ENDE My LOCADOBook

Privacy policy

Last updated:

1. Controller and contact

The controller responsible for processing personal data on this website and for bookings is:

Gierschmann – Kochems GbR
trading under the brand “LOCADO”, represented by its partners Moritz Gierschmann and Malcom Kochems
Mühlenweg 21 A
53619 Rheinbreitbach
Germany
Email: info@locadostays.com
Phone / WhatsApp: +49 155 10603648

Contact for data protection requests: Moritz Gierschmann, reachable at info@locadostays.com. You can also write to us by post at the address above. In this policy, “LOCADO”, “we” and “us” mean Gierschmann – Kochems GbR.

2. Data protection officer

We have not appointed a data protection officer because we are not required to: fewer than 20 people at LOCADO are constantly involved in the automated processing of personal data (Section 38(1) of the German Federal Data Protection Act, BDSG), and our core activities consist neither of regular and systematic monitoring of people on a large scale nor of processing special categories of personal data on a large scale (Art. 37(1) GDPR). For data protection questions, please use the contact details in section 1.

3. Overview

This policy explains, in line with Art. 13 and 14 GDPR, which personal data we process when you visit locadostays.com, write to us or book with us, why we do so, how long we keep the data and what rights you have. Personal data means any information relating to you, such as your name, email address or IP address.

At a glance

  • Visiting the website: delivering the pages, server logs and security, based on our legitimate interests (section 4).
  • Cookies and browser storage: what is strictly necessary without consent, everything else only if you consent in the cookie banner (sections 5 and 6).
  • Analytics with PostHog and the Google Maps map: only with your consent (section 7, section 8).
  • Contact form, email, phone and WhatsApp: to answer your enquiry (section 9, section 10).
  • Booking, payment and your stay: to carry out your booking, comply with legal obligations and prevent misuse (sections 11 to 15).
  • Sign-in with a code (section 17), service providers and recipients (section 16, section 18) and your rights (section 19).

We do not sell personal data and do not pass it on for advertising purposes. We do not currently send advertising emails or a newsletter – with one exception: after a stay that you booked on our website and stayed at yourself, we ask you once by email for a review; you can object to this at any time (section 11). Should we introduce other advertising emails, we will only send them if you have given separate consent and confirmed your email address via a confirmation link (double opt-in); a booking or an account on this website is not such consent. We will update this privacy policy beforehand.

Legal bases

  • Consent (Art. 6(1)(a) GDPR): you have given your consent, for example in the cookie banner. You can withdraw it at any time with effect for the future.
  • Contract (Art. 6(1)(b) GDPR): we need the data to conclude and perform a contract with you or to answer your enquiry before a contract.
  • Legal obligation (Art. 6(1)(c) GDPR): the law requires it, for example keeping booking records or the guest registration form.
  • Legitimate interests (Art. 6(1)(f) GDPR): we have a legitimate interest that is not overridden by your interests, for example in running the website securely. You can object to this (section 19).
  • Storing and accessing information on your device (Section 25 of the German Telecommunications Digital Services Data Protection Act, TDDDG): only with your consent (subsection 1), unless it is strictly necessary for a service you have requested (subsection 2 No. 2).

Retention

We only keep personal data for as long as we need it for the purpose concerned or as long as the law requires us to keep it. After that, we delete or anonymise it. The individual periods are given in the following sections. What we store in our database is deleted by an automatic run once a day; a period there therefore ends no later than one day after the time stated.

4. Visiting the website: hosting and server logs

Hosting and server functions (Vercel)

Our website is run by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA (“Vercel”). Vercel delivers the pages through a worldwide network of servers (content delivery network); your request is usually answered by a server near you. The functions that process your input – such as price checks, booking, payment confirmation, the contact form and sign-in – run as server functions at Vercel in Frankfurt am Main, Germany, and pass your input on to the services responsible (sections 9 to 17).

Vercel processes the data on our behalf under a data processing agreement (Art. 28 GDPR). We base transfers to the USA on the EU-US Data Privacy Framework and the European Commission’s standard contractual clauses (section 18).

Server logs

With every request, Vercel processes technically necessary data: your IP address, the date and time, the address (URL) requested including its parameters, the page you came from (referrer), information about your browser and operating system (user agent) and the status of the response. The address of the confirmation page contains your booking reference; when you return from approving a payment with your bank, it also contains technical identifiers of the payment at Stripe for one request. Access keys for the confirmation page and the keys in sign-in links are never part of the address sent to the server.

We use this data to deliver the website, keep it secure (for example to detect and fend off attacks) and find errors. The legal basis is our legitimate interest in a secure and working website (Art. 6(1)(f) GDPR); where server functions handle your booking or enquiry, Art. 6(1)(b) GDPR. Vercel keeps the logs for at most 30 days; we do not forward them to other services. Our own error logs only contain technical details such as error codes and booking references, no names, email addresses or messages.

Fonts, images and links

We serve fonts and images from our own server; no connection is made to Google Fonts or other providers. The photos of the region come from Wikimedia Commons; we downloaded them and also serve them ourselves. Links to other websites (for example to WhatsApp, Wikipedia, Wikimedia Commons or Google Maps) are plain links: only when you click one does your browser open the other website, and that website’s privacy policy applies there.

Reviews and image credits

On the website we show reviews that guests have published on Airbnb and Booking.com: first name or display name, where given their town or country as shown there, month, rating, text and platform. We only use what is publicly available there. The legal basis is our legitimate interest in showing prospective guests genuine experiences of other guests (Art. 6(1)(f) GDPR). We show a review for as long as it is public on the platform. If the platform takes it down or you object, we remove it from our website without delay; an informal message to the contact details in section 1 is enough. For openly licensed photos, we name the author with a link to their profile, as the licence requires (Art. 6(1)(c) or (f) GDPR), for as long as we show the photo.

5. Cookies and browser storage

Cookies are small text files that a website stores in your browser. Your browser’s local storage and session storage work in a similar way; session storage entries disappear when you close the tab. We store what is strictly necessary for a service you have requested without consent (Section 25(2) No. 2 TDDDG). We only store or read anything else with your consent (Section 25(1) TDDDG). What we then use the data for is explained in the relevant sections.

