Thank you for your interest in our website. The protection of your personal data is very important to us. In the following, you will find information on how we handle your data that is collected through your use of our website, as well as information on how we handle your data if you are a customer, interested party or business partner. Your data will be processed in accordance with the legal regulations on data protection.
When contacting the Data Protection Officer, please state the company to which your enquiry relates. Please refrain from enclosing sensitive information, such as a copy of an ID card, with your request.
Definitions
Our privacy policy is intended to be simple and understandable for everyone. In this privacy policy, the official terms of the General Data Protection Regulation (GDPR) are generally used. The official definitions are explained in Art. 4 GDPR.
General information on data transfers to third countries
Your data may, where applicable, also be processed in countries outside the European Union (EU) and the European Economic Area (EEA).
For data transfers to certain third countries, an adequacy decision of the European Commission pursuant to Art. 45(1) GDPR may exist. Such a decision establishes that an adequate level of data protection exists in the third country. A list of the adequacy decisions adopted to date can be viewed at the following link: Data protection adequacy for non-EU countries.
The scope of an adequacy decision may also be limited to a specific group of recipients or made subject to further conditions.
For example, the adequacy decision for data transfers to the USA applies only to companies certified under the EU-U.S. Data Privacy Framework. The certification status of a participating company can be viewed at the following link: Participant Search (dataprivacyframework.gov).
When your data is transferred to recipients in third countries for which no adequacy decision exists, there is a risk that authorities there may access your data for security and surveillance purposes without you being informed or being able to seek legal remedies.
To safeguard an adequate level of data protection when transferring your data to recipients in such third countries, we therefore ensure that appropriate safeguards within the meaning of Art. 46 GDPR are in place.
As a rule, either we or the service providers we engage conclude Standard Contractual Clauses of the European Commission pursuant to Art. 46(2)(c) GDPR. They oblige the recipient of the data in the third country to process it in accordance with the European level of protection. The clauses can be viewed at the following link: Publications on the Standard Contractual Clauses (SCCs) - European Commission. If you require further information on the modules of the Standard Contractual Clauses we have concluded in individual cases or on supplementary measures, we will gladly provide you with a copy. In this case, simply contact us using the contact details given above under Controller.
In the case of certain recipients, data transfers may also be based on binding corporate rules (BCR) approved by the supervisory authorities pursuant to Art. 46(2)(b) GDPR. These can be viewed at the following link: Approved Binding Corporate Rules | European Data Protection Board.
Where the Standard Contractual Clauses or binding corporate rules are not sufficient to ensure the level of protection, additional technical, contractual or organisational measures are taken to safeguard the data transfer. In addition, it is regularly reviewed and assessed whether these additional measures continue to ensure a sufficient level of data protection or whether further supplementary measures need to be taken.
Further information on data transfers to third countries can be found, where relevant, below in the sections on data processing or the services used, under "Data Processing in Third Countries".
Access to and storage of information in terminal equipment
By using our website, information (e.g. IP address) may be accessed or stored (e.g. cookies) in your terminal equipment. This access or storage may involve further processing of personal data within the meaning of the GDPR.
In cases where such access to information or such storage of information is absolutely necessary for the technically error-free provision of our services, this is done on the basis of § 25 Abs. 2 Nr. 2 TDDDG.
In cases where such a process serves other purposes (e.g. the needs-based design of our website), this will only be carried out on the basis of § 25 Abs. 1 TDDDG with your consent in accordance with Art. 6(1)(a) GDPR. The consent can be revoked at any time for the future.
For further information on the processing of your personal data and the relevant legal bases in this context, please refer to the section "Cookies" below and the following sections on the specific processing activities on our website.
Web hosting
This website is hosted by an external service provider (Amazon Web Services). This website is hosted in Ireland. Personal data collected on this website is stored on the host's servers. This may include, but is not limited to, IP addresses, contact requests, meta and communication data, website traffic and other data generated by this website.
We collect the listed data in order to be able to guarantee a smooth connection setup of the website and a technically error-free provision of our services. The processing of this data is absolutely necessary to provide you with the website. The legal basis for the processing of the data is our legitimate interest in the correct presentation and functionality of our website in accordance with Art. 6(1)(f) GDPR.
We have concluded an order processing contract with the external service provider in accordance with the requirements of Art. 28 GDPR, in which we oblige the external service provider to protect our customers' data and not to pass it on to third parties.
Server log files
When you access our website, it is technically necessary for data to be transmitted to our web server via your internet browser. The following data is recorded during an ongoing connection for communication between your internet browser and our web server:
Date, time and duration of the request
Name of the requested file
Page from which the file was requested
Access status
Web browser and operating system used
(Complete) IP address of the requesting computer
Transmitted data volume
Http referrer and http-method
We collect the listed data in order to be able to guarantee a smooth connection setup of the website and a technically error-free provision of our services. The processing of this data is absolutely necessary to provide you with the website. The log files are used to evaluate system security and stability as well as for administrative purposes. The legal basis for the processing of the data is our legitimate interest in the protection and functionality of our website in accordance with Art. 6(1)(f) GDPR.
For reasons of technical security, in particular to defend against attempted attacks on our web server, we store this data for a short period of time. After 7 days at the latest, the data is anonymised by shortening the IP address at domain level, so that it is no longer possible to establish a link to the individual user.
In addition, the data is processed anonymously for statistical purposes, if necessary. This data is never stored together with other personal data of the user, compared with other data or passed on to third parties.
