Privacy policy
Updated: 21 October 2026. The marked Vercel account settings and retention details still need verification before publication. This privacy policy is not yet cleared for publication.
Controller and contact
The controller responsible for data processing is Pension Bergidyll, sole proprietorship, owner Thomas Hennig, GrenzstraĂe 6, 08248 Klingenthal, Germany. Telephone: +49 37467 639588, mobile: +49 173 5202716, email: info@bergidyll-aschberg.de. If you have any data protection questions, you can reach us using these contact details.
Website delivery and hosting
We host this website on Vercel Pro, provided by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Page and API requests technically involve IP addresses, requested URLs, timestamps, browser, device and error data. Delivery and security are based on our legitimate interest in reliable website operation under Art. 6(1)(f) GDPR. Vercel uses an international delivery network and subprocessors; processing and access outside the EEA, particularly in the USA, are possible. Its Data Processing Addendum describes contractual safeguards, including EU standard contractual clauses. Processing exclusively in Germany or Europe is not guaranteed.
Vercel: processing agreement and transfer safeguards (new tab) â
Server logs and security data
The application logs technical error codes, not form messages, credentials or full booking responses. Hosting and security services may process additional technical access data. Abuse prevention uses short-lived network identifiers hashed with a random key. Rate-limit entries are valid for no more than 15 minutes and are removed on later access or process termination. Duplicate-submission protection retains checksums, offer references and technical results for 15 minutes; full offer text is not retained as a result in that server-process cache. The basis is our legitimate interest in abuse prevention and reliable processing under Art. 6(1)(f) GDPR. [CHECK REQUIRED: actual Vercel log retention, add-ons, exports and backups. Vercel documents one day for standard Pro runtime logs; other products and settings require separate verification.] The operator also uses Vercel Observability for technical operations monitoring, evaluating the technical request, error and performance data available there. Detecting and resolving failures is based on Art. 6(1)(f) GDPR. The application does not embed an additional browser analytics script for Observability.
Email and telephone contact
We process your contact details and message when you contact us. Emails are received, stored and sent through united-domains GmbH, Gautinger StraĂe 10, 82319 Starnberg, Germany. Stay-related requests and declarations are processed under Art. 6(1)(b) GDPR; general correspondence is based on our legitimate interest in responding under Art. 6(1)(f). Email and telephone links open your own application or telephone function. The domain is also registered with united-domains. This website does not process online payments or offer a newsletter.
Booking offer form
We process your first and last name, email, accommodation, dates and occupancy. For children travelling, we request age on arrival for occupancy and price calculations, not names or dates of birth. We also process extras, breakfast choices, calculated prices, language, accepted terms version, receipt time and offer reference. Telephone and message are optional. Please do not enter health information or other particularly sensitive data in free text. Your details are processed for pre-contractual steps and contract performance under Art. 6(1)(b) GDPR. Data about travellers who are not themselves contracting parties is processed under our legitimate interest in organising the requested stay, Art. 6(1)(f) GDPR. The form requires mandatory fields; you may contact us directly instead. Submitting constitutes a binding booking offer; a contract is concluded only through our timely express acceptance.
Beds24 accommodation management
Availability, pricing and booking offers are managed using Beds24, provided by Beds24 GmbH, c/o EDGE Workspaces Grand Central Berlin, InvalidenstraĂe 65, 10557 Berlin, Germany. Our server sends room IDs, dates and guest numbers to api.beds24.com without forwarding your browser IP or browser cookies. On submission, form details, prices and the complete offer including the accepted terms are also transmitted. The bases are Art. 6(1)(b) GDPR for your booking and Art. 6(1)(f) for general availability and details of travellers who are not contracting parties. Beds24âs published processing agreement names Hetzner Online GmbH as server host in Germany and is incorporated into its user agreement according to the provider.
Consent and browser storage
Language is determined by the URL. Accommodation selections and form entries remain in the open documentâs memory; this application does not persist them in browser storage. Acceptance or rejection of statistics, performance measurement and maps is stored in Local Storage under âbergidyll.privacy-consent.v1â with a validity of 180 days. The record contains the decision, technical version and expiry, not form entries. Storage exclusively respects your privacy choice under section 25(2)(2) TDDDG and Art. 6(1)(f) GDPR. If storage is blocked, the choice lasts only in the open document. Map consent is also valid in this browser for 180 days; if storage is blocked, it applies only to the open document. The application itself sets no cookies; voluntarily activated external content may involve the provider processing information in your browser. Your choice distinguishes visitor statistics, performance measurement and maps; expired entries are removed on later access or while the document is open.