Strictly necessary

  • locado_consent (cookie, LOCADO): stores your choice in the cookie banner – categories, version of the banner, time and a random identifier. Only set once you make a choice. 6 months.
  • __Host-locado_preauth (cookie, LOCADO): links a requested sign-in or confirmation to your browser. Only if you request a sign-in code or open an account. 20 minutes.
  • __Host-locado_session (cookie, LOCADO): keeps you signed in to your account. Only after you sign in. 30 days, renewed when you use your account.
  • __Host-locado_member (cookie, LOCADO): tells the page header that it may show your first name. Contains a random value that is new at every sign-in, no personal details, and is not stored by us. Only after you sign in. 30 days like the sign-in.
  • locado:member:name (session storage, LOCADO): your first name for the page header while you are signed in; checked again every 5 minutes. Until you close the tab or sign out.
  • __Host-locado_admin (cookie, LOCADO): sign-in of the LOCADO team to the admin area, team only. 8 hours.
  • locado:checkout:… (session storage, LOCADO, booking page only): your input in the booking form without payment details, the current step and an identifier so that a booking is not submitted twice. Until you close the tab; we delete your input after booking.
  • locado:order:… (session storage, LOCADO, booking and confirmation pages only): the access key the confirmation page uses to check the status of your booking, your language and the status of the payment approval. Until you close the tab.
  • __stripe_mid and __stripe_sid (cookies, Stripe, set on the booking page): fraud prevention for the payment (section 12). About 1 year and 30 minutes respectively. Stripe.js stores them under our address; your browser therefore sends them along with every request to our website for as long as they exist. Our server does not evaluate them. Within the embedded payment form, which comes from Stripe, Stripe may set further strictly necessary cookies; Stripe’s privacy policy applies to them.

The bot check when you submit (section 15) stores nothing in your browser.

Only with your consent

  • PostHog (section 7), only with consent to “Analytics”: cookie ph_…_posthog with a random identifier and settings, 6 months; local storage ph_… with the same details and no expiry date of its own – we delete it when you withdraw your consent or visit our website again after your consent has ended (after 6 months), and you can delete it in your browser at any time; session storage ph_… for the current session, until you close the tab.
  • locado:conv:… (session storage, LOCADO, confirmation page only and only with consent to “Analytics”): remembers that the completed booking has already been counted, so that it is not counted twice. Until you close the tab.
  • Google Maps (section 8), only after a click or with consent to “External media”: when the map loads, Google receives your IP address and may set cookies, such as NID (Google preferences and statistics, up to 6 months). Google decides which cookies these are; more in Google’s cookie overview.

6. Consent management (cookie banner)

On your first visit, our cookie banner asks whether we may use services that require consent. “Accept all” and “Reject” are equivalent; under “Settings” you can choose individual categories. Before you consent, we load none of these services. We run the banner ourselves (“CookieConsent” software, loaded from our own server, no third party). We store your choice only in the cookie locado_consent in your browser, not on our server.

You can change your choice and withdraw your consent at any time via “Cookie settings” at the bottom of every page. After a withdrawal, we delete the cookies and browser entries of the services concerned and reload the page. We ask again after 6 months and whenever we start using new services.

The legal basis for the consent cookie is Section 25(2) No. 2 TDDDG: without it we could not remember your decision and would have to ask you again on every visit. We process your choice in order to act on it, that is, to load services only with your consent (Art. 6(1)(c) GDPR in conjunction with Section 25(1) TDDDG).

We do not currently use advertising or analytics services from Google or Meta (such as Google Analytics, Google Ads, Google Tag Manager or the Meta Pixel). If this changes, we will update this privacy policy beforehand and the banner will ask you again.

7. Audience measurement, session recordings and error reports with PostHog

If you consent to “Analytics” in the cookie banner, we use PostHog, a service of PostHog Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA. PostHog stores the data on servers in the EU (Frankfurt am Main). Without your consent we do not load PostHog and collect no analytics data. On the booking page, the pages where you sign in with a code, in the account and in the admin area we never load PostHog, not even with consent.

What is collected

  • Use of the website: page views and leaving a page, clicks on links and buttons and the steps of search, booking, enquiry and registration (such as apartment, dates, number of guests, topic of an enquiry, that a form was submitted; on the confirmation page, the completed booking with the accommodation price), together with technical details such as browser, operating system, device type, screen size, language and the page you came from. PostHog does not store your IP address and does not derive an approximate location from it.
  • Error reports: if a technical error occurs on the website, PostHog transmits the error message, the affected place in the program code, the page and your browser.
  • Session recordings: on the public pages (such as the home page, apartments, contact), PostHog records how you use the page: page layout, mouse movements, clicks, scrolling and window size. All text on the page – including image descriptions and the labels and hints of form fields – and everything you enter is replaced in your browser by placeholders of the same length; only the placeholders are sent. The layout and design of the page, images and link targets remain recognisable. Console messages and network requests are not recorded. The booking and confirmation pages are never recorded.
  • What we remove first: we remove booking references, payment identifiers and email addresses from all data before it is sent to PostHog. We do not link the data to your name or email address; PostHog only recognises your browser by a random identifier (section 5).

Purpose: we want to understand which content is useful, where booking gets stuck and where technical errors occur, so that we can improve the website.

Legal basis: your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw it at any time with effect for the future via “Cookie settings”. PostHog then stops collecting, and its data is deleted from your device.

Recipients and third countries: PostHog processes the data on our behalf (Art. 28 GDPR). Access from the USA cannot be ruled out; the European Commission’s standard contractual clauses apply (Art. 46(2)(c) GDPR). We have switched off PostHog’s AI features; no data goes to PostHog’s AI providers.

Retention: PostHog deletes session recordings after 30 days and other analytics data after one year.

