privacy policy

Controller

The controller for the processing of personal data on this website is:

Philipp Rees
Ferienhaus ReesL
Silberbergstraße 35
79254 Oberried
Germany

Phone: 07602 9209808
Email: hallo@reesl.de

General information

The protection of your personal data matters to us.

We treat personal data confidentially and in accordance with the statutory data protection provisions, in particular the General Data Protection Regulation (GDPR), and with this privacy policy.

This privacy policy tells you which personal data is processed when you use our website and when you make a booking, for what purposes this happens, and what rights you have.

Personal data means any data by which you can be personally identified.

Visiting our website

When you access our website, the web server processes technically necessary information.

This may include in particular:

• IP address of the accessing device
• date and time of access
• pages and files accessed
• volume of data transferred
• browser used
• operating system used
• referrer URL
• information on successful retrieval

This processing serves to provide the website technically, to ensure the security and stability of the service and to detect possible technical faults.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in providing our website securely and in a technically reliable manner.

The website is hosted with ALL-INKL.COM. Insofar as personal data is processed in the course of hosting, this serves the technical provision and protection of the website.

Hosting

Our website runs on servers of our hosting provider ALL-INKL.COM, Neue Medien Münnich.

In the course of hosting, technical access data and server log data in particular may be processed.

This processing serves the secure and reliable provision of the website and the detection and prevention of technical attacks.

The legal basis is Art. 6(1)(f) GDPR.

No use of analytics or marketing services

We currently do not use any of the following on this website:

• Google Analytics
• Matomo
• comparable analytics or tracking services
• advertising tracking services
• newsletter systems

There is therefore no statistical analysis of usage behaviour through such tools.

Cookies and technically necessary storage

Our website may use technically necessary cookies or comparable technologies insofar as these are required to operate the website or to provide a function you have expressly requested.

Where cookies or comparable technologies are exclusively technically necessary, they are used on the basis of the statutory provisions.

For non-essential cookies or comparable technologies, your consent is obtained before they are used, where this is required.

The legal basis for accessing information on your device is Section 25 TDDDG. Insofar as personal data is processed, the legal basis is additionally governed by Art. 6 GDPR.

On the booking page at my.reesl.de/buchen we set a technically necessary session cookie („myreesl“). It protects the booking form against misuse and is deleted when you close your browser. The legal basis is Section 25(2) no. 2 TDDDG.

The website itself only stores in your browser whether you have consented to loading external services (local storage, entry „reesl-consent“). This only matters if the Smoobu form is shown as a fallback (see section 7).

Bookings and Smoobu

Direct booking on this website

On the home page and on the pages of both apartments you will find our booking calendar. It loads free dates and prices from our own server my.reesl.de, which, like this website, is hosted by ALL-INKL.COM (see section 4). Only the technically necessary access data is processed (see section 3). No cookies are set and no content from third parties is loaded. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) and Art. 6(1)(f) GDPR.

When you click „Continue to booking“, you go to our booking page at my.reesl.de/buchen. There we process:

• first and last name
• email address
• mobile number
• travel dates, apartment and number of guests (adults, children, infants)
• your message to us, if you write one
• your acceptance of the terms and conditions, house rules and cancellation policy
• the IP address from which you book and the time of the booking

We process this data to complete the booking, send you the confirmation, prepare your stay and stay in touch with you. We only use your mobile number for questions about your arrival. The legal basis is Art. 6(1)(b) GDPR.

We store the IP address to detect and prevent misuse of the booking page, such as mass-submitted forms. For this we also count how often bookings are made from the same address within one hour. We only store this count as an irreversible check value and delete it after two hours. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a secure and functioning booking process. We delete the IP address after 90 days.

Booking attempts that are not paid are deleted after 30 days. Completed bookings are kept as long as necessary for the stay and statutory retention obligations (see sections 17 and 21).

Smoobu

We use Smoobu (Smoobu GmbH, Pappelallee 78/79, 10437 Berlin, Germany) to manage our occupancy and bookings. Smoobu synchronises our calendar with booking platforms such as Airbnb and Booking.com so that no dates are booked twice.

After your payment we transmit the booking to Smoobu:

• name, email address and phone number
• dates, apartment and number of guests
• price and payment status
• your message

Smoobu then sends you the booking confirmation by email on our behalf. For bookings via platforms such as Airbnb or Booking.com, we also receive the booking data via Smoobu.

This processing serves to carry out the booking and your stay, to communicate with you and to fulfil legal obligations. The legal basis is Art. 6(1)(b) GDPR and, where statutory retention obligations exist, Art. 6(1)(c) GDPR. Smoobu processes the data on our behalf on the basis of a data processing agreement pursuant to Art. 28 GDPR. Further information can be found in Smoobu's privacy policy.

