Privacy Policy
This is a convenience translation. The legally binding version is the German „Datenschutzerklärung".
The protection of your personal data is important to us. This policy informs you about the nature, scope and purpose of the processing of personal data in connection with this website.
1. Controller
Sternkopf Residencies GbR (partners: Paul-Vincent Sternkopf, Lilly-Vianne Sternkopf), Fabrikweg 4v, 09557 Flöha, Germany. Email: support@sternkopf.design (privacy/enquiries); bookings: booking@sternkopf.design.
A data protection officer has not been appointed, as this is not required by law.
A data protection officer has not been appointed, as this is not required by law.
2. Your rights
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21), as well as the right to withdraw consent at any time with effect for the future (Art. 7 (3)). You also have the right to lodge a complaint with a supervisory authority (Art. 77). The authority responsible for us is:The Saxon Data Protection and Transparency Commissioner (Die Sächsische Datenschutz- und Transparenzbeauftragte), Postfach 11 01 32, 01330 Dresden, Germany (visitor address: Maternistraße 17, 01067 Dresden), email: post@sdtb.sachsen.de.
3. Hosting (Cloudflare)
The website is operated with Cloudflare (Cloudflare, Inc., USA). When you access it, technically necessary connection data (including IP address, date/time, requested resource, user agent) is processed to ensure delivery, security and stability.
- Legal basis: Art. 6 (1) (f) GDPR (secure, efficient provision).
- Third country: a transfer to the USA is possible; it is safeguarded by the EU-US Data Privacy Framework (DPF) or Standard Contractual Clauses (SCC).
- Your account and booking master data, by contrast, is stored in the EU (Supabase, see 4.).
4. Database, accounts & storage location (Supabase)
Application data (customer account, booking overview, newsletter, enquiries) is stored and processed with Supabase in the EU region (Frankfurt am Main, Germany) (processor). Passwords are stored exclusively as a hash. Supabase is a provider with international group/sub-processor structures; the processing is safeguarded by a data processing agreement (DPA) and, where necessary, Standard Contractual Clauses (SCC).
Legal basis: Art. 6 (1) (b) GDPR (account/usage relationship) or (f).
Legal basis: Art. 6 (1) (b) GDPR (account/usage relationship) or (f).
5. Fonts
We embed fonts locally from our own server (self-hosted). No transfer of your data (in particular your IP address) to third parties (e.g. Google) takes place.
6. Cookies & local storage (§ 25 TDDDG)
We do not use tracking, analytics or marketing cookies. Only technically necessary information is stored in your browser's local storage:
- your cookie/notice choice,
- your language setting (DE/EN) to display content in your language,
- your remembered consent for loading external content (e.g. Google Maps), if given,
- a login token, if you log into your customer account – until its technical validity expires, until logout, or until it is cleared by your browser.
Legal basis: § 25 (2) TDDDG (strictly necessary) or Art. 6 (1) (f) GDPR. As only technically necessary storage takes place and non-essential external embeds such as Google Maps are loaded only after your active click (see 9.), a consent banner is not mandatory. The Smoobu booking widget is embedded on the property pages to process bookings (details under 8.). The existing notice can be re-opened via the link in the footer.
7. Customer account
For the optional registration we process your email address, first and last names, your phone number where applicable (optional) and your language setting. The purpose is to provide the account with a booking overview, newsletter management and access to stay information.
Legal basis: Art. 6 (1) (b) GDPR. Erasure: upon deletion of the account; associated bookings are pseudonymised (see 8. and 13.). Account emails (registration confirmation, password reset) are sent via the SMTP server of our email hosting provider futris (FUTRIS Inh. Fabian Eschrich; server location Germany).
Legal basis: Art. 6 (1) (b) GDPR. Erasure: upon deletion of the account; associated bookings are pseudonymised (see 8. and 13.). Account emails (registration confirmation, password reset) are sent via the SMTP server of our email hosting provider futris (FUTRIS Inh. Fabian Eschrich; server location Germany).
