Privacy policy

Maximilian Fricke
Körtestraße 22
10967 Berlin
Germany
E-Mail: kontakt@hotelklar.de

No data protection officer has been appointed; the statutory requirements for doing so are not met.

When you visit, technically necessary connection data is processed (IP address, timestamp, address requested, volume of data transferred, browser and operating system identifier). The legal basis is Art. 6(1)(f) GDPR — our legitimate interest in secure and stable operation.

No analytics or marketing cookies are set, no tracking is embedded, and no external fonts, maps or video services are loaded. A consent banner is therefore not required.

We process the hotel or company name, the contact person's name, the email address and, optionally, the address of your existing website and your message. The purpose is to handle your enquiry; no account is created. To prevent abuse we check whether the same email address submits more than once within ten minutes, or the same connection within one hour. For this the IP address is converted with a secret key into a non-reversible check value and is not stored in plain text with the enquiry. We also use Cloudflare Turnstile, which transmits technical browser and connection data to Cloudflare for bot detection.

The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures), and Art. 6(1)(f) GDPR for abuse prevention.

For an account we store the company name, email address and a hashed password (scrypt with a random salt; the plain-text password is not stored). The session runs on a random key in an httpOnly cookie valid for 30 days.

For access recovery we store the email address, timestamp and processing status; only a SHA-256 hash of the one-time link is kept. Failed sign-in attempts are counted per email address to slow down password guessing — this count is held in memory only.

The legal basis is Art. 6(1)(b) and (f) GDPR.

We store the addresses checked and the results of those checks. This includes shortened HTML excerpts of the passages objected to. These may contain personal data where it is publicly visible on the page checked.

The legal basis is Art. 6(1)(b) GDPR.

To approach potential customers we process publicly available information about hotel businesses: search term, public profile, review status and photo references via the Google Places API, plus contact details from the legal notice of the respective website.

The legal basis is Art. 6(1)(f) GDPR (direct marketing to businesses). As this data is not collected from the data subject, we inform them of its source and purpose in accordance with Art. 14 GDPR at the latest upon first contact. You may object to the processing at any time without formality; the data will then be deleted.

Zur Bewertung von Bildqualität und Gestaltung werden bis zu vier öffentlich sichtbare Website-Fotos, bis zu vier Google-Places-Fotos sowie Profildaten des Hotels serverseitig an das Vercel AI Gateway übermittelt und dort an das eingestellte Sprachmodell weitergereicht (Vorgabe: deepseek/deepseek-v4-flash). Only the structured assessment and the design proposal are stored, not the downloaded image files.

Depending on the model configured, this involves a transfer to a third country without an adequacy decision. The transfer is based on Art. 6(1)(f) GDPR in conjunction with the provider's standard contractual clauses.

System messages (invitations, password links) and approved outreach are sent viaResend. We process the recipient address, subject, message and the approval and dispatch status. Outreach messages are sent only after manual approval and a separate send command.

The application runs onVercel Inc., the database and media storage onSupabase Inc.Both providers are bound as processors under Art. 28 GDPR. Where processing takes place outside the EU, the standard contractual clauses apply.

Enquiries are deleted once they have been dealt with conclusively and no statutory retention obligation applies. Account data is stored for the lifetime of the account and removed after its deletion. Check results are kept for as long as they are needed to support the website. Statutory periods of six and ten years respectively apply to commercial and tax records.

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on a legitimate interest (Art. 21). You may withdraw any consent given at any time with effect for the future.

No automated decision-making with legal effect concerning you takes place.

You have the right to lodge a complaint with a supervisory authority. The competent authority is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, Germany.