Privacy policy
Controller: Horst Schulz, Kronstädter Gasse 21, 51674 Wiehl, Germany · Email: ferien@hscon.net.
Data we process
For an enquiry we process name, email, optional phone, travel dates, party size, message, language and price data. After confirmation we also process address, payment and contract data. Before arrival, legally required identity and travel data are collected for Spanish guest reporting. Necessary server logs may contain IP address, time and requested page.
Purposes and legal bases
Enquiries, bookings, payments and guest communications are processed for pre-contractual steps and performance of the contract (Art. 6(1)(b) GDPR). Invoicing, statutory retention and Spanish guest reporting fulfil legal duties (Art. 6(1)(c)). Security logs and abuse prevention rely on legitimate interest (Art. 6(1)(f)). Reviews are published only with consent (Art. 6(1)(a)).
Recipients and transfers
Necessary data is shared with our hosting and email provider, a payment provider once activated, and competent authorities where legally required, including Spanish security authorities for guest reporting. No transfer outside the EEA currently takes place.
Retention
Unsuccessful enquiries are generally erased or anonymised no later than six months after closure unless claims remain open. Contract, payment and invoice data is kept for applicable statutory periods. Guest-reporting data is retained under Spanish rules, including three years where that duty applies.
Your rights
You may request access, correction, erasure, restriction, portability and object to processing. Consent can be withdrawn at any time for the future via ferien@hscon.net. You may also complain to an EU data protection authority.
Cookies and automated decisions
In addition to necessary cookies, only with your consent (Art. 6(1)(a) GDPR) we use our own audience statistics: page views, successful price checks and booking enquiries are aggregated by day, property, source and campaign. Horst Schulz is the controller; processing takes place on our hosting server without sharing with advertising networks. These statistics contain no names, email addresses, IP addresses, visitor IDs or personal links. Technical security logs are separate. The casa_statistics_v1 cookie keeps your choice for 180 days. After consent, casa_statistics_context_v1 in session storage holds the source and campaign ID until the tab closes. Daily counts are kept for 13 months, with cleanup on the next collection. Use Statistics settings to accept, reject or withdraw for the future. Existing aggregate counts cannot be attributed to a guest. No Meta pixel, profiling or automated decision with legal effect.
Personal links
Links for booking details, date decisions, cancellation and reviews are personal and must not be shared. These pages are blocked from search indexing; the link itself acts as the access credential.
Version 2026-09-10