The German version of this privacy policy is authoritative; this translation is provided solely for ease of understanding.

Last updated: October 2026

1. Controllers

Marina and Matthias Förtsch, Waldrast Apartments, Kandelstraße 3, 78136 Schonach im Schwarzwald, Germany, phone +49 15679 585212, email info@waldrast-apartments.de

2. Visiting the website and hosting

When you visit the website, technically necessary data are processed: IP address, date and time, page accessed, volume of data transferred, browser and operating system, and the previously visited page. This is necessary to deliver the website and ensure its security (Art. 6(1)(f) GDPR). The website is operated using the website builder of Smoobu GmbH, Pappelallee 78/79, 10437 Berlin, Germany, which uses Duda, Inc. (USA) as its technical service provider. Individual program libraries are loaded via the network of Cloudflare, Inc. (USA). Smoobu processes the data on our behalf. Where data are transferred to the USA, this is done on the basis of the safeguards provided for in Art. 44 et seq. GDPR (EU-US Data Privacy Framework or standard contractual clauses).

3. Cookies

Our website uses only technically necessary cookies and comparable storage technologies, for example for the language selection and the booking process (§ 25 Abs. 2 TDDDG, Art. 6(1)(f) GDPR). We do not use analytics or advertising cookies. The one exception is the spam protection on the contact page, see section 4.

4. Contacting us

If you contact us by form, email or telephone, we process your details in order to respond to your enquiry (Art. 6(1)(b) GDPR, or (f) in the case of general enquiries). We delete the enquiry as soon as it has been dealt with and no statutory retention obligations apply. If you write to us via WhatsApp, WhatsApp Ireland Limited, Dublin, additionally processes your message and your phone number under its own responsibility; please use email or phone instead if you do not want this.

Spam protection in the contact form (Google reCAPTCHA): To protect against automated spam enquiries, the contact page uses Google reCAPTCHA, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you open the contact page, your IP address, information about your browser and device and your behaviour on the page, among other things, are transmitted to Google; Google may set cookies and transfer data to the USA. Google is certified under the EU-US Data Privacy Framework. The legal basis is our legitimate interest in protection against misuse (Art. 6(1)(f) GDPR). If you do not want this, you can reach us at any time by email or phone without opening the contact page. Details: policies.google.com/privacy.

5. Booking and payment

To display availability and take bookings, we use the booking system of Smoobu GmbH, Berlin, which is embedded in our website. When you make a booking, we process your name, address, email address, telephone number, travel dates, number of guests and payment information in order to conclude and perform the contract (Art. 6(1)(b) GDPR). Payment is made via Stripe Payments Europe Ltd., Dublin, Ireland and PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg; these providers process your payment data under their own responsibility. We retain booking and invoice data for up to ten years in accordance with the provisions of tax and commercial law (Art. 6(1)(c) GDPR).

6. Bookings via portals

If you book via a portal such as Booking.com, Airbnb or FeWo-direkt, we receive your booking data from the portal concerned and process it in order to provide your stay (Art. 6(1)(b) GDPR).

7. Registration form and visitor's tax (Kurtaxe)

We are obliged to collect the visitor's tax (Kurtaxe) and to transmit the details required for this purpose to the municipality of Schonach im Schwarzwald. For guests of foreign nationality, we additionally collect the details for the statutory registration form (Meldeschein) and retain it for the statutory period (Art. 6(1)(c) GDPR in conjunction with the Bundesmeldegesetz (German Federal Registration Act) and the Kurtaxesatzung (visitor's tax by-laws)).

8. Digital door access

Access to the apartment is via an electronic lock from Nuki Home Solutions GmbH, Graz, Austria. We generate a code for your stay and can see in the log when the code was used. This serves the performance of the contract and the security of the apartment (Art. 6(1)(b) and (f) GDPR). The code is deleted after your departure, and the log after 30 days.

9. Recipients

Your data is passed only to those who need it in order to provide your stay: our technical service providers (booking system, hosting, payment processing, email), the municipality of Schonach for the visitor's tax (Kurtaxe) and registration purposes, and our tax advisers.

10. Your rights

You have the right of access (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to withdraw any consent given with effect for the future (Art. 7(3)).

Right to object: Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object to this at any time on grounds relating to your particular situation (Art. 21 GDPR).

Right to lodge a complaint: You may lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

11. Obligation to provide data

To make a booking, we need the details marked as mandatory fields in the booking form. Without these details, we cannot conclude a contract.