Privacy

Name and contact details of the controller for this website (lieblingsapartments.de) pursuant to Article 4(7) GDPR

OSKOREAL Service GmbH
Schlüsselblumenweg 43
18198 Kritzmow
Germany

Managing Director:
Christian Konarski

Phone: +49 173 7341208
Email: christian@lieblingsapartments.de

Security and protection of your personal data
We consider it our primary task to maintain the confidentiality of the personal data you provide and to protect it from unauthorised access. We therefore apply the utmost care and state-of-the-art security standards to ensure maximum protection of your personal data.

As a company, we are subject to the provisions of the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). We have taken technical and organisational measures to ensure that data protection regulations are observed both by us and by our external service providers.

Definitions
The law requires that personal data be processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”). To ensure this, we inform you about the individual legal definitions that are also used in this privacy policy:

Personal data
“Personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Processing
“Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Restriction of processing
“Restriction of processing” means the marking of stored personal data with the aim of limiting their processing in the future.

Profiling
“Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

Pseudonymisation
“Pseudonymisation” means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.

Filing system
“Filing system” means any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis.

Controller
“Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

Processor
“Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

Recipient
“Recipient” means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing.

Third party
“Third party” means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.

Consent
“Consent” of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

Lawfulness of processing
The processing of personal data is only lawful if there is a legal basis for it. Under Article 6(1)(a)–(f) GDPR, the legal basis for processing may in particular be:

1. the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
2. processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
3. processing is necessary for compliance with a legal obligation to which the controller is subject;
4. processing is necessary in order to protect the vital interests of the data subject or of another natural person;
5. processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
6. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

The operators of this website take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.

When you use this website, various personal data are collected. Personal data are data that can be used to identify you personally. This privacy policy explains which data we collect and what we use them for. It also explains how and for what purpose this is done.

Please note that data transmission over the internet (e.g. when communicating by email) may have security gaps. Complete protection of data against access by third parties is not possible.

General information
The following information provides a simple overview of what happens to your personal data when you visit our website. Personal data are all data that can be used to identify you personally. Detailed information on data protection can be found in our privacy policy below.

Data collection on our website

1. Who is responsible for data collection on this website?
   Data processing on this website is carried out by the website operator. You can find the operator’s contact details in the legal notice (imprint) of this website.
2. How do we collect your data?
   Some data are collected when you provide them to us, for example data you enter when making a booking or send us by email. Other data are collected automatically by our IT systems when you visit the website. These are mainly technical data (e.g. web browser, operating system or time of page access). These data are collected automatically as soon as you enter our website.
3. What do we use your data for?
   Some of the data are collected to ensure that the website is provided without errors. Other data are used for statistical analysis of how our website is used (see “Web analytics with Matomo (without cookies)”).
4. What rights do you have regarding your data?
   You have the right to receive information free of charge at any time about the origin, recipients and purpose of your stored personal data. You also have the right to request the correction, restriction or erasure of these data. For this purpose, and for any other questions on data protection, you can contact us at any time at the address given in the legal notice. You also have the right to lodge a complaint with the competent supervisory authority.

Information on the controller
The controller responsible for data processing on this website (lieblingsapartments.de) is:

OSKOREAL Service GmbH
Schlüsselblumenweg 43
18198 Kritzmow
Germany

Managing Director:
Christian Konarski

Phone: +49 173 7341208
Email: christian@lieblingsapartments.de

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data (e.g. names, email addresses, etc.).

Withdrawal of consent
Where the processing of personal data is based on consent, you have the right to withdraw your consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

You can contact us at any time to exercise your right of withdrawal.

Right to confirmation
You have the right to obtain from the controller confirmation as to whether or not we process personal data concerning you. You can request this confirmation at any time using the contact details above.

Right of access
Where personal data are processed, you can at any time request access to these personal data and to the following information:

1. the purposes of the processing;
2. the categories of personal data concerned;
3. the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
4. where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
5. the existence of the right to request rectification or erasure of personal data or restriction of processing of personal data concerning you, or to object to such processing;
6. the right to lodge a complaint with a supervisory authority;
7. where the personal data are not collected from the data subject, any available information as to their source;
8. the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

Where personal data are transferred to a third country or to an international organisation, you have the right to be informed of the appropriate safeguards pursuant to Article 46 GDPR relating to the transfer. We provide a copy of the personal data undergoing processing. For any further copies you request, we may charge a reasonable fee based on administrative costs. Where you make the request by electronic means, the information shall be provided in a commonly used electronic form, unless you request otherwise. The right to obtain a copy shall not adversely affect the rights and freedoms of others.

