Privacy at a Glance

The protection of your personal data is of great importance to us. We want you to feel safe on our website and to be transparently informed about how we handle your data.

We use technically necessary cookies. The optional measurement of Meta advertising described below requires your explicit consent. For web analytics we use Plausible Analytics, a privacy-friendly solution that works without cookies, does not store IP addresses and does not require consent. Fonts are loaded locally from our servers, so no connections to Google servers are established.

When you visit our website, personal data is processed on the basis of the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TTDSG). Below we inform you in detail about the nature, scope and purpose of data processing.

Controller and Data Protection Officer

Controller

The controller within the meaning of the GDPR and other national data protection laws of the member states as well as other data protection provisions is:

Sonnenhotels Nord GmbH & Co. KG Nordhäuser Str. 1 D-38667 Bad Harzburg

Commercial register: Amtsgericht Braunschweig, HRA 201829

Phone: +49 (0) 5321 68554 0 Email: info@sonnenhotels.de Website: www.sonnenhotels.de

Data Protection Officer

We have appointed an external data protection officer:

DataCo GmbH Sandstraße 33, 80335 München Phone: +49 89 7400 45840 Website: www.dataguard.de

If you have any questions about data protection or wish to exercise your data subject rights, you can contact our data protection officer at any time.

Legal Bases for Processing

The processing of personal data on our website is always carried out on the basis of a legal ground pursuant to Art. 6(1) GDPR. The following legal bases apply in particular:

• Consent (Art. 6(1)(a) GDPR): Where we obtain your consent for the processing of personal data, for example for sending our newsletter. You may revoke any consent given at any time with effect for the future.
• Performance of a contract (Art. 6(1)(b) GDPR): Where the processing is necessary for the performance of a contract or for the implementation of pre-contractual measures, in particular for hotel bookings and payment processing.
• Legal obligation (Art. 6(1)(c) GDPR): Where we are subject to a legal obligation, for example the retention of business documents under commercial and tax law.
• Legitimate interest (Art. 6(1)(f) GDPR): Where the processing is necessary to protect our legitimate interests or those of a third party and the interests, fundamental rights and freedoms of the data subject do not prevail.

Your Rights as a Data Subject

Right of Access (Art. 15 GDPR)

You have the right to obtain information about the personal data we process concerning you. This includes in particular information about the purposes of processing, the categories of personal data, the recipients and the planned retention period.

Right to Rectification (Art. 16 GDPR)

You have the right to request the immediate rectification of inaccurate personal data or the completion of incomplete personal data.

Right to Erasure (Art. 17 GDPR)

You have the right to request the erasure of your personal data, provided that no statutory retention obligations or other exceptions apply.

Right to Restriction of Processing (Art. 18 GDPR)

You have the right to request the restriction of the processing of your personal data, for example if you contest the accuracy of the data.

Right to Data Portability (Art. 20 GDPR)

You have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format or to request the transfer to another controller.

Right to Object (Art. 21 GDPR)

Where we process your personal data on the basis of legitimate interests pursuant to Art. 6(1)(f) GDPR, you have the right to object to the processing pursuant to Art. 21 GDPR.

Right to Withdraw Consent (Art. 7(3) GDPR)

You may withdraw any consent given at any time with effect for the future. The lawfulness of processing carried out on the basis of consent before its withdrawal shall not be affected.

Right to Lodge a Complaint with a Supervisory Authority (Art. 77 GDPR)

You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data by us. The supervisory authority responsible for us is the State Commissioner for Data Protection of Lower Saxony, Prinzenstraße 5, 30159 Hannover.

A list of all data protection supervisory authorities in Germany can be found at: https://www.bfdi.bund.de/DE/Service/Anschriften/Laender/Laender-node.html

Provision of the Website and Server Log Files

Each time our website is accessed, the system automatically collects technical data from the requesting computer: IP address, date and time of access, page accessed, referrer URL, browser and operating system, access provider and HTTP status code.

The temporary storage is technically necessary to enable the delivery of the website and to ensure system security.

Legal basis: Art. 6(1)(f) GDPR. Retention period: Log files are deleted after no more than 30 days.

Hosting

Our website is hosted on our own servers in Germany (self-hosting). No transfer of your data to third countries takes place in connection with hosting. The servers are operated by us and are located in a German data centre.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the reliable, fast and secure provision of our website.

Content Delivery and Image Hosting

For the optimised delivery of images, we currently use Cloudinary Ltd., Santa Clara, USA. When loading images, your browser establishes a connection to Cloudinary servers, whereby your IP address and browser information are transmitted.

Legal basis: Art. 6(1)(f) GDPR. Data transfer to the USA: Safeguarded by Standard Contractual Clauses (SCCs). We have concluded a data processing agreement pursuant to Art. 28 GDPR.

Cookies

We use technically necessary cookies. Only with your explicit consent do we also store your choice and Meta ad attribution, as described in the optional measurement section. We do not use Google Analytics, Facebook Pixel or Google Tag Manager. You can change your Meta choice at any time through “Meta privacy setting”.

The use of technically necessary cookies is permitted without consent pursuant to Section 25(2) No. 2 TTDSG. The corresponding legal basis is Art. 6(1)(f) GDPR.