Fallback: Smoobu booking form

If our online booking is temporarily unavailable, we show the booking and calendar widget from Smoobu instead. This widget is only loaded after you have expressly consented to loading external services. Before you consent, no connection whatsoever is made to Smoobu.

When the widget loads, your IP address is transmitted to Smoobu. For technical reasons the widget additionally loads a program library via the content delivery network „cdnjs“ operated by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Your IP address is transmitted to that provider as well. Any transfer to the USA takes place on the basis of the European Commission's standard contractual clauses.

The widget on this website only offers the search for free dates. As soon as you click „Search“, the booking itself opens in a new tab on a page operated by Smoobu. The details you enter there, such as name, address, e-mail address and payment data, you enter directly with Smoobu.

The legal basis for loading the widget and the associated access to information on your device is your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time with effect for the future via the „Cookie settings“ link in the footer.

Payment processing via Stripe

We process online payments – the price of your direct booking and the tourist tax in the guest app – via Stripe. The provider for customers in the European Economic Area is Stripe Payments Europe, Limited, One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland.

Payment takes place on a Stripe payment page. We transmit the amount, a description of the booking and your email address to it. You enter your card or account details directly with Stripe; we do not receive them. We only receive the amount, time and status of the payment and a payment reference. With this reference we can refund a payment, for example in the event of a cancellation.

Stripe processes the data to carry out and secure the payment, to prevent fraud and to fulfil legal obligations, in particular under anti-money-laundering law. Stripe is itself the controller for these purposes. Stripe may also transfer data to the USA on the basis of the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

Depending on the payment method chosen, Stripe involves further providers such as Apple Pay, Google Pay or Klarna. With Klarna (Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden), Stripe transmits the data required for instalment or invoice payment. Klarna may carry out an identity and credit check and is itself the controller for this.

The legal basis is Art. 6(1)(b) GDPR (performance of the contract) and, where legal obligations are concerned, Art. 6(1)(c) GDPR. Further information can be found in the privacy notices of Stripe and, when paying with Klarna, of Klarna.

If the chosen apartment is booked elsewhere while you are paying, we automatically refund the full amount via Stripe and inform you by email.

Communication by email and telephone

If you contact us by email or telephone, we process the personal data you provide insofar as this is necessary to deal with your enquiry.

This may include in particular:

• name
• email address
• telephone number
• details of your enquiry
• details of a desired or existing booking

This processing serves to handle your enquiry and, where applicable, to carry out pre-contractual measures or an existing contract.

The legal basis is Art. 6(1)(b) GDPR insofar as your enquiry relates to a booking or a possible conclusion of contract. In other cases the legal basis may be Art. 6(1)(f) GDPR.

Contact form

No contact form is currently used on this website.

If you would like to contact us, you can do so using the contact options given on the website.

Newsletter

We do not currently offer a newsletter and do not use any newsletter distribution system.

Google Maps

Google Maps is not embedded on this website. We merely provide a link to Google Maps to make it easier for you to find our location and route.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

As long as you do not click the link, no data is transmitted to Google. Only when you click it do you leave our website, and personal data, in particular technical data and possibly location or usage information, may be transmitted to Google.

Further information on data processing by Google can be found in Google's privacy policy.

Fonts

The fonts used on this website are served locally from our own web server.

No connection is therefore made to external font servers such as Google Fonts.

Your IP address is therefore not transmitted to an external provider merely in order to load the fonts used.

YouTube

No YouTube videos are currently embedded on this website.

Instagram

Direct embedding of Instagram content is not currently part of this website.

Should Instagram content be embedded in future, this privacy policy will be updated accordingly.

No disclosure for advertising purposes

As a matter of principle, we do not disclose personal data to third parties for advertising purposes.

Disclosure takes place only where it is necessary for the performance of a contract, where a legal obligation exists, where there is a legitimate interest, or where corresponding consent has been given.

Statutory retention obligations

We store personal data only for as long as is necessary for the respective purpose.

In addition, we may be legally obliged to retain certain data for a specified period. This concerns in particular retention obligations under tax and commercial law.

Once the respective retention periods have expired, the data is deleted unless another legal basis for further storage exists.

Your rights

You have the following rights in relation to us concerning your personal data:

• right of access pursuant to Art. 15 GDPR
• right to rectification pursuant to Art. 16 GDPR
• right to erasure pursuant to Art. 17 GDPR
• right to restriction of processing pursuant to Art. 18 GDPR
• right to data portability pursuant to Art. 20 GDPR
• right to object to certain processing pursuant to Art. 21 GDPR

Where processing is based on your consent, you may withdraw it at any time with effect for the future.

The lawfulness of processing carried out up to the point of withdrawal remains unaffected.