8. Maps (Google Maps)

On the region and apartment pages we show a map from Google Maps. It only loads when you click “Load map” or have consented to “External media” in the cookie banner (also via “Always allow” on the map). Until then, no connection is made to Google.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When the map loads, Google receives your IP address, information about your browser, the page of our website the map is embedded in and the map section shown. Google may set or read cookies (section 5); if you are signed in to Google, Google can link the visit to your account. We are jointly responsible with Google for embedding the map and for the transmission of this data to Google when the map loads (Art. 26 GDPR); Google alone is responsible for what it does with the data afterwards. You can exercise your rights with us and with Google. More in Google’s privacy policy.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time via “Cookie settings”. Google may also transfer the data to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework, for which an adequacy decision of the European Commission applies (Art. 45 GDPR).

9. Contact form, email and phone

You can ask us questions via the contact form, the enquiry forms (for example on the “For companies” and “Long stays” pages and in the booking area), by email and by phone.

What data: name, email address and your message are required; phone number, company, topic, preferred dates and number of guests are optional. The form also sends the language and the page you are writing from, plus details for spam detection (a field invisible to people and the time taken to submit). If you call us, we process your phone number if your phone transmits it, and what you tell us, to the extent that we note it for your enquiry or booking.

How it works: we do not store form enquiries in a database. Our server sends them as an email via our delivery service (section 16) to our mailbox and sets your email address as the reply address. We do not send a confirmation email. To prevent mass enquiries, we only accept a limited number of enquiries from one IP address (section 15).

Purpose and legal basis: we answer your enquiry. If it concerns a booking or a possible contract, the legal basis is Art. 6(1)(b) GDPR; otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).

Health information: please only send us information about your health, for example about accessibility or allergies, if it matters for your enquiry or your stay. We only use such information to answer your enquiry and prepare your stay. The legal basis is your explicit consent, given by providing the information voluntarily (Art. 9(2)(a) GDPR); you can withdraw it at any time, and we will then delete this information.

Retention: enquiries are kept as emails in our mailbox; how long we keep emails is stated in section 16. If an enquiry leads to a booking, we keep it like the booking records (section 11); emails that have to be kept as business correspondence are kept for 6 years from the end of the calendar year (Section 147(1) Nos. 2 and 3, (3) of the German Fiscal Code, AO).

Enquiries from property owners (LOCADO Real Estate)

You can offer us a property using the form on the “LOCADO Real Estate” page.

What data: name, email address, your role (such as owner, property manager or developer), postcode and town of the property are required; salutation, phone number, street, type of property, living space, rooms, furnishing, current use, available from, consent of the owners’ association and your message are optional. Processing and spam protection as for the contact form; we do not store the data in a database but receive it by email.

Purpose and legal basis: answering your enquiry, assessing the property and preparing a lease. If you are the owner as a private individual, the legal basis is Art. 6(1)(b) GDPR; if you write as the contact person of a company, property manager or developer, our legitimate interest in initiating business (Art. 6(1)(f) GDPR).

Retention: if no cooperation results, we keep your enquiry like other emails without a retention obligation (section 16); otherwise the statutory retention periods apply.

10. Communication via WhatsApp Business

For questions before booking, about your arrival and during your stay, you can reach us via WhatsApp Business on +49 155 10603648. The WhatsApp links on our website are plain links; no data is sent to WhatsApp before you click one.

The provider is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, a Meta group company. If you message us on WhatsApp, we process your phone number, your profile name and, where applicable, your profile picture, the content of your messages and attachments, and times and delivery status. WhatsApp also processes usage and device data under its own responsibility; this may involve transfers to the USA, for which the EU-US Data Privacy Framework applies. More in WhatsApp’s privacy policy.

We use the WhatsApp Business app on a dedicated business phone, not the WhatsApp Business Platform. Only our partners Moritz Gierschmann and Malcom Kochems have access to the chats. For our guests’ contact details that we use in the app, WhatsApp acts on our behalf under the app’s terms (Art. 28 GDPR; WhatsApp Business Data Processing Terms). If the app has access to the business phone’s address book, WhatsApp regularly matches the phone numbers stored there with its servers, including those of contacts who do not use WhatsApp.

Purpose and legal basis: we use the messages to answer your questions and to carry out your booking and your stay (Art. 6(1)(b) GDPR). For general enquiries not related to a booking, we rely on our legitimate interest in quick communication (Art. 6(1)(f) GDPR).

Voluntary: you do not have to use WhatsApp; you can reach us just as well by email at info@locadostays.com.

Retention: We delete chats no later than 12 months after your departure or after the last message of an enquiry without a booking, unless retention obligations apply.

11. Booking on our website

What data we process

  • About you as the person booking: first and last name, email address, phone number and country; your address if our booking management system requires it (the form then asks for it); optionally your approximate arrival time, your bed preference (how many people sleep in which bed, without names) and a message to us. Health information in your message is treated as for enquiries (section 9).
  • If you are not staying yourself: the travelling guest’s first and last name and email address, optionally their phone number and country.
  • If you book for a company: company name and billing address, optionally VAT ID, cost centre, purchase order number and a separate invoice email address.
  • Booking data: apartment, dates, number of adults and children, whether a pet is coming, the prices including the accommodation tax, booking reference, booking status, the rate you chose with its cancellation terms, the version of our terms and conditions and the language you booked in (we send you the booking emails in that language).
  • Payment data: amount, payment status, payment method, card brand and the last four digits of your card, the result of your bank’s security check (3-D Secure) and identifiers of the payment at Stripe. We do not receive your full card number or security code (section 12).
  • Pseudonymous check values: hash values of your email address and IP address that we use to limit booking attempts (section 15), and a hash value of the access key for the confirmation page.

Purposes and legal bases

  • Carrying out the booking (Art. 6(1)(b) GDPR): accepting and confirming the booking, processing the payment, sending you information about your stay, issuing invoices and answering your questions about the booking.
  • Legal obligations (Art. 6(1)(c) GDPR): keeping booking and invoicing records (Section 147 of the German Fiscal Code, AO; Section 14b of the German VAT Act, UStG), the guest registration form (section 13) and the accommodation tax (section 14).
  • Protection and proof (Art. 6(1)(f) GDPR): preventing misuse and payment fraud (section 15) and being able to prove our claims (“Proof of your booking” below).

