We take the protection of your data seriously. This policy describes what data we process, why, and what rights you have — in plain language, without legal jargon.
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
For any data protection questions, you can reach us at any time by e-mail or phone. As a small family business, we have not appointed an external data protection officer — we handle your enquiries personally.
When you make a booking or a non-binding enquiry with us, we process the following data:
Legal basis: Performance of a contract (Art. 6(1)(b) GDPR) as well as statutory retention obligations (Art. 6(1)(c) GDPR, in particular under German commercial and tax law).
Retention period: Booking data is retained for up to 10 years in accordance with German commercial and tax law requirements. Enquiries that do not result in a booking are deleted after 6 months at the latest.
Until the end of 2024, accommodation providers in Germany were required under § 29 of the Federal Registration Act (Bundesmeldegesetz) to have every guest complete a registration form. Since 1 January 2025, this requirement no longer applies to guests holding German citizenship.
For guests without German citizenship, the registration requirement continues unchanged. We collect: name, date of birth, address, nationality, travel dates and, where applicable, ID document number. These registration forms are retained for one year and passed on to the registration authority or police if requested.
Regardless of nationality, we collect name, address and travel dates anyway as part of invoicing, and retain them in accordance with the statutory retention periods (see section 02).
When you visit this website, our hosting provider stores technical access data in server logs: IP address, date and time, page requested, amount of data transferred, and browser type. This data is used exclusively for the security and stability of the website and is automatically deleted after 7 days.
Legal basis: Legitimate interest in secure operation (Art. 6(1)(f) GDPR).
Hosting: This website is hosted in Germany. No data is transferred to third countries.
We use no cookies on this website for marketing, tracking or reach measurement. There is no Google Analytics, no Facebook Pixel, and no advertising networks.
Language selection is handled via URL prefixes (/de/, /en/, /nl/) — no localStorage or cookies are needed.
Google Fonts: This website loads the fonts Cormorant Garamond, Caveat and Work Sans via Google Fonts. In doing so, your IP address is transmitted to Google. We are currently reviewing a switch to locally hosted fonts.
Maps: The Getting Here and Surroundings pages contain links to Google Maps and OpenStreetMap. Maps are only loaded once you actively click a link — the respective provider's privacy policy then applies.
Under the GDPR, you have the right at any time to:
An informal e-mail to hallo@winsen-urlaub.de is enough — we reply within 30 days.
Competent supervisory authority: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Königstraße 10a, 70173 Stuttgart, Germany.
We update this privacy policy whenever legal requirements or our processing activities change. The current version is always available on this page.
Last updated: 26. April 2026