Registration
On all of our websites, you have the option to register a customer account in order to search for and book holiday homes. When you create a customer account, we enable you to use a unified login (Single Sign-On) across various websites of our company. In this process, your booking data from all our websites is centrally consolidated. This serves to provide you with a more convenient user experience, simplify the login process, and give you an overview of all bookings you have made on our websites.
If you would like to register as a host, you can do so via Holidu Hosts GmbH at https://www.holidu.de/host.
As part of the regular registration and setup for the services of Holidu GmbH, we collect and use the following personal data:
First and last name or nickname
Email address
Date and time of registration
Password
As soon as you make a booking, information regarding your bookings and stays, as well as additional data where applicable, may also be displayed in your customer account.
The registration and consolidation of your booking data for Single Sign-On are based on your consent pursuant to Art. 6(1)(a) GDPR. Your data will be deleted as soon as you withdraw your consent, the user account on our website is deleted, and insofar as no statutory retention obligations exist. You may request a modification and/or deletion of your user account, including the data you provided, by sending a corresponding message to the controller named at the beginning of this privacy policy.
Facebook, Apple, Google and Microsoft Sign-In
If you wish to log in or register on our website via Facebook, Google or Microsoft, you will be redirected to the provider's website, where you can enter your credentials and thus log in. In this process, the personal data you use for your account, as well as further profile information, is linked with our service.
We automatically receive the following personal data via Facebook:
Your Facebook name
Your stored email address
Your place of residence and your chosen language
Your profile picture
We automatically receive the following personal data via Google:
Email address
First and last name
Your Google ID
Your profile picture
Gender
We use this data exclusively to complete your user profile and insofar as the information is necessary to identify you. The registration/login data is passed on to us on the basis of the consent you give when you click the sign-in button of the respective provider, in accordance with Art. 6(1)(a) GDPR; where information is stored on or accessed from your terminal equipment in connection with the sign-in, this is done on the basis of § 25 Abs. 1 TDDDG. You can withdraw your consent at any time with effect for the future, for example by removing the access you granted to us in your account with the respective provider or by contacting us using the contact details above. The lawfulness of the processing carried out until the withdrawal remains unaffected. Use of this registration and login option is voluntary; you can alternatively register directly with us at any time.
As the providers have their headquarters in the USA and personal data may be transferred to the USA, further safeguards are required to ensure the level of data protection of the GDPR. The transfer is based on the European Commission's adequacy decision for the EU-US Data Privacy Framework (DPF) pursuant to Art. 45(1) GDPR; the providers are certified under the DPF, which can be verified at the following link: https://www.dataprivacyframework.gov/s/participant-search.
Further information on Google Sign-In and on data protection at Google can be found in the provider's privacy policy: https://business.safety.google/privacy/
Further information on Facebook Sign-In and on data protection at Facebook can be found in the provider's privacy policy: https://www.facebook.com/privacy/policy
When you book accommodation, we process your personal data in order to handle your booking and fulfill the contract with you as well as with the respective accommodation provider and, where applicable, additional intermediaries. The processed data (booking data) may include, in particular, the following categories of data:
Name
Email address
Telephone number
Booking information (booking period, booked accommodation, etc.)
Information regarding accompanying persons (e.g. information about the age of accompanying persons)
Payment and banking information
Description of the Data Processing and Purpose
We process your personal data (e.g. name, contact details, booking details, payment information) for the purpose of handling the booking, communicating with you and the accommodation provider and, where applicable, additional intermediaries, processing payments, and, if necessary, handling cancellations or inquiries.
Legal Basis for the Data Processing
The processing of your data is carried out for the performance of a contract pursuant to Art. 6(1)(b) GDPR (processing of your booking). Where necessary and legally permissible, we process your data beyond the actual contractual purposes in order to fulfill legal obligations pursuant to Art. 6(1)(c) GDPR (e.g. compliance with statutory retention obligations or fulfillment of local reporting obligations at the location of your accommodation).
Furthermore, processing may take place in order to safeguard our legitimate interests or those of third parties, as well as for the defense and assertion of legal claims pursuant to Art. 6(1)(f) GDPR. Where legally required, we will inform you separately, stating the legitimate interest concerned.
Recipients
Your data will be transferred to the following recipients:
Accommodation providers with whom you have booked (for the performance of the contract) and additional intermediaries where required for the processing of the booking (e.g. agencies representing multiple accommodation providers/hosts)
Payment service providers (for payment processing)
Where applicable, IT service providers or processors supporting us in the technical provision of the portal as described in this privacy policy
Where applicable, additional recipients where necessary to fulfill contractual or legal obligations
The accommodation providers process your data under their own responsibility for the fulfillment of the rental agreement existing between you and the accommodation. In this context, the accommodation providers may further process your data, for example in order to organize/prepare your arrival and departure. To provide additional services or fulfill local regulations, accommodation providers may request further information from you where applicable. Please read the privacy policies of the accommodation provider to obtain information about the processing of your data.
Should the provider of your accommodation change during the period between booking and the start of your trip, we will forward your booking data to the new accommodation provider.
Data Processing in Third Countries
As a general rule, your data will not be transferred to third countries outside the EU/EEA unless this is necessary for the performance of the contract or you have expressly consented to it (e.g. if the booked accommodation is located in a third country).
