Privacy Policy

1. Controller

The controller within the meaning of Art. 4(7) GDPR and other data protection provisions is:

Fewo-Tebben, Gästehaus Weserblick
Owner: Sascha Tebben
Donnerschweer Str. 46, 26123 Oldenburg
Germany
Telephone: +49 (0) 441-212132300
Email: home@fewo-tebben.de

A data protection officer is not required by law (fewer than 20 persons constantly engaged in the processing of personal data, § 38(1) BDSG). If you have any questions about data protection, please contact the above-mentioned contacts directly.

2. Overview / Scope

This privacy policy provides you with comprehensive information about the processing of personal data when you visit and use our website https://fewo-tebben.de and its language versions (/en, /nl). It covers the following processing contexts:

• Provision of the website (sections 4-6)
• Web analysis with Google Analytics 4 and Google Ads / remarketing (section 7)
• Usage analysis with Microsoft Clarity (section 7a)
• Error tracking with Sentry (section 8)
• Contact by email, form, telephone, WhatsApp, website chat (section 9)
• Online booking and payment processing with Stripe (section 10)
• Booking management via ILOCA (section 11)
• Map integration via OpenStreetMap/Leaflet (section 12)
• Display of reviews from Booking.com (section 13)
• Sending of emails (section 14)

Optional processing (in particular Google Analytics and Microsoft Clarity) takes place exclusively after your explicit consent via our cookie consent banner. You may withdraw your consent at any time with effect for the future via the “Cookie settings” link in the footer.

3. Legal Bases for Processing

Where we process personal data, the following legal bases may apply (Art. 6 GDPR):

• Art. 6(1)(a) GDPR: consent (cookie consent, optional functions).
• Art. 6(1)(b) GDPR: performance of a contract and pre-contractual measures (bookings, contact enquiries initiating a booking).
• Art. 6(1)(c) GDPR: compliance with legal obligations (retention obligations under tax and commercial law pursuant to AO/HGB).
• Art. 6(1)(f) GDPR: protection of legitimate interests (IT security, troubleshooting, building trust through the display of reviews). We carry out a balancing of interests for each processing operation; the essential considerations are documented in the respective processing section.

In addition, § 25 TTDSG applies to the storing and reading of information on your terminal device: storage and access operations that are strictly technically necessary are permitted without consent under para. 2 no. 2; all other cookies and similar technologies are permitted only with consent (para. 1).

4. Hosting (Hetzner)

This website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The server location is the European Union (Hetzner data centre in Germany). A data processing agreement (Art. 28 GDPR) is in place with Hetzner.

Data processed: IP address, time of access, requested URL, browser type, HTTP status code, referrer URL, user agent.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the reliable provision of the website).

5. Server Log Files

When the pages are accessed, server log files are automatically created which contain the following information: browser type and version, operating system used, referrer URL, hostname of the accessing computer, time of the server request, IP address.

Retention period: Server log files are retained for a maximum of 30 days and then automatically deleted.

Purpose: Maintaining the functionality of the website, detecting and defending against attacks (e.g. DoS/brute force).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in IT security; Recital 49 GDPR).

The log file data is not merged with other data sources. No personal evaluations (e.g. profiling via log files) take place.

6. Cookies and Similar Technologies

We use cookies and comparable storage technologies (LocalStorage). We distinguish between two categories:

6.1 Necessary cookies / LocalStorage (without consent)

• Booking session and shopping basket: stores selected travel data during checkout (browser session).
• CSRF token: protection against cross-site request forgery in forms (browser session).
• Language setting: DE/EN/NL selection (LocalStorage, permanent until manually deleted).
• Consent status: your cookie banner selection (LocalStorage key cookie_consent, permanent).
• Website chat: LocalStorage key ft_webchat: a randomly generated identifier and the number of your chat conversation, so that the chat can be continued after the page is reloaded. It is set only if you actually start the chat on a page about replacement or temporary accommodation; it contains no name and no telephone number; it expires after 30 days (see section 9.3). No cookie is set for this purpose.
• Business card benefit: cookie fewo_kartenvorteil: set only if you access the QR code or the short link fewo-tebben.de/vk on our business card, so that the discount promised there can be deducted automatically from a later booking. It contains only the name of the card print run, no identifier of your person; it expires after 90 days.
• Stripe anti-fraud cookies (e.g. __stripe_mid, __stripe_sid): set only when the payment page is reached; they serve exclusively for fraud prevention and are required for secure payment processing (see section 10).