Right to rectification
You have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

Right to erasure (“right to be forgotten”)
You have the right to obtain from the controller the erasure of personal data concerning you without undue delay, and we are obliged to erase personal data without undue delay where one of the following grounds applies:

1. The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
2. The data subject withdraws consent on which the processing is based according to Article 6(1)(a) or Article 9(2)(a) GDPR, and there is no other legal ground for the processing.
3. The data subject objects to the processing pursuant to Article 21(1) GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2) GDPR.
4. The personal data have been unlawfully processed.
5. The personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.
6. The personal data have been collected in relation to the offer of information society services referred to in Article 8(1) GDPR.

Where the controller has made the personal data public and is obliged to erase them, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.

The right to erasure (“right to be forgotten”) does not apply to the extent that processing is necessary:

– for exercising the right of freedom of expression and information;

– for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

– for reasons of public interest in the area of public health in accordance with Article 9(2)(h) and (i) and Article 9(3) GDPR;

– for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) GDPR, in so far as the right referred to above is likely to render impossible or seriously impair the achievement of the objectives of that processing; or

– for the establishment, exercise or defence of legal claims.

Right to restriction of processing
You have the right to obtain from us restriction of processing of your personal data where one of the following applies:

1. the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
2. the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
3. the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims; or
4. the data subject has objected to processing pursuant to Article 21(1) GDPR pending the verification whether the legitimate grounds of the controller override those of the data subject.

Where processing has been restricted under the above conditions, such personal data shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

To exercise the right to restriction of processing, the data subject may contact us at any time using the contact details given above.

Right to data portability
You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and you have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:

1. the processing is based on consent pursuant to Article 6(1)(a) or Article 9(2)(a) or on a contract pursuant to Article 6(1)(b) GDPR; and
2. the processing is carried out by automated means.

In exercising your right to data portability, you have the right to have the personal data transmitted directly from one controller to another, where technically feasible. The exercise of the right to data portability is without prejudice to the right to erasure (“right to be forgotten”). That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Right to object
You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Article 6(1)(e) or (f) GDPR, including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

Where personal data are processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing. Where you object to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.

In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.

Where personal data are processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1) GDPR, you, on grounds relating to your particular situation, have the right to object to processing of personal data concerning you, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

You can exercise your right to object at any time by contacting the respective controller.

Automated individual decision-making, including profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision:

1. is necessary for entering into, or performance of, a contract between the data subject and the controller;
2. is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests; or
3. is based on the data subject’s explicit consent.

The controller shall implement suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.

The data subject may exercise this right at any time by contacting the respective controller.

Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you also have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.

Right to an effective judicial remedy
Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77 GDPR, you have the right to an effective judicial remedy if you consider that your rights under the GDPR have been infringed as a result of the processing of your personal data in non-compliance with the GDPR.

Right to complain to the competent supervisory authority
In the event of a data protection breach, the data subject has the right to lodge a complaint with the competent supervisory authority. The competent supervisory authority for data protection matters is the data protection commissioner of the federal state in which our company is based. For us, this is: Der Landesbeauftragte für Datenschutz und Informationsfreiheit Mecklenburg-Vorpommern, Schloss Schwerin, Lennéstraße 1, 19053 Schwerin, Germany, https://www.datenschutz-mv.de/.

Right to data portability
You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party in a commonly used, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done to the extent technically feasible.

SSL/TLS encryption
For security reasons and to protect the transmission of confidential content, such as bookings or enquiries you send to us as the site operator, this site uses SSL/TLS encryption. You can recognise an encrypted connection by the browser’s address bar changing from “http://” to “https://” and by the lock symbol in your browser bar.

When SSL/TLS encryption is activated, the data you transmit to us cannot be read by third parties.

Cookies
Some of our web pages use cookies. Cookies do not harm your computer and do not contain viruses. Cookies serve to make our offer more user-friendly, effective and secure. Cookies are small text files that are stored on your computer and saved by your browser.

