Privacy Policy
This is a translation for your convenience. Only the German version is legally binding.
1. Controller and contact
The controller responsible for the processing of personal data on this website is:
Michael Oster Ferien im Weingut Walter J. Oster Moselweinstraße 14 56814 Ediger-Eller Germany
Phone: +49 2675 235
Email: ferien@weingutoster.de
If you have any questions about data protection or wish to exercise your rights, you are welcome to contact us using these details.
The controller for the KapellenHof (letting, enquiries and bookings) is:
Anna Oster Kapellenstr. 23 56814 Ediger-Eller Germany
Email: anna.oster@weinmanufakturoster.de
2. Visiting our website and hosting
When you access our website, technical information is transmitted to the servers used to provide the website. This includes, in particular, your IP address, the time of access, the page accessed, and information about your browser and operating system.
This data is processed to display the website, ensure its functionality, and detect technical faults or misuse. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and reliable operation of our online services.
Hosting provider: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (Cloudflare Pages). Cloudflare delivers the pages via a worldwide network of servers and protects them against attacks. Cloudflare processes the data as a processor. For transfers to the USA, see section 10. Further information: Cloudflare’s Privacy Policy .
Upstream server: Requests to ferienwohnung-ediger.de first pass through a server of our web service provider Upscaled Media GmbH, Am Metternicher Bahnhof 10, 56072 Koblenz, Germany, which is operated in the data centre of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. It forwards the request to Cloudflare in encrypted form and in doing so processes your IP address and the address requested. Upscaled Media and Hetzner act as processors.
Logging: We do not ourselves evaluate or store access logs. The data Cloudflare temporarily logs for network security purposes is set out in Cloudflare’s privacy policy.
Our website does not use any analytics or advertising services, no third-party tracking, and no third-party fonts. The fonts are hosted on our own server.
3. Availability calendar
On our accommodation pages we show a calendar of available dates and prices. This information is retrieved by our server from our booking system, Lodgify (section 5). Only the chosen travel dates and the number of guests are transmitted, with no information about you personally and not your IP address. The request to Lodgify is made by our server, not by your browser.
4. Getting in touch and enquiries
If you contact us via the contact form, by email or by phone, we process the information you provide in order to deal with your enquiry. This may include your name, your contact details, your desired travel period and the content of your message.
If your enquiry relates to a possible or existing booking, processing takes place in preparation for, or performance of, the contract pursuant to Art. 6(1)(b) GDPR. For other enquiries, it is based on our legitimate interest in dealing with your message pursuant to Art. 6(1)(f) GDPR.
We require the information necessary to deal with your enquiry. You may provide further information voluntarily. For storage, see the notes under “Storage period”.
Contact form: The details you enter in the form are forwarded by our server (Cloudflare, section 2) to us by email. To ensure that no enquiry is lost, each enquiry is also stored in a Cloudflare database (Cloudflare D1, data centre in Europe), together with the time, a non-reversible check value (hash) of your IP address and your browser identifier. The enquiry is deleted once it has been dealt with and no statutory retention obligations apply. For delivery, we use the email service Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA). Resend processes the message as a processor solely for delivery purposes. For transfers to the USA, see section 10. To prevent automated spam submissions, we technically check how quickly the form was submitted.
Origin of the enquiry: So that we can see how guests find us (for example via a search engine, an advert or a link), your browser remembers in its session storage (sessionStorage), for the duration of your visit, which source and entry page you came from. This information only leaves your device if you submit the contact form and is then stored together with the enquiry. It is deleted automatically when you close the browser window. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in understanding how guests reach us.
The KapellenHof is let by Anna Oster (contact details in section 1). Enquiries about it go directly to her by email or via Airbnb. Bookings made through Airbnb are additionally subject to Airbnb’s privacy information.
5. Bookings and booking management with Lodgify
For our online bookings and the management of our holiday accommodation, we use Lodgify. The provider is:
Codebay Solutions Limited Magma House, 16 Davy Court Castle Mound Way, Rugby Warwickshire, CV23 0UZ United Kingdom
When you click “Book”, you are taken to Lodgify’s booking page (checkout.lodgify.com). There, you enter your booking details. Lodgify supports us, in particular, with processing bookings, managing reservations and communicating with our guests.
In connection with an enquiry or booking, we process the information required for this purpose. This includes, in particular, name, address, email address, phone number, the accommodation booked, travel period, number of guests, booking price, payment status and booking-related messages.
We use this data to process your booking, prepare for and carry out your stay, and send you booking confirmations and information needed for your arrival. Providing the required booking data is a prerequisite for concluding and carrying out your booking. Additional information is voluntary. The legal basis is Art. 6(1)(b) GDPR.
Lodgify processes the guest data we manage as a processor. This is based on the data processing agreement included in Lodgify’s terms and conditions. We remain responsible for our processing of your guest data. Technically necessary cookies may be set on Lodgify’s booking page, see section 7.
6. Payment processing
Online payments via Stripe
We use Stripe to process online payments on the booking page. The contracting party for Stripe’s services is generally Stripe Payments Europe, Limited, Ireland. Depending on the payment method, other companies in the Stripe group may also be involved.
