Privacy notice

Controller

The controller responsible for processing personal data on this website is:

Jens Schumacher
Zum Berggarten 84
34130 Kassel
Germany

Email: info@colle-il-diaccino.de
Telephone: +49 171 4756351

Optional statistics and performance measurement with Vercel

With your separate consent, we use Vercel Web Analytics for visitor statistics and Vercel Speed Insights to improve website performance. The recipient is Vercel Inc. (USA). The legal bases are Article 6(1)(a) GDPR and, for accessing information on your device, section 25(1) of the German TDDDG. Each measurement script loads only after consent to its purpose. You can use the website and send enquiries even if you decline.

Web Analytics processes page views, timestamps, referrers and location, browser and device information derived from the request. Vercel recognises visitors using an identifier generated from the request, with a lifetime limited to 24 hours according to the provider; this is not a deletion period for all statistics. We use no custom events and do not pass form entries to these services. We remove URL query parameters and fragments before sending; unknown page paths are excluded. Details: Vercel Web Analytics.

Speed Insights collects Web Vitals such as loading time, responsiveness and layout shifts, together with the page path, browser, device, operating system, network type, country and technical information about the affected page element. According to Vercel, these metrics are not used to identify individual visitors. These measurements do not set analytics cookies; transmission nevertheless requires technical processing of the IP address. Details: Vercel Speed Insights.

You may withdraw consent at any time for the future using “Privacy settings” in the footer. This does not affect processing lawfully performed before withdrawal. Vercel specifies a twelve-month reporting window for Web Analytics on the standard Pro plan; available periods for Speed Insights depend on its feature tier. Reporting windows do not promise deletion of all raw, security or backup data. Their retention follows the necessary statistical, security or evidentiary purpose and legal obligations. Vercel may process data in the USA and other countries; the data processing agreement linked in the hosting section explains subprocessors, EU Standard Contractual Clauses and applicable safeguards.

Website, hosting and security logs

We use Vercel Pro, provided by Vercel Inc. (USA), to deliver this website. Data processed includes IP addresses, timestamps, requested URLs, browser/device information and technical status or error data. This serves website delivery, troubleshooting and abuse prevention. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is a secure and reliable website.

Vercel specifies one day of retention for runtime logs on the standard Pro plan. This does not apply across the board to other access, security or billing logs. Their retention depends on the relevant security or operational purpose and any legal obligations; data relating to specific incidents may be needed until those incidents are resolved. See the Vercel documentation for runtime log details.

Vercel may process data in the USA and other countries. Its data processing agreement describes recipients, subprocessors and transfer mechanisms, including EU Standard Contractual Clauses and the EU-US Data Privacy Framework where its requirements are met. The linked safeguards can be consulted there or requested through our contact address.

Accommodation enquiries and general questions

For accommodation enquiries, we process your name, email address, selected accommodation, arrival and departure dates, guest count, and any optional telephone number and message. For general questions, we process your name, email address and message. We also process a reference identifier, the spam protection result and technical delivery status data. We do not operate a separate enquiry database.

We handle enquiries about a possible stay to take steps prior to entering into a contract under Article 6(1)(b) GDPR. For other questions, we rely on Article 6(1)(f) GDPR and our legitimate interest in responding to incoming requests. Required fields are marked. Without the necessary details, we cannot process the form; additional information is voluntary.

We delete completed enquiries that do not result in a booking from the mailbox once processing is finished, unless retention obligations or outstanding claims require otherwise. The responsible people perform this deletion; the website does not do so automatically. For bookings or correspondence subject to legal retention, the period follows the applicable contractual, commercial and tax requirements, in particular under Article 6(1)(c) GDPR. Establishing or defending outstanding claims may justify further retention under Article 6(1)(f) GDPR. Data is deleted once the relevant reason no longer applies.

Email delivery and mailbox

Resend (Plus Five Five, Inc., USA) delivers form submissions to info@colle-il-diaccino.de and sends an acknowledgement to your address. It processes sender/recipient details, the subject, message content and delivery information. The legal basis follows the enquiry purpose under Article 6(1)(b) or (f) GDPR.