Most of the cookies we use are so-called “session cookies”. They are automatically deleted at the end of your visit. Other cookies remain stored on your device until they expire or you delete them. These cookies are used, for example, to store your choice in the cookie notice. The individual cookies are described for each service in this privacy policy.

You can set your browser to inform you about the setting of cookies and allow cookies only in individual cases, exclude the acceptance of cookies for certain cases or in general, and activate the automatic deletion of cookies when closing the browser. If cookies are deactivated, the functionality of this website may be limited.

Consent management with Complianz
On this website we use the WordPress plugin “Complianz” by Complianz B.V., Kalmarweg 14-5, 9723 JG Groningen, the Netherlands. With Complianz we obtain your consent before information is stored on or read from your device where consent is required, and we respect your choice. External content such as the booking calendar and maps is blocked until you agree. The Matterport 360° tours load without consent (see there).

The plugin runs on our own web server. No data are transmitted to Complianz or other third parties for consent management. Complianz stores your choice in cookies in your browser (prefix “cmplz_”, e.g. cmplz_functional, cmplz_preferences, cmplz_statistics, cmplz_marketing, cmplz_consented_services, cmplz_policy_id, cmplz_banner-status). These cookies have a lifetime of 365 days.

Legal basis: Storing these cookies is strictly necessary in order to respect your consent or refusal (Section 25(2) no. 2 TDDDG). The processing serves to fulfil our legal obligation to obtain consent and to be able to demonstrate it (Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR and Section 25(1) TDDDG).

You can change or withdraw your consent at any time with effect for the future using the “Manage consent” link at the bottom of every page. Choosing “Deny” withdraws all consents given, including consent to individual services such as the booking calendar. You can also delete the cookies in your browser at any time.

Server log files
The provider of these pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:

Browser type / browser version
Operating system used
Referrer URL
Host name of the accessing computer
Time of the server request

These data cannot be assigned to specific persons. These data are not combined with other data sources. We reserve the right to check these data subsequently if we become aware of specific indications of unlawful use.

Hosting
This website is hosted by ALL-INKL.COM – Neue Medien Münnich, owner: René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. The servers are located in data centres in Germany. When you access the website, the host processes the data listed above under “Server log files” and your IP address in order to deliver the website and ensure its secure operation. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the reliable and secure provision of our website. A data processing agreement pursuant to Art. 28 GDPR has been concluded with the host.

Information, erasure, restriction
You have the right at any time to receive information free of charge about your stored personal data, their origin and recipients and the purpose of the data processing, as well as the right to rectification, restriction or erasure of these data. For this purpose, and for any other questions on personal data, you can contact us at any time at the address given in the legal notice.

Objection to advertising emails
We hereby object to the use of contact data published under the legal notice obligation for sending unsolicited advertising and information material. The operators of these pages expressly reserve the right to take legal action in the event of unsolicited advertising, such as spam emails.

Integration of third-party services and content
Content from third parties, such as videos from YouTube, maps from Google Maps, RSS feeds or graphics from other websites, may be integrated within this website. This always requires that the providers of this content (“third-party providers”) receive the IP address of the users, as without the IP address they could not send the content to the user’s browser. The IP address is therefore required to display this content. We endeavour to use only content whose providers use the IP address solely for delivering the content. However, we have no influence on whether third-party providers store the IP address, e.g. for statistical purposes. Where we are aware of this, we inform users accordingly.

Booking calendar and online booking via Smoobu
On our apartment pages you can check availability and prices and request or complete a booking. For this we use the booking system of Smoobu GmbH, Pappelallee 78/79, 10437 Berlin, Germany. Smoobu processes the data on our behalf. A data processing agreement pursuant to Art. 28 GDPR has been concluded with Smoobu. According to Smoobu, the data are hosted by Amazon Web Services (AWS EMEA SARL, Luxembourg) in data centres in the EU (Germany/Ireland).

There are two ways to book:

1. Embedded booking calendar.
   The calendar is loaded from login.smoobu.com, but only after you click “Load booking calendar” or have agreed to the “Marketing” category in the cookie notice. Before that, no data are transmitted to Smoobu or the service providers listed below. Once loaded, the Smoobu script also retrieves the “iframe-resizer” library from cdnjs.cloudflare.com (Cloudflare, Inc.), which transmits your IP address to Cloudflare.
2. Direct link “Availability & booking (opens Smoobu)”.
   This link opens the booking page directly at Smoobu (booking.smoobu.com). The same processing as described below takes place there.

