PRIVACY POLICY

1. Introduction

We take the protection of your personal data very seriously. This privacy policy informs you about how we collect, process, and use your personal data when you visit our website brauhaus-apartment-bamberg.de (hereinafter “Website”).

Personal data means any information relating to an identified or identifiable natural person, such as name, email address, IP address, or usage behavior.

2. Controller

The controller responsible for data processing on this website is:

Brauhaus Apartment Bamberg
Carsten Cramer
Ernst-Griesheimer-Platz 6
63071 Offenbach am Main
Germany

Email: inquiry@brauhaus-apartment-bamberg.com
Phone: +491772775617

3. Hosting

Our website is hosted by:

Infomaniak Network SA
Rue Eugène-Marziano 25
1227 Genève
Switzerland

Infomaniak processes data on our behalf and is contractually obligated to comply with data protection regulations. As a Swiss company, Infomaniak is subject to the Swiss Federal Act on Data Protection (FADP), which provides an adequate level of data protection recognized by the European Commission.

When you visit our website, Infomaniak automatically collects and stores information in server log files that your browser transmits to us. These include:

Browser type and version
Operating system used
Referrer URL
Host name of the accessing computer
Time of server request
IP address

This data is not merged with other data sources. The collection of this data is based on Art. 6(1)(f) GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimization of the website.

Server log files are stored for a maximum of 30 days and then automatically deleted.

4. SSL/TLS Encryption

This website uses SSL/TLS encryption for security reasons and to protect the transmission of confidential content. You can recognize an encrypted connection by the “https://” in the address line of your browser and the lock symbol.

When SSL/TLS encryption is activated, the data you transmit to us cannot be read by third parties.

5. Consent Management (CookieConsent)

We use the open-source tool CookieConsent by Orest Bida to manage your cookie preferences and obtain your consent for data processing activities that require it.

When you first visit our website, a consent banner appears allowing you to:

Accept all cookies
Reject non-essential cookies
Customize your preferences by category

Your consent preferences are stored in a cookie on your device. You can change your preferences at any time by clicking on the cookie settings link in the footer of our website.

Legal basis: Art. 6(1)(a) GDPR (consent) for optional cookies; Art. 6(1)(f) GDPR (legitimate interest) for the consent management tool itself.

6. Cookies

6.1 What are Cookies?

Cookies are small text files that are stored on your device when you visit our website. They serve various purposes, from ensuring basic functionality to analyzing user behavior.

6.2 Cookie Categories

We categorize cookies as follows:

Strictly Necessary Cookies
These cookies are essential for the website to function properly. They include the cookie that stores your consent preferences. These cookies do not require your consent.

Analytics Cookies
These cookies help us understand how visitors interact with our website by collecting and reporting information. They are only set after you have given your consent.

6.3 How to Control Cookies

You can control and delete cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of this website.

You can also withdraw or modify your consent at any time through our cookie settings (accessible via the footer).

7. Web Analytics

We use two analytics tools to understand how our website is used. Both tools are only activated after you have given your consent via the cookie banner.

7.1 Google Analytics 4 (GA4)

We use Google Analytics 4, a web analytics service provided by:

Google Ireland Limited
Gordon House, Barrow Street
Dublin 4, Ireland

Google Analytics uses cookies to analyze your use of the website. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there.

IP Anonymization: We have activated IP anonymization on this website. This means that your IP address will be truncated by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area before being transmitted to the USA.

Data Processing Agreement: We have concluded a Data Processing Agreement with Google.

Data Transfer to USA: Google is certified under the EU-U.S. Data Privacy Framework, ensuring an adequate level of data protection.

Data collected includes:

Pages visited
Time spent on pages
Device and browser information
Geographic location (country/city level)
Referral source

Storage duration: User-level data is automatically deleted after 14 months.

Opt-out: Besides managing your consent via our cookie banner, you can prevent Google Analytics from collecting your data by installing the Google Analytics opt-out browser add-on: tools.google.com/dlpage/gaoptout

Legal basis: Art. 6(1)(a) GDPR (your consent)

For more information, please see Google’s privacy policy: policies.google.com/privacy

7.2 Google Tag Manager

We use Google Tag Manager, a solution that allows us to manage website tags (including Google Analytics) through a single interface.

