Privacy policy

This is a translation provided for your convenience. The German version is legally binding.

This policy explains, in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR), which personal data we process when you visit our website, book the holiday apartment with us or contact us.

Summary

We use no analytics or tracking tools and no advertising cookies. Our own website does not store any cookies on your device.
Fonts are hosted on our own server. We do not embed maps, videos or social media plugins from third parties, and we do not send newsletters.
For bookings we use the booking system Smoobu and the payment service provider Stripe. Stripe’s payment form is only loaded in the last booking step.

1. Controller

The controller responsible for data processing is:

Christian Scherer
Werkstraße 28, 56410 Montabaur, Germany
Email: wasserturm.montabaur@gmail.com

We have not appointed a data protection officer because we are not legally required to do so. If you have any questions about data protection, please write to the email address above.

2. Visiting the website: hosting and server

Our website runs on a server operated by us at Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany (servers located in Germany). The hosting provider supplies the server and network connection and processes the data on our behalf under a data processing agreement (Art. 28 GDPR).

When you visit the website, our server necessarily processes your IP address, the date and time, the address (URL) requested and the browser identifier (user agent) in order to deliver the pages to you. To protect the booking functions against misuse, we also briefly count how many requests come from an IP address.

We do not store access logs. IP addresses are processed in memory only and discarded after one minute at the latest; they are neither written to disk nor analysed. Our server only writes technical error messages without IP addresses and without guest data; these are continuously overwritten.

Purpose: delivering the website and protection against misuse.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure and stable operation of the website.

3. Cookies and access to your device

Our own website does not set any cookies and does not store any information on your device.

Only in the payment step do we load Stripe’s payment form (see section 5.3). Stripe stores cookies and reads device and browser information in order to process the payment and prevent payment fraud. This is strictly necessary for the online payment you have requested and is therefore permitted without consent (Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG). Further processing of this data is described in section 5.3.

4. Contact by email

If you email us, we process your email address, your name (if provided) and the content of your message in order to answer your enquiry.

Legal basis: Art. 6(1)(b) GDPR if your enquiry concerns a booking or a stay; otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries).
Service provider: Our mailbox is provided through the Gmail service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Your emails are stored on Google’s servers. Google may also transfer data to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR).
Retention: We delete emails once the enquiry has been dealt with and no retention obligations apply. Emails relating to a booking are kept as business correspondence for up to six years (Section 147 German Fiscal Code, Section 257 German Commercial Code).

5. Booking via our website

5.1 What data we process and why

For a booking we process:

travel data: arrival and departure date, number of guests, price and price components,
guest data: first and last name, email address, phone number, postal address, country, language and your message to us (optional),
the time at which you accepted the rental terms,
payment data (see section 5.3).

Purpose: concluding and performing the rental contract, communication about your stay (e.g. booking confirmation, arrival information, queries by phone), payment processing and, on request, issuing an invoice.
Legal basis: Art. 6(1)(b) GDPR (contract and pre-contractual measures) and, for retention under tax and commercial law, Art. 6(1)(c) GDPR.
Required information: We need the details marked as required fields in the booking form to conclude the contract. Without them, a booking via the website is not possible. Your message to us is optional.

5.2 Smoobu booking system

We manage availability, prices and bookings with Smoobu, a booking and channel management system of Smoobu GmbH, Pappelallee 78/79, 10437 Berlin, Germany. Smoobu also synchronises availability with the booking platforms on which the apartment is listed to prevent double bookings. Your travel and guest data are stored in Smoobu. We also use Smoobu to send emails about your booking (e.g. booking confirmation and arrival information).

Smoobu processes the data on our behalf under a data processing agreement (Art. 28 GDPR). Smoobu uses its own sub-processors, in particular Amazon Web Services with data centres in the EU. Where sub-processors process data outside the EU, this is based on the EU-US Data Privacy Framework or on EU standard contractual clauses (Art. 45, 46 GDPR).

5.3 Payment processing with Stripe

Payments are processed by Stripe, provided by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland (“Stripe”). The payment form is embedded in our page directly by Stripe. Stripe does not pass your full card or account details on to us. We only see details such as the payment method, card brand, the last four digits of the card and the payment status.

We transmit the amount and, for the technical processing of the booking, your travel and guest data as described in section 5.1 to Stripe. Stripe also processes the data you enter in the payment form as well as device and usage data (e.g. IP address, browser and device information, interactions with the payment form).