8. Booking & booking overview (Smoobu)
On the property pages we embed an availability calendar and a booking widget from Smoobu (Smoobu GmbH, Pappelallee 78/79, 10437 Berlin, Germany; details on Smoobu's data processing: www.smoobu.com/en/privacy-policy/). The availability calendar loads with the page; in doing so your IP address is transmitted to Smoobu and a technically necessary session cookie may be set. Smoobu is our processor and at the same time the authoritative source of the booking and invoice data. The actual booking widget is only loaded once you actively start it (click on “Book now”). It then embeds Stripe for payment processing (and, depending on the payment method, PayPal); to prevent fraud (protection against automated attacks or “card testing”), Stripe additionally loads hCaptcha (Intuition Machines, Inc., USA). These services are embedded within the Smoobu booking widget. Their data-protection role depends on the provider and integration; an overview can be found under 14. As long as you do not start the booking widget, Stripe, PayPal and hCaptcha are not loaded; the automatically loaded availability calendar may only set a technically necessary Smoobu session cookie.
- In our customer account we show an overview of your stays (minimal mirror: property, period, status, email for matching). No payment instruments or invoice details are stored; only the booking amount and currency are shown.
- Data retained at Smoobu: even if we delete or de-personalise data in your website account, the underlying booking and invoice data remains at Smoobu insofar as contractual or tax retention obligations apply there.
- Incoming booking events are received via a secured interface (webhook); the raw record is reduced to what is necessary after processing (see 13.).
- Payment: depending on your choice via Smoobu's payment providers (e.g. Stripe/PayPal) or by advance transfer to us. For online payment, payment data is processed directly by the respective payment provider.
Legal basis: Art. 6 (1) (b) or (f) GDPR. We use the email address collected at booking once after your stay for a review reminder (details and right to object: no. 12a).
8a. Statutory registration duty (registration form)
To process the booking and billing we process name, address, arrival and departure date and the number of accompanying persons (Art. 6 (1) (b) GDPR). As an accommodation business we additionally keep a registration form insofar as this is required by law or under a municipal guest/tourist tax statute. The special registration and identification duty under §§ 29–30 of the German Federal Registration Act (BMG) applies exclusively to foreign guests; from them we additionally collect nationality and ID/passport data for identity verification.
- Legal basis: Art. 6 (1) (c) GDPR (legal obligation); for municipal guest/tourist tax data, the respective municipal statute.
- Retention: one year from departure; thereafter destruction within three months (§ 30 BMG).
- Collection: For the municipal registration, tourist-tax and guest-card procedure we use the AVS registration system provided by the Augustusburg tourist information office, operated by AVS Abrechnungs- und Verwaltungs-Systeme GmbH, Josephsplatz 8, 95444 Bayreuth. The required guest data is entered by us into AVS via an access-protected user account set up by the tourist information office or – where an interface released for this purpose is used – transmitted to AVS from our booking or reservation system. The data is processed to calculate and settle the tourist tax and to produce guest cards and, where necessary, special registration forms. For foreign guests, the special registration form is printed and signed by hand in accordance with the procedure currently provided by the town of Augustusburg. Insofar as an electronic procedure under § 29 (5) BMG confirmed by the relevant municipality is used in the future, identification takes place in accordance with its statutory requirements.
9. Maps (Google Maps)
On the property pages we embed Google Maps to show the location (Google Ireland Limited or Google LLC, USA). The map is loaded only after your active click („click-to-load"); beforehand no data is transmitted to Google. After loading, data (including your IP address) is transmitted to Google; a transfer to the USA is possible.
Legal basis: Art. 6 (1) (a) GDPR (consent by clicking). Third country: USA, safeguarded by the EU-US Data Privacy Framework (DPF) or Standard Contractual Clauses (SCC). Your click consent is remembered in your browser's local storage so the map loads directly on future visits (see no. 6). You can withdraw the consent at any time via the „Privacy settings" link in the footer, which deletes the stored choice. Alternatively, you can clear your browser data.
Legal basis: Art. 6 (1) (a) GDPR (consent by clicking). Third country: USA, safeguarded by the EU-US Data Privacy Framework (DPF) or Standard Contractual Clauses (SCC). Your click consent is remembered in your browser's local storage so the map loads directly on future visits (see no. 6). You can withdraw the consent at any time via the „Privacy settings" link in the footer, which deletes the stored choice. Alternatively, you can clear your browser data.