Legal basis: § 25(2) no. 2 TTDSG (strictly technically necessary) in conjunction with Art. 6(1)(b) GDPR (performance of a contract) or Art. 6(1)(f) GDPR (legitimate interest in functionality and security).

6.2 Optional cookies (only after consent)

• Google Analytics 4: _ga (client ID, lifetime 2 years), _ga_BVNLKJGKJK (session state, 2 years); see section 7.
• Google Ads click attribution: ft_gclid (first-party cookie, lifetime 90 days): stores the Google click ID if you reached the website via one of our Google advertisements, so that a later booking can be attributed to the advertisement (conversion measurement); see sections 7 and 10.
• Origin attribution: ft_ref (first-party cookie, lifetime 90 days): stores, on the first visit, the source of origin (e.g. the domain of the search engine or “direct”), the page first accessed and the date, without search terms, click IDs or user IDs, so that a later booking can be attributed to the channel of origin (e.g. search, referral, direct access).

Legal basis: Art. 6(1)(a) GDPR and § 25(1) TTDSG (consent).

You may withdraw your consent at any time with effect for the future via the “Cookie settings” footer link. The withdrawal does not affect the lawfulness of the processing carried out up to that point.

7. Web Analysis with Google Analytics 4 and Google Ads

On this website we use, only with your explicit consent, Google Analytics 4 (GA4), a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google Ireland”). The parent company is Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Data processed: truncated IP address (anonymize_ip: true is set: Google truncates the IP within the EU/EEA before transfer to the USA), a pseudonymous client ID (cookie _ga), device and browser information, referrer URL, length of stay, pages accessed, clicks on certain UI elements (booking buttons, telephone and WhatsApp clicks, language changes), performance metrics (Web Vitals). No user ID link to a Google account takes place.

Google Consent Mode v2: Before you grant your consent, all storage parameters (analytics_storage, ad_storage, ad_user_data, ad_personalization) are set to denied. In this state no identifying cookies are set; Google receives only anonymous ping signals without personal data.

Link with Google Ads (conversion measurement and remarketing): Our GA4 property is linked to our Google Ads account. Only if your consent has been given (ad_storage, ad_user_data, ad_personalization set to granted) are GA4 events (e.g. completed bookings as a “purchase” event) and GA4 audience lists transferred to Google Ads and used there for measuring the performance of our advertisements, for reports and for personalised advertising (remarketing). If you reach the website via one of our Google advertisements, your browser also stores, likewise only after consent, the Google click ID as the first-party cookie ft_gclid (90 days), with which we attribute a later booking to the advertisement. Without consent, transfer, personalisation and click attribution do not take place at all.

Advertisements in ChatGPT (OpenAI Ads): We place advertisements in ChatGPT. If you reach our website via such an advertisement and have consented to marketing use, we load the measurement script from OpenAI (OpenAI Ireland Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland; parent company OpenAI, L.L.C., San Francisco, USA). It stores the click reference passed on by the advertisement as the first-party cookies __oppref and __obref (30 days) and reports to OpenAI whether the click has resulted in an enquiry (guide, contact form) or a booking (booking reference, amount), so that we can measure the success of the advertisements. Contact data is transferred in this process, if at all, only as a SHA-256 hash. Without consent the script is not loaded. Independently of this, we keep the click reference and the campaign details from the address bar for the duration of your visit in the sessionStorage of your browser (not a cookie), in order to attribute an enquiry or booking internally to the advertisement; we do not pass these values on to OpenAI. Legal basis: Art. 6(1)(a) GDPR, § 25(1) TDDDG (consent) or Art. 6(1)(f) GDPR for the internal attribution. For OpenAI, the EU standard contractual clauses apply as a safeguard for the third-country transfer.

Third-country transfer to the USA: A data processing agreement (Art. 28 GDPR) is in place with Google. A transfer to the USA takes place. Legal bases for the third-country transfer:

• EU-US Data Privacy Framework (adequacy decision of the EU Commission of 10.07.2023; Google LLC is certified).
• EU standard contractual clauses (Art. 46(2)(c) GDPR) as a supplementary safeguard.

Despite the adequacy decision, residual risks remain due to access rights of US authorities (e.g. FISA 702). You can avoid these risks entirely by declining analytics consent.

Retention period: 14 months (GA4 default setting).

Legal basis: Art. 6(1)(a) GDPR and § 25(1) TTDSG (consent). Withdrawal at any time via “Cookie settings” in the footer.