Should a transfer to third countries take place, we ensure that an adequate level of data protection is guaranteed, for example through EU Standard Contractual Clauses or an adequacy decision of the European Commission.
Storage Period
We store your personal data for the duration of the contractual processing and beyond in accordance with statutory retention periods. After the expiry of these periods, your data will be deleted unless further processing is required for other purposes stated in this declaration.
Digital Check-in – Chekin.io
On our booking platform, we integrate the service “Chekin.io” provided by Chekin S.L., Calle de la Innovación 3, 41020 Seville, Spain. Chekin.io is a digital platform for the automated guest registration and management of legal reporting obligations for accommodation businesses. If you book a Holidu accommodation (Holidu Homes) via our booking platform or one of our partner portals, you can use the service provider to check in digitally to your accommodation.
Description of the Data Processing and Purpose
Within the scope of using Chekin.io, personal data of guests (e.g. name, contact details, ID data, stay-related data) are processed. The purpose of the data processing is the digital collection, management, and transmission of guest data for the handling of your booking, as well as the fulfillment of statutory reporting obligations towards authorities and the optimization of internal administrative processes within the accommodation business.
Legal Basis for the Data Processing
The processing is carried out for the performance of a contract pursuant to Art. 6(1)(b) GDPR as well as for the fulfillment of legal obligations (Art. 6(1)(c) GDPR), particularly in connection with reporting obligations under the respective national laws.
Recipients
The recipient of the data is Chekin S.L. as a processor. As a processor pursuant to Art. 28 GDPR, Chekin is obliged to process your data exclusively in accordance with instructions and not for its own purposes. Depending on legal obligations, data may be forwarded to competent authorities (e.g. police, registration authorities).
As a general rule, processing takes place within the European Union (EU). Should a transfer to a third country nevertheless occur in individual cases, this will only take place in compliance with the legal requirements, in particular through the conclusion of Standard Contractual Clauses or on the basis of an adequacy decision by the European Commission.
Storage Period
The data are stored for the duration of the statutory retention periods and subsequently deleted unless further statutory retention or documentation obligations exist. Any further storage only takes place if this is necessary for the fulfillment of additional contractual or legal obligations.
Zendesk for answering customer queries
If you send us a request via the Website or by email, we use the ticketing system "Zendesk" to process these requests, a service provided by Zendesk Inc, 989 Market Street 300, San Francisco, CA 94102.
The data you initially provided in your enquiry will be recorded in Zendesk. This is at least your first and last name, your email address and/or your telephone number. If you have also provided us with your address and other personal data in the course of your enquiry, these will also be processed in the ticketing system. The legal basis for the processing of your data in Zendesk is Art. 6(1)(f) GDPR), our legitimate interest in the efficient processing of customer enquiries.
In principle, your personal data is processed in the EU, but since Zendesk is a provider with headquarters in the USA, a transfer of personal data to the USA cannot be ruled out. Accordingly, further protection mechanisms are required to ensure the level of data protection of the GDPR. To ensure this, we have agreed standard data protection clauses with the provider in accordance with Art. 46(2)(c) GDPR. These oblige the recipient of the data in the USA to process the data in accordance with the level of protection in Europe. In cases where this cannot be ensured even through this contractual extension, we endeavour to obtain additional regulations and commitments from the recipient in the USA.
For more information about Zendesk's data processing, please see Zendesk's privacy policy at: http://www.zendesk.com/company/privacy.
Communication via Chat
In order to efficiently respond to customer inquiries, we provide our guests with an AI-based chat function on our website and in the app. Artificial Intelligence (AI) automatically responds to simple inquiries. For more complex matters or upon request, a customer service employee will be involved. Within the scope of communication via chat, your account data are processed (only for registered users), and personal data communicated through your messages are collected. If you are not registered or logged in, you may also use the chat anonymously (provided that you do not include any personal data in your text entries).
As a general rule, we respond to your inquiry within the chat tool. However, you may also voluntarily provide your email address and/or telephone number so that your inquiry can be processed through these channels.
The legal basis for processing the data is our legitimate interest in efficiently responding to inquiries submitted at the initiative of the user pursuant to Art. 6(1)(f) GDPR. If the inquiry or messages relate to the performance of a contract or the implementation of pre-contractual measures, the legal basis for processing is Art. 6(1)(b) GDPR.
If you book accommodation via Holidu, you may contact the host and Holidu customer service directly through our chat function and communicate regarding your booking. Your chat messages will be shared with the host. You can access the chat history at any time in your conversations within the messaging section. Within the scope of the chat, personal data may be processed, in particular:
Contact and booking data (e.g. name, contact details, booked accommodation, travel dates)
Content data: text messages that you compose in the chat, including all personal information contained therein (e.g. information regarding arrival and departure, inquiries, complaints, etc.)
Metadata: time of the message, chat history, assignment to your user account
Technical data: IP address, device and browser information
Please refrain from sharing sensitive content via the chat (e.g. health data, photos of identification documents, etc.). If you do not wish to use the chat, you may contact your host at any time using the contact details provided in the booking confirmation (e.g. by telephone or email).
The legal basis for processing the data is the performance of our contract pursuant to Art. 6(1)(b) GDPR (responding to your inquiries and facilitating communication between you and your host). If your inquiry expressed in the chat does not relate to our contract, the legal basis is our legitimate interest in centralized and efficient communication between Holidu, guest, and host pursuant to Art. 6(1)(f) GDPR.
