Privacy policy

Introduction and overview

We have written this privacy notice to explain to you, in accordance with the General Data Protection Regulation (EU) 2016/679 and applicable national law, which personal data we as the controller (and the processors we commission, such as providers) process, will process in future, and what lawful options are available to you.

Privacy notices usually sound very technical and use legal jargon. This notice, by contrast, aims to describe the most important things as simply and transparently as possible. Where it helps transparency, technical terms are explained in plain language and links to further information are provided. We process personal data in the course of our business only where there is a corresponding legal basis.

If questions remain, please contact the responsible body named below and in the imprint. Our contact details can of course also be found in the imprint.

In short: We inform you fully about the data we process about you.

Scope

This privacy notice applies to all personal data processed by us and to all personal data processed by companies we commission (processors). By personal data we mean information within the meaning of Art. 4(1) GDPR, such as a person name, email address and postal address. The scope of this notice covers:

this website
enquiries that reach us through the form or the contact details given
our Instagram presence and email communication

Not covered is processing for which someone else is responsible: the booking process at Smoobu, which you reach only by clicking "book", the 360 degree tours from Matterport, which you release yourself, and Instagram itself. Those providers own notices apply there.

Should we enter into legal relations with you outside these channels, we will inform you separately where necessary.

In short: The notice applies to every area in which we process personal data in a structured way through the channels named.

Legal bases

In this privacy notice we give you transparent information about the legal principles and provisions, that is the legal bases of the General Data Protection Regulation, that allow us to process personal data.

As regards EU law, we refer to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016. You can read this regulation online at EUR-Lex, the gateway to EU law.

We process your data only where at least one of the following conditions applies:

https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32016R0679

Consent (Art. 6(1)(a) GDPR): you have given us your consent to process data for a specific purpose. For us this concerns only the 360 degree tours, which you release yourself.
Contract (Art. 6(1)(b) GDPR): we process your data in order to perform a contract or pre-contractual obligations with you. If you ask us about a period or prepare a stay, we need details from you.
Legal obligation (Art. 6(1)(c) GDPR): where we are subject to a legal obligation, we process your data. For example, we are required by law to keep invoices for accounting purposes, and these usually contain personal data.
Legitimate interests (Art. 6(1)(f) GDPR): where we have legitimate interests that do not restrict your fundamental rights, we reserve the right to process personal data. For instance, we must process certain data in order to operate this website securely.

Further conditions, such as the performance of tasks in the public interest, the exercise of official authority or the protection of vital interests, do not arise in our case.

In addition to the EU regulation, national laws apply: in Germany the Federal Data Protection Act (BDSG) and the Telecommunications Digital Services Data Protection Act (TDDDG). Its § 25 governs when consent is required to access your device; for us that concerns only the 360 degree tours. Where applicable, the Thuringian Data Protection Act (ThürDSG) also applies.

Contact details of the controller

Should you have questions about data protection, you will find the contact details of the responsible body below:

ANDERS Apartment GbR
Constance Weißenborn / Constance Stockmann-Fleck
Am Heinrichsberg 7, 07743 Jena
+49 172 3702872 · appartments@anders.cafe

We are not required to designate a data protection officer: the conditions of Art. 37 GDPR and § 38 BDSG do not apply to us. Please address any concerns directly to the body named above.

Retention periods

As a general criterion, we store personal data only for as long as is strictly necessary to provide our services. This means we delete personal data as soon as the reason for processing no longer exists. In some cases we are required by law to store certain data even after the original purpose has ceased, for example for accounting purposes.

Should you wish your data to be deleted or withdraw your consent to processing, the data will be deleted as quickly as possible, provided no retention obligation applies.

The following periods apply in detail:

Server logs: after seven days at the latest.
Enquiries sent through the form: automatically 6 months after they arrive.
Your release for the tours: held in your browser, not with us; you can withdraw it at any time.
Usage measurement data: it contains nothing by which we could identify you and is kept as statistics.

Rights under the General Data Protection Regulation

Under Art. 13 GDPR you have the following rights, so that data is processed fairly and transparently:

Access (Art. 15 GDPR): You have the right to know whether we process data about you. If we do, you have the right to receive a copy of the data and to learn the following:
for what purpose we carry out the processing;
the categories, that is the types of data being processed;
who receives this data and, if it is transferred to third countries, how security can be guaranteed;
how long the data is stored;
the existence of the right to rectification, erasure or restriction of processing, and the right to object;
that you may lodge a complaint with a supervisory authority;
the origin of the data, where we did not collect it from you;
whether profiling takes place, that is whether data is evaluated automatically to arrive at a personal profile of you.
Rectification (Art. 16 GDPR): You have the right to rectification, which means we must correct data if you find errors.
Erasure (Art. 17 GDPR): You have the right to erasure (the "right to be forgotten"), which means you may request that your data be deleted.
Restriction of processing (Art. 18 GDPR): You have the right to restriction of processing, which means we may then only store the data but not use it further.
Data portability (Art. 20 GDPR): You have the right to data portability, which means that on request we provide your data in a common, machine-readable format.
Objection (Art. 21 GDPR): You have a right to object, which upon being upheld brings about a change in the processing.
Where the processing of your data is based on Art. 6(1)(f) (legitimate interest), you may object to the processing. We will then check as quickly as possible whether we can legally comply with this objection.
We do not carry out direct marketing. Should we ever do so, you could object at any time and we would no longer be permitted to use your data for it.
Withdrawal of consent (Art. 7(3) GDPR): You may withdraw consent at any time with effect for the future. Processing carried out until then remains lawful.
No automated decisions (Art. 22 GDPR): You have the right not to be subject to a decision based solely on automated processing. We make no such decisions and carry out no profiling.