Booking for other people and for companies

If you provide details of another travelling guest, we have received their name, email address and, where given, phone number and country from you. We process them to provide the stay (Art. 6(1)(b) or (f) GDPR). We inform the travelling guest ourselves: before arrival, we send them an email – via our email delivery service or via Smoobu (section 13) – with the arrival information and a link to this privacy policy.

If you book for a company, the company is our contracting party. We process your data as its contact person on the basis of our legitimate interest in performing the contract with the company (Art. 6(1)(f) GDPR). We include the company name in the booking summary, in our internal note in Smoobu and on the invoice; for sole traders, it may identify a person.

Request for a review

After your stay, we send you one email to say thank you and ask you for a review – only if you booked on our website and stayed yourself. For this, we use your email address and first name from the booking and the booking reference. The legal basis is our legitimate interest in receiving feedback on our stays and collecting reviews (Art. 6(1)(f) GDPR in conjunction with Section 7(3) of the German Act against Unfair Competition, UWG). Whether you write a review is up to you; you write it on Google’s page, which the button in the email leads to, and Google’s privacy notice applies there. You can object to us using your email address for such requests at any time (Art. 21(2) GDPR, section 19), for example by replying to the email or by sending an informal message to the contact details in section 1; this costs you nothing beyond the transmission costs at the basic rates. We store your objection as a hash value of your email address (not the address itself), so that you do not receive such a request for later bookings either, for as long as we send review requests.

Proof of your booking

When you click “Book and pay”, we store the text of the “Review & book” summary exactly as it was shown to you, with a checksum, together with the time, the version of our terms and conditions, your browser identifier (user agent) and a hash value of your IP address. This allows us to show which terms applied to your booking, for example if a payment is disputed with your bank (chargeback). The legal basis is our legitimate interest in establishing and defending legal claims (Art. 6(1)(f) GDPR). The summary text contains no names of people; for a company booking, it contains the company name.

Browser storage

To keep your input when you change the dates, for example, the booking page stores it without payment details in your browser’s session storage, together with the access key for the confirmation page (details in section 5). This is strictly necessary for the booking you have requested (Section 25(2) No. 2 TDDDG; Art. 6(1)(b) GDPR). No analytics or marketing services load on the booking page, even with consent.

Recipients

Stripe for the payment (section 12), Smoobu for booking management and guest communication (section 13), Vercel as hosting provider (section 4), Neon for the database, Brevo for email delivery and IONOS for our mailbox (section 16) and, only if it requests details of individual guests, the City of Königswinter for the accommodation tax (section 14).

Retention

  • Booking and invoicing records: name, email address, country and – where given – address of the person booking, name of the travelling guest, the billing details for company bookings, booking and payment data and the summary text. We keep them for 8 years from the end of the calendar year in which the departure, the last invoice or the last payment or refund took place (Section 147(1) No. 4, (3) AO; Section 14b(1) UStG). On the following 1 January we anonymise the booking: personal details, card details and the payment identifiers at Stripe are deleted; apartment, dates and amounts remain without any personal reference.
  • Details without a retention obligation: phone number, approximate arrival time, bed preference and message, the travelling guest’s email address, phone number and country, and the browser identifier and IP hash value from the proof: 180 days after departure or, if a chargeback is still ongoing at that time, until it has been concluded.
  • Hash value of the access key for the confirmation page: 30 days after departure; after that, the link in the emails no longer leads to the booking.
  • Bookings that are not concluded (abandoned, refused or expired): 30 days after the last change we delete all personal details; what remains is a record without any personal reference (apartment, dates, price, status).
  • Email delivery log in our system (without recipient address or content): 90 days after sending.

For the data at Stripe and Smoobu, see section 12 and section 13.

12. Payment processing with Stripe

Payments on our website are processed by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland (“Stripe”). You enter your card details, or approve the payment via Apple Pay or Google Pay, directly in a Stripe form embedded in our booking page; this data never reaches our servers. From us, Stripe receives your name, email address and phone number, the amount and a description of the booking (booking reference, apartment, dates). Stripe also processes your IP address and information about your device and browser. We do not create a customer account at Stripe, and your card is not stored for later payments.

Roles: for processing the payment, Stripe is our processor (Art. 28 GDPR). For its own purposes – in particular detecting and preventing fraud, legal obligations (for example anti-money-laundering) and working with banks and card networks – Stripe is an independent controller. More in Stripe’s privacy policy.

Stripe.js on the booking page: so that Stripe can detect fraud, our booking page – and only this page – loads the Stripe.js script with Stripe’s fraud signals as soon as it is opened, that is, before the payment step. It collects characteristics of your device and of how you use the booking page (such as browser and screen properties, time on the page, mouse movements), sends them to Stripe and sets the cookies __stripe_mid and __stripe_sid (section 5). Stripe also detects card misuse from how the whole booking proceeds. To prevent fraud, Stripe.js may also load the hCaptcha service, which Stripe obtains from Intuition Machines, Inc., USA, as its own service provider; features of your browser and certain hashed identifiers may be sent to it. Stripe is responsible for this as part of its own fraud prevention.

Legal bases: processing the payment: Art. 6(1)(b) GDPR. Fraud detection: Art. 6(1)(f) GDPR (our and Stripe’s interest in secure payments and in preventing card misuse). Loading Stripe.js and storing and reading the Stripe cookies are strictly necessary for the secure processing of the booking with payment that you have requested (Section 25(2) No. 2 TDDDG).

Transfers to the USA: Stripe may transfer data to Stripe, Inc. and affiliated companies in the USA. The EU-US Data Privacy Framework and the European Commission’s standard contractual clauses apply.

Apple Pay and Google Pay: if you use a wallet, Apple (Apple Distribution International Ltd., Ireland) or Google (Google Ireland Limited, Ireland) receives the details of your payment as an independent controller; their privacy terms apply.

Retention at Stripe: Stripe keeps the data for as long as necessary for the purposes above and under the legal obligations that apply to Stripe. For the automated checking of payments, see section 20.

