Privacy notice

1. Controller and contact

Titus Projektentwicklungsgesellschaft mbH
Schüllsmühle 5, 52353 Düren, Germany
Represented by managing director Jacline Hinz
Email: info@inundout.info
Telephone: +49 173 6211412

You can also use these contact details to exercise your data protection rights.

2. Providing this website

When you visit, your IP address, request time, requested resource and technical browser information are transmitted to the hosting infrastructure. This is needed to deliver and secure the website. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is a secure and functional website.

The website is provided through OpenAI Sites with Cloudflare infrastructure. The domain is registered with Strato. The hosting platform's technical cookies and logs are separate from our own website code. Sign-in data processed for the protected administration area is described below.

To be completed before public launch: the applicable hosting contract, contractual entity and address, actual logs, retention periods, data processing agreement and, where applicable, recipients outside the EEA and transfer safeguards. The completed website must also be checked on its final domain.

3. Privacy settings & optional statistics

We use our own website statistics only after you choose “Allow statistics”. Without consent, we do not send analytics events or create analytics identifiers. You can use and book through the website without allowing statistics.

With consent, we count visitors, visits, public page views and clicks on booking or WhatsApp links. The browser receives a random visitor identifier for up to 30 days and a session identifier that expires after 30 minutes of inactivity. We store only hashed identifiers, the day, a public page path, an event category and a coarse source category (e.g. Google). We do not store IP addresses, full referrer URLs, search terms, guest names or form contents in this analytics database. No fingerprinting, advertising pixel or Google Analytics is used.

The controller is the company named above. The purpose is to measure use of our website and improve our room information. The legal bases are your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. The data is processed in our existing website hosting infrastructure; the hosting information above also applies to analytics. Only authorised administrators can access the aggregated reports.

Analytics records are excluded from reports after 90 days and deleted when the next analytics event is processed. The choice cookie (up to 180 days) is necessary to remember your privacy decision; its legal basis is section 25(2) TDDDG and Article 6(1)(f) GDPR. The cookies are named __Host-inout_consent, __Host-inout_visitor and __Host-inout_session.

Use “Privacy settings” in the footer to refuse or withdraw at any time. Withdrawal stops further collection and removes the analytics identifiers from this browser; it does not affect the lawfulness of prior processing. Existing pseudonymous records expire as described above. Browser Do Not Track and Global Privacy Control signals prevent collection. Deleting cookies or using another browser may cause a visitor to be counted again.

Fonts and images are served locally. External booking, map, WhatsApp and social links load their destination only when opened. The hosting platform and protected administration login may use their own technical cookies.

4. Email, telephone and company enquiries

When you contact us, we process your contact details and enquiry to respond and arrange a stay. For your own contractual or booking enquiries, the basis is Article 6(1)(b) GDPR. For other business enquiries, including contacts acting for a company, it is Article 6(1)(f) GDPR; our legitimate interest is handling the enquiry.

When the company form shows “Send enquiry”, your company name, email address, travel dates, guest and room counts, and optional message are sent through our web server and Resend to our mailbox. Resend processes the message and address data needed to send the email. When direct sending is disabled, “Prepare enquiry” opens your email app instead. To prevent abuse, we record sending attempts with a timestamp, random request ID and a daily changing cryptographic value derived from your IP address. Message contents are not stored in this sending counter. Entries older than 32 days are removed on successful sending. Provider information: Resend privacy policy.

Still to be added: our email provider and the mailbox retention and deletion rules.

5. Booking through Hostaway / Holidayfuture

“Book now” and the room booking links open our external booking website at inundoutboardinghaus.holidayfuture.com. Our website code loads that site only when you follow the link. The booking takes place there.

To arrange and manage a stay, we process the necessary names, contact details, arrival and departure dates, room and guest numbers, booking communications, billing details and, where applicable, payment information. Where you make your own booking, the basis is Article 6(1)(b) GDPR. Where an employer or another person books for you, we may receive the necessary guest, contact and travel details from them. Processing to organise that stay relies on Article 6(1)(f) GDPR; the legitimate interests are those of the booking party and our business in carrying out the reservation. Statutory record-keeping relies on Article 6(1)(c) GDPR.

The booking process identifies the information required to enter into and perform the contract. Without that information, we may be unable to accept or carry out the booking. Additional information is voluntary unless a separate legal obligation applies.

Hostaway identifies Hostaway Opco Oy, Finland, in its privacy policy. Its role depends on the processing activity and our contract. The provider's policy does not replace our information about how your booking data is handled.