Vercel Web Analytics â with consent only
Consenting to visitor statistics loads Vercel Web Analytics from Vercel Inc. (address under Hosting). We analyse page visits, referrers, approximate region, browser, operating system and device type to understand use of the website. Vercel technically processes the IP address; according to the provider, a visitor identifier derived from request data is discarded after 24 hours and no analytics cookies are used. We remove query strings and fragments before sending events and do not send form fields or custom booking events. Vercel documents a twelve-month reporting window for standard Pro; this does not guarantee erasure of all data after twelve months. The bases are consent under Art. 6(1)(a) GDPR and, where required, section 25(1) TDDDG. The script is not loaded without consent. Consent can be withdrawn through âPrivacy settingsâ in the footer; the page then reloads without the script. Previously transmitted data is not retrieved by withdrawal and prior lawful processing remains unaffected. Possible US transfers are addressed under Recipients. [CHECK REQUIRED: actual Analytics plan, retention and any exports.]
Vercel Speed Insights â separate consent
With your separate performance choice, we load Vercel Speed Insights from Vercel Inc. (address under Hosting). It measures loading and response times and layout stability using page URLs, browser, device and network information, timestamps and possibly element attribution. The purpose is improving technical quality. Transmission technically involves your IP address; according to Vercel, metrics are evaluated without an identifiable usage profile. We remove query strings and fragments from the page URL. The bases are Art. 6(1)(a) GDPR and, where required, section 25(1) TDDDG. The script is not loaded without your separate choice. Consent can be withdrawn through Privacy settings at any time; the page then reloads. We use the confirmed standard service without Speed Insights Plus. Available reporting periods do not guarantee a specific deletion deadline for all data. Vercelâs recipients and transfer safeguards are described above. [CHECK REQUIRED: actual Speed Insights account retention.]
OpenStreetMap â only after activation
Maps on the home and contact pages are initially switched off. Selecting maps in Privacy settings, choosing âAllow allâ or choosing âLoad mapâ consents to connecting to the OpenStreetMap Foundation (OSMF), St Johnâs Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom. This involves IP address, time, browser information and requested map areas. OSMF also uses Fastlyâs worldwide delivery network. Displaying our location is based on Art. 6(1)(a) GDPR and, where terminal information is accessed, section 25(1) TDDDG. Other website functions are available without the map. âSwitch off mapâ or withdrawing map consent in Privacy settings removes the embed and stops further map requests; it does not retrieve data already transmitted. Your map choice is valid in this browser for 180 days. If storage is blocked, a fresh document requires activation again. An EU adequacy decision covers transfers to OSMF in the United Kingdom; further delivery-network processing is described in the providerâs information. See OSMFâs privacy policy for its retention, recipients and purposes.
Fonts, external links and abuse prevention
Fonts are served from our own website origin; the browser does not load Google Fonts files. Links to Google Maps, OpenStreetMap, tourism, restaurant or Tripadvisor pages connect to those providers only when opened. Their own privacy information then applies. No videos, social widgets or external CAPTCHA services are embedded. Validation, a control field and rate limits prevent abuse under Art. 6(1)(f) GDPR. This website does not make automated decisions with legal effect under Art. 22 GDPR or profile guests for booking decisions.
Recipients and international transfers
Recipients are the operator, Vercel, united-domains, Beds24 and their service-specific subprocessors. Consenting to maps also sends data to OSMF and its delivery providers. Only data needed for the respective purpose is processed. For Pro processing, Vercel provides EU standard contractual clauses in its Data Processing Addendum linked under Hosting. Safeguards are available there, and copies can also be requested from the controller. OSMF is based in the United Kingdom, which has an adequacy decision. Statistics or map consent does not replace the safeguards required for further international transfers.
Retention and statutory storage
Ordinary completed enquiries and unaccepted booking offers without a statutory retention duty or a specific dispute are retained for handling for up to 90 days after final resolution and deleted in the monthly review no later than 120 days afterwards. For accepted offers, we retain documents needed to perform the contract and establish necessary legal claims. The usual limitation period is generally three years, with its start determined under sections 195 and 199 BGB. Statutory retention takes precedence: depending on the document, this includes six years for qualifying business correspondence, eight years for invoices and accounting vouchers, and ten years for certain books and records under section 147 AO and, where applicable, section 257 HGB. These periods generally begin at the end of the relevant calendar year; statutory extensions, including ongoing tax proceedings, remain applicable. Statutory retention is based on Art. 6(1)(c) GDPR; specifically necessary legal evidence on Art. 6(1)(f). Unnecessary data is deleted. Reviews cover Beds24, emails and our own copies. This website does not automatically erase records in the mailbox or Beds24 account. Browser choices and security data follow the periods or cleanup criteria stated above. Statutory registration records follow their separate rules; in particular, section 7(2) of Klingenthalâs guest tax rules specifies one year from arrival followed by destruction within three months.
Your rights and complaints
Subject to legal conditions, you have rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18) and portability (Art. 20 GDPR). You may object to processing based on legitimate interests on grounds relating to your particular situation under Art. 21. Any consent you may have given outside this website can be withdrawn for the future without affecting the lawfulness of earlier processing. Contact the controller to exercise these rights. Under Art. 77 you can complain to a supervisory authority, particularly where you live or work or where an alleged infringement occurred. In Saxony: SĂ€chsische Datenschutz- und Transparenzbeauftragte, saechsdsb.de. Competence depends on the actual circumstances.