Data processed: When the calendar is loaded, your IP address, browser and device information, the apartment viewed, the time and the travel dates queried are processed. When you book, the details you enter are added (e.g. name, contact details, address, travel dates, number of guests, message) as well as information on the payment method chosen.

Payment: In the booking form you can choose between invoice (bank transfer), PayPal and credit card.

• Credit card (Stripe): Card payments are processed via Stripe. Smoobu lists Stripe Payments Europe, Ltd. (Ireland) as a sub-processor for payment processing. According to Stripe, it processes payment data on behalf of its business users and, for certain purposes of its own such as fraud prevention, as an independent controller. According to Stripe’s imprint, the provider is Stripe Technology Company Limited, One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland. The Stripe card field is already loaded when the calendar is opened, i.e. before any payment action. Stripe sets, among others, the cookie “m” (m.stripe.com, lifetime approx. 400 days) to detect fraudulent payments. A transfer to the USA is possible; Stripe, LLC is certified under the EU-U.S. Data Privacy Framework. Further information: https://stripe.com/privacy.
• PayPal: If you choose PayPal, you will be redirected to PayPal. The provider is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. PayPal processes your data in accordance with its own privacy statement: https://www.paypal.com/de/legalhub/paypal/privacy-full.
• Invoice (bank transfer): No payment service provider is involved.

Further service providers in the Smoobu calendar: The following services, which Smoobu embeds in its booking page, are also loaded when the calendar is opened. We have no technical influence on this.

• hCaptcha by Intuition Machines, Inc., 1065 SW 8th St #704, Miami, FL 33130, USA, is used to distinguish humans from automated access. Among others, the cookie “hmt_id” (api.hcaptcha.com, approx. 30 days) is set. Intuition Machines is certified under the EU-U.S. Data Privacy Framework. Further information: https://www.hcaptcha.com/privacy.
• Cloudflare by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, protects the Smoobu page against attacks and automated access (cookie “cf_clearance”, .smoobu.com, approx. 365 days) and measures reach on the Smoobu page. In its privacy policy, Smoobu names Cloudflare as a subcontractor (content delivery network). Cloudflare is certified under the EU-U.S. Data Privacy Framework. Further information: https://www.cloudflare.com/privacypolicy/.
• Smoobu itself sets a session cookie (“PHPSESSID8”, login.smoobu.com), which is deleted at the end of the browser session.

Legal bases: Loading the embedded calendar and the associated storage of or access to information on your device is based on your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). Your booking and payment data are processed to take steps prior to entering into a contract and to perform the accommodation contract (Art. 6(1)(b) GDPR). Where we are legally obliged to retain data (e.g. commercial and tax retention periods, registration obligations), Art. 6(1)(c) GDPR applies. Fraud prevention for payments and protection against automated access are based on Art. 6(1)(f) GDPR; our legitimate interest lies in secure booking and payment.

Transfers to third countries: With Stripe, hCaptcha and Cloudflare, data may be transferred to the USA. This is based on the EU-U.S. Data Privacy Framework (Art. 45 GDPR) or on standard contractual clauses (Art. 46(2)(c) GDPR).

Withdrawal: You can withdraw your consent to the booking calendar at any time via “Manage consent” at the bottom of every page (see “Consent management with Complianz”). The calendar will then no longer be loaded. The direct link to Smoobu remains available.

Storage period: We store booking data for as long as necessary to process the booking and beyond that for the duration of statutory retention periods. The cookie lifetimes stated above apply to the service providers’ cookies.

360° tours (Matterport)
On our apartment pages we embed 360° tours from the Matterport service (my.matterport.com). Matterport belongs to the CoStar Group. According to its privacy notice, the controller is CoStar Realty Information, Inc., 1201 Wilson Boulevard, Arlington, VA 22209, USA (contact: privacy@matterport.com).

