Privacy Policy

We process personal data only where necessary to operate this website, communicate with you, or handle bookings. This policy explains the type, scope and purpose of processing.

We store your chosen language in a cookie (bollenhut_locale, 1-year lifetime) so the site opens in the right language on your next visit. On your first visit we redirect based on your browser language. Legal basis: our legitimate interest in a user-friendly website (Art. 6 (1) (f) GDPR).

We store your light/dark mode choice in a cookie (bollenhut_theme, 1-year lifetime). Legal basis: our legitimate interest in a comfortable presentation (Art. 6 (1) (f) GDPR).

When you sign up we store your email address, chosen language and optionally the sign-up source (e.g. footer) in a database (Cloudflare D1) to send occasional updates about Das Bollenhuthaus — e.g. special offers, renovations or availability. Legal basis: your consent (Art. 6 (1) (a) GDPR). Sign-up requires your explicit consent. Unsubscribe anytime via ···. If email delivery uses Brevo, we transfer the email address there; Brevo acts as a processor. Details: Privacy at Brevo.

To protect against automated sign-ups we use Cloudflare Turnstile. Technical data (e.g. IP address, browser information) may be transferred to Cloudflare. Legal basis: our legitimate interest in protecting our forms (Art. 6 (1) (f) GDPR). More information: Privacy at Cloudflare.

This website is hosted on Cloudflare Pages. Technically necessary connection data (e.g. IP address, time, page requested) is processed to deliver and secure the site. Legal basis: our legitimate interest in secure operation (Art. 6 (1) (f) GDPR). Details: Privacy at Cloudflare.

For reach and usage analysis we use Cloudflare Web Analytics and anonymous event measurement (Workers Analytics Engine) on the same infrastructure. No analytics cookies are set and no lasting user profiles are created. We collect page views, technical performance data, and anonymous interactions (e.g. clicks on enquiry buttons, email or phone links, waitlist sign-ups). Legal basis: our legitimate interest in improving the website (Art. 6 (1) (f) GDPR). Details: Privacy at Cloudflare.

On the Arrival page we embed a Google Maps map. When loaded, data (e.g. IP address) may be transferred to Google Ireland Limited or Google LLC (USA). Legal basis: your consent by actively loading the map or our legitimate interest in clear directions (Art. 6 (1) (f) GDPR) when you view the map. Details: Privacy at Google.

When you enquire or book, we process personal data (e.g. name, contact details, travel dates) to perform the contract. Legal basis: contract performance (Art. 6 (1) (b) GDPR).

Server log data at the host is generally stored for a limited period by Cloudflare. We keep waitlist entries until you unsubscribe or the purpose no longer applies. Registration form data for foreign guests is kept separately under statutory retention periods (not via this website).

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21 GDPR). You may withdraw consent at any time with effect for the future. Contact: ···. You may also lodge a complaint with the Baden-Württemberg Commissioner for Data Protection and Freedom of Information.