The chat contents may also be used to continuously improve the quality of the automated responses. If an inquiry is escalated by you to a human service employee or if an issue is identified within the chat history, our customer service team may review the relevant chat histories between you, the host, and the AI assistant. The purpose of this review is, on the one hand, the processing and resolution of the specific issue and, on the other hand, the evaluation of the chat histories to improve the instructions (prompts) of the AI assistant. The legal basis for this is our legitimate interest in improving our services and customer service pursuant to Art. 6(1)(f) GDPR.
The data will be deleted as soon as they are no longer necessary for achieving the purpose for which they were collected, i.e. once the reason for the inquiry has been conclusively resolved. Chat histories related to your booking are stored for the duration of the business relationship and thereafter until the expiry of statutory retention periods. Chat contents used within the scope of AI training are stored for as long as they are required to improve the AI model. Where possible, they are stored in anonymized form.
Communication via WhatsApp Business
We use WhatsApp Business, a service provided by WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, for communication purposes.
You can contact us, for example, via a button on the website. In doing so, your contact data in the form of your telephone number will be processed, as well as meta/communication data (e.g. device information, IP addresses).
We would like to point out that the communication content (i.e. the content of the message and attached images) is encrypted from end to end. This means that the content of the messages cannot be viewed, not even by WhatsApp Ireland Limited itself. You should always use an up-to-date version of Messenger with encryption enabled to ensure that message content is encrypted.
However, we would also like to point out that although the messenger providers cannot view the content, they can find out that you are communicating with us and when, as well as technical information about the device used and, depending on the settings of your device, location information (so-called metadata) is processed.
If we ask you for permission before communicating with you via Messenger, the legal basis for our processing of your data is consent pursuant to Art. 6(1)(a) GDPR. Otherwise, if we do not ask for permission and you contact us, for example, of your own accord, we use WhatsApp in relation to our contractual partners and in the context of initiating a contract as a contractual measure pursuant to Art. 6(1)(b) GDPR and in the case of other interested parties on the basis of our legitimate interests pursuant to Art. 6(1)(f) GDPR in fast and efficient communication.
We have concluded an order processing contract with the service provider in which we oblige them to protect our customers' data and not to pass it on to third parties.
As a transfer of personal data to the USA takes place, further protection mechanisms are required to ensure the level of data protection of the GDPR. To ensure this, we have agreed standard data protection clauses with the provider in accordance with Art. 46(2)(c) GDPR. These oblige the recipient of the data in the USA to process the data in accordance with the level of protection in Europe. In cases where this cannot be ensured even through this contractual extension, we endeavour to obtain additional regulations and commitments from the recipient.
WhatsApp's terms of use and information on data protection can be accessed via the following links:
You can revoke any consent given and object to communication with us and WhatsApp at any time. In this case, we delete the messages in accordance with our general deletion guidelines (i.e., e.g., as described above, after the end of contractual relationships in the context of archiving requirements, etc.) and otherwise as soon as we can assume that we have answered any information you may have provided, if no reference back to a previous conversation is to be expected and the deletion does not conflict with any statutory retention obligations.
Finally, we would like to point out that we reserve the right not to answer enquiries via WhatsApp for reasons of your security. This is the case if, for example, internal contractual information requires special confidentiality or an answer via WhatsApp does not meet the formal requirements. In such cases, we will refer you to more adequate communication channels.
Sending applications
If you apply to us via our careers page or by e-mail, we collect personal data. This includes, in particular, your contact details (such as first and last name, telephone number and user email address) as well as other data you provide about your background (e.g. curriculum vitae, qualifications, degrees and work experience) and yourself (e.g. covering letter, personal interests). This may also include special categories of personal data (e.g. information on a severe disability).
As a rule, your personal data will be collected directly from you as part of the application process and encrypted during electronic transmission. The primary legal basis for this is Section 26 (1) BDSG. In addition, consent pursuant to Art. 6(1)(a) GDPR in conjunction with § 26 Para. 2 BDSG can be used as a data protection permission provision. If the processing of your data is based on consent, you have the right to revoke your consent at any time with effect for the future.
Within our company, only those persons and departments (e.g. Human Resources) that absolutely need it to carry out the application process or to fulfil our legal obligations have access to your personal data. If necessary, your applications will be forwarded to the relevant responsible persons for examination. Under no circumstances will your personal data be passed on to third parties without authorisation.
We use the order processor "Personio" from Personio GmbH & Co. KG, Rundfunkplatz 4, 80335 Munich, to view and process applications. We have concluded an order processing agreement with this company in accordance with Art. 28 GDPR to ensure that the security of your personal data is guaranteed.
Your data relating to an application for a specific job advertisement will be stored and processed by us or in the Personio platform during the current application process. After completion of the application process (e.g. in the form of an acceptance or rejection), the application process including all personal data is deleted from the system no later than six months after completion of the application process. The data of selected applicants will be stored securely for up to 2 years, provided the applicants have given their consent to this in accordance with Art. 6(1)(a) GDPR in conjunction with § 26 para. 2 BDSG. You can revoke your consent at any time with effect for the future. An informal e-mail to the contact details of the responsible person listed above is sufficient for this purpose. In the event of an acceptance, your application documents will be transferred to the personnel file.
Writing reviews
On our website you have the possibility to leave reviews for the offered holiday homes. For this, we need your name or a pseudonym and your e-mail address (which will not be published). Furthermore, your IP address and the time of publication will be logged and stored for up to 7 days. This storage of the IP and email address is done for security reasons and in case the person concerned violates the rights of third parties or posts illegal content through a submitted comment.
