Privacy Policy
Privacy Policy of Burgflotte
Version: June 2026
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Dr. Tobias Brinkmann, Burgflotte
Gutleutstraße 293
60327 Frankfurt am Main
Germany
Email: [email protected]
Telephone: +49 1713475512
hereinafter referred to as “Burgflotte”, “we”, “us” or “our”.
2. Data Protection Officer
No data protection officer has been appointed at present, as we currently assume that there is no statutory obligation to appoint one. Questions regarding data protection can be sent to [email protected].
3. General Information on Data Processing
We process personal data only to the extent necessary to provide our website, process enquiries, handle bookings, process payments, communicate with guests, issue invoices, comply with statutory obligations or protect legitimate interests.
The main legal bases are:
- Article 6(1)(b) GDPR for pre-contractual measures and performance of contracts;
- Article 6(1)(c) GDPR for compliance with legal obligations;
- Article 6(1)(f) GDPR for legitimate interests;
- Article 6(1)(a) GDPR for consent;
- Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) for access to information stored on end-user devices, in particular cookies and similar technologies.
4. Website and Server Data
When you visit our website, technically necessary data are processed in order to provide the website and ensure secure operation. This may include:
- IP address;
- date and time of access;
- pages accessed;
- browser type and version;
- operating system;
- referrer URL;
- technical log data.
Processing is carried out for the technical provision, stability, security and error analysis of the website on the basis of Article 6(1)(f) GDPR. Where technically necessary cookies or comparable technologies are used, this is done on the basis of Section 25(2) TDDDG.
5. Lodgify as Website, Booking and Management Platform
We use Lodgify as a technical platform for our website, booking requests, reservation management, availability calendar, guest communication and, where applicable, payment and invoicing processes.
The provider is, according to Lodgify’s contractual documentation:
Codebay Solutions Limited
Lodgify processes personal data on our behalf to the extent that it concerns the management of guests, bookings and transaction data. A data processing agreement or data processing addendum must be concluded with Lodgify.
The following data may be processed through Lodgify:
- name;
- address;
- email address;
- telephone number;
- booking data;
- travel period;
- number of guests;
- messages and special requests;
- payment and transaction data;
- invoice data;
- technical usage data.
Processing is carried out for pre-contractual measures and performance of the accommodation contract on the basis of Article 6(1)(b) GDPR, for compliance with legal obligations on the basis of Article 6(1)(c) GDPR and, where applicable, for efficient management of our accommodation business on the basis of Article 6(1)(f) GDPR.
6. Booking Requests and Bookings
If you submit a booking request or make a booking, we process the data required to review, accept, perform and administer the booking. This includes, in particular:
- name;
- contact details;
- requested travel period;
- selected floating home;
- number of guests;
- payment method;
- invoice data;
- communication content;
- information relating to arrival, stay and special circumstances.
The legal basis is Article 6(1)(b) GDPR.
7. Guest Communication
We process contact details and communication content when you contact us by email, telephone, contact form, Lodgify, Airbnb, Booking.com or other booking platforms.
Processing is carried out to handle your enquiry, perform the contract and document communication on the basis of Article 6(1)(b) GDPR. Where communication is not directly contract-related, processing is carried out on the basis of our legitimate interest in appropriate communication and documentation pursuant to Article 6(1)(f) GDPR.
8. Payment Processing
Depending on the payment method offered and selected, payment processing may be carried out through external payment service providers, including Lodgify Payments, Stripe, PayPal or bank transfer.
For online payments, the data required for payment processing are transmitted to or collected directly by the relevant payment service provider. This may include:
- name;
- billing address;
- email address;
- payment amount;
- booking number;
- payment status;
- transaction data;
- where applicable, credit card, bank account or wallet data.
We generally do not receive full credit card details. These are processed by the relevant payment service provider.
Processing is carried out for performance of the contract on the basis of Article 6(1)(b) GDPR, for compliance with statutory accounting and documentation obligations on the basis of Article 6(1)(c) GDPR and for fraud prevention and secure payment processing on the basis of Article 6(1)(f) GDPR.
9. Invoices, Accounting and Tax Obligations
We process booking, payment and invoice data for the purpose of issuing invoices, payment receipts, accounting records and tax documentation.
The legal bases are Article 6(1)(b) GDPR for contract performance and Article 6(1)(c) GDPR for statutory retention, accounting and tax obligations.
Invoices and booking documents are stored in accordance with statutory retention periods. Invoices must generally be retained for eight years under Section 14b of the German VAT Act. Further tax or commercial retention obligations may apply depending on the type of document.
10. Tourism Contribution / Local Charges
For stays in Lorch am Rhein, a municipal tourism contribution or similar local charge may apply. Where data must be processed for this purpose, we process in particular:
- name of the guest;
- travel period;
- number of overnight stays;
- number of persons subject to the contribution;
- exemptions or reductions, if claimed;
- billing and payment data.
Processing is carried out to comply with legal obligations on the basis of Article 6(1)(c) GDPR and to properly administer the stay on the basis of Article 6(1)(b) GDPR.
11. Registration Law Obligations
Where special registration obligations apply to accommodation providers, in particular for foreign guests under Sections 29 and 30 of the German Federal Registration Act, we process the legally required registration data.