Privacy notices from Google: policies.google.com/privacy. Additional browser opt-out via the Google Analytics opt-out add-on: tools.google.com/dlpage/gaoptout.

7a. Usage Analysis with Microsoft Clarity

On this website we use, only with your explicit consent, Microsoft Clarity, an analysis service of Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA (“Microsoft”).

Purpose: Clarity helps us to understand how visitors operate our website, in particular where abandonments occur in the booking process. For this purpose the service creates session recordings (session replays) and heatmaps (click, scroll and movement patterns). We do not carry out any behavioural evaluation of individual, identifiable persons for advertising purposes.

Data processed: mouse movements, clicks, scroll depth, pages visited and length of stay, device and browser information, operating system, screen size and the approximate location (derived from the IP address). According to its own information, Microsoft truncates or masks the IP address before storage. Text entries and sensitive content are by default made unrecognisable by the activated masking function of Clarity before they are added to our recordings.

Cookies: After consent, Clarity sets first-party cookies, including _clck (approx. 1 year), _clsk (approx. 1 day) and CLID (approx. 1 year), which attribute sessions to a pseudonymous user profile.

No loading without consent: Unlike Google Analytics, Clarity sends no data whatsoever before your consent: the Clarity script is loaded only after you click “Accept all”. If you select “Essential only”, no transfer to Microsoft takes place.

Third-country transfer to the USA: A data processing agreement (Microsoft Data Processing Addendum, Art. 28 GDPR) is in place with Microsoft. A transfer to the USA takes place. The legal basis for the third-country transfer is the EU-US Data Privacy Framework (adequacy decision of the EU Commission of 10.07.2023; Microsoft Corporation is certified). Despite the adequacy decision, residual risks remain due to access rights of US authorities (e.g. FISA 702). You can avoid these risks entirely by declining statistics consent.

Retention period: Session recordings are deleted after 30 days in accordance with the Microsoft standard; aggregated evaluations are retained beyond this only in non-personal form.

Legal basis: Art. 6(1)(a) GDPR and § 25(1) TTDSG (consent). Withdrawal at any time via “Cookie settings” in the footer; after withdrawal, Clarity is no longer loaded.

Privacy notices from Microsoft: privacy.microsoft.com/de-de/privacystatement. Further information on Clarity: clarity.microsoft.com/terms and learn.microsoft.com/clarity.

8. Error Tracking with Sentry

To detect and remedy technical errors on the website we use Sentry, a service of Functional Software, Inc. d/b/a Sentry, 132 Hawthorne Street, San Francisco, CA 94107, USA. EU contractual partner: Sentry GmbH, Berlin.

Data processed: when an error occurs, technical information is captured (browser and device type, screen size, URL of the faulty page, stack trace, timestamp, IP address). We have configured Sentry in a privacy-friendly manner:

• sendDefaultPii: false: cookies, headers and body are not transferred automatically.
• Session replay is disabled by default (replaysSessionSampleRate: 0); in the event of errors, at most 10% of sessions are captured as a replay in order to trace problems.
• Query strings in breadcrumbs are removed before transfer (beforeBreadcrumb hook) in order to avoid an accidental transfer of URL parameters (e.g. IDs).
• Form contents, entries in search fields and plain-text entries are not captured.

Third-country transfer to the USA: Sentry may transfer data to US servers. A data processing agreement including EU standard contractual clauses is in place with Sentry. Functional Software Inc. is certified under the EU-US Data Privacy Framework.

Retention period: 90 days (Sentry standard for error events).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in an error-free, secure web offering). Without error tracking, critical bugs (e.g. in the booking process) could remain undetected and cause financial losses for users.

Privacy notices from Sentry: sentry.io/privacy.

9. Contacting Us

You can contact us in various ways. Depending on the channel chosen, different data is processed:

9.1 Email, contact form, telephone

The data you provide (name, contact details, address if applicable, content of the enquiry) is processed. The processing takes place in order to deal with your enquiry.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures or initiation of a contract) or Art. 6(1)(f) GDPR (legitimate interest in answering general enquiries).

Retention period: 6 months after completion of the enquiry, unless a booking is concluded. If a booking is concluded, the retention periods under tax law apply (see section 15).

