Privacy & cookies

This notice explains how personal data is processed when you visit our website, make a holiday enquiry or communicate with us. Personal data is information relating to an identified or identifiable person.

Technical data is processed to provide and secure the website. You supply other details yourself. Optional visitor measurement takes place only with your consent. Without it, you can still use the website and enquiry form.

Biantali GbR determines the purposes and means of the processing described here. For privacy enquiries, please use the contact details above.

• Enquiries and stays: Article 6(1)(b) GDPR for steps prior to entering into and performing a contract.
• Legal obligations: Article 6(1)(c) GDPR, for example for business records subject to retention requirements.
• Operation, security and general communication: Article 6(1)(f) GDPR. Legitimate interests include a functioning, secure website, protection against misuse and handling your requests.
• Optional statistics and advertising requiring consent: Article 6(1)(a) GDPR; storage on or access to your device is additionally governed by section 25(1) TDDDG.
• Strictly necessary storage on your device: Section 25(2), point 2 TDDDG. Any subsequent processing of personal data is subject to the GDPR legal basis specified for that processing.

Website via Lovable

The website is provided via Lovable. Current provider information names Lovable Labs Sweden AB, Regeringsgatan 25, 111 53 Stockholm, Sweden. Requests involve processing in particular your IP address, requested URL, date and time, and browser and connection information for delivery, security and troubleshooting. The legal basis is Article 6(1)(f) GDPR.

Lovable privacy information · Subprocessors

Booking system and email

IT Service Peter Semke, Heinrich-Heine-Straße 64, 08412 Werdau, maintains the existing booking system and our email accounts. Hosting is provided by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin. Data required for operation, maintenance, enquiry handling and communication is processed. Article 6(1)(b) GDPR applies to contract-related matters and Article 6(1)(f) GDPR to technical security. STRATO privacy information.

Technical logs

Logs may contain requested pages, access times, data volumes, status messages, referrers, browser, operating system and IP or connection data. They support operation, fault analysis and protection against misuse. Data is deleted or anonymised once no longer needed for these purposes. Evidence required for a specific security incident may be retained longer.

Enquiry form and existing database

We process travel dates, guest and child counts, apartment preferences, extras and pet details, as well as the names, contact and address details and messages you provide. Required fields are marked. Without the necessary information, we may be unable to process your enquiry.

After submission, the website sends your enquiry to our existing booking system, where it is stored and made available to Jana and Bodo for personal handling. Email notifications are also processed. The legal basis is Article 6(1)(b) GDPR. An enquiry is not yet a binding booking.

Protection against misuse and repeat submissions uses technical request identifiers, timestamps and a check value derived from the IP address. This value is pseudonymised, not anonymous. The legal basis is Article 6(1)(f) GDPR. The public availability calendar retrieves occupancy information from the existing system through our web server and shows no guest names or contact details.

Email and telephone

When you contact us, we process your contact details and the content of your request, including necessary follow-up questions. Article 6(1)(b) GDPR applies to contract-related matters; other enquiries are handled on the basis of our legitimate interest under Article 6(1)(f) GDPR.

WhatsApp

You can contact Jana and Bodo via WhatsApp. We process your phone number, profile name, messages and attachments to deal with your request. Article 6(1)(b) GDPR applies to contract-related communication. You may withdraw any additional voluntary consent under Article 6(1)(a) GDPR at any time.

The provider in the European Economic Area is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. WhatsApp also processes its own usage and connection data; international processing is possible. Alternatively, you can reach us by email or phone. Simply visiting our website does not start a WhatsApp chat. WhatsApp privacy information.

Please share only information necessary for your request in free-text fields and messengers.

Cookies store information in the browser and may be sent with later requests. Session Storage stores information within an open browser tab. Storage and access are governed by the TDDDG and, where personal data is processed, the GDPR.

You can decline, selectively choose or consent to optional visitor measurement. No optional category is preselected. You can change your choice or withdraw consent for the future via ‘Cookies’ in the footer. Withdrawal does not affect the lawfulness of earlier processing.

biantali-consent · necessary

The website's own choice cookie stores your selection, the cookie-choice version and timestamp for up to 180 days, including when you decline. Legal bases: section 25(2), point 2 TDDDG and Article 6(1)(c) GDPR to respect and document your choice.

biantali-travel · trip planning in the browser tab

The website's Session Storage carries arrival, departure, guest count and pet selection between trip planning and the enquiry. It stores no names, postal addresses, phone numbers or emails. Data is usually deleted when the tab closes; restored browser sessions may restore it. Legal bases for the requested trip planning: section 25(2), point 2 TDDDG and Article 6(1)(b) GDPR.

tsr-scroll-restoration-v1_3 · page navigation

The website's Session Storage remembers scroll positions so that going back to a page restores its previous view. It applies within the browser session; browsers may restore sessions. Legal bases: section 25(2), point 2 TDDDG and Article 6(1)(f) GDPR for functioning navigation.

session-id · optional Lovable visitor measurement

Associates page views with a session. It lasts 30 minutes; further measurement events may renew it. Used only with consent to statistics. Legal bases: section 25(1) TDDDG and Article 6(1)(a) GDPR.

You can also delete or block cookies and browser storage through your browser. Deleting the choice cookie means you will be asked again. Linked third-party websites have their own settings.

After your consent to statistics, we use Lovable visitor measurement. It records in particular page views, requested URLs, referral pages, time, language, technical browser information and a temporary session identifier. The recipient is Lovable and its technical service providers. Its purpose is to analyse usage and improve our website.

The legal bases are Article 6(1)(a) GDPR and section 25(1) TDDDG. You can withdraw consent in the cookie settings. The cookie duration is listed above. Personal measurement data is retained according to the criteria in section 11. Further provider information is available in the linked Lovable privacy notice.

