Privacy Policy

1. The data controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws of the member states, as well as other data protection regulations, is: Philipp Eisele Staylio-Apartments Sperlingweg 6 71691 Freiberg a.N. Germany Phone: +4917657986637 Email: info@staylio-apartments.de VAT ID Number: DE334291204 The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

2. General Information on Data Processing

2.1 Scope of Personal Data Processing We generally process our users’ personal data only to the extent necessary to provide a fully functional website and our content and services (e.g., information about and booking of our vacation rental). The processing of our users’ personal data generally takes place only with the user’s consent. An exception applies in cases where obtaining prior consent is not possible for practical reasons and the processing of the data is permitted by law.

2.2 Legal Basis for Processing To the extent that we obtain the data subject’s consent for the processing of personal data, Article 6(1)(a) of the GDPR serves as the legal basis. When processing personal data necessary to fulfill a contract to which the data subject is a party (e.g., booking and fulfilling the lodging contract), Article 6(1)(b) of the GDPR serves as the legal basis. If the processing is necessary to comply with a legal obligation (e.g., record-keeping obligations under registration or tax law), Article 6(1)(c) of the GDPR serves as the legal basis. If the processing is necessary to protect a legitimate interest on our part or on the part of a third party, and the interests, fundamental rights, and fundamental freedoms of the data subject do not override the aforementioned interest, Article 6(1)(f) of the GDPR serves as the legal basis. Our hosting provider: IONOS SE Elgendorfer Str. 57 56410 Montabau The hosting provider is engaged for the purpose of fulfilling our contractual obligations to our potential and existing customers (Article 6(1)(b) of the GDPR) and in the interest of ensuring the secure, fast, and efficient provision of our online services by a professional provider (Article 6(1)(f) of the GDPR). A data processing agreement (Art. 28 GDPR) has been concluded with the hosting provider. 

5. Cookies and Consent Management (Consent Tool) Our website uses cookies. Cookies are small text files that are stored on your device. Cookies do not cause any damage to your computer and do not contain viruses. A distinction is made between technically necessary cookies, which are essential for the operation of the website, and optional cookies (e.g., for statistical or marketing purposes), which are set only with your consent. Technically necessary cookies are stored on the basis of Art. 6(1)(f) GDPR or § 25(2) TTDSG. To the extent that your consent is required for the use of cookies (e.g., for analytics tools), they are stored exclusively on the basis of this consent, in accordance with Article 6(1)(a) of the GDPR in conjunction with Section 25(1) of the TTDSG. You may revoke this consent at any time with future effect, e.g., via our cookie consent banner when you visit the website.  

6. Contacting Us

6.1 Contact Form Our website features a contact form that can be used to contact us electronically. If a user chooses this option, the data entered in the form (e.g., name, email address, phone number, message) is transmitted to us and stored. Alternatively, you may contact us via the provided email address and/or phone number. The legal basis for processing the data, provided the user has given consent, is Article 6(1)(a) of the GDPR. The legal basis for processing data transmitted when sending an email or collected in connection with a (booking) inquiry is Article 6(1)(b) of the GDPR, provided that the inquiry relates to the performance of a contract or is necessary for the implementation of pre-contractual measures. The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. This is the case for data from the contact inquiry once the respective conversation with the user has ended. The conversation is deemed to have ended when the circumstances indicate that the matter in question has been conclusively resolved. Statutory retention periods remain unaffected.

7. Booking Inquiries, Reservations, and Contract Processing When you submit a booking inquiry or make a reservation for our vacation rental through our website, we collect and process the data you provide in the booking or inquiry form, specifically: ● First and last name, and the names of any traveling companions, if applicable ● Address ● Email address and phone number ● Check-in and check-out dates, number of guests ● Special requests or details regarding your stay ● Payment information (see Section 8) This data is required to process your request, to initiate or conclude the accommodation contract with you, and to fulfill the terms of the contract. The legal basis is Article 6(1)(b) of the GDPR (performance of a contract or pre-contractual measures).

7.1 Registration Obligations Under the Federal Registration Act (or the corresponding state regulations), we, as the operator of an accommodation facility, are required to have adult guests fill out a registration form upon arrival and to retain it for a period of [typically one year, as required by law]. This data is processed exclusively to fulfill the statutory registration obligation and, where applicable, to collect the visitor’s tax/tourism tax on behalf of the relevant municipality. The legal basis is Article 6(1)(c) of the GDPR in conjunction with the respective registration and municipal tax regulations. Note: Please verify which registration regulations (Federal Registration Act, state registration laws, and, if applicable, deviating regulations for properties abroad) and which municipal tourist tax ordinance specifically apply to your vacation rental, and adapt this section accordingly.

7.2 Disclosure to Third Parties in Connection with Contract Performance Your data will only be disclosed to third parties to the extent necessary for contract performance, such as to: ● Payment service providers for processing payments (see Section 8) ● Tax advisors or tax authorities in connection with statutory retention and documentation requirements ● The relevant registration authority or municipality in connection with the collection of tourist taxes

8. Payment Processing Depending on the payment method you select, we use the following payment channels or payment service providers. Only the data necessary for payment processing (e.g., name, transaction amount, bank account information, or payment details) is processed and transmitted to the respective payment service provider. The legal basis is Article 6(1)(b) of the GDPR.