Reviews can be submitted in such a way that it is not possible for other website users to identify you. It is up to you to decide whether you wish to provide personal details over and above the mandatory information. Please note that when choosing your pseudonym, as well as within the free text fields and when uploading photos, it is also possible to provide information that makes it possible to identify you personally. We recommend that you write your review text without providing personal data and design photos accordingly. We reserve the right not to publish or to (partially) anonymise reviews that contain personal data.
If the review contains personal data, the processing is based on your consent (Art. 6(1)(a) GDPR). You can revoke your consent at any time. For this purpose, an informal communication by e-mail to us is sufficient. The legality of the data processing operations already carried out remains unaffected by the revocation. In the event of revocation of your consent, we will delete or anonymise the review.
The storage of additional information (IP address) is based on our legitimate interest pursuant to Art. 6(1)(f) GDPR in the possibility of assigning the reviews to the authors. We reserve the right to delete comments if they are objected to by third parties as unlawful. The collected IP and email addresses are deleted after 7 days.
Telephone Contact – AirCall
We use the software “AirCall” (Aircall SAS, 11-15 rue Saint Georges, 75009 Paris) for the purpose of telephone communication. Aircall is a cloud-based telephony solution that is used in particular for the management and execution of telephone calls as well as integration with other communication and CRM systems.
Within the scope of using Aircall, the following personal data are processed:
Telephone numbers, names, and other contact details of the communication partners
Call histories, call times, connection data
Where applicable, call recordings (if activated and legally permissible)
Technical usage data (e.g. IP address, device information)
The purpose of the data processing is the efficient handling and documentation of telephone communication with customers, prospective customers, and business partners, as well as the improvement of service processes and integration into existing CRM and support systems.
The processing is carried out on the basis of Art. 6(1)(b) GDPR (performance of a contract or implementation of pre-contractual measures), insofar as the communication takes place for the initiation or execution of a contractual relationship. Where consent is required (e.g. for call recordings), the processing is carried out on the basis of your consent pursuant to Art. 6(1)(a) GDPR. Consent may be withdrawn at any time with effect for the future. Otherwise, processing is carried out on the basis of Art. 6(1)(f) GDPR (legitimate interest), in particular for answering general telephone inquiries that do not fall under the above-mentioned cases, as well as, where necessary, for the defense and assertion of legal claims. Where legally required, we will inform you separately, stating the legitimate interest concerned.
We have concluded a data processing agreement with the service provider in which we oblige it to protect our customers’ data and not to pass them on to third parties. Aircall may use subprocessors outside the EU/EEA, in particular in the United States, to provide its services. For data transfers to third countries, Aircall is obliged to provide appropriate safeguards pursuant to Art. 44 et seq. GDPR, in particular by concluding EU Standard Contractual Clauses and, where applicable, implementing additional protective measures. The U.S.-based Aircall, Inc. is certified under the EU-U.S. Data Privacy Framework.
Personal data are generally stored only for as long as necessary to achieve the stated purposes. Call data and connection data are deleted by Aircall after the expiry of the contractually agreed periods, unless longer statutory retention obligations exist. Call recordings are stored only for as long as necessary for the respective purpose and where consent has been provided.
When you subscribe to our newsletter, we use the so-called double opt-in procedure. This means that we will only send you our newsletter by email once you have expressly confirmed to us that you consent to receiving newsletters. In the first step, you receive an email with a link through which you can confirm that, as the owner of the email address concerned, you wish to receive newsletters in future. By confirming, you give us your consent pursuant to Art. 6(1)(a) GDPR to use your personal data for the purpose of sending the requested newsletter.
When you subscribe to the newsletter, in addition to the email address required for sending, we store the IP address from which you subscribed to the newsletter and the date and time of subscription and confirmation, so that any misuse can be traced at a later date. The legal basis for this is our legitimate interest pursuant to Art. 6(1)(f) GDPR.
You can unsubscribe from the newsletter at any time via the link included in every newsletter or by emailing the controller named above. After you have unsubscribed, your email address will be removed from our newsletter distribution list without delay, unless you have expressly consented to the continued use of the data collected or the continued processing is otherwise permitted by law.
In addition to the newsletter, you receive so-called transactional messages and push notifications. These are information on bookings, payments and check-ins that are necessary for communication within the contractual relationship. The legal basis for sending this type of message is Art. 6(1)(b) GDPR, the performance of the contract between you, Holidu GmbH and the hosts.
Our email newsletters and transactional messages are sent via a technical service provider (Sendgrid), to which we pass on your data.
Sendgrid is used to send the transactional messages and push notifications mentioned above within the framework of your contractual relationship. Where necessary, information about your interaction with the Holidu website is also processed for this purpose.
Furthermore, if you have consented, newsletters are statistically evaluated. For this evaluation, the emails sent contain so-called web beacons or tracking pixels. This makes it possible to determine whether a newsletter message has been opened and which links, if any, have been clicked. Conversion tracking can also be used to analyse whether a predefined action has taken place after a link in the newsletter was clicked. In addition, technical information is recorded (e.g. time of access, IP address, browser type and operating system). The data is linked to your other personal data, i.e. your email address. This data is used for the statistical analysis of newsletter campaigns and for retargeting the recipient. The results of these analyses can be used to better tailor future newsletters to the interests of the recipients. If you wish to withdraw your consent to the data analysis for statistical evaluation purposes, you must unsubscribe from the newsletter.