This may include:
- name;
- date of birth;
- nationality;
- address;
- number of fellow travellers;
- arrival and departure date;
- serial number of a recognised and valid passport or passport substitute, where legally required;
- signature, where legally required.
Processing is carried out to comply with legal obligations on the basis of Article 6(1)(c) GDPR in conjunction with Sections 29 and 30 of the German Federal Registration Act.
12. Bookings Through Airbnb, Booking.com and Other Platforms
If you book through Airbnb, Booking.com or another external booking platform, the respective platform operator also processes personal data under its own responsibility. The privacy notices of the relevant platform apply to such processing.
We receive from the platform the data necessary to perform the booking, in particular name, contact details, booking data, communication content and, where applicable, payment or status information.
Processing by us is carried out for contract performance on the basis of Article 6(1)(b) GDPR, for compliance with legal obligations on the basis of Article 6(1)(c) GDPR and for management of our bookings on the basis of Article 6(1)(f) GDPR.
13. Cookies and Similar Technologies
Our website may use technically necessary cookies or similar technologies required for website operation, language settings, booking processes, security functions or provision of the availability calendar.
Technically necessary cookies are used on the basis of Section 25(2) TDDDG. The subsequent processing of personal data is carried out on the basis of Article 6(1)(f) GDPR or, where the booking process is concerned, Article 6(1)(b) GDPR.
Non-essential cookies, in particular for analytics, marketing, retargeting or external media, are used only if you have given prior consent pursuant to Section 25(1) TDDDG and Article 6(1)(a) GDPR.
At present, we intend not to use our own tracking or newsletter marketing.
14. Maps, External Links and Embedded Content
Where we merely link to maps, social networks, videos or other external content, personal data are transmitted to those providers only when you click the external link.
If maps, videos, social media plugins or other third-party content are embedded directly into the website in the future, data may be transmitted to the respective provider when the page is accessed. In such case, we will update this Privacy Policy accordingly and obtain consent where required.
15. Photos and Videos
We do not take photos or videos of guests for marketing purposes without consent.
If photos or videos of guests are used for the website, social media or advertising, this will be done only on the basis of separate consent pursuant to Article 6(1)(a) GDPR. Consent may be withdrawn at any time with effect for the future.
16. Recipients of Personal Data
Personal data may be transmitted to the following recipients where necessary:
- Lodgify as website, booking and management platform;
- payment service providers, including Stripe, PayPal or banks;
- booking platforms such as Airbnb or Booking.com, where the booking is made through those platforms;
- tax advisors, accounting providers and legal advisors;
- IT and hosting service providers;
- banks and insurance companies;
- competent authorities where legally required;
- the marina operator, where necessary for access, safety, damage clarification or performance of the stay.
Data are transferred only where a legal basis exists.
17. Transfers to Third Countries
When using Lodgify, payment providers, booking platforms or other technical service providers, personal data may be transferred to countries outside the European Union or the European Economic Area.
Such transfers take place only where the requirements of Articles 44 et seq. GDPR are met, in particular on the basis of an adequacy decision, standard contractual clauses, the Data Privacy Framework or other suitable safeguards.
18. Retention Period
We store personal data only for as long as necessary for the relevant purposes.
In general, the following criteria apply:
- enquiries without subsequent booking: until final handling and for an appropriate documentation period;
- booking and contract data: for the duration of contract performance and thereafter in accordance with statutory limitation periods;
- invoice and tax documents: in accordance with statutory retention periods;
- registration data: in accordance with special statutory periods;
- data relating to legal claims: for the duration of possible claims and proceedings.
Where statutory retention obligations apply, data will be deleted only after expiry of those periods.
19. Data Subject Rights
Under the GDPR, you have, in particular, the following rights:
- right of access pursuant to Article 15 GDPR;
- right to rectification pursuant to Article 16 GDPR;
- right to erasure pursuant to Article 17 GDPR;
- right to restriction of processing pursuant to Article 18 GDPR;
- right to data portability pursuant to Article 20 GDPR;
- right to object pursuant to Article 21 GDPR;
- right to withdraw consent pursuant to Article 7(3) GDPR.
To exercise your rights, please contact [email protected].
20. Right to Object Under Article 21 GDPR
Where we process personal data on the basis of Article 6(1)(f) GDPR, you may object to such processing on grounds relating to your particular situation.
In the event of an objection, we will no longer process the relevant data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or unless processing serves the establishment, exercise or defence of legal claims.
21. Right to Lodge a Complaint With a Supervisory Authority
You have the right to lodge a complaint with a data protection supervisory authority.
The authority generally responsible for us is:
The Hessian Commissioner for Data Protection and Freedom of Information
Gustav-Stresemann-Ring 1
65189 Wiesbaden
Germany
Postal address: P.O. Box 3163, 65021 Wiesbaden
Email: [email protected]
Telephone: +49 611 1408-0
Website: www.datenschutz.hessen.de
22. Obligation to Provide Personal Data
The provision of certain personal data is necessary for booking requests, conclusion of contract, payment processing and performance of the stay. Without these data, we cannot process a booking or provide the stay.
Where data are collected due to statutory obligations, you are legally required to provide such data.
23. Automated Decision-Making
Burgflotte does not carry out automated decision-making, including profiling, within the meaning of Article 22 GDPR.
24. Changes to This Privacy Policy
We reserve the right to amend this Privacy Policy if legal, technical or organisational circumstances change. The version published on the website applies.