8.1 Bank Transfer / Prepayment When you pay by bank transfer, we process the data transmitted by your bank as part of the payment transaction (name, account number/IBAN, transaction description) for the purpose of contract fulfillment and to comply with commercial and tax law retention requirements.

8.2 Payment Service Provider (PayPal) If you choose to pay via an online payment service provider, the transaction will be processed by that provider. In this regard, the provider’s privacy policy also applies.

PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg – Privacy Policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full 8.3 Bookings via Booking Portals (e.g., Booking.com, Airbnb) If you book our vacation rental through an external booking portal (e.g., Booking.com, Airbnb, FeWo-direkt), data processing in connection with the booking is initially carried out by the respective portal operator in accordance with its own privacy policy. The data required to fulfill the lodging contract (in particular, name, contact information, and travel dates) is transmitted to us by the respective portal for the purpose of contract fulfillment and is further processed by us in accordance with the principles set forth in this policy. Booking.com B.V.: https://www.booking.com/content/privacy.de.html or Airbnb Ireland UC: https://www.airbnb.de/help/article/2855]

9. Google Analytics This website uses features of the web analytics service Google Analytics. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics enables us to analyze the behavior of website visitors. In doing so, we receive various usage data such as page views, time spent on the site, operating systems used, and the user’s location. This data is aggregated into a user ID and assigned to the website visitor’s respective device. Google Analytics uses technologies that enable user recognition for the purpose of analyzing user behavior (e.g., cookies). The information collected in this way regarding the use of this website is generally transmitted to a Google server in the United States and stored there. This processing is carried out exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR in conjunction with § 25(1) TTDSG, which you can grant via our cookie consent banner or revoke at any time with future effect. Google Analytics will not be activated without your consent. We have enabled IP anonymization on this website. The IP address is truncated by Google within member states of the European Union or in other signatory states to the Agreement on the

European Economic Area before being transmitted to a server in the United States. Only in exceptional cases is the full IP address transmitted to a Google server in the United States and truncated there. Data transfers to the U.S. are based on the Standard Contractual Clauses issued by the European Commission or—where applicable—on an adequacy decision (e.g., the EU-U.S. Data Privacy Framework), provided that Google has submitted to this framework. For more information about Google Analytics, please see Google’s Privacy Policy: https://policies.google.com/privacy?hl=de You can prevent the collection of data generated by the cookie and related to your use of the website, as well as the processing of this data by Google, by downloading and installing the browser add-on available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de

10. Google Maps This website uses the Google Maps mapping service. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). To use the features of Google Maps, it is necessary to store your IP address. This information is generally transmitted to a Google server in the United States and stored there. The provider of this site has no influence over this data transfer. The use of Google Maps is in the interest of presenting our offerings in an appealing manner and making it easy to locate the places we specify on the website. This constitutes a legitimate interest within the meaning of Article 6(1)(f) of the GDPR. To the extent that Google Maps is integrated only after prior consent has been given (e.g., via a two-click solution or our cookie consent banner), the legal basis is exclusively Article 6(1)(a) of the GDPR in conjunction with Section 25(1) of the TTDSG; consent may be revoked at any time. For more information on the handling of user data, please see Google’s Privacy Policy: https://policies.google.com/privacy?hl=de

11. SSL/TLS Encryption This website uses SSL or TLS encryption for security reasons and to protect the transmission of confidential information, such as booking requests, that you send to us as the website operator. You can recognize an encrypted connection by the fact that the address bar of your browser changes from “http://” to “https://” and by the lock icon in your browser’s address bar. When SSL or TLS encryption is enabled, the data you transmit to us cannot be read by third parties.

12. Rights of the Data Subject If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller:

12.1 Right of Access (Art. 15 GDPR) You may request confirmation from us as to whether we are processing personal data concerning you and, if so, request access to such data as well as the information specified in more detail in Art. 15 GDPR.

12.2 Right to Rectification (Art. 16 GDPR) You have the right to have inaccurate personal data concerning you rectified and, where applicable, to have incomplete personal data concerning you completed.

12.3 Right to Erasure (Art. 17 GDPR) You have the right to request that we erase your personal data without delay, provided that the conditions set forth in Art. 17 GDPR are met. Statutory retention requirements remain unaffected by this.

12.4 Right to Restriction of Processing (Art. 18 GDPR) Subject to the conditions set forth in Art. 18 GDPR, you have the right to request the restriction of the processing of personal data concerning you.

12.5 Right to Data Portability (Art. 20 GDPR) You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used, and machine-readable format, or to request that it be transmitted to another controller, to the extent that this is technically feasible.

12.6 Right to Object (Art. 21 GDPR) You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is carried out pursuant to Art. 6(1)(f) GDPR.

12.7 Right to Withdraw Consent (Art. 7(3) GDPR) You have the right to withdraw your consent to the processing of your data at any time, with effect for the future. Withdrawing your consent does not affect the lawfulness of processing carried out on the basis of your consent prior to its withdrawal.

12.8 Right to lodge a complaint with a supervisory authority (Art. 77 GDPR) You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work, or the place of the alleged infringement, if you believe that the processing of personal data concerning you violates the GDPR.

13. Validity and Amendments to This Privacy Policy This Privacy Policy is currently valid and is effective as of August 2026. Due to the ongoing development of our website and the services offered through it, or due to changes in legal or regulatory requirements, it may become necessary to amend this Privacy Policy. You may access and print the most current version of this Privacy Policy at any time on this website.