For analytics, advertising and newsletters, we use the services described below. This website's consent choice enables Lovable visitor measurement. Consenting to it does not activate additional Google or Meta tags and is not a newsletter subscription.

Google Tag Manager, Google Analytics and Google Ads

Tag Manager manages website tags; Analytics evaluates website usage; Ads supports advertising and measuring ad effectiveness. IP and device information, page views, ad or click identifiers and usage or conversion events may be processed. Loading a tag manager alone can transmit connection data.

Optional website integrations may load only after the appropriate consent: Article 6(1)(a) GDPR and, for device access, section 25(1) TDDDG. Consent to statistics is not automatic consent to advertising. The provider is Google Ireland Limited, Ireland, potentially with other Google companies. Retention follows the criteria in section 11. Information about Google's processing and your settings is available here: Google privacy information.

Meta Pixel

Meta Pixel evaluates advertising campaigns and can associate website actions with an ad or Meta account. The EEA provider is Meta Platforms Ireland Limited. Integration requires appropriate marketing consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. Retention follows the criteria in section 11. Information on Meta's processing and your rights is available in the Meta privacy notice.

Google Search Console

Search Console is used to manage and analyse our website's appearance in Google Search. Its use alone does not require a corresponding visitor-tracking script on our pages. Google's privacy information describes processing when its search is used.

Newsletter via rapidmail

For newsletters, we use rapidmail by Positive Group Deutschland GmbH, Ingeborg-Krummer-Schroth-Straße 18a, 79106 Freiburg im Breisgau. Contact details supplied for this purpose and necessary subscription/unsubscription data are processed. Consent-based sending relies on Article 6(1)(a) GDPR. A holiday enquiry or cookie consent is not a newsletter subscription.

Newsletter consent can be withdrawn for the future, particularly through the unsubscribe link or our contact address. Sending data is used for the duration of the subscription. Withdrawal ends advertising use; necessary consent evidence and suppression records are retained only for statutory proof obligations or to respect your unsubscribe request. Personal open or click analysis requires an applicable legal basis. Further provider information: rapidmail privacy information.

We link to WhatsApp, Facebook, Instagram, Google Search and reviews, Google Maps, Deutsche Bahn, Trassenheide, UsedomCard and excursion providers, among others. Opening a link takes you away from our site; the destination provider may process your IP address and connection information. Its privacy notice applies. Maps and social networks are links here, not embedded widgets loaded later.

Photos, logos, review images and the Lora and Manrope fonts are served locally. Displaying fonts makes no request to Google Fonts. Tali guides trip planning and comparison; your input is not sent to an external AI chat service.

GitHub manages and versions the website code. Visitor and enquiry functions use neither a GitHub login nor an embedded GitHub widget. GitHub privacy information.

Jana, Bodo and commissioned service providers have access where required for operation and handling. Processing on instructions is governed by Article 28 GDPR. Disclosure may also be necessary to meet legal obligations or pursue legal claims.

International providers may process data outside the European Economic Area, particularly in the USA. Articles 44 et seq. GDPR apply, for example an applicable adequacy decision or suitable safeguards such as EU standard contractual clauses. Certifications and transfer mechanisms must fit the specific recipient and operation. You can request information on safeguards using our contact address; additional provider information is linked under the relevant services.

Enquiry and communication data is retained as long as required for handling, the stay or legitimate follow-up questions. It is then deleted unless statutory retention duties or other legal reasons prevent this. Business records requiring retention are kept for the statutory period and restricted to necessary purposes.

Technical security and receipt data supports misuse prevention, matching stored enquiries and resolving transmission errors. Retention criteria are the necessity to prevent or investigate a security incident, associate a transmission and meet statutory proof obligations. Backup retention depends on the restoration purpose and technical necessity; statutory retention duties remain unaffected.

The public website uses HTTPS/TLS to protect transmission between browser and website. Complete protection cannot be guaranteed along every transmission path for ordinary email. Jana and Bodo review enquiries personally; the procedure described does not involve a solely automated booking decision with legal or similarly significant effects.

• Access, Article 15 GDPR: Information about personal data processed, its source, recipients and purposes, and a copy within the statutory scope.
• Rectification, Article 16 GDPR: Correction of inaccurate data and completion of incomplete data.
• Erasure, Article 17 GDPR: Deletion where statutory conditions are met, unless retention duties or other legal exceptions apply.
• Restriction, Article 18 GDPR: Particularly while disputed data is checked, instead of erasure for unlawful processing, when evidence is needed for legal claims or while an objection is examined. Thereafter, apart from storage, processing is generally permitted only with consent or for the legal claims and protective interests provided by law.
• Data portability, Article 20 GDPR: For automated processing based on consent or contract, receive data you provided in a structured, commonly used, machine-readable format and, where technically feasible, have it sent directly to another controller.
• Withdrawal, Article 7(3) GDPR: You can withdraw consent at any time for the future. Previous processing remains lawful. Use the cookie button for statistics; for other matters, contact us by email, phone or post.

Objection under Article 21 GDPR

For processing under Article 6(1)(e) or (f) GDPR, you may object on grounds relating to your particular situation. We will stop processing unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or processing serves the establishment, exercise or defence of legal claims. This also applies to profiling based on those provisions.

You can object at any time to direct marketing and related profiling. The data concerned will no longer be processed for those purposes.

Complaint under Article 77 GDPR

You may complain to a data protection supervisory authority, particularly in the place of your habitual residence, work or the alleged infringement. The Saxon Data Protection and Transparency Commissioner is a contact authority for Biantali GbR's registered office.

We update this notice when processing or services change. New services requiring consent are enabled only after appropriate information and the necessary consent.

Last updated: 26 October 2026.