10. Contact form
When you use the contact form we process name, email address, subject and message as well as any property reference. The purpose is to handle your enquiry. To process it, we additionally send your enquiry by email to our mailbox and send you an automated acknowledgement of receipt (with a copy of your message); this email dispatch is carried out via our processor Resend (operated by Plus Five Five, Inc., USA), safeguarded by the EU-US Data Privacy Framework (DPF) or Standard Contractual Clauses (SCC) (cf. no. 14).
Legal basis: Art. 6 (1) (b) or (f) GDPR. Erasure: at the latest 12 months after completion.
Legal basis: Art. 6 (1) (b) or (f) GDPR. Erasure: at the latest 12 months after completion.
10a. Support/check-in requests (customer account)
Registered guests can submit support requests in the customer account (e.g. regarding check-in or the stay). For this we process category, subject, message and status as well as any internal processing notes and the reference to account/booking. The purpose is to handle your request.
To handle it, we additionally send your support request as a notification to our operator mailbox; as the reply-to address we use the email address of your customer account so that we can reply to you directly. This dispatch is carried out via our processor Resend (operated by Plus Five Five, Inc., USA; the transfer to the USA is safeguarded by the EU-US Data Privacy Framework or Standard Contractual Clauses – see 14.). Your email address is not additionally stored in the support request for this notification.
Legal basis: Art. 6 (1) (b) GDPR. Erasure: the support ticket in the customer account upon deletion of the account (the booking reference is decoupled); the notification received in the operator mailbox is deleted at the latest twelve months after the matter has been finally resolved.
To handle it, we additionally send your support request as a notification to our operator mailbox; as the reply-to address we use the email address of your customer account so that we can reply to you directly. This dispatch is carried out via our processor Resend (operated by Plus Five Five, Inc., USA; the transfer to the USA is safeguarded by the EU-US Data Privacy Framework or Standard Contractual Clauses – see 14.). Your email address is not additionally stored in the support request for this notification.
Legal basis: Art. 6 (1) (b) GDPR. Erasure: the support ticket in the customer account upon deletion of the account (the booking reference is decoupled); the notification received in the operator mailbox is deleted at the latest twelve months after the matter has been finally resolved.
10b. AI-assisted handling of guest enquiries
To handle guest enquiries that reach us via the chat/messaging systems of booking portals (e.g. Booking.com, Airbnb, FeWo-direkt, HomeToGo), we use an AI-assisted assistant. For this, the text of your message, together with the property reference and minimal stay data (arrival/departure, number of persons, booking channel), is transmitted via an interface to our processor Anthropic (Anthropic PBC, USA), which generates a suggested reply.
- Data minimisation: only the message text, the property reference and minimal stay data are transmitted to the AI service. Name, email address, telephone number and payment data are not passed on as separate data fields; however, insofar as guests enter such details in the message text themselves, these may form part of the transmitted enquiry. Payment data should not be sent via the messaging system.
- For non-critical standard questions (e.g. Wi-Fi, directions), the reply created by the AI assistant may be sent automatically; matters going beyond this (e.g. complaints, cancellations, payments, special requests) are handled by a human. This does not involve any automated decision with legal or similarly significant effect (Art. 22 GDPR).
- Your data is not used to train AI models (contractually excluded).
Legal basis: Art. 6 (1) (b) GDPR (performance or initiation of the accommodation relationship) or (f) GDPR (legitimate interest in efficient handling of enquiries). Third country: processing takes place with a US provider; it is safeguarded by Standard Contractual Clauses (SCC). Automatically sent messages are marked as created with AI assistance and let you know that you can switch to personal handling by our team at any time.
11. Newsletter
The newsletter is sent using the double opt-in procedure: after registering you receive a confirmation email; only after your confirmation are you added. We store your email address and the time of confirmation and unsubscription; for accountability we log the consent (time and the version of the consent text). We only store a selection of preferred topics if you manage the newsletter in your logged-in customer account; for the public sign-up without an account we do not record a topic selection. After confirmation you may receive a one-time welcome discount code.
Legal basis: Art. 6 (1) (a) GDPR (consent). Withdrawal: at any time via the unsubscribe link in every newsletter email; the time of unsubscription is stored and sending is stopped. For sending the actual (editorial) newsletter as well as the associated double opt-in and any welcome discount-code emails, we use the service Resend (operated by Plus Five Five, Inc., USA) as processor. Of each newsletter dispatch we retain, for accountability, only the subject, content, the number of recipients and the time of dispatch – no recipient list (retention see 13.). Account emails (registration confirmation, password reset), by contrast, are sent via FUTRIS (see 7.). A transfer to the USA is safeguarded by the EU-US Data Privacy Framework (DPF) or Standard Contractual Clauses (SCC).
