Privacy policy
Last updated: October 2026
1. Controllers
The controllers for data processing on this website are Jens and Charlotte Lübken, Im Nimstal 57, 54634 Bitburg, Germany, email: Info@pure-Suedeifel.de, phone: +49 1567 9813746. We have not appointed a data protection officer, as there is no legal obligation to do so.
2. Hosting & server logs
This website is operated on our behalf by Hostinger (Hostinger International Ltd., Larnaca, Cyprus); the web server is located in Frankfurt am Main. Each time a page is requested, Hostinger processes technically necessary connection data (IP address, date and time, requested URL, referrer, browser and operating system information, HTTP status) to deliver the website, keep it secure and analyse errors. The legal basis is our legitimate interest in secure and reliable operation (Art. 6(1)(f) GDPR). The data is kept only as long as necessary for these purposes. We have a data processing agreement with Hostinger under Art. 28 GDPR. Hostinger uses subprocessors, including providers in the USA; transfers to third countries are based on the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.
3. Cookies, local storage & consent
Without your consent we set no cookies and load no third-party services. We store your choice in the consent banner in your browser's local storage until you change it or clear your browser storage; this is strictly necessary for the website to work (Section 25(2) No. 2 TDDDG, Art. 6(1)(f) GDPR). Lodgify, embedded Komoot routes, Google Analytics 4 and Google Ads load only after your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR) and may then set their own cookies. You can withdraw or change your consent at any time with effect for the future via “Cookie settings” in the footer.
4. Contact form & email
When you write to us via the contact form or by email, we process your name, email address and message as well as any phone number, travel dates and number of guests you choose to provide, in order to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where a booking is concerned, otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). The website does not store form enquiries in a database. To deliver form messages to our mailboxes we use Resend (Plus Five Five, Inc., San Francisco, USA) as a processor; Resend is certified under the EU-US Data Privacy Framework, and the EU Standard Contractual Clauses also apply. Enquiries that do not lead to a booking are deleted no later than six months after they have been dealt with. If an enquiry leads to a booking, we keep it in line with statutory tax retention periods.
5. Booking via Lodgify
For the booking widget, checkout and booking management we use Lodgify (Codebay Solutions Ltd., United Kingdom) as a processor; the data processing agreement is part of Lodgify's terms of service. The EU Commission has issued an adequacy decision for the United Kingdom; where Lodgify uses subprocessors in other third countries, appropriate safeguards such as the EU Standard Contractual Clauses apply. The booking widget loads only after your consent to external services (Section 25(1) TDDDG, Art. 6(1)(a) GDPR); Lodgify then receives technical connection data such as your IP address and browser information. We process the booking, contact and payment details you enter in the checkout to perform the rental contract (Art. 6(1)(b) GDPR) and keep them in line with statutory tax retention periods (up to ten years, Section 147 German Fiscal Code; Art. 6(1)(c) GDPR). Payments are handled under its own responsibility by the payment provider shown in the checkout. Lodgify's own cookie notices also apply on Lodgify pages. The availability calendar on this website is fetched server-side, so your browser's IP address is not sent to Lodgify for it.
6. Maps, routes & external links
The interactive area map loads OpenStreetMap tiles (OpenStreetMap Foundation, United Kingdom) only when you click “Show map”; by clicking you consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). Your IP address, browser data and the requested map tiles are then sent to the tile service. Embedded routes from komoot GmbH (Schönefeld, Germany) load only after your consent to external services; komoot then receives technical connection data. Links to Google Maps (directions), Komoot, restaurants and attractions are plain links: only when you click them do you leave our website, and the respective provider's privacy information applies.
7. WhatsApp
Our WhatsApp button is a plain link. Only when you click it does WhatsApp (Meta Platforms Ireland Ltd., Dublin, Ireland) open; Meta then processes your IP address, device and connection data and the content of your messages, and may also process data in the USA (Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework). We process and delete messages you send us via WhatsApp in the same way as contact enquiries (see section 4).
8. Google Analytics 4
Only if you allow “Statistics” do we load Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; measurement ID G-N3JR6KHRHK) to analyse page views and how the website is used. The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). Events, page URL and title, technical browser and device information and online identifiers are processed; Google sets cookies for this (e.g. “_ga”) with a lifetime of up to two years. According to Google, GA4 does not log or store IP addresses. Event data is deleted after 14 months at the latest. Data may be transferred to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework.
9. Google Ads conversion tracking
Only if you allow “Ad measurement” do we load Google Ads conversion tracking (Google Ireland Limited). It measures whether visitors arrive via our ads, start a booking and complete it. At booking start we pass the consent status and a pseudonymous booking-attempt identifier to Lodgify; the booking conversion fires on the confirmation page only when ad-measurement consent was given. Google receives the conversion identifier and a fixed measurement value of EUR 1, not the actual booking price. The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). Google processes online identifiers, page and event data and technical connection data and sets cookies with a lifetime of up to 90 days; personalised advertising is disabled. Data may be transferred to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework.
10. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Where we process data on the basis of legitimate interests, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR). You can withdraw consent at any time with effect for the future, for example via Cookie settings. Please write to Info@pure-Suedeifel.de. You also have the right to lodge a complaint with a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate. No automated decision-making, including profiling, takes place.