9.2 WhatsApp

If you contact us via WhatsApp, your messages, telephone number, profile picture and profile name are transferred to WhatsApp Ireland Ltd. (4 Grand Canal Square, Dublin). WhatsApp Ireland forwards data to its parent company Meta Platforms, Inc., 1601 Willow Road, Menlo Park, CA 94025, USA. WhatsApp encrypts content end-to-end; metadata (who, when, with whom) is, however, accessible to WhatsApp.

Third-country transfer to the USA: Via the EU-US Data Privacy Framework (Meta Platforms Inc. is certified) and EU standard contractual clauses. Nevertheless, residual risks remain due to access rights of US authorities.

Legal basis: Art. 6(1)(a) GDPR (consent through your active choice of the communication channel) and Art. 6(1)(b) GDPR (initiation of a contract).

If you prefer to contact us without a transfer to the USA as a third country, you can alternatively reach us by email at home@fewo-tebben.de or by telephone at +49 (0) 441-212132300.

10. Booking and Payment Processing (Stripe)

We use Stripe to process online payments. The contractual partner for EU customers is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland; data may be transferred to the parent company Stripe, Inc., 510 Townsend Street, San Francisco, CA 94103, USA.

Data processed: name, email address, billing address, payment data (credit card or SEPA direct debit data), transaction amount, booking reference, IP address (for fraud prevention). The payment data is not routed via our servers, but entered directly into a Stripe iFrame (Stripe Elements).

Role: Stripe processes the data as an independent controller (joint controller for fraud prevention).

Third-country transfer to the USA: Via the EU-US Data Privacy Framework (Stripe Inc. is certified) and EU standard contractual clauses.

Legal basis: Art. 6(1)(b) GDPR (performance of the accommodation contract).

Booking metadata and advertisement attribution: When an online booking is completed, we additionally store your IP address and the page last accessed (referrer) and, if you have consented to marketing cookies, campaign parameters (UTM) and the Google click ID (gclid, see sections 6 and 7). Purposes: traceability and securing of the booking (fraud prevention) and internal measurement of whether a booking resulted from one of our advertisements. This data is processed in our internal booking notification and an internal booking log and is not passed on to third parties. Legal bases: Art. 6(1)(b) GDPR (processing of the booking), Art. 6(1)(f) GDPR (legitimate interest in fraud prevention and in measuring the effectiveness of our own advertising); for gclid/UTM, Art. 6(1)(a) GDPR (consent).

Privacy notices from Stripe: stripe.com/de/privacy.

11. Booking Management (ILOCA)

To manage availability, bookings and guest data we use the booking system ILOCA from BSE Software GmbH, Germany (iloca.de).

Data processed: name, email address, telephone number, postal address, travel period, number of guests, booking reference, fellow travellers if applicable.

Server location: Germany. A data processing agreement (Art. 28 GDPR) is in place with ILOCA. No transfer to third countries takes place.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (registration obligation under the BundesmeldeG for accommodation establishments).

12. Map Display (OpenStreetMap / Leaflet)

On individual pages (e.g. excursion destinations, directions) we embed interactive maps based on data from the OpenStreetMap Foundation (St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom). The tiles are loaded from tile servers of the OSM Foundation.

Data processed: When the map tiles are loaded, your IP address is transferred to the tile server of the OSM Foundation. We ourselves do not log this transfer.

Third-country transfer to the United Kingdom: Since Brexit, the United Kingdom has been regarded as a third country. In an adequacy decision of 28.06.2021 (extended 2025), the EU Commission established an adequate level of data protection. An additional safeguard is not required.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in an appealing presentation of locations). Technically, the maps are loaded only when they are scrolled into the visible area (Intersection Observer); no transfer takes place before then.

Privacy notices from the OSM Foundation: wiki.osmfoundation.org/wiki/Privacy_Policy.

13. Reviews from Booking.com

On property detail pages we show excerpts from publicly accessible guest reviews, which we take periodically from the partner portal of Booking.com (Booking.com B.V., Herengracht 597, 1017 CE Amsterdam, the Netherlands) and cache on our website.

Data displayed: first name (as stated by the guest on Booking.com, usually first name with the initial of the surname, e.g. “Markus W.”), country of origin, review score (1-10), date, review text.

Role: We pass on exclusively data that the respective guests have already made public themselves on Booking.com. Additional identification of persons via our site is not possible (no profiles, no links to Booking profiles).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in transparency and building trust; by publishing on Booking.com, guests have already consented to broad visibility).

Withdrawal: If you have been a guest with us and no longer wish to see your review on our website, please contact us informally; we will remove the entry without undue delay.