We have concluded a data processing agreement with our email service provider in which we oblige it to protect our customers' data.
Service provider: Sendgrid (by Twilio)
Address: SendGrid, Inc., 1801 California Street, Suite 500, Denver, CO 80202, United States
Third-country transfer: Sendgrid Inc. is certified under the EU-U.S. Data Privacy Framework and has accordingly committed to complying with appropriate data protection standards, which can be verified at the following link: https://www.dataprivacyframework.gov/s/participant-search.
Conducting Competitions and Giveaways
We occasionally organize competitions and promotional campaigns in which customers and interested parties may participate. When participating in a competition or campaign, we process the data you provide in the registration form or email. These may include the following data: email address, first and last name, address, content data (e.g. text entries, photos, videos). Your data will not be shared with third parties unless such disclosure is necessary for conducting the competition or sending the prize.
The processing of your personal data is carried out for the purpose of handling the competition or campaign, in particular for determining and notifying the winners. For the purpose of sending and delivering prizes, we may subsequently collect and process additional data (e.g. your postal address).
The data processing is carried out for the performance of the competition agreement pursuant to Art. 6(1)(b) GDPR.
If winners are published within the scope of the competition, we point out that participants’ names may also be published in this context. Participants may object to this at any time.
The processed data will be deleted after the completion or expiry of the competition or campaign and the dispatch of the prizes. As a general rule, the data will be deleted within 7 days after participation. If you consented to receiving advertising information when registering for the competition, the further processing of the data and information covered by this consent will take place in accordance with the statutory provisions – generally until you withdraw your consent.
Processing of Photo and Video Recordings at Events
As part of our events, we regularly create photo and, where applicable, video recordings in which participants may be wholly or partially identifiable. The legal basis for processing these recordings is Art. 6(1)(f) GDPR. The legitimate interest of Holidu GmbH lies in documenting the event as well as in external and internal communication and public relations activities.
This may include, in particular, the publication of recordings on the following channels:
The Holidu GmbH website
The social media channels of Holidu GmbH (Instagram, LinkedIn)
As well as in newsletters or other publications of Holidu GmbH
The recordings are used exclusively for the aforementioned purposes.
If participants do not wish to be photographed or have recordings published, they may inform the photographer or the persons responsible for the event at any time on site.
The recordings will be deleted as soon as they are no longer necessary for the stated purposes or if a justified objection pursuant to Art. 21 GDPR is raised. Further information on exercising your rights as a data subject can be found in the section “Your Rights.”
Cookies
We use cookies and similar technologies on our websites, such as pixels, local storage and SDKs. Some of them are strictly necessary for our websites to work. These do not require your consent. All others only run if you allow them. We use them to understand how our websites are used and to show you relevant advertising. Below, we list each category and each provider we use. For each provider, we explain which data is collected and how long it is kept.
Cookies are small text files that are stored on your device. Session cookies are deleted automatically when you close your browser. Permanent cookies remain on your device until you delete them or your browser deletes them automatically.
Some cookies are technically necessary, because certain functions of our websites would not work without them, for example your language settings. Other cookies help us analyse how visitors use our websites, or show you advertising.
Strictly necessary cookies are stored on your device and read from it on the basis of § 25 Abs. 2 Nr. 2 TDDDG. We process the personal data involved on the basis of our legitimate interest in providing our services securely and without technical errors (Art. 6(1)(f) GDPR). The purposes and legitimate interests for each service are described below.
All other cookies are stored on your device and read from it only with your consent (§ 25 Abs. 1 TDDDG). We process the personal data involved on the basis of your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future. To do so, use "Change cookie settings" below.
Withdrawing your consent is as easy as giving it: you can reopen your cookie settings at any time via "Change cookie settings" below or via the link in the footer of our websites, and change your choice there. The withdrawal does not affect the lawfulness of the processing carried out before the withdrawal (Art. 7(3) GDPR). We store your cookie settings for up to 6 months; after that, we ask you again.
Retention periods differ from provider to provider; the entry for each provider states how long the data it collects is kept. Where a provider is located outside the European Economic Area, its entry names the safeguard on which the transfer is based.
Profiling for advertising purposes
Where you consent to marketing cookies, we and our advertising partners analyse your use of our websites in order to infer your likely interests and to show you advertising that matches them, including on other websites and in social networks. This constitutes profiling within the meaning of Art. 4(4) GDPR. It does not involve any automated decision that produces legal effects concerning you or similarly significantly affects you within the meaning of Art. 22 GDPR. You can prevent this profiling at any time by not giving or withdrawing your consent.
You can also find information about the cookies we use in our cookie banner.
You can set your browser so that it
informs you when cookies are set,
allows cookies only in individual cases,
blocks cookies for certain cases or in general,
deletes cookies automatically when you close it.
You can find out how to manage cookies in these browsers:
Many browsers also let you limit tracking, for example with tracking prevention or a "Do Not Track" signal. The available settings differ from browser to browser.
You can find out how to use these settings in these browsers:
You can also block scripts by default. For example, the browser add-on "NoScript" only allows JavaScript and other active content to run on websites you trust. For Mozilla Firefox, NoScript is available at https://addons.mozilla.org/en-GB/firefox/addon/noscript/.