The tour loads as soon as the apartment page is opened, without prior consent. Your IP address, browser and device information, the page viewed and the time, among other data, are transmitted to Matterport (my.matterport.com, static.matterport.com, cdn-2.matterport.com, events.matterport.com). Matterport sets the cookie “__cf_bm” (session, protection against automated access) and stores the identifier “sc_anonymous_id” in your browser’s local storage; the player also sends usage events to events.matterport.com. We have no technical influence on this. In the process, your data may be transferred to the USA.

Note on the transfer to the USA: Neither CoStar Realty Information, Inc. nor Matterport, Inc. is currently certified under the EU-U.S. Data Privacy Framework. There is therefore no adequacy decision of the European Commission covering this transfer. There is a risk that your data are not protected in the USA to the same standard as in the EU, in particular that US authorities may access them without effective legal remedies being available to you.

The legal basis for embedding the tours is our legitimate interest in presenting our apartments vividly (Art. 6(1)(f) GDPR) or taking steps prior to entering into a contract (Art. 6(1)(b) GDPR).

Objection: You may object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR).

Further information: https://www.costar.com/about/privacy-notice.

Web analytics with Matomo (without cookies)
On this website we use the open-source software Matomo to analyse the use of our website statistically and to improve our offer, in particular the apartment search and the path to booking. Matomo is installed as a WordPress plugin on our own web space at ALL-INKL.COM (see “Hosting”). The data collected are stored exclusively there. They are not passed on to third parties, including the manufacturer of the software. The data are not combined with other data, in particular not with booking data.

We have configured Matomo so that no cookies are set. In particular, the following are recorded: pages visited and time of access, the page from which you came to us (referrer), browser, operating system, device type, screen resolution, language setting and your IP address. The IP address is shortened by two bytes before it is stored (e.g. 192.168.10.20 becomes 192.168.0.0), so that it can no longer be attributed to you. To assign several page views to one visit, Matomo creates a pseudonymous value from technical characteristics of the request, which is not stored on your device.

In addition, we record individual events: submitting the apartment search (number of guests, number of nights – longer stays only in broad groups – and number of results), clicking on an apartment, opening the Smoobu booking calendar or the Smoobu booking page and clicking on a telephone or e-mail link on our website. For the latter, we only record that such a link was clicked, on which page and in which area of the page; we do not record the telephone number, the e-mail address or the content of your communication. We do not record arrival or departure dates; we also remove them from the stored page addresses. We do not record anything you enter in the Smoobu booking calendar.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in analysing the use of our website in a data-minimising way and improving our offer. Where information is read from your device that is technically transmitted for the provision of the website (e.g. browser or screen resolution), we base this on Section 25(2) no. 2 TDDDG.

Storage period: We delete the raw data of individual visits after six months. After that, only aggregated statistics remain that do not relate to individual visits.

Objection: You can object to tracking by Matomo at any time using the following form. Matomo will then store an opt-out cookie in your browser so that your visits are no longer recorded. If you delete your cookies or use another browser, you will need to object again.

Opt-out complete; your visits to this website will not be recorded by the Web Analytics tool. Note that if you clear your cookies, delete the opt-out cookie, or if you change computers or Web browsers, you will need to perform the opt-out procedure again.

You may choose to prevent this website from aggregating and analyzing the actions you take here. Doing so will protect your privacy, but will also prevent the owner from learning from your actions and creating a better experience for you and other users.

The tracking opt-out feature requires cookies to be enabled.

Campaign parameters in our links
Some links that we distribute ourselves (e.g. in our Google Business Profile or on QR codes) contain additions such as “utm_source”, “utm_medium” or “utm_campaign”. They only show through which channel a visit came about and contain no information about you. We evaluate these additions exclusively in Matomo (see “Web analytics with Matomo (without cookies)”). The same information on legal basis, storage period and objection applies.

Google Maps
This site embeds maps from the Google Maps service. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The map is only loaded after you have agreed to the “Marketing” category. Your IP address, among other data, is then transmitted to Google. This information may be transferred to and stored on servers of Google LLC in the USA. According to its own information, Google LLC is certified under the EU-U.S. Data Privacy Framework. The operator of this site has no influence on this data transfer.

The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw it at any time via “Manage consent” at the bottom of every page.

More information on how user data are handled can be found in Google’s privacy policy: https://policies.google.com/privacy?hl=en.

—

Last updated: 31 October 2026

Source reference: eRecht24