To exercise your rights, an informal message to the following address is sufficient:

Email: hallo@reesl.de

Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data.

The competent supervisory authority may in particular be the data protection authority responsible for our place of business:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI BW)
Königstraße 10a
70173 Stuttgart, Germany
Germany

Further information and contact options can be found on the website of the LfDI Baden-Württemberg.

Data security

We use appropriate technical and organisational security measures to protect your personal data against loss, destruction, manipulation and unauthorised access.

Our security measures are continuously adapted in line with technical developments and legal requirements.

Guest portal my.reesl.de

At my.reesl.de we run a guest app for our guests. Like this website, it is hosted by ALL-INKL.COM (see section 4). We do not use any analytics, tracking or advertising services and do not load content from third parties; fonts and images are served from our own server.

At my.reesl.de we also run our booking page for direct bookings (see section 7).

Access without a booking link

The content of the app is only visible to our guests via their personal booking link. Without this link, the app only shows an information page with contact and booking options. Only the technically necessary access data is processed (see sections 3 and 4). The language you choose is stored in a technically necessary cookie ("reesl_lang"). So that the app also works offline, your browser keeps public content (e.g. house information) in a local cache on your device; personal pages are never stored there.

Our server retrieves the weather forecast from Bright Sky, a free service for the open data of the German Weather Service (Deutscher Wetterdienst). Only the location of our house is transmitted, no data about you. Links to Google Maps or WhatsApp only take you to the respective provider once you click them (for Google see section 12; WhatsApp is operated by WhatsApp Ireland Limited, Merrion Road, Dublin 4, Ireland).

Personal area "My stay"

You open the personal area via the link in your booking message. So that you do not need the link every time, your device remembers the booking in a technically necessary cookie ("reesl_stay"). The link is valid until 30 days after departure; you can log out on your device at any time under "Account". The legal basis is Art. 6(1)(b) GDPR and Section 25(2) no. 2 TDDDG.

Online check-in and registration form

During online check-in we collect the details required for the registration form and the tourist tax: first and last name, date of birth and nationality of all guests and the address of the person required to register; for foreign guests also the type and number of the identity document. In addition, your signature and, voluntarily, your expected arrival time.

We are obliged to collect the registration data under Sections 29 and 30 of the German Federal Registration Act (BMG) and to collect and report the tourist tax under the tourist tax statute of the municipality of Oberried. The legal basis is Art. 6(1)(c) GDPR. We transmit the details required for the tourist tax to the municipality of Oberried or its billing system. Identity document numbers are stored encrypted. Registration data and signatures are deleted automatically one year after your departure (Section 30(4) BMG).

For contactless self check-in, the person required to register can additionally upload a photo of their identity document so that we can verify the details. This only happens with your explicit consent (Art. 6(1)(a) GDPR), which you can withdraw at any time. The photo is deleted automatically after verification, at the latest on the day of departure.

Tourist tax exemption for severe disability

Under Section 4(d) of the tourist tax statute of the municipality of Oberried, persons with a severe disability of degree 100 are exempt from the tourist tax. If you select "Exempt" for yourself or a fellow traveller during online check-in, we collect the number of the disability card and its period of validity. This is health data within the meaning of Art. 9 GDPR. Providing it is voluntary; without it, the regular tourist tax applies. We do not ask for a degree of disability below 100 or for any other health information.

The legal basis is Art. 6(1)(c) GDPR in conjunction with Sections 4(d) and 7(5) of the tourist tax statute and Art. 9(2)(g) GDPR. We transmit these details to the municipality of Oberried or its registration system for the tourist tax settlement. We look at the card on arrival; we do not store a copy. The card number is stored encrypted and deleted automatically together with the other registration data one year after your departure.

Tourist tax payment

You can pay the tourist tax in the app by card, Apple Pay, Google Pay or another payment method offered by Stripe. Payment takes place on a Stripe payment page (see section 8); we do not receive your card or account details, only the amount, time and status of the payment. The legal basis is Art. 6(1)(b) and (c) GDPR.

Invoices

For your invoice we process your name, billing address (where applicable company and VAT ID), stay and services. We keep invoices for eight years in accordance with German tax law (Section 147 AO, Section 14b UStG; Art. 6(1)(c) GDPR). You can download them in the personal area.

Messages about your stay

We send the check-in invitation, reminders, arrival information including the door code and invoice notices by email from our mailbox at ALL-INKL.COM. If you booked via a platform that does not pass on an email address to us (e.g. Airbnb), we send the message via Smoobu to the platform's inbox (see section 7). The legal basis is Art. 6(1)(b) GDPR.

Updates to this privacy policy

We reserve the right to amend this privacy policy if the technical circumstances, the services we use or the legal requirements change.

The current version published on this website applies in each case.

Version: October 2026