For payment processing, Stripe acts as our processor (Art. 28 GDPR). Legal basis: Art. 6(1)(b) GDPR.
For fraud prevention, legal obligations (e.g. anti-money laundering) and the security of its services, Stripe also processes data as an independent controller. In doing so, Stripe uses automated procedures that may decline a payment in individual cases. If your payment is declined, please get in touch with us and we will look into the matter personally. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure payments) and Art. 6(1)(c) GDPR.

If you use Link, Stripe’s service for saving payment details, Stripe processes the data stored there as an independent controller. If you choose PayPal, you will be redirected to PayPal; PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, 2449 Luxembourg, then processes your data as an independent controller. With Apple Pay or Google Pay, Apple or Google also process data under their own responsibility in accordance with their privacy policies.

Stripe may transfer data to Stripe, Inc. in the USA on the basis of the EU-US Data Privacy Framework or EU standard contractual clauses (Art. 45, 46 GDPR). After a successful payment and in the event of refunds, you receive a receipt from Stripe by email. More information: stripe.com/privacy.

5.4 Registration form

Guests who are not German nationals are legally required to complete and sign a special registration form on arrival (Sections 29 and 30 of the German Federal Registration Act, BMG). It contains the arrival and expected departure date, surname, first names, date of birth, nationalities, address, the number and nationality of accompanying foreign travellers and the serial number of the passport or passport substitute. The legal basis is Art. 6(1)(c) GDPR. We keep the form for one year from the day of departure and destroy it within the following three months (Section 30(4) BMG). Only authorities entitled by law may inspect it.

5.5 Retention

We store your booking data for as long as we need it to perform the contract and to resolve any claims. After that, we only keep records to the extent required by law: invoices and accounting records for eight years, business correspondence for six years, in each case from the end of the calendar year (Section 147 German Fiscal Code, Section 14b German VAT Act, Section 257 German Commercial Code). Stripe additionally retains payment data in accordance with its own legal obligations.

6. Personal greeting on the control panel in the apartment

A control panel in the apartment operates the heating, air conditioning and lighting. So that it can greet you by name and set your language, a control unit in the tower retrieves your name, language and dates of stay from Smoobu and stores them locally on the device. Email address, phone number and prices are not stored there. At most the last 30 past stays remain stored; the device deletes older entries automatically.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to make your stay pleasant. If you would rather not be greeted by name, just send us a short message.

7. Charging at the wallbox

Guests can charge an electric vehicle at the wallbox in front of the apartment. The wallbox is activated with a common charging card or by credit card. Charging is not billed by us but by your charging card or payment provider, which processes your data under its own responsibility in accordance with its privacy policy.

The wallbox is connected to the service of eCarUp AG, Riedstrasse 18, 6343 Rotkreuz, Switzerland. Activation and payment of a charging session take place directly between you and eCarUp or your charging card provider; eCarUp is the controller for this. The EU Commission has issued an adequacy decision for Switzerland (Art. 45 GDPR). To our knowledge, we are not shown any names or payment details; technical details such as the time and amount of energy of a charging session are used only to operate the wallbox and resolve faults (Art. 6(1)(f) GDPR).

8. Bookings via platforms

If you book via a platform such as Airbnb, the platform’s privacy policy applies to its processing. We process the data the platform sends us about your booking in Smoobu as described in sections 5.2, 5.4, 5.5 and 6 (Art. 6(1)(b) and (c) GDPR).

9. Recipients at a glance

Your data is only shared to the extent necessary for the purposes described, with:

our server hosting provider (section 2),
Google as the provider of our mailbox (section 4),
Smoobu (section 5.2),
Stripe and, depending on the payment method, PayPal, Apple or Google (section 5.3),
the operator or backend provider of the wallbox if you charge there (section 7),
our tax adviser and the tax authorities, where necessary for accounting and tax purposes,
authorities, courts or lawyers where we are legally obliged to do so or where it is necessary to enforce or defend legal claims (Art. 6(1)(c) or (f) GDPR).

We do not sell your data and do not use it for advertising.

10. Your rights

You have the right to

access the data we hold about you (Art. 15 GDPR),
rectification of inaccurate data (Art. 16 GDPR),
erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR), unless statutory retention obligations apply,
data portability (Art. 20 GDPR).

An informal message to wasserturm.montabaur@gmail.com is sufficient.

Where we process data on the basis of Art. 6(1)(f) GDPR (legitimate interest), you may object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz), Hintere Bleiche 34, 55116 Mainz, Germany, www.datenschutz.rlp.de.

11. Changes

We will update this privacy policy when our website, our processes or the law change. The version published here applies.

Last updated: October 2026