To be confirmed: our Hostaway contracting entity, data processing agreement, enabled integrations, payment providers, retention periods, recipients outside the EEA and applicable transfer safeguards. Cookie consent on the booking website must be reviewed and configured separately.

6. WhatsApp Business

We use the WhatsApp Business app.

Using WhatsApp is optional; you can also contact us by email or telephone. When you send a message, we process your telephone number, visible profile name where applicable, and message to handle your enquiry on the bases described in section 4. This website includes a link only.

WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, also processes usage and connection data for its own purposes. Data may be processed outside the EEA. Details of recipients and transfer mechanisms, including adequacy decisions and standard contractual clauses, are available in WhatsApp's privacy policy.

Still to be reviewed: address book synchronisation, backups, service providers and retention periods. Using the Business product alone does not establish a compliant configuration.

7. Instagram, Facebook and Google Maps

The contact section and footer contain ordinary links. No social feeds, tracking pixels, chat widgets or external maps are embedded. Displaying these links does not itself cause our website code to connect to Meta, WhatsApp or Google. The property map is a local image with local interactive markers.

Following a link opens the external service. Its operator receives connection data such as your IP address and browser information and may associate activity with your account if you are signed in. Our links are configured not to transmit an HTTP referrer. Processing on the destination service is governed by its own information: Facebook privacy policy, Instagram privacy policy and Google privacy policy. WhatsApp is described in section 6.

Social profiles — still to be completed: our Facebook and Instagram profiles are managed by Titus Projektentwicklungsgesellschaft mbH. The processing of messages, comments, page statistics and any advertising tools on our profiles must be documented separately using the actual account settings and provider terms. That includes any joint responsibilities and transfers outside the EEA. The link-only design of this website does not establish the compliance of the profiles themselves.

8. Recipients and retention

People handling your enquiry or stay may access the information they need. Depending on the process, recipients also include hosting and email providers, booking and payment services, advisers subject to professional confidentiality and competent authorities. The exact service providers and their roles must be confirmed using the contracts identified above.

Enquiries are retained until they have been dealt with and no further action is needed. Any retention after that requires a separate purpose, such as a statutory obligation or the necessary establishment, exercise or defence of legal claims. An enquiry does not automatically have to be kept for ten years.

• Invoices and accounting vouchers: generally eight years under section 14b UStG and section 147 AO.
• Commercial and business correspondence subject to retention: generally six years under section 147 AO.
• Books, inventories and annual financial statements: generally ten years under section 147 AO, where personal data is included in those records.

These statutory periods generally start at the end of the calendar year in which the relevant document was created or the correspondence received or sent. Statutory extensions may apply, for example while records remain relevant to an open tax matter. After the applicable purposes end, the data is deleted unless another lawful retention ground applies.

Statutory retention relies on Article 6(1)(c) GDPR. Necessary legal claims handling relies on Article 6(1)(f) GDPR, with the legitimate interest of protecting our legal position. This does not mean that all guest data or every chat is retained for the periods applying to accounting records.

To be confirmed operationally: actual deletion rules for enquiries, mailboxes, booking systems, chat histories, server logs and backups. Any recipients outside the EEA, applicable transfer safeguards and how to obtain a copy must also be established from the provider contracts. Exclusively European storage is not promised.

9. Your rights

Subject to the relevant legal conditions, you can exercise the following rights:

• Access to your personal data and the way it is processed (Article 15 GDPR).
• Correction or completion of inaccurate or incomplete data (Article 16 GDPR).
• Erasure of your data, subject to applicable retention obligations and exceptions (Article 17 GDPR).
• Restriction of processing (Article 18 GDPR).
• Data portability where processing is automated and based on your consent or a contract (Article 20 GDPR).
• Withdrawal of consent at any time for the future (Article 7(3) GDPR). This does not affect the lawfulness of earlier processing.

Right to object: where processing relies on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. We must then stop the processing unless overriding compelling legitimate grounds or the establishment, exercise or defence of legal claims justify its continuation. You can object to direct marketing at any time without giving a reason; your data must then no longer be processed for that purpose.

Contact info@inundout.info or write to the controller at the postal address above. You may also complain to a data protection supervisory authority, especially where you live, work or believe an infringement occurred.

For North Rhine-Westphalia, you can contact the State Commissioner for Data Protection and Freedom of Information (LDI NRW), Postfach 20 04 44, 40102 Düsseldorf, Germany; email: poststelle@ldi.nrw.de. Information about making a complaint.

10. Automated decisions

The company form does not make automated decisions with legal or similarly significant effects and does not create profiles. This notice will be updated when the website or its services change.