According to Resend, its Free plan retains email and log data for 30 days; backups persist for seven days. Early deletion of individual messages can be requested from the provider. This retention is independent of deletion from our mailbox. See Resend’s privacy information.

Resend stores customer data in the USA even when a European sending region is selected. Its data processing agreement includes EU Standard Contractual Clauses and information about the EU-US Data Privacy Framework as an additional transfer mechanism. Copies or further details of these safeguards are available there or through our contact address.

Our mailbox at netcup GmbH (Germany) is used to receive, store and answer messages. Netcup processes email content, address data and technical connection data for this purpose. Access is limited to authorised people handling enquiries and bookings; there is no automatic forwarding. The legal bases and deletion criteria above apply. Backups and technical logs are retained separately according to their recovery or security purpose and legal obligations. Provider information: Netcup privacy notice and data processing agreement.

Spam protection with Cloudflare Turnstile

When configured, Cloudflare Turnstile is embedded as soon as a page containing a form loads, rather than only on submission. Cloudflare Inc. (USA) processes signals including IP addresses, browser information (User-Agent), TLS characteristics and the website visited. A verification token is validated on the server upon submission. The form cannot be sent without successful verification.

Our purpose is to prevent automated requests and protect the forms, based on Article 6(1)(f) GDPR. Cloudflare processes signals as a processor to protect our website and as a separate controller to improve its bot detection. For the latter purpose, Cloudflare cites its own legitimate interest. Retention depends on what is necessary for security, bot detection and legal obligations; we do not promise a single fixed deletion period for all signals. See the Turnstile privacy notice.

Data may be processed outside the EEA, in particular in the USA. Cloudflare describes safeguards including EU Standard Contractual Clauses and the EU-US Data Privacy Framework in its data processing agreement. These documents explain the transfer safeguards; further information can also be requested from us.

Cookies and local form drafts

Optional statistics and performance measurements start only with consent; we do not use advertising trackers. Switching languages may set the NEXT_LOCALE session cookie containing a language code. It supports the requested language function and normally ends with the browser session; browser session restoration may preserve it. Processing is based on Article 6(1)(f) GDPR for consistent language display; where access is strictly necessary for the requested function, section 25(2)(2) of the German TDDDG applies.

Changing accommodation within the enquiry form may save a draft in your browser’s sessionStorage. It contains the form values already entered, including any contact details and message, together with a timestamp. This preserves your entries during the requested navigation (Article 6(1)(b) GDPR and section 25(2)(2) TDDDG). This local storage alone does not send an enquiry.

The draft is removed when next read and is restored only if it is no more than one hour old. There is no automatic deletion at exactly one hour. If it is not read again, it remains until the page session ends or browser data is cleared; browser session restoration may extend the session. Technical access associated with Turnstile is explained in the spam protection section.

We store your statistics and performance choices, version number and timestamp in your browser’s localStorage under colle-il-diaccino:measurement-consent:v1. The choice is valid for 180 days. Expired or invalid records are removed when checked again; without another access they may remain until browser data is cleared. This respects your choice and avoids asking on every page view (Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR and section 25(2)(2) TDDDG). If browser storage is unavailable, your choice applies only to the current page. It is not sent to a separate consent database.

Fonts and external links

Fonts are delivered with this website. Your browser does not need to contact Google Fonts servers to load them. Google Maps and other external services are linked, not embedded as maps or content. A connection to the destination is established only when you follow the respective link; the provider then receives your IP address and potentially referrer information. Its own privacy notice governs processing on that service.

Your rights and complaints

Subject to the statutory conditions, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17) and restriction of processing (Article 18). Where automated processing is based on consent or a contract, you may receive the data you provided in a portable format under the conditions of Article 20 GDPR.

You may object to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation under Article 21 GDPR. We will then stop processing unless there are compelling legitimate grounds or the processing serves legal claims. Where processing is based on consent, you may withdraw it at any time with effect for the future. Contact info@colle-il-diaccino.de to exercise these rights.

Under Article 77 GDPR, you may complain to a supervisory authority, particularly in your place of residence, place of work or the place of the alleged infringement. For our stated establishment in Hesse, you may contact the Hessian Commissioner for Data Protection and Freedom of Information. We do not make solely automated booking decisions with legal or similarly significant effects.