Please note: if you block cookies, some functions of our websites may not work.
Necessary
Required for the site to function — session, security, load balancing, and fraud protection. This category also contains services that deliver functions you request on our websites, such as signing in with an external account, maps, payment and online check-in. Cannot be turned off.
Adyen
We use the service "Adyen" on our websites. The service is provided by Adyen N.V. (the provider). The address of the provider is Simon Carmiggeltstraat 6-50, 1011 DJ Amsterdam, Netherlands.
The service enables us to process the payment for your booking securely and to protect payments against fraud. Your payment details are entered directly into Adyen's payment form, so card data goes straight to Adyen and is not stored by us. You can object to Adyen's fraud checks at any time by contacting Adyen's data protection officer at dpo@adyen.com. For hosts, it also enables us to verify your identity, your business and your bank account before payouts can be made, as payment regulation requires; Adyen does this with identity providers and credit reference agencies.
Payment processing
Fraud prevention
Identity verification
Data processed
User-related data
Payment data
Cardholder name
Billing address
Email address
Transaction data
Order reference
Identity data
Bank account details
Business details
Technical usage data
IP address
Behavioral fraud signals
Page URL
Device and connection data
Device ID
Browser metadata
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
We use this service because the processing is necessary to perform the contract with you or to take steps at your request before entering into a contract (Art. 6(1)(b) GDPR). Where the service stores information on your device or reads information from it, this is strictly necessary to provide a digital service that you have expressly requested. Your consent is therefore not required for this (§ 25 Abs. 2 Nr. 2 TDDDG). You cannot switch this service off in the cookie settings.
Recipients
The provider receives personal data and processes it as an independent controller (Art. 4(7) GDPR). The provider decides for itself on the purposes and means of this processing.
Adyen N.V., Simon Carmiggeltstraat 6-50, 1011 DJ Amsterdam, Netherlands (EU/EEA)
You can find more information on how the provider processes personal data in the provider's privacy policy: www.adyen.com/privacy-policy
Storage and retention
We do not store the data collected by this service in our own systems. The data is stored by the provider. Retention period: Transaction data: 7 years after the transaction (Adyen, most jurisdictions); risk cookie: 30 days
Cookies
Retention
Description
_RP_UID
30 days
Adyen risk ID that helps detect suspicious behaviour when you pay.
_cfuvid
session
Cloudflare firewall cookie on Adyen's payment domain; tells apart visitors who share an IP address
Chekin
We use the service "Chekin" on our websites. The service is provided by Chekin Soluciones Digitales, S.L. (the provider). The address of the provider is Avda. República Argentina, 24 - 7º, 41011 Sevilla, Spain.
The service enables guests to complete online check-in for their stay and enables hosts to register their guests with the police and other authorities, as the law requires in many countries. Guests enter their identity document details in a form that loads from Chekin's servers, and Chekin passes them on to the authority the host has connected.
Guest registration
Online check in
Identity verification
Authority account connection
Data processed
User-related data
Identity document data
Identity document images
Facial images
Email address
Stay details
Booking data
Authority account status
Name
Phone number
Technical usage data
IP address
Device and connection data
Browser metadata
Other data
Locale
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
This service is strictly necessary for us to provide our websites and the services you request on them. Storing information on your device and reading information from it is therefore permitted without your consent (§ 25 Abs. 2 Nr. 2 TDDDG). The further processing of your personal data is based on our legitimate interest in providing our websites and services securely and without technical errors (Art. 6(1)(f) GDPR). You cannot switch this service off in the cookie settings.
Right to object: You have the right to object to this processing at any time, on grounds relating to your particular situation (Art. 21(1) GDPR). We will then stop the processing, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. To object, please use the contact details in this privacy policy.
Recipients
The provider processes personal data on our behalf as a processor (Art. 28 GDPR). We have concluded a data processing agreement with the provider for this purpose. The provider processes the data only on our documented instructions.
You can find more information on how the provider processes personal data in the provider's privacy policy: chekin.com/en/privacy-policy
Storage and retention
The data collected by this service is stored by the provider and also in our own systems. We keep the data in our own systems only as long as we need it for the purposes described above, or as long as statutory retention obligations require. We then delete or anonymise the data. Retention period: Photos of the identity document and the selfie: deleted by Chekin immediately after verification. Other guest data: for the duration of the contract and then for the period required by law.
Cookies
Retention
Description
i18nextLng (local storage)
until you clear your browser data
Language of the online check-in form, stored on the Holidu page's own domain.
Filter settings of the host guest-registration list.
Google reCAPTCHA
We use the service "Google reCAPTCHA" on our websites. The service is provided by Google Ireland Limited (the provider). The address of the provider is Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland.
The provider belongs to a group of companies. The parent company of the group is Google LLC, which is based outside the European Economic Area (EEA). The address of the parent company is 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
The service enables us to tell whether a form on our website is being used by a person or by an automated program, so that we can protect our forms against spam, fraud and other automated abuse. We use it on the basis of our legitimate interest in providing our service to hosts securely.
Bot prevention
Form security
Protecting the forms through which hosts use and contact our service, such as sign-up and enquiry forms, against spam, fraud and other automated abuse, so that we can provide our service to hosts securely. For this, Google receives technical data such as the IP address and browser data.