In short: You have rights. Do not hesitate to contact the responsible body named above.

Supervisory authority

If you believe that the processing of your data breaches data protection law or that your data protection rights have been infringed in some other way, you may lodge a complaint with the supervisory authority. In Germany each federal state has its own data protection commissioner. The authority responsible for us is:

Authority: Thuringian Commissioner for Data Protection and Freedom of Information
Address: Häßlerstraße 8, 99096 Erfurt, Germany
Phone: +49 361 57 3112900
Email: poststelle@datenschutz.thueringen.de
Website: https://www.tlfdi.de

Security of processing

The connection to this website is encrypted throughout with TLS; via HSTS your browser is instructed never to establish it unencrypted in the first place. Access to the administration area is protected by a password that we store solely as a bcrypt hash, never in plain text. The database can only be reached from the server itself, not from the internet.

Web hosting

When you visit websites today, certain information, including personal data, is automatically created and stored, and this website is no exception. Such data should be processed as sparingly as possible and only with good reason.

Your web browser has to connect to another computer where the code of the website is stored: the web server. Personal data may be processed while the connection is established and during data transfer. The web server has to store data for a time in order to ensure proper operation.

The purposes of processing are providing the website, maintaining operational and IT security and, where necessary, pursuing claims. In doing so our web server automatically stores:

the address (URL) requested
browser and browser version
the operating system used
the address of the previously visited page (referrer)
the IP address of the accessing device
date and time
the amount of data transferred

This data is deleted automatically after seven days at the latest. We do not pass it on, but cannot rule out that it may be inspected by authorities where unlawful conduct has occurred.

The lawfulness follows from Art. 6(1)(f) GDPR (protection of legitimate interests), since operating a server is necessary to provide the website securely and in a user-friendly manner.

In short: Your visit is logged on our server, but we do not pass your data on.

Hostinger

The server on which this website runs is operated by Hostinger International Ltd., Švitrigailos str. 34, LT-03230 Vilnius, Lithuania. The server is located in Germany. A data processing agreement under Art. 28 GDPR is in place with the provider. You can learn more about the data processed in the provider own privacy notice.

https://www.hostinger.com/privacy-policy

Enquiry form

If you use the form, we process your name, email address, message and the optional details about dates and apartment in order to answer your enquiry (Art. 6(1)(b) GDPR). We delete the enquiry automatically 6 months after it arrives, unless a statutory retention obligation applies. We use no captcha; instead we check a field invisible to you and limit the number of submissions per address.

Only your name and an email address are required; without them we cannot reply to you. All further details, such as dates or apartment, are optional; omitting them puts you at no disadvantage. You are under no legal or contractual obligation to provide us with data.

Usage measurement

We count which pages are opened, using Umami running on our own server. The measurement script and the measured values are served and received through this address; your browser contacts no external provider for this, and nothing is passed on to third parties. The measurement sets no cookies and stores nothing in your browser, so no consent under § 25 TDDDG is required.

We do not store your IP address. It is used, together with your browser identification and a secret value, to compute an identifier that groups requests within one visit, and to derive country, region and city. We also record: the address opened, page title, referring page, browser, operating system, device type, screen size and the language set in your browser. The legal basis is our legitimate interest in designing this website to meet actual demand (Art. 6(1)(f) GDPR).

Object to the measurement

If "Do Not Track" or "Global Privacy Control" is switched on in your browser, we do not even load the measurement script, so you are not counted. You will find both in your browser privacy settings.

Tours from Matterport

The 360 degree tours come from Matterport, Inc., 352 East Java Drive, Sunnyvale, CA 94089, USA, and load only when you click the corresponding button. Only then are your IP address and browser data transmitted to that provider, including to the USA. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Your decision is kept in your browser local storage, not in a cookie and not with us.

Transfer to the USA

Matterport is based in the USA. There is no adequacy decision by the European Commission for the USA, and Matterport is not listed as certified in the EU-US Data Privacy Framework. We therefore base the transfer on your explicit consent under Art. 49(1)(a) GDPR. You should know what this means: under US law, authorities there may access the transmitted data, and you have no legal remedies comparable to those in the EU. That is precisely why we load the tours only once you click. You can always choose not to.

Withdraw consent

You can withdraw the consent you gave at any time. After that, content will again only load after a further click.

Availability and booking via Smoobu

Which apartment is free when, and what it costs, is requested by our server from Smoobu GmbH, Bornholmer Straße 91, 10439 Berlin, Germany, not by your browser. Smoobu learns nothing about you in the process. Only when you click "Book directly" do you move over to Smoobu; from that point Smoobu is responsible for processing your data and their privacy notice applies.

Recipients

Smoobu GmbH: availability and prices. Our server retrieves availability, not your browser. Smoobu receives no data about you. Only when you click "book" do you move over to Smoobu.
Matterport, Inc.: 360 degree tours. Loaded only after explicit consent. Matterport additionally loads Cloudflare.
Cloudflare, Inc.: bot protection on behalf of Matterport. Only indirectly, when a tour is loaded.
Hostinger (Serverbetrieb): operation of the website. Server in Germany, processing on our behalf.

Last updated

3 September 2026