Protecting your personal data matters to us. With this notice we inform you, in accordance with Art. 13 and 14 of the General Data Protection Regulation (GDPR), which data we process when you visit this website, make enquiries or orders, or book a stay, what we need it for, how long we keep it and what rights you have. We collect only the data we need for the purpose in question and pass it on only where there is a reason that we state here.
The controller for data processing on this website within the meaning of Art. 4 No. 7 GDPR is:
Christine und Petra Burger GbR – Naturferienhaus ZeiTraum and Penthouse Weitsicht
Vorderzinken 8b
79215 Elzach – Yach, Germany
Telephone: +49 7682 909644
Email: zeitraum@in-yach.de
Represented by Christine Burger and Petra Burger. We have not appointed a data protection officer, as the statutory requirements are not met. For any questions about data protection you can reach us at the contact details above.
This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. The programs of this website (interfaces for prices, forms and orders) run in data centres in Frankfurt am Main (EU); page content may be delivered via servers of the Vercel network close to you. When a page is requested, the hosting provider processes technically necessary access data (server log files): IP address, date and time, requested address, amount of data transferred, status code, browser and operating system details and the page visited before. This is necessary to deliver the website, to ensure its stability and security and to fend off attacks. The logs are stored only for a short time and are not evaluated by us.
The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a secure and functioning website). A data processing agreement under Art. 28 GDPR exists with Vercel. The connection to our website is encrypted using TLS/HTTPS.
Our website itself sets no cookies and uses no techniques to recognise your device for analytics or advertising. The chosen language is contained only in the web address (/ or /en/); it is not stored.
Your browser’s local storage (localStorage): Only if you tick “Remember these details for next time” in the bakery service or Regional delights, your browser stores your name, apartment and contact detail on your own device so that you do not have to enter them again next time. This does not transmit them to us. The legal basis is your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR), which you give by ticking the box. You can delete the details at any time in your browser settings. For staff of the house, the internal area (section 10) keeps the login in local storage; this does not affect visitors to the website.
Through embedded third-party services (booking system Smoobu, section 6; Google Maps, section 11), information may, according to the providers, be stored on or read from your device. You will find details there.
If you contact us via the contact form, by email or by telephone, we process your details (form of address, first and last name, email address, telephone number where given, content of your message) in order to handle and answer your enquiry. Required fields are marked in the form; without them we cannot reply.
After you send the form you receive an automatic acknowledgement at the address you entered. Its text is fixed and contains nothing from your message. To protect against automated submissions the form contains a hidden field and a simple sum; both are evaluated only on our server or in your browser, without a third-party service. We also limit the number of submissions per sender (section 12, Upstash).
The legal basis is Art. 6(1)(b) GDPR where your enquiry is aimed at a contract (e.g. a booking), and otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). We delete your enquiry once it has been dealt with and no statutory retention obligations apply (for business correspondence usually after six years, § 257 HGB, § 147 AO). We use the email service provider Resend for technical delivery (section 12).
Availability and prices. Our server retrieves the calendar and prices on the apartment pages from Smoobu; no data about you is transmitted to Smoobu in the process. The number of guests and the dates you enter in the calendar are used only to calculate the price.
Booking tool. The availability search on the home page and the booking form on the apartment pages come directly from Smoobu GmbH, Wattstraße 11, 13355 Berlin, Germany. The booking form is loaded only when you choose “Book” or “Book now”; the search on the home page is loaded when you open the home page. When it is loaded, your IP address and technical details (e.g. browser, time) are transmitted to Smoobu and to the services Smoobu uses for delivery, in particular Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. According to Smoobu, technically necessary cookies or browser storage may be used. The legal basis is Art. 6(1)(b) GDPR (pre-contractual steps at your request) or Art. 6(1)(f) GDPR (legitimate interest in a working online booking offer) and § 25(2) No. 2 TDDDG.
Booking data. When you book, we process the data required to conclude and perform the accommodation contract: form of address, first and last name, address, email address, telephone number, travel dates, number of guests (where necessary names and ages of accompanying persons), arrival time, payment method and your messages to us. Without this data we cannot accept the booking. The legal basis is Art. 6(1)(b) GDPR. Payment is made as stated at booking (deposit after invoice or confirmation, balance on site); you do not enter payment data on the website.
Recipients. Smoobu operates the booking and management system on our behalf (data processing under Art. 28 GDPR). Further recipients are our tax adviser and the tax authorities and – where required by law – authorities and the bodies responsible for the tourist tax and guest card (see below).
Registration duties, tourist tax, guest card. When we accommodate guests from abroad we are required under §§ 29, 30 of the German Federal Registration Act (BMG) to keep special registration forms; we keep them for one year and then destroy them (Art. 6(1)(c) GDPR). For collecting the tourist tax and for the KONUS guest card we pass on the necessary details (name, period of stay, number of persons) to the competent body; the legal basis is Art. 6(1)(c) GDPR or Art. 6(1)(b) GDPR (the guest card service for you).
Retention. We keep booking and invoice data in line with commercial and tax retention periods (generally six to ten years after the end of the calendar year, § 257 HGB, § 147 AO; Art. 6(1)(c) GDPR) and delete it afterwards. We do not use contact details from completed stays for advertising.