13. Booking management with Smoobu and registration form

We manage our apartments and bookings using the software of Smoobu GmbH, Pappelallee 78/79, 10437 Berlin, Germany (“Smoobu”). Smoobu processes the data on our behalf (Art. 28 GDPR); on request we will tell you which sub-processors Smoobu uses for this.

What Smoobu receives from us: the travelling guest’s first and last name, email address, phone number and country (yours, if you book for yourself), your address if you are staying yourself and have provided it, arrival and departure dates, number of adults and children, the price items, the payment status and the booking reference. In addition, an internal note for our team: the rate you chose, whether a pet is coming, approximate arrival time, bed preference, your message, whether a company invoice is wanted (with the company name) and, if you book for someone else, your name as the person booking.

What for: Smoobu keeps our occupancy calendar; we use Smoobu to communicate about the stay. For a booking on our website, we send you the arrival information with the access codes and our other messages about the stay by email – via our email delivery service (section 16) or via Smoobu. The legal basis is Art. 6(1)(b) GDPR.

Synchronisation with booking platforms: to prevent double bookings, Smoobu synchronises occupancy with Airbnb and Booking.com; only the booked period is transmitted, not your personal details. Our server also regularly reads the bookings in Smoobu, including those made via Airbnb or Booking.com, to keep availability and booking status in line. We process details of guests from platform bookings only briefly in memory and do not store them. The legal basis is our legitimate interest in avoiding double bookings and errors in the booking status (Art. 6(1)(f) GDPR).

Registration form: as an accommodation provider, we have to keep a registration form only for guests who are not German citizens (Sections 29(2) and 30 of the German Federal Registration Act, BMG). We collect the details for it on arrival: date of arrival and expected date of departure, surname, first names, date of birth, nationalities, address, number of foreign fellow travellers and their nationality, and the serial number of the passport or passport substitute (Section 30(2) BMG). We are still setting up exactly how we collect them (on paper or digitally); we will tell you before you arrive. The legal basis is Art. 6(1)(c) GDPR in conjunction with Sections 29 and 30 BMG. Guests who are German citizens do not have to fill in a registration form; we do not ask for copies or photos of identity documents. We keep registration forms and any registration data collected electronically for one year from the day of departure and destroy or delete them no later than three months after that year has ended (Section 30(4) BMG); on request, we have to show or transmit them to the competent authorities.

Access to the apartment (Nuki): you get into the apartment via a key box and a smart lock from Nuki Home Solutions GmbH, Münzgrabenstraße 92/4, 8010 Graz, Austria (“Nuki”). The access codes are generated automatically and are valid only for the time of your stay. Once we create the personal door code for bookings on our website ourselves, we do so via Nuki’s interface: for this, Nuki receives from us only the booking reference, the code and the period in which it is valid – no name and no contact details. We then store the code encrypted, send it with the arrival information and delete it from the lock after your stay or after a cancellation, and from our database 30 days after departure. Until then, and for bookings via Airbnb or Booking.com, the code may be created via Smoobu’s connection with Nuki; in that case, Nuki may also receive the travelling guest’s name. The smart lock logs when the door is opened or locked and with which access. Nuki stores this log according to its own rules; at LOCADO, only our partners Moritz Gierschmann and Malcom Kochems can view it. The legal basis is Art. 6(1)(b) GDPR for the access and, for the log, our legitimate interest in the security of the apartment (Art. 6(1)(f) GDPR).

Cleaning: we clean the apartments ourselves or with our own cleaning staff; we do not use external cleaning services. Whoever cleans has no access to Smoobu and is told by message only the arrival and departure dates, the number of guests and special requests.

Pricing (PriceLabs): we set the prices of our apartment on Freyenberger Weg with the PriceLabs service (USA), which we have connected via Smoobu. For the bookings, PriceLabs receives only travel dates, revenue, number of guests, booking channel and commission; PriceLabs does not receive guests’ names or contact details. The legal basis is our legitimate interest in prices in line with the market (Art. 6(1)(f) GDPR).

Retention at Smoobu: we keep the booking itself (name, dates, prices, payment status, booking reference) in Smoobu for as long as our other booking records (section 11). We delete phone number, email address and address and the internal note there no later than 12 months after departure. For registration forms, the period above applies.

14. Invoices, accounting and accommodation tax

Invoices: we currently create invoices ourselves as PDFs and send them to you by email. For this we use your name or company, billing address, where applicable VAT ID, cost centre and purchase order number, the service and the amounts. If we use an invoicing program for this in future (Lexware Office is planned), we will update this policy beforehand. We have not currently engaged a tax adviser. The legal bases are Art. 6(1)(b) and (c) GDPR in conjunction with Section 14b UStG and Section 147 AO; we keep invoices and accounting vouchers for 8 years from the end of the calendar year in which they were created.

Accommodation tax: the City of Königswinter charges an accommodation tax for overnight stays in Königswinter. We calculate it when you book, show it in the price and pay it to the city. For this, we report only totals to the city for each reporting period, namely the number of overnight stays and the revenue. We only pass on details of individual guests if the city requests them, for example as proof of overnight stays on business trips. The legal basis is Art. 6(1)(c) GDPR in conjunction with the bylaw of the City of Königswinter.

15. Protection against misuse

Bot check (ALTCHA): to prevent automated misuse of our forms, for example to test stolen card details, your browser solves a small computational task (“ALTCHA”) when you submit a booking, when you register for an account and when sign-in codes are requested repeatedly. The task is issued and checked by our own server; no data is transferred to third parties, no cookies are set and no characteristics of your device are analysed. So that solved tasks cannot be reused, we store them until they expire after 10 minutes; our daily deletion run removes them no later than one day after that. They contain no personal data.

Limiting requests: we limit the number of booking attempts per email address and per IP address and stop a payment after several failed attempts. For counting, we only use hash values that we store with the booking: pseudonyms created with a secret key from which the address cannot be recovered. We do not store your IP address in plain text for this; your email address is part of the booking anyway because we need it for the booking (section 11). We store failed sign-in attempts for 30 days with a hash value of the email address. For forms, sign-in and price checks, our server also limits the number of requests per IP address; for this it keeps your IP address only in memory, not in a database, until newer entries replace it or the server restarts. If a booking attempt is refused for this reason, you can ask for a person to review the case (section 20).