Google Ireland Limited
Gordon House, Barrow Street
Dublin 4, Ireland

Google Tag Manager itself does not collect any personal data. The tool triggers other tags which may collect data. Google Tag Manager does not access this data. If you have opted out at domain or cookie level, this opt-out will remain in place for all tracking tags implemented with Google Tag Manager.

Legal basis: Art. 6(1)(a) GDPR (your consent) for tags that require consent; Art. 6(1)(f) GDPR (legitimate interest) for the tag management functionality itself.

7.3 Matomo

We also use Matomo (formerly Piwik), an open-source web analytics platform.

Matomo is self-hosted on our servers at Infomaniak, meaning your data is not transferred to third parties.

Data collected includes:

Pages visited
Time spent on pages
Device and browser information
Geographic location (country/city level, based on anonymized IP)
Referral source

IP Anonymization: We have configured Matomo to anonymize IP addresses by masking the last two bytes (e.g., 192.168.xxx.xxx).

Storage duration: Analytics data is stored for 12 months and then automatically deleted.

Opt-out: You can opt out of Matomo tracking at any time by managing your cookie preferences or by enabling the “Do Not Track” setting in your browser, which Matomo respects.

Legal basis: Art. 6(1)(a) GDPR (your consent)

8. Content Delivery Network (CDN)

8.1 Cloudflare CDN

We use Cloudflare’s Content Delivery Network (CDN) to ensure fast and reliable delivery of our website content worldwide.

Cloudflare, Inc.
101 Townsend St.
San Francisco, CA 94107
USA

European Representative:
Cloudflare Germany GmbH
Rosenheimer Straße 143C
81671 München
Germany

When you access our website, content may be delivered from Cloudflare servers located in various countries. This process involves the transmission of your IP address to Cloudflare servers.

Data collected includes:

IP address
Browser type and version
Operating system
Referrer URL
Time of access

Data Processing Agreement: We have concluded a Data Processing Agreement with Cloudflare.

Storage duration: According to Cloudflare’s policies, log data is stored for a maximum of 24 hours for Free, Pro, and Business plans.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in fast, secure, and reliable website delivery)

Data Transfer to USA: Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework, ensuring an adequate level of data protection as recognized by the European Commission. Additionally, we rely on the EU Standard Contractual Clauses incorporated in Cloudflare’s Data Processing Addendum.

For more information, please see Cloudflare’s privacy policy: cloudflare.com/privacypolicy

9. Web Fonts

9.1 Google Fonts

Our website uses Google Fonts for uniform font representation.

Google Ireland Limited
Gordon House, Barrow Street
Dublin 4, Ireland

When you access a page on our website, your browser loads the required fonts from Google servers. This involves the transmission of your IP address to Google.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in uniform and appealing presentation of our website)

Data Transfer to USA: Google is certified under the EU-U.S. Data Privacy Framework.

For more information about Google Fonts, please visit: developers.google.com/fonts/faq

10. Maps

10.1 HERE Maps

We use HERE Maps to display interactive maps on our website.

HERE Global B.V.
Kennedyplein 222-226
5611 ZT Eindhoven
Netherlands

The map is embedded via HERE’s API. When you view a page containing a HERE map, your browser establishes a direct connection to HERE’s servers. HERE receives information about which pages you have visited.

We do not use HERE Maps for:

Route planning
Location tracking
Collection of personal movement data

The integration is purely for displaying the static location of our property.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in presenting our location effectively)

For more information, please see HERE’s privacy policy: www.here.com/privacy

11. Contact Form

If you contact us via the contact form on our website, we collect the following data:

Name
Email address
Message content

This data is used exclusively to process your inquiry and is stored on our servers at Infomaniak.

11.1 Cloudflare Turnstile

To protect our contact form from spam and automated abuse, we use Cloudflare Turnstile, a privacy-focused CAPTCHA alternative.