Web Analytics with Plausible Analytics

We use Plausible Analytics for the statistical evaluation of website usage (self-hosted on our own servers). Plausible does not set cookies, does not store IP addresses and does not collect any personal data. Only aggregated, anonymous statistics are generated. No consent is required. Since we self-host Plausible, the data does not leave our servers in Germany.

Hotel Booking via Apaleo

For the processing of hotel bookings, we currently use Apaleo GmbH, Munich. When making a booking, your name, contact details, booking details and payment information are processed.

Legal basis: Art. 6(1)(b) GDPR. Data processing in the EU: Apaleo processes data exclusively within the EU. We have concluded a data processing agreement pursuant to Art. 28 GDPR. Retention period: In accordance with commercial and tax law retention periods, up to 10 years.

Payment Processing via Stripe

For payment processing, we currently use Stripe Payments Europe Ltd., Dublin, Ireland. Stripe is PCI DSS Level 1 certified. Payment data (card data, name, billing address) is processed directly by Stripe and is not stored on our servers.

Legal basis: Art. 6(1)(b) GDPR. Stripe generally processes data within the EU. Where a transfer to the US parent company takes place, it is safeguarded by SCCs. Retention period: Transaction references up to 10 years.

Contact Form

When you use our contact form, your details (name, email, message) are processed on our own servers in Germany. The form contents (name, email, message) are not sent to Meta through the measurement described below. A separate enquiry event is sent only with your explicit consent.

Legal basis: Art. 6(1)(b) GDPR for booking enquiries, Art. 6(1)(f) GDPR for other enquiries. Retention period: Until the enquiry has been fully dealt with; where related to a contract, up to 10 years.

Newsletter via Brevo

For sending our newsletter, we currently use Brevo (Sendinblue SAS), Paris, France. Registration is carried out using the double opt-in procedure.

Legal basis: Art. 6(1)(a) GDPR. Brevo processes data within the EU. Withdrawal: At any time via the unsubscribe link in every newsletter email or by email to info@sonnenhotels.de. We have concluded a data processing agreement pursuant to Art. 28 GDPR.

Social Media Presence

We maintain online presences on Instagram and Facebook (Meta Platforms Ireland Ltd.). When you visit our profiles, data is collected by Meta. We and Meta are joint controllers within the meaning of Art. 26 GDPR. Meta is certified under the EU-U.S. Data Privacy Framework. We do not embed social media plugins on our website. An additional transfer may take place with your explicit consent to the Meta measurement described below.

Legal basis: Art. 6(1)(f) GDPR.

Data Transfers to Third Countries

Some services are based outside the EU. Overview:

• Cloudinary (USA): SCCs
• Meta (Ireland/USA): DPF + SCCs
• Stripe (Ireland, possibly USA): SCCs

Services without third-country transfers: website hosting (own servers in Germany), Strapi CMS, Plausible Analytics, Apaleo, Brevo, contact form, Google Fonts (locally embedded).

For the contact form, this statement refers to the form contents; a separate measurement event may be sent to Meta only with your explicit consent, as described below.

Retention Periods

• Server log files: up to 14 days
• Booking data: up to 10 years (Section 147 AO)
• Payment data: up to 10 years (Section 147 AO)
• Contact enquiries: until completion of processing; where related to a contract, up to 10 years
• Newsletter data: until withdrawal; consent records up to 3 years after unsubscription

Automated Decision-Making

Automated decision-making including profiling pursuant to Art. 22 GDPR does not take place.

Fonts

We use Google Fonts embedded locally on our own servers. When accessing our website, no connection to Google servers is established. No personal data is transferred to Google.

Changes to this Privacy Policy

We reserve the right to amend this privacy policy as required. The current version is always available on our website.

As of: April 2026. This privacy policy was prepared with technical assistance. A review by a data protection lawyer is recommended.

Optional measurement of enquiries and bookings with Meta

On the hotels’ own offer and booking pages for Weingut Römmert, Das Ettershaus, Sonnenhotel Bayerischer Hof and Post Seefeld, you may consent to additional measurement of our Facebook and Instagram advertising. We use the Conversions API provided by Meta Platforms Ireland Limited. Measurement for the respective hotel starts only with your explicit consent. You can enquire or book without consenting.

With your consent, we store an ad click identifier and the click time. For related enquiries, booking starts, confirmed bookings and subsequent cancellations, we send the event type, time, technical event identifier, booking reference where available, value and currency, website and browser information to Meta. This measurement does not send guest names, email addresses, telephone numbers or visitor IP addresses. Meta may combine this information with data from its services to attribute events to advertisements. Processing outside the European Economic Area, including in the United States, may occur. See Meta’s privacy policy at https://www.facebook.com/privacy/policy/ for further information.

We store your choice in a cookie on this device for up to 90 days and record it on our servers with the hotel, time and text version. You can change or withdraw your choice through “Meta privacy setting” at any time. Refusal, expiry or an effective withdrawal prevents further transfers through this measurement. If the server cannot be reached, withdrawal applies immediately on this device and is sent to the server when the connection becomes available. This does not automatically delete events already received by Meta. Your general privacy rights and the contact channels in this policy remain available.

The 90 days describe the validity of your choice on this device. They do not mean that booking records, consent evidence or data already sent to Meta are automatically deleted after 90 days. Their retention follows the respective purposes, evidence requirements and general retention information.