Legal basis: our legitimate interest in protection against misuse and payment fraud (Art. 6(1)(f) GDPR). Where the computational task uses information on your device, this is strictly necessary for the booking or sign-in you have requested (Section 25(2) No. 2 TDDDG).

16. Email delivery, mailboxes and database

Email delivery (Brevo)

We send our website’s emails via the Brevo service of Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany (“Brevo”): confirmations and other messages about your booking and your stay (such as the arrival information and the request for a review), sign-in and confirmation codes, emails about your account and the forwarding of your form enquiries to our mailbox. Brevo processes the recipient address, name, content of the message and technical delivery data (time, delivery status) in data centres in the EU, only on our behalf (Art. 28 GDPR; the data processing agreement is part of Brevo’s terms of use). The legal basis is Art. 6(1)(b) GDPR, or (f) for enquiries not related to a contract.

Brevo adds an invisible tracking pixel to our emails and routes links in them via the address r.mail.locadostays.com to Brevo before they take you to their destination; Brevo does not allow this to be switched off. Brevo records opens and clicks only anonymously, without linking them to your email address. We do not analyse this information. Brevo keeps the delivery logs for 1 month and then deletes them automatically; Brevo does not store the content of the emails (previews). In our own system we only record which email was sent when, without recipient address or content, and delete these entries 90 days after sending.

Our emails show our logo as an image that your email program fetches from our website, if it loads images; this produces the server logs described in section 4. The address of this image is the same for all recipients, so it does not tell us who opened an email.

Mailboxes

If you email us or we reply to you, the messages are kept in our mailbox info@locadostays.com at IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany (“IONOS”), which stores them on our behalf (Art. 28 GDPR). We also access the mailbox on a smartphone.

How long we keep emails: we delete enquiries without a booking (including from property owners, section 9) and messages about the stay that are not business letters no later than 12 months after the last message or after your departure. We keep emails about bookings and other business correspondence for 6 years and invoices for 8 years, each from the end of the calendar year (Section 147(1) and (3) AO).

Database (Neon)

Bookings, payment statuses, sign-in data and the other data mentioned in this policy that we store are kept in a database provided by Neon in an Amazon Web Services data centre in Frankfurt am Main, Germany. Our contracting party is Databricks, Inc., 160 Spear Street, 15th Floor, San Francisco, CA 94105, USA, the parent company of Neon, LLC. Neon processes the data on our behalf (Art. 28 GDPR). Access from the USA, for example for maintenance and support, cannot be ruled out; the European Commission’s standard contractual clauses apply. Deleted data remains recoverable from the database backups for 7 days and is then permanently deleted. The legal bases follow the processing concerned.

Maintenance and operation of the website

The agency NEWAVE Forward (owner Til Kams, Malplaquetstraße 43, 13347 Berlin, Germany) built the website for us and maintains and runs it on our behalf (Art. 28 GDPR). For this it has access to the admin area, the database and the services in this section and in sections 4, 7, 12 and 13, to the extent necessary for maintenance and troubleshooting, and receives technical alerts from our system (with booking references or identifiers, without names or messages). The legal basis is our legitimate interest in secure and reliable operation (Art. 6(1)(f) GDPR).

The agency uses the following sub-processors: Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland, for its email mailbox (Google Workspace), where the technical alerts arrive; and Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, Ireland, for the AI assistant Claude, which it uses for programming, maintaining the website and troubleshooting. Personal data from our systems may be processed in the course of this, for example details of a booking when the agency investigates an error. Anthropic does not use this data to train its AI models and generally deletes it after 30 days. Both providers may transfer data to the USA: Google on the basis of the EU-US Data Privacy Framework, Anthropic on the basis of the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

17. Sign-in with a code

For the account on this website and for the LOCADO team in the admin area, there is a separate sign-in without a password: you enter your email address, we send you a 6-digit code and you enter it on the same page. The code is valid for 15 minutes and can only be used once; we do not send sign-in links. We do not send any email to addresses that have no account.

What data: your email address (in plain text, so that we can write to you), the code with an associated identifier, the language and target page of the sign-in, the number of attempts, sessions (start, last use, expiry, checksum of the browser identifier) and failed attempts (only with a hash value of the email address). We store the code and identifier as checksums; until you use the code, they are also kept in encrypted form so that our email system can send you the code. We delete this encrypted version as soon as you use the code, or after too many failed attempts.

Cookies: for signing in we set the strictly necessary cookies __Host-locado_preauth, __Host-locado_session and __Host-locado_member, and __Host-locado_admin for the team; we keep the first name for the page header in session storage under locado:member:name. Details and durations in section 5. On the sign-in pages and in the account we do not load any analytics or marketing services, not even with consent.

Purpose and legal basis: signing in to the account: Art. 6(1)(b) GDPR. Team sign-in and protection against misuse: Art. 6(1)(f) GDPR. The cookies are strictly necessary for the sign-in you have requested (Section 25(2) No. 2 TDDDG).

Retention: sign-in and confirmation codes 30 days after they expire, sessions 30 days after they end, failed attempts 30 days.

LOCADO Regular

This section applies if you sign up for our membership programme LOCADO Regular or are a member. The controller is LOCADO (section 1).

