1. Collection and storage of personal data
a) Visit the website
With every visit to our website, our server automatically collects technical connection data: IP address, date and time of access, file accessed, website from which accessed, and browser and operating system information. This data is solely used to establish the connection and to keep the website stable and secure. It is not used to draw conclusions about individual persons. The transmission of this data is technically necessary for the website to function; without it, the website cannot be displayed.
The technical provision of our website is carried out by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, with which an order processing agreement in accordance with Art. 28 GDPR exists. The storage duration of the connection data is 7 days, after which it is automatically deleted.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and stable operation of the website, in particular in the detection and defense against attacks.
b) Contacting
When you contact us by email or telephone, we process the information you provide to us, such as your name, contact details, information about your property and your request.
If your request concerns our services or a possible collaboration, the legal basis is Art. 6(1)(1)(b) GDPR (pre-contractual measures). In all other cases, the legal basis is Art. 6(1)(1)(f) GDPR; our legitimate interest lies in answering inquiries from you. The provision of your data is voluntary; however, without it we cannot process your request.
Our email inbox is provided by IONOS SE, with which an order processing agreement in accordance with Art. 28 GDPR exists.
We delete your data as soon as it is no longer necessary for processing your request. If no cooperation is reached, this will take place no later than six months after our last communication. If cooperation is reached, we will store the data for the duration of the contractual relationship. Legal retention obligations, such as those under § 257 HGB or § 147 AO (usually six to ten years), remain unaffected; the legal basis for the retention is Art. 6(1)(c) GDPR in this respect.
c) Cookies and similar technologies
Our website uses only technically necessary cookies and comparable storage technologies, such as your browser's local storage. They are necessary for the website to function and are not used for analysis, advertising or statistical purposes. Consent is not required for this under § 25, paragraph 2, no. 2 of the TDDDG, which is why we do not display a cookie banner to you.
In detail, the following can be processed:
– a randomly generated session or device identifier to match your requests during a visit,
– your language selection, so that the website is displayed in the language of your choice,
– Website display settings, such as the state of individual page elements,
– security-related identifiers that differentiate automated access from regular visits.
These identifiers are considered personal data within the meaning of Article 4(1) of the GDPR. We do not associate them with your name or other information about you and do not draw any conclusions about you as an individual.
The legal basis for storing and reading the information on your end device is § 25, paragraph 2, no. 2 of the TDDDG; for the subsequent processing, Art. 6, paragraph 1, letter f of the GDPR. Our legitimate interest lies in making the website functional, secure, and available in the language of your choice.
The mentioned cookies are deleted at the latest when you close your browser; individual settings, such as the language selection, can remain stored for up to twelve months. You can delete or block cookies at any time via the settings of your browser. In this case, you may not be able to fully use all the functions of the website.
d) Protection against attacks and delivery of the content
(Keep this section only if Cloudflare is in use.)
To protect against attacks and to deliver our content more quickly, we use the services of Cloudflare Germany GmbH, Rosental 7, 80331 Munich, a subsidiary of Cloudflare, Inc., USA. Traffic to our website is routed through servers from Cloudflare. Cloudflare processes your IP address, information about the content accessed, as well as browser and device data, and sets technical cookies to detect automated access.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the defense against attacks and in the secure and reliable provision of our website. An order processing agreement has been concluded with Cloudflare pursuant to Article 28 GDPR.
Processing in the United States cannot be ruled out. The transfer is based on the EU Commission’s standard contractual clauses pursuant to Art. 46(2)(c) GDPR. Despite these guarantees, it cannot be completely ruled out that US authorities will access the data and that you will not have the same legal remedies against such access as within the European Union. For more information, please refer to the privacy policy of Cloudflare.
2. Fonts
To display fonts uniformly, our website uses Google Fonts, which are locally integrated on our own server. There is no connection to Google servers involved; no data is transmitted to Google.
3. Tracking, third countries and automated decision-making
We do not use analysis or tracking tools, nor cookies for marketing or statistical purposes. We do not embed third-party content, such as videos, maps, or social networks, directly into our website. Beyond the cases mentioned in this statement, your data will not be transferred to countries outside the European Union or the European Economic Area. Automated decision-making, including profiling within the meaning of Article 22 GDPR, does not take place.
(Without Cloudflare, replace the third sentence with: „Your data will not be transferred to countries outside the European Union or the European Economic Area.“)
4. Rights of the affected parties
You have the right to information (Article 15 GDPR), rectification (Article 16 GDPR), deletion (Article 17 GDPR), restriction of processing (Article 18 GDPR), data portability (Article 20 GDPR), and the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR).
For the exercise of your rights, a simple message is sufficient. hello@great-stay.com.
The Berlin Data Protection and Information Freedom Commissioner is responsible for us: Alt-Moabit 59–61, 10555 Berlin. You can also contact the supervisory authority at your usual place of residence or workplace.
5. Right of objection
To the extent that your data is processed based on legitimate interests pursuant to Art. 6(1)(f) GDPR, you may object to this processing in accordance with Art. 21 GDPR, provided that there are reasons arising from your particular situation.
7. Data security
To protect the transmitted data, our website uses TLS encryption (HTTPS). In addition, we take technical and organizational measures to protect the data stored with us from loss, manipulation, and unauthorized access.
8. Timeliness of this privacy policy
Status: September 2026. Changes to the website or legal requirements may require an update.