Cloudflare, Inc.
101 Townsend St.
San Francisco, CA 94107
USA

European Representative:
Cloudflare Germany GmbH
Rosenheimer Straße 143C
81671 München
Germany

We use Turnstile in “Managed” mode. When you interact with a form protected by Turnstile, Cloudflare collects certain client-side signals to distinguish human users from bots. These signals include:

IP address
TLS fingerprint
User-Agent header
Site key and associated origin

Important privacy features:

Turnstile does not set cookies for tracking purposes
Turnstile does not harvest data for advertising or retargeting
Turnstile does not look for or use login cookies
In most cases, verification happens automatically without user interaction

Cloudflare processes this data as a data processor on our behalf to provide bot protection, and as a data controller to improve Turnstile’s detection capabilities. Cloudflare states that it cannot directly identify individuals from the signals collected.

Data Processing Agreement: We have concluded a Data Processing Agreement with Cloudflare.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protecting our website and contact form from spam and automated abuse)

For more information, please see Cloudflare’s Turnstile Privacy Addendum: cloudflare.com/turnstile-privacy-policy

11.2 Data Storage and Deletion

Your contact form data will be stored until you request deletion, revoke your consent for storage, or the purpose for data storage no longer applies (e.g., after your inquiry has been completed). Mandatory statutory provisions, particularly retention periods, remain unaffected.

Legal basis: Art. 6(1)(b) GDPR (processing for the performance of a contract or pre-contractual measures) and Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries)

12. Social Media Links

Our website contains links to our social media profiles on:

Facebook
Instagram

These are simple hyperlinks and not social media plugins. Clicking these links will redirect you to the respective platform. Only when you click on these links and are redirected to the external platform will your data be processed according to the privacy policies of Facebook (Meta) and Instagram (Meta).

No data is transmitted to these platforms by merely visiting our website.

13. Your Rights

Under the GDPR, you have the following rights:

13.1 Right of Access (Art. 15 GDPR)

You have the right to request confirmation as to whether personal data concerning you is being processed, and if so, to access this data and receive further information.

13.2 Right to Rectification (Art. 16 GDPR)

You have the right to request the correction of inaccurate personal data concerning you without undue delay.

13.3 Right to Erasure (Art. 17 GDPR)

You have the right to request the deletion of your personal data under certain circumstances (e.g., if the data is no longer necessary for its original purpose).

13.4 Right to Restriction of Processing (Art. 18 GDPR)

You have the right to request restriction of processing under certain circumstances.

13.5 Right to Data Portability (Art. 20 GDPR)

You have the right to receive your personal data in a structured, commonly used, and machine-readable format.

13.6 Right to Object (Art. 21 GDPR)

You have the right to object at any time to the processing of your personal data based on legitimate interests (Art. 6(1)(f) GDPR).

In particular, you have the right to object to data processing for direct marketing purposes at any time.

13.7 Right to Withdraw Consent (Art. 7(3) GDPR)

You have the right to withdraw your consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

13.8 Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data violates the GDPR. You can contact the supervisory authority in your place of residence, your place of work, or the place of the alleged infringement.

The supervisory authority responsible for us is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Postfach 3163
65021 Wiesbaden
Germany
datenschutz.hessen.de

14. Data Transfer to Third Countries

Some of the services we use may transfer data to the United States or other third countries.

Cloudflare (CDN and Turnstile): Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework, which ensures an adequate level of data protection as recognized by the European Commission (Adequacy Decision of July 10, 2023). We have also concluded a Data Processing Agreement with Cloudflare that incorporates the EU Standard Contractual Clauses.

Google (Analytics, Tag Manager, Fonts): Google LLC is certified under the EU-U.S. Data Privacy Framework, ensuring an adequate level of data protection.

HERE Maps: Data processing occurs within the European Economic Area.

Matomo: All data remains on our servers hosted by Infomaniak in Switzerland, which has an adequate level of data protection recognized by the EU.

15. Data Security

We use appropriate technical and organizational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.

16. Changes to This Privacy Policy

We reserve the right to update this privacy policy to reflect changes in our practices or for other operational, legal, or regulatory reasons. We encourage you to review this page periodically.

17. Contact for Privacy Matters

For any questions regarding this privacy policy or your personal data, please contact:

Carsten Cramer
Email: inquiry@brauhaus-apartment-bamberg.com
Phone: +491772775617

This privacy policy was last updated on November 28th, 2025.