When you make a payment, Stripe processes the information required to carry out the payment transaction. Depending on the payment method chosen, this may include, for example, name, billing and contact details, payment amount, payment references, and card or account details. Technical information to secure the payment transaction may also be processed. Further information is available in Stripe’s Privacy Policy.
Our processing of the data required for payment takes place for the performance of the contract pursuant to Art. 6(1)(b) GDPR. Insofar as we process payment data to comply with statutory retention obligations, Art. 6(1)(c) GDPR is the legal basis.
Depending on the activity, Stripe processes personal data either as a processor or under its own data protection responsibility. This concerns, in particular, its own statutory obligations and certain fraud-prevention measures. Stripe provides information on this in its own privacy area.
Payment by bank transfer
For payments by bank transfer, we process the information transmitted with the payment, in particular the payer’s name, bank details, the amount and the payment reference. This serves to allocate your payment correctly and to comply with our statutory bookkeeping and retention obligations.
7. Cookies and similar technologies
Our website itself does not set any cookies. Only the origin of your visit is noted in your browser’s session storage for the duration of the visit (see section 4, “Origin of the enquiry”); it is deleted when you close the browser window. We do not use any analytics or advertising services.
Lodgify’s booking page and Stripe’s payment functions may use cookies or similar technologies once you access them. Insofar as this is strictly necessary to provide a service you have expressly requested, this is based on Section 25(2) No. 2 TDDDG (German Telecommunications Digital Services Data Protection Act). Consent pursuant to Section 25(1) TDDDG is required for any further, consent-requiring technologies.
8. Videos from YouTube
On some pages we show videos from YouTube. Until you click on a video, you only see a preview image hosted on our own server. No data is transmitted to YouTube at this stage.
Only when you click on a video is it loaded via www.youtube-nocookie.com. This transmits your IP address and technical data about your browser to YouTube. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. A transfer to Google LLC in the USA is possible (section 10). The legal basis is your consent given by clicking (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Further information: Google’s Privacy Policy .
9. Statutory registration obligations for accommodation providers
Insofar as we are obliged under the German Federal Registration Act (Bundesmeldegesetz) to collect registration data, we process the legally required information about our foreign guests. This may include, in particular, name, date of birth, nationality, address, dates of arrival and departure, and the number of the passport or substitute identity document.
Providing this information is mandatory to the extent required by law. The legal basis is Art. 6(1)(c) GDPR in conjunction with Sections 29 and 30 of the German Federal Registration Act (BMG). Disclosure or presentation takes place only to the bodies legally authorised to receive it.
The special registration forms are retained for one year from the date of departure and destroyed within three months after this period expires.
10. Recipients and data processing outside the EU
Personal data is disclosed to those persons and service providers who need it for the respective processing purpose. This includes, in particular, the persons involved in processing bookings and the hosting, booking and payment service providers named in this policy. Insofar as this is necessary to comply with statutory obligations, data may also be disclosed, for example, to tax advisors, tax authorities or other legally authorised bodies. Service providers who process personal data on our behalf are engaged on the basis of the data processing agreements required for this purpose.
When using Cloudflare, Resend, Lodgify, Stripe and YouTube, personal data may be processed outside the European Union or the European Economic Area. In its data processing agreement, Lodgify also provides for the use of sub-processors outside the EEA.
For the United Kingdom, where Lodgify’s provider is based, there is an adequacy decision by the European Commission. This enables data transfers under Art. 45 GDPR.
According to its own privacy policy, Cloudflare bases transfers to the USA on its certification under the EU-U.S. Data Privacy Framework. For international data transfers, Stripe describes, among other things, the use of adequacy decisions and standard contractual clauses. For transfers to appropriately certified US companies, the adequacy decision on the EU-US Data Privacy Framework is decisive.
11. Storage period
We store personal data for as long as is necessary for the respective processing purpose. The data is then deleted, unless statutory retention obligations or other legal grounds require further storage.
The applicable statutory periods apply to documents subject to retention requirements. Invoices and tax-relevant accounting records must generally be retained for eight years, and business correspondence subject to retention requirements for generally six years. The start of the period is determined by statutory provisions and generally falls at the end of the relevant calendar year. Statutory extensions remain unaffected.
Insofar as data is required to assert, exercise or defend legal claims, it may continue to be stored for this purpose. The separate retention period for registration forms is set out in section 9.
12. Your rights
Subject to the statutory requirements, you have the right to access your personal data, to have inaccurate data corrected, to have it erased, and to restrict its processing. Where the requirements are met, you also have a right to data portability.
Right to object: Insofar as we process your data on the basis of legitimate interests pursuant to Art. 6(1)(f) GDPR, you may object for reasons arising from your particular situation. We will then no longer process the data concerned for this purpose, unless there are statutorily recognised grounds for further processing.
Withdrawing consent: You may withdraw any consent given at any time with effect for the future. Processing carried out before the withdrawal remains lawful.
Right to lodge a complaint: You may lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, your place of work, or the place of the alleged infringement.
To exercise your rights, you can reach us using the contact details given above.
Last updated: September 2026