Legal basis: Art. 6 (1) (a) GDPR (consent). Withdrawal: at any time via the unsubscribe link in every newsletter email; the time of unsubscription is stored and sending is stopped. For sending the actual (editorial) newsletter as well as the associated double opt-in and any welcome discount-code emails, we use the service Resend (operated by Plus Five Five, Inc., USA) as processor. Of each newsletter dispatch we retain, for accountability, only the subject, content, the number of recipients and the time of dispatch – no recipient list (retention see 13.). Account emails (registration confirmation, password reset), by contrast, are sent via FUTRIS (see 7.). A transfer to the USA is safeguarded by the EU-US Data Privacy Framework (DPF) or Standard Contractual Clauses (SCC).
12. Arrival/stay information (guides)
The public property guide contains no personal data. Sensitive arrival information (e.g. door code, Wi-Fi access) is made available exclusively to confirmed guests and is access-protected.
12a. Reviews
After a completed stay, registered guests can leave a review of their accommodation (star ratings in several categories and an optional free text). Reviews are displayed publicly on the respective property page.
- Publicly visible are: your chosen display name, the month of your stay (month granularity only), the star ratings (overall as well as cleanliness, amenities, communication and location), your free text including its automatic translation and – where available – our public reply. If you do not provide a display name, the review appears as “Verified guest”. No account or booking reference is shown publicly.
- Automatic translation: so the review can be shown bilingually, your free text is translated automatically (German ↔ English). The translation is carried out by our processor Anthropic (Anthropic PBC, USA). This involves a transfer to the USA, safeguarded by Standard Contractual Clauses (SCC). Your data is not used to train AI models.
- Please do not include personal data of third parties (e.g. names, telephone numbers) in the free text or display name. As it is free text, it may nonetheless contain personal data; complete data minimisation cannot be technically guaranteed.
- Review reminder: after departure you receive a one-time email (usually three days after check-out) inviting you to leave a review, with a link to your booking; for this we process your email address, the booking reference and your language preference. It is sent via our processor Resend (operated by Plus Five Five, Inc., USA – cf. no. 14). The competition-law basis for the email dispatch is § 7 (3) of the German Act against Unfair Competition (UWG); the data-protection legal basis is Art. 6 (1) (f) GDPR. We inform you about this one-time use of your email address and your free right to object at any time (e.g. by email to support@sternkopf.design) already in the booking area of the property page and in every reminder email. A record of the one-time dispatch remains attached to the booking (prevents duplicate sending).
Legal basis: Art. 6 (1) (b) GDPR for providing the review function in the customer account and for verifying that only actual guests can leave reviews; Art. 6 (1) (f) GDPR for the public display of genuine guest reviews, their translation and the display of our public reply. Submitting a review is voluntary. Storage/erasure: as long as your customer account exists, you can edit your review for up to 90 days after departure and delete it yourself at any time. After deletion of your customer account, you can contact us to have your review reviewed or erased. If you delete your customer account, the review is pseudonymised: the display name and the link to your account are removed (the review is then shown as “Verified guest”), while the review text remains. An internal reference to the underlying booking may persist; this is therefore pseudonymisation, not full anonymisation. Insofar as processing is based on Art. 6 (1) (f) GDPR, you may object to it in accordance with Art. 21 GDPR. Affected third parties may contact us to have such details reviewed or erased.
13. Retention & erasure
We store personal data only for as long as necessary (details are governed by our internal erasure concept):
- Booking overview with account: as long as the account exists. Upon deletion of the account, the booking data in our account is pseudonymised (email and account reference removed). As a technical reference to Smoobu remains, this is pseudonymisation, not full anonymisation.
- Booking without account: erasure 180 days after departure.
- Raw data of incoming booking events: reduced after processing, at the latest after 14 days.
- Contact enquiries: 12 months. Security logs: 12 months. Consent records: until withdrawal plus 3 years.
