents, business correspondence or tax-relevant documents may be subject to statutory retention obligations.
In these cases, the data will be stored for the duration of the applicable statutory retention period and subsequently deleted unless another legal basis justifies further storage.
13. Guest Reviews
Reviews or excerpts from reviews submitted by our guests may be published on our website.
Reviews may have been submitted directly by guests or previously published on a booking or review platform used by them.
We publish personal information only where there is an appropriate legal basis for doing so. Where possible, names are abbreviated or otherwise displayed in a way that avoids unnecessary identification.
Where publication is based on consent, the legal basis is Art. 6(1)(a) GDPR.
Consent that has been granted may be withdrawn at any time with effect for the future.
14. External Links
Our website contains links to websites operated by other providers.
In the case of a normal external link, merely displaying our website does not generally establish a connection to the linked website.
Only when you click on the link do you leave our website. The operator of the website you then visit is generally responsible for the subsequent processing of personal data.
Maps or directions displayed on our website may be embedded as image files stored locally on our own web server. Merely displaying such locally stored images does not establish a direct connection to an external map service.
15. Recipients of Personal Data
We only disclose personal data where there is a legal basis for doing so.
Recipients or categories of recipients may include in particular:
- hosting and IT service providers
- Smoobu GmbH
- booking and intermediary platforms
- banks and payment service providers
- tax advisers and tax authorities, where necessary
- other public authorities where required by law
- service providers processing personal data on our behalf
Where required by law, appropriate data processing agreements pursuant to Art. 28 GDPR are concluded with processors.
16. Transfers to Countries Outside the EU or EEA
Where the use of a service provider involves the processing of personal data outside the European Union or the European Economic Area, such processing will only take place in compliance with the legal requirements of Art. 44 et seq. GDPR.
A data transfer may take place, in particular, on the basis of an adequacy decision by the European Commission or appropriate safeguards, such as the EU Standard Contractual Clauses.
17. Storage Period
Unless a specific storage period is stated in this Privacy Policy, personal data will only be stored for as long as is necessary for the respective purpose.
Where statutory retention obligations exist, the relevant data will be stored for the duration of those obligations.
Once the purpose of the processing no longer applies and any statutory retention periods have expired, the data will be deleted unless another legal basis permits further storage.
18. Rights of Data Subjects
Subject to the applicable legal requirements, you have in particular the right to:
- obtain information about the personal data stored about you
- have inaccurate or incomplete data corrected
- request the deletion of personal data
- request restriction of processing
- data portability
- object to certain data processing activities
- withdraw consent that you have given with effect for the future
Where processing is based on Art. 6(1)(f) GDPR, you may object to the processing pursuant to Art. 21 GDPR on grounds relating to your particular situation.
To exercise your rights, you may contact us at:
Email:
or by post:
Brigitte Orth-Jordan and Michael Jordan
Winterbergstraße 80
66996 Erfweiler
Germany
19. Right to Lodge a Complaint with a Data Protection Supervisory Authority
Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes data protection law.
The supervisory authority responsible for us is in particular:
The State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate
(Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz)
Hintere Bleiche 34
55116 Mainz
Germany
Telephone: +49 6131 8920-0
Email:
You may generally also contact another data protection supervisory authority responsible for you.
20. Changes to this Privacy Policy
We will amend this Privacy Policy if legal requirements, our website or the services we use change.
The current version published on our website shall apply.
Last updated: 20 September 2026