What data we process

  • Sign-up: email address, first and last name, language. As proof that you agreed to the terms of participation: the version of the terms, checksums of the terms text and of the text next to the tick box (with it you also confirm that you are at least 18 years old), where you signed up (form or booking, then with the booking reference), and the time, IP address (in full) and browser identifier at sign-up and at confirmation.
  • Account: status and start of your membership, your level and its period, the number of counted stays and nights, your setting for automatic linking, the time of your last sign-in and of your last activity in the account, and the language for our emails; optionally your phone number, country, address and billing details (company, billing address, invoice email address, VAT ID, cost centre, purchase order number); a history of key events (such as joining, level changes, linking a stay, a change of the email language, data export) without free text.
  • Language for emails: it follows the page on which you last did something. It changes when you sign in to your account on a page in the other language, submit a booking while signed in as a member (also for someone else), send or withdraw a request, save your profile or end your membership. You can choose it yourself in your profile. We record every change with its time and cause in the history.
  • Stays: for your direct bookings linked to your account: booking reference in Smoobu, apartment, booking channel, arrival and departure, number of nights, booking date, status (upcoming, completed, cancelled), the check-in and check-out times entered in Smoobu, how the stay was linked, whether or why it does not count, and a hash value of the guest name so that we can tell whether different people book under one email address.
  • Linking suggestions: bookings we do not link automatically (see below) and stays you report to us are shown to our team as suggestions: booking reference in Smoobu, dates, how the suggestion came about, and our team’s decision.
  • Requests for earlier check-in or later check-out: type and time, your note to us, your level on the day of the request, the result of our check (whether other guests arrive or leave on the same day), our decision and the times.
  • Signing in to your account: as described above in this section 17.

Where the data comes from: from you; from Smoobu, our booking management system (your direct bookings); from our booking system when you book on our website.

Purposes and legal bases

  • Running your membership (Art. 6(1)(b) GDPR): account and sign-in, linking your direct stays (also automatically, see below), calculating your level, handling your requests, emails about your membership (confirmation, sign-in codes, level, requests, end) and your saved details for your next booking.
  • Security and protection against misuse (Art. 6(1)(f) GDPR): we limit sign-ups and sign-in attempts and have your browser solve a small computational task (section 15). Exclusions and blocks continue to apply after a membership ends (section 10 of the terms of participation). Our legitimate interest is a fair programme without misuse.
  • Proof of your agreement (Art. 6(1)(f) GDPR): we need to be able to show who agreed to which version of the terms of participation and when.
  • Legal obligations (Art. 6(1)(c) GDPR): only for booking and invoicing records (section 11); there is no retention obligation for the membership itself.

How we link direct bookings: we link a booking to your account if you book it on our website while signed in and staying yourself, or automatically if the email address and last name of the travelling guest match your account. We only compare direct bookings for this; bookings via platforms such as Airbnb or Booking.com are filtered out before any comparison, not compared and not stored. Bookings made before you signed up are also taken into account if arrival was on or after the programme start on 28 October 2026. We do not link automatically for shared addresses (such as info@ or travel@), for email addresses with bookings for different people, or if the last name does not match; only our team sees such cases as suggestions, reviews them and only then links them.

Switching off automatic linking: you can switch off automatic linking in your account at any time (section 5(3) of the terms of participation). We will then only link stays if you book for yourself while signed in or report a stay to us. You can also object to processing based on our legitimate interests under Art. 21 GDPR (section 19).

No automated decision-making: we calculate your level automatically according to the fixed rules in the terms of participation. It only determines which earlier or later times you can request; a person from our team decides on every request. There is no automated decision within the meaning of Art. 22 GDPR. If you think a calculation is wrong, we will check it when you contact us.

Smoobu: Smoobu is also our processor for the programme (section 13). We read your direct bookings there in order to link them. For each request, we add an internal note for our team to your booking in Smoobu (type of request, time, level, deadline), without your note; guests do not see it. To check whether other guests arrive or leave on the day of your request, we look at the apartment’s occupancy; we do not store any of it.

Emails: we send emails about your membership from konto@locadostays.com via the same delivery service as our booking emails (section 16), in the language of your account. They contain no advertising. Signing up for LOCADO Regular is not consent to advertising emails or a newsletter; for those we would need your separate consent with confirmation of your email address (double opt-in), which you could withdraw at any time (section 3).

Recipients: Vercel (hosting and server functions), Neon (database in Frankfurt am Main), Brevo (email delivery), Smoobu (booking management) and the agency NEWAVE Forward (maintenance and operation, section 16), all as processors. Our payment provider Stripe receives no data about your membership. For transfers to the USA, see section 18.

Retention

  • Unconfirmed sign-up, including the proof: 48 hours.
  • Account with profile and billing details, stays, requests and history: until your membership ends; we then delete them without delay, within two days at the latest.
  • Requests and history: even during membership, no longer than 24 months after the stay or event; we keep the entry for your current level for as long as that level applies.
  • Linking suggestions: automatic suggestions rejected by our team 30 days after the decision; other decided suggestions and your reports 24 months after the decision; suggestions our team has not decided on 3 months after the booking’s departure.
  • Proof of your agreement (version, checksums, times, IP address, browser identifier): for the duration of your membership and 3 years after it ends (standard limitation period, Section 195 of the German Civil Code, BGB); after the end, only with a hash value of your email address instead of the address.
  • IP address and browser identifier for the tick box in a booking: until transferred into the proof; if the booking is not concluded, 30 days.
  • Exclusion of individual stays (hash value of the email address, booking reference in Smoobu, reason): 48 months after departure.
  • Block on a new sign-up (hash value of the email address): until it expires, no longer than 3 years.
  • Sessions, sign-in and confirmation codes, failed code entries and delivery logs: as in section 16 and above in section 17.

We do not delete your account because of inactivity: it only contains what you have provided yourself and what belongs to your stays, we delete requests and history after 24 months regardless, and your level should remain yours even after a longer break. You can end your membership at any time; we then delete your account as described above.

Your rights in your account: in your account you can download your data as a file (Art. 15 and 20 GDPR). Automatic linking suggestions, which only our team sees, are only given there as a number, because they may concern other people’s bookings. You change your details in your profile (Art. 16 GDPR), end your membership and delete your account with “End membership and delete account” (Art. 17 GDPR) and switch off automatic linking there. You cannot currently change your email address yourself: end your membership and sign up again with the new address; on request, we will link your earlier direct stays again. All other rights are set out in section 19.