Order. If you order a gift voucher via the website, we process your name, email address, billing address, telephone number and note where given, and the voucher details (amount, chosen photo, name of the person receiving the gift, personal dedication and – if you choose delivery to the recipient – their email address). Your order reaches us by email (Resend, section 12) and is not stored on the website. We then issue an invoice (accounting software) and send the voucher by email once payment has arrived. The legal basis is Art. 6(1)(b) GDPR. If you give the name and email address of a recipient, please make sure you are entitled to do so; we use these details only to deliver the voucher.
Voucher register. We keep the issued voucher (number, amount, names, dedication, validity, invoice number, notes on payment and redemption, booking note) in our register so that it can be checked when redeemed and cannot be redeemed twice (Art. 6(1)(b) GDPR). The register is held in a database at Supabase (section 12). Retention: for the validity period and the tax retention periods (Art. 6(1)(c) GDPR, § 147 AO).
If you order bread rolls or breakfast items via our website or the QR code in the apartment, we process the details from the order form: apartment, delivery days, items and quantities, notes and – depending on the route – your name, arrival and departure date and your email address or telephone number (for an order via the QR code in the apartment only apartment, delivery days and items; name and note are optional). The order is stored in our database (Supabase, section 12) so that we can fulfil it and settle it on site. Payment is made on site. The legal basis is Art. 6(1)(b) GDPR. We delete order data once it is no longer needed for delivery and settlement; records we need for accounting are kept according to the periods in section 6. For “remembering” details in your browser see section 4.
We currently offer no newsletter through this website. You will not receive advertising emails from us unless you have expressly consented or the statutory requirements for advertising to existing customers (§ 7(3) UWG) are met; you can object to this at any time.
For staff and caretakers of the house there is a non-public area (/intern/) with task management, calendar, order overview and voucher administration. There we process name, email address, role, login times and the content users enter. The legal basis is Art. 6(1)(b) GDPR in conjunction with § 26 BDSG or Art. 6(1)(f) GDPR (organisation of the business). The data is held at Supabase in Frankfurt am Main (section 12). Accounts become active only after approval by an administrator and are blocked when someone leaves.
Google Maps (only with your consent). On the contact page, maps from Google Maps (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) can be shown. They are not loaded automatically: only when you click “Load map” is a connection to Google established and your IP address transmitted to Google; Google may set cookies and – if you are signed in to a Google account – associate the visit with your account. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you can withdraw at any time by reloading the page. Alternatively you can open the address directly in Google Maps via a link; Google’s privacy policy applies then too.
Instagram posts. On the home page we show recent posts from our Instagram account @imzeitraum. We retrieve the post data on our server; the associated images and videos, however, are loaded from servers of Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland, in the course of which your IP address is transmitted to Meta. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in an attractive presentation of our offer). You can object at any time (section 15). If you open a post or follow our links to Instagram and Facebook, Meta’s privacy policy applies; the links are simple references without embedded plug-ins.
Fonts. The fonts used are delivered from our own server. There is no connection to Google Fonts.
External links. Our pages contain links to third-party offers (e.g. bike hire via ZweiTälerLand Tourismus, Playtomic, Instagram). Data is transmitted to these providers only once you click them; their privacy policies apply.
Where required, data processing agreements under Art. 28 GDPR exist with the following service providers. We use them to run this website and our offer securely and reliably (Art. 6(1)(b) and (f) GDPR):
Third countries. With Vercel, Smoobu (via Cloudflare), Supabase, Resend, Upstash and – only if you click – Google and Meta, data may be processed in the USA. The transfer relies on the European Commission’s adequacy decision on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission’s standard contractual clauses under Art. 46(2)(c) GDPR. There is a risk that US authorities may access data without you having the same legal remedies as you know them in the EU.
We use your data only for the purposes stated. We pass it on to third parties only where this is necessary to perform the contract (e.g. Smoobu, payment handling), you have consented, we are legally obliged to (e.g. registration duties, tax and supervisory authorities) or disclosure is necessary to assert or defend legal claims. We neither pass your data on for advertising purposes nor sell it. Access to your data is limited to the people who need it for their tasks.
We protect your data by technical and organisational measures: encrypted transmission (TLS), access to databases restricted by role and permission checks, personal user accounts with strong passwords in the internal area, limiting and checking of inputs, separate storage of access keys and regular review. Complete security of data transmission on the internet, in particular by email, cannot be guaranteed. Please send confidential information to us by post.
You have the following rights against us regarding the personal data concerning you:
Right to object (Art. 21 GDPR). You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you that is based on Art. 6(1)(f) GDPR. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims. If your data is processed for direct marketing, you can object at any time without giving reasons.
To exercise your rights an informal message to zeitraum@in-yach.de or to the address in section 1 is enough. We generally answer within one month.
Without prejudice to other remedies, you have the right under Art. 77 GDPR to lodge a complaint with a data protection supervisory authority if you believe that the processing of your data infringes the GDPR. The authority responsible for us is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Lautenschlagerstraße 20, 70173 Stuttgart, Germany
Telephone: +49 711 615541-0
Email: poststelle@lfdi.bwl.de
Providing your data is neither generally required by law nor by contract; it is, however, necessary if you wish to book, order or write to us, because otherwise we cannot provide the respective service or reply to you. There is no exclusively automated decision-making including profiling within the meaning of Art. 22 GDPR.
Persons under 18 should not send us personal data without the consent of their parents or guardians. We do not specifically request data from children and young people. Age details given when booking serve only to plan prices and occupancy.
We adapt this privacy notice when our offers, the services we use or the legal situation change. The version published on this page applies.
Version: October 2026