- Newsletter dispatch records (subject, content, number of recipients, time of dispatch – no recipient list): retained to document newsletters sent, deleted at the latest after 24 months.
- AI-assisted guest enquiries and suggested replies: as for contact enquiries; any storage in the AI-assistant system is deleted at the latest 12 months after completion.
- Support requests in the customer account: until deletion of the customer account. Support notifications transmitted by email in the operator mailbox: at the latest 12 months after completion.
- Reviews: until deleted by the guest or upon a legitimate erasure or review request. If the customer account is deleted, the review is pseudonymised; the display name and account link are removed and the review text remains as a review by a “Verified guest”. An internal reference to the underlying booking may persist.
- Dispatch record of the review reminder: until deletion or pseudonymisation of the associated booking record in accordance with the aforementioned periods.
- Registration forms: one year from departure; thereafter destruction within three months (§ 30 BMG).
- We use backups. After an erasure, data may persist in these backups until the end of the respective backup period (usually up to 7 days) and is permanently deleted upon its expiry.
14. Recipients, processors and further controllers
| Service | Purpose | Location | Third country |
|---|---|---|---|
| Supabase | Database, accounts, authentication | Data region EU/Frankfurt; provider with international group/subprocessor structure | third-country transfer possible → DPA, SCC |
| Cloudflare | Hosting / delivery | USA / international group structure | yes → DPF/SCC |
| Smoobu GmbH | Booking, widget, invoices | Germany / EU | no |
| Stripe (via Smoobu) | Payment processing in the booking widget | EU/USA possible | third-country transfer possible → DPF/SCC |
| PayPal (Europe) S.à r.l. et Cie, S.C.A. (via Smoobu) | Payment processing, where chosen | Luxembourg / international group structure | group transfer possible |
| hCaptcha / Intuition Machines, Inc. (via Stripe) | Fraud prevention (bot / “card-testing” protection) in the Stripe payment step | USA | yes → DPF/SCC |
| Plus Five Five, Inc. (Resend) | Sending the editorial newsletter as well as double opt-in and welcome-code emails; support and contact-form notification, acknowledgement and review reminder emails | USA | yes → DPF/SCC |
| FUTRIS Inh. Fabian Eschrich (email hosting/SMTP) | Sending account emails (confirmation, password reset) and receipt/storage of contact-form and support communication in our mailbox | Germany | no |
| Google (Maps) | Map display (after consent) | Ireland/USA possible | yes → DPF/SCC |
| Anthropic (AI assistant) | Suggested replies and, where applicable, automated replies for guest enquiries (portal chats); translation of public review texts | USA | yes → SCC |
| Town of Augustusburg / Augustusburg tourist information office and AVS Abrechnungs- und Verwaltungs-Systeme GmbH, Josephsplatz 8, 95444 Bayreuth | Municipal registration, tourist-tax and guest-card procedure; entry or transmission of guest data, calculation and settlement of the tourist tax and production of the guest card | Germany | no |
Stripe, PayPal and hCaptcha are not loaded by us directly but within the Smoobu booking widget. hCaptcha is embedded not by Smoobu but by Stripe as an integrated security / fraud-prevention function (Intuition Machines acting as Stripe's sub-processor in this respect). Depending on the integration, the payment providers may act as Smoobu's sub-processors or as independent controllers/payment service providers; details follow from the respective provider's privacy information and the contract with Smoobu. Data is disclosed to further third parties only insofar as this is legally permissible or required.
The town of Augustusburg is responsible for the municipal registration, tourist-tax and guest-card procedure. AVS Abrechnungs- und Verwaltungs-Systeme GmbH operates the system provided for this purpose as a processor of the town. We collect the required guest data in connection with the accommodation relationship and enter it into the system provided by the town or transmit it via an approved interface.
15. Server log files
When the site is accessed, technically necessary access data is processed (IP address, time, requested page, referrer, user agent). This data is processed only for the period necessary for the security and stability of operation. To prevent abuse (rate limiting) we additionally store, for a short time, pseudonymised identifiers derived from the IP address using a hash procedure (no plain text); they are deleted after 24 hours.
Legal basis: Art. 6 (1) (f) GDPR.
Legal basis: Art. 6 (1) (f) GDPR.
16. Status
This policy is adjusted when the processing changes. Last updated: July 2026.