Privacy Policy

Privacy Policy

1. Controller

The controller responsible for data processing on this website is:
Fridmar Kleber – Elbsandstein Apartments
Kirnitzschtalstraße 53
01814 Bad Schandau, Germany
Phone: +49 163 444 11 44
Email: kontakt@elbsandstein-apartments.de

2. Your rights as a data subject

You have the right at any time to information (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR) and to object to processing (Art. 21 GDPR). You may withdraw any consent granted at any time with effect for the future (Art. 7 (3) GDPR). You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority is the Saxon Data Protection Commissioner, Devrientstraße 5, 01067 Dresden, Germany.

3. Hosting and server log files

This website is hosted by an external service provider (host). The personal data collected on this website is stored on the host's servers. When you access the website, the host automatically collects information in so-called server log files that your browser transmits: browser type and version, operating system used, referrer URL, host name of the accessing computer, time of the server request and IP address. This data serves the technically error-free delivery and the security of our website; the legal basis is Art. 6 (1) (f) GDPR (legitimate interest). We have concluded a data processing agreement (DPA) with the host pursuant to Art. 28 GDPR.

4. SSL / TLS encryption

For security reasons and to protect the transmission of confidential content, this website uses SSL or TLS encryption. You can recognise an encrypted connection by the „https://“ string and the lock symbol in your browser bar.

5. Cookies and consent management

Our website uses cookies. Technically necessary cookies that enable the operation of the website are set on the basis of Art. 6 (1) (f) GDPR and Section 25 (2) TDDDG. All non-essential cookies and the integration of external services (e.g. maps) take place exclusively with your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG). We manage your consent via a consent tool that stores your selection. You can withdraw your consent at any time with effect for the future or adjust your cookie settings.

6. Contact and booking enquiries

If you contact us via the enquiry form or by email, we process the data you provide (e.g. name, email address, telephone number, arrival and departure dates, subject and message) in order to handle your enquiry. The legal basis is Art. 6 (1) (b) GDPR if your enquiry is aimed at concluding a contract, otherwise Art. 6 (1) (f) GDPR (legitimate interest in handling enquiries) or Art. 6 (1) (a) GDPR (consent). The data remains with us until the purpose of storage no longer applies; statutory retention obligations remain unaffected. The data is not passed on to third parties without your consent.

7. Newsletter

To send our newsletter we use the service EmailOctopus, a product of Three Hearts Digital Ltd, 86-90 Paul Street, London, EC2A 4NE, United Kingdom. When you subscribe to the newsletter, the email address you provide and the associated data are transmitted to and stored by EmailOctopus. Registration takes place using the so-called double opt-in procedure. The legal basis is your consent (Art. 6 (1) (a) GDPR). You can unsubscribe from the newsletter and withdraw your consent at any time, e.g. via the unsubscribe link in every newsletter. EmailOctopus processes the data in the United Kingdom, for which an adequacy decision of the EU Commission exists, and uses Amazon Web Services (Amazon SES) as a sub-processor for sending. A data processing agreement pursuant to Art. 28 GDPR exists with the provider. For more information, please see EmailOctopus's privacy policy: https://emailoctopus.com/legal/privacy.

8. Google Maps

This website integrates maps from the Google Maps service. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The map is only loaded after your express consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG). When using Google Maps, your IP address is transmitted to Google and may be forwarded to servers in the USA. The transfer of data to the USA is based on the standard contractual clauses of the EU Commission and – where applicable – the EU-US Data Privacy Framework. For more information, please see Google's privacy policy: https://policies.google.com/privacy.

9. Validity and amendment of this privacy policy

This privacy policy is currently valid. As our website develops or due to changed legal or official requirements, it may become necessary to amend this privacy policy.