18. Recipients and transfers to third countries

We only pass on personal data where this is necessary for the purposes described, the law requires it or you have consented. These service providers and bodies receive data:

  • Vercel Inc., USA – hosting and server functions (section 4); processor; USA: EU-US Data Privacy Framework and standard contractual clauses.
  • Databricks, Inc. (Neon), USA, data centre in Frankfurt am Main – database (section 16); processor; access from the USA possible: standard contractual clauses.
  • Brevo GmbH, Germany – email delivery (section 16); processor; processing in the EU.
  • IONOS SE, Germany – mailbox (section 16); processor.
  • Stripe Payments Europe, Limited, Ireland, with Stripe, Inc., USA – payment (section 12); processor, independent controller for fraud prevention and its own legal obligations; for fraud prevention, Stripe.js may load the hCaptcha service of Intuition Machines, Inc., USA (Stripe’s service provider); USA: EU-US Data Privacy Framework and standard contractual clauses.
  • Apple Distribution International Ltd. and Google Ireland Limited, Ireland – only if you pay with Apple Pay or Google Pay (section 12); independent controllers.
  • Smoobu GmbH, Germany – booking management, guest communication (section 13); processor.
  • Nuki Home Solutions GmbH, Austria – smart lock with access codes and access log; once we create the door codes for bookings on our website ourselves, from us only the booking reference, door code and validity period; via the connection with Smoobu possibly also the travelling guest’s name (section 13).
  • PriceLabs, USA – pricing, without guests’ names or contact details (section 13).
  • PostHog Inc., USA, data stored in Frankfurt am Main – analytics, only with consent (section 7); processor; access from the USA possible: standard contractual clauses; AI features switched off.
  • Google Ireland Limited, Ireland, with Google LLC, USA – Google Maps map, only after a click or with consent (section 8); jointly responsible with us for loading the map, solely responsible afterwards; USA: EU-US Data Privacy Framework.
  • WhatsApp Ireland Limited, Ireland – communication if you use WhatsApp (section 10); processor for our guests’ contact details, independent controller for its own purposes; USA possible: EU-US Data Privacy Framework.
  • City of Königswinter – accommodation tax (section 14): totals per reporting period, details of individual guests only on request; independent controller.
  • NEWAVE Forward (owner Til Kams), Germany – maintenance and operation of the website, technical alerts (section 16); processor.
  • Google Cloud EMEA Limited, Ireland, and Anthropic Ireland, Limited, Ireland – the agency’s email mailbox and AI assistant (section 16); sub-processors; USA: EU-US Data Privacy Framework (Google) or standard contractual clauses (Anthropic).

We also pass on data to authorities and courts where we are legally obliged to (Art. 6(1)(c) GDPR) and, in the event of disputes, to our legal advisers (Art. 6(1)(f) GDPR).

Transfers to third countries: third countries are countries outside the EU and the European Economic Area. We only transfer data there if the European Commission has found an adequate level of data protection (Art. 45 GDPR) – for example for US companies certified under the EU-US Data Privacy Framework – or if we have agreed the European Commission’s standard contractual clauses with the recipient (Art. 46(2)(c) GDPR). You can ask us for a copy of the standard contractual clauses.

19. Your rights

You have the following rights in relation to us:

  • access to the data we process about you (Art. 15 GDPR),
  • rectification of inaccurate or incomplete data (Art. 16 GDPR),
  • erasure (Art. 17 GDPR), for example where we no longer need the data for its purpose, you withdraw your consent, you have objected effectively or the processing was unlawful – unless the law requires us to keep the data or we need it to establish, exercise or defend legal claims,
  • restriction of processing (Art. 18 GDPR),
  • data portability: the data you have given us in a common, machine-readable format (Art. 20 GDPR),
  • objection to processing based on our legitimate interests and to direct marketing (Art. 21 GDPR, see below),
  • withdrawal of consent (Art. 7(3) GDPR) and
  • complaint to a supervisory authority (Art. 77 GDPR).

To exercise your rights, write to info@locadostays.com or to the address in section 1. This is free of charge. So that we do not disclose data to unauthorised persons, we may ask you to prove your identity. We reply without undue delay and at the latest within one month. Where requests are particularly complex or numerous, we may extend this period by two further months; we will then tell you so, with the reasons, within the first month (Art. 12(3) GDPR).

Right to object under Art. 21 GDPR

Where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you can object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. We use your data for direct marketing in one case only: the one-off request for a review after a stay (section 11). You can object to this at any time without giving reasons (Art. 21(2) GDPR); we will then no longer use your data for this purpose (Art. 21(3) GDPR). An informal message to the contact details in section 1 is enough to object, and for the review request also a reply to that email.

Withdrawing consent

You can withdraw consent at any time with effect for the future; for cookies and services on this website, via “Cookie settings” at the bottom of every page. This does not affect the lawfulness of processing carried out before the withdrawal.

Complaint to a supervisory authority

You can lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work or where the alleged infringement took place. Because our seat is in Rheinbreitbach, the authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz (State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate)
Hintere Bleiche 34
55116 Mainz
Germany
www.datenschutz.rlp.de

20. Automated individual decisions

For payments, Stripe and your bank check automatically whether there is a risk of fraud; they may require additional authentication (3-D Secure) or decline a payment. In addition, our system automatically refuses booking attempts when the limits described in section 15 are exceeded, for example too many attempts per email or IP address or several failed payments. Where this is a decision based solely on automated processing that significantly affects you (Art. 22 GDPR), it is necessary for entering into the contract with you (Art. 22(2)(a) GDPR): it protects you and us from card misuse. You can ask for a person from our team to review the case, express your point of view and contest the decision; to do so, write to the contact details in section 1. If your payment is declined, you can also use another payment method. We make no other decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

21. Obligation to provide your data

It is up to you whether you give us data. For a booking, however, we need the details marked as required in the form: name, email address, phone number and country, your address where asked, the travelling guest’s details if you book for someone else and the billing details for a company booking. Without them we cannot conclude the contract. We need the phone number so that we can reach you around your arrival and if there are problems with the booking. Guests who are not German citizens are required by law to provide the details for the registration form (section 13). For an enquiry, we need your name, email address and message, otherwise we cannot reply. Consent is voluntary: without it you can use the website and book; the map then only loads after a click, and we do not measure how you use the website.

22. Changes to this privacy policy

We update this privacy policy when our website, our service providers or the law change. The version published here applies. If we need your consent for something new, we will ask you first.

Last updated: 28 October 2026