14. Sending of Emails

To send booking confirmations, cancellation confirmations, invoices and support replies we use an SMTP mail server in the European Union. No transfer to US providers (e.g. Google Workspace / Gmail) takes place during sending.

Data processed: name, email address, content of the message (booking details).

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

Note: Once the message has arrived in your mailbox, the privacy notices of your email provider apply. If you yourself use Gmail/Outlook etc., your message may be processed by these providers; we have no influence over this.

15. Storage Duration / Retention Periods

Personal data is deleted or blocked as soon as the purpose of storage no longer applies. Overview:

• Booking and invoice data: 10 years (§ 147 AO, tax law)
• Contractual correspondence: 6 years (§ 257 HGB)
• Server log files: max. 30 days (see section 5)
• Sentry error data: 90 days (see section 8)
• Google Analytics data: 14 months (see section 7)
• Microsoft Clarity recordings: 30 days (see section 7a)
• Contact enquiries without a booking: 6 months (see section 9)
• Website chat conversations without a booking: 180 days after the last message (see section 9.3)
• ILOCA booking data: for the duration of the active contractual relationship and the statutory retention period (10 years)
• Stripe payment data: in accordance with Stripe's own retention period (see stripe.com/de/privacy; currently up to 10 years for regulatory purposes)

16. Third-Country Transfer Overview

The following processing operations involve a transfer of personal data outside the EU/EEA:

Note on residual risks in the USA: Despite the EU-US Data Privacy Framework, fundamental concerns remain regarding access rights of US authorities (FISA 702, EO 12333). Where this was possible without loss of functionality, we have deliberately chosen EU providers (Hetzner for hosting, ILOCA for booking management, Booking.com B.V. based in the Netherlands, EU SMTP for sending emails).

17. Your Rights

You have the following rights in relation to us:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing based on legitimate interests (Art. 21 GDPR)
• Right to withdraw consent given, with effect for the future (Art. 7(3) GDPR), at any time via “Cookie settings” in the footer
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

You may exercise your rights against us informally by email to home@fewo-tebben.de or by post. We deal with requests without undue delay, in any event within the statutory period of one month (Art. 12(3) GDPR; extendable by two months for complex requests where applicable).

Competent supervisory authority: Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, lfd.niedersachsen.de.

18. Obligation to Provide Data

The provision of your personal data when visiting our website is neither required by law nor by contract. There is no obligation to provide information.

For a booking, however, the provision of the data necessary for processing the contract (name, address, contact details, payment data) is required so that we can conclude and perform the accommodation contract. If the data is not provided, no booking can take place. In addition, we are legally obliged to record registration data in accordance with the Federal Registration Act (Bundesmeldegesetz, BundesmeldeG).

19. Automated Decisions / Profiling

No automated decision-making including profiling within the meaning of Art. 22 GDPR takes place on this website. Bookings are processed manually or according to fixed (non-profile-based) availability rules in the booking system ILOCA. The automatic first response in the website chat (section 9.3) merely asks follow-up questions and makes no decision; every enquiry is dealt with personally by the host team.

20. Technical and Organisational Measures (TOMs)

We take technical and organisational measures in accordance with Art. 32 GDPR to protect your data:

• Transport encryption (TLS 1.2/1.3) for all connections between browser and server (HTTPS mandatory).
• Strict Content Security Policy (CSP) in the HTTP header against cross-site scripting and data exfiltration.
• Restriction of access on a need-to-know basis (role-based access concept, MFA for administrative access).
• Regular security updates of the server and the software components used.
• Daily encrypted backups; separate storage of backup and production system.
• Commitment of employees to data secrecy (Art. 28(3)(b) GDPR for processors).

21. SSL/TLS Encryption

For security reasons, this site uses SSL/TLS encryption. You can recognise an encrypted connection by the fact that the address bar of the browser begins with “https://” and a padlock symbol is displayed.

22. Protection of Minors

Our offers are not specifically directed at persons under the age of 16. Persons under the age of 16 may not transmit personal data to us or make a booking without the consent of their legal guardians (Art. 8 GDPR in conjunction with § 110 BGB).

Should we become aware that a person under the age of 16 has transmitted data without the corresponding consent, this data will be deleted without undue delay.

23. Changes to This Privacy Policy

We reserve the right to amend this privacy policy so that it always complies with current legal requirements or in order to implement changes to our services (e.g. when introducing new services). The new privacy policy will then apply to your next visit. We additionally communicate material changes to active contractual partners by email.