Data processed
Technical usage data
Behavioral bot signals
Device and connection data
Device ID
IP address
Browser metadata
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
We use this service on the basis of our legitimate interest under Art. 6(1)(f) GDPR. We describe this legitimate interest in the purpose section above. Where the service stores information on your device or reads information from it, this is strictly necessary to provide a digital service that you have expressly requested. Your consent is therefore not required for this (§ 25 Abs. 2 Nr. 2 TDDDG).
Right to object: You have the right to object to this processing at any time, on grounds relating to your particular situation (Art. 21(1) GDPR). We will then stop the processing, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. To object, please use the contact details in this privacy policy.
Recipients
The provider processes personal data on our behalf as a processor (Art. 28 GDPR). We have concluded a data processing agreement with the provider for this purpose. The provider processes the data only on our documented instructions.
Google Cloud EMEA Limited (EU/EEA)
Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (third country)
You can find more information on how the provider processes personal data in the provider's privacy policy: policies.google.com/privacy
Transfers to third countries
Personal data is transferred to these countries outside the European Economic Area (EEA): United States. The recipient in the United States is certified under the EU-U.S. Data Privacy Framework (DPF). The certified recipient is Google LLC, which is based in the United States. By its adequacy decision of 10 July 2023, the European Commission decided that the United States ensures an adequate level of protection for personal data transferred to certified companies (Implementing Decision (EU) 2023/1795). The transfer is therefore based on this adequacy decision (Art. 45(1) GDPR). You can check the certification in the official DPF list: https://www.dataprivacyframework.gov/s/participant-search.
Storage and retention
We do not store the data collected by this service in our own systems. The data is stored by the provider. Retention period: 6 months
Cookies
Retention
Description
_GRECAPTCHA
6 months
Set by reCAPTCHA when it runs, to provide its risk analysis
Holidu Necessary
We use the service "Holidu Necessary" on our websites. It is operated by us, Holidu GmbH.
The service enables us to run our website and booking process: it keeps you logged in, remembers your language, currency and cookie choices, and gives you access to your bookings.
Site functionality
Authentication
Consent management
Localisation
Data processed
Device and connection data
Pseudonymous visitor ID
IP address
Browser metadata
User-related data
User ID
Other data
Locale
Currency
Consent choices
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
This service is strictly necessary for us to provide our websites and the services you request on them. Storing information on your device and reading information from it is therefore permitted without your consent (§ 25 Abs. 2 Nr. 2 TDDDG). The further processing of your personal data is based on our legitimate interest in providing our websites and services securely and without technical errors (Art. 6(1)(f) GDPR). You cannot switch this service off in the cookie settings.
Right to object: You have the right to object to this processing at any time, on grounds relating to your particular situation (Art. 21(1) GDPR). We will then stop the processing, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. To object, please use the contact details in this privacy policy.
Recipients
No other recipients are involved.
Storage and retention
The data collected by this service is stored only in our own systems. We keep the data only as long as we need it for the purposes described above, or as long as statutory retention obligations require. We then delete or anonymise the data. Retention period: up to 365 days
Cookies
Retention
Description
__consent
365 days
Stores your cookie choices for each service listed here.
__acons
365 days
Older record of your choice for analytics cookies.
__ccons
365 days
Older record of your choice for necessary cookies.
__mcons
365 days
Older record of your choice for marketing cookies.
uuid
365 days
Pseudonymous ID that recognises your browser across visits.
userId
365 days
Stores your user ID while you are logged in.
_lo
365 days
Remembers the language you selected for the website.
_cu
365 days
Remembers the currency you selected for showing prices.
auto_login_attempted
session
Prevents repeated automatic sign-in redirects when you open the website.
userStore
365 days
Remembers that you visited before, to personalise the home page.
Gives you access to your booking, limited to that booking's page.
AUTH_SESSION_ID
session
Keeps your Holidu login session on our sign-in server.
KC_AUTH_SESSION_HASH
session
Checks your Holidu login session on our sign-in server.
lastVisitTimestamp (local storage)
until you clear your browser data
Stores the time of your last visit, for analytics.
HAS_SEEN_LIST_TRUSTPILOT
365 days
Remembers an earlier visit so the Trustpilot reviews block can be hidden.
SendGrid
We use the service "SendGrid" on our websites. The service is provided by Twilio Inc. (the provider). The address of the provider is 101 Spear Street, 5th Floor, San Francisco, CA 94105, USA.
The service enables us to send you the emails you need for your booking, for example the booking confirmation, payment and check-in information, cancellations and requests to review your stay. It also sends the email that confirms your address when you sign up and the confirmation email for newsletter sign-ups. For this, SendGrid receives your name, your email address and the details that the email contains. When you subscribe to the newsletter, we also store your email address with the time you signed up.
Transactional messages
Data processed
User-related data
Name
Email address
Booking data
Legal basis
This service is strictly necessary for us to provide our websites and the services you request on them. Storing information on your device and reading information from it is therefore permitted without your consent (§ 25 Abs. 2 Nr. 2 TDDDG). The further processing of your personal data is based on our legitimate interest in providing our websites and services securely and without technical errors (Art. 6(1)(f) GDPR). You cannot switch this service off in the cookie settings.
Right to object: You have the right to object to this processing at any time, on grounds relating to your particular situation (Art. 21(1) GDPR). We will then stop the processing, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. To object, please use the contact details in this privacy policy.
Recipients
The provider processes personal data on our behalf as a processor (Art. 28 GDPR). We have concluded a data processing agreement with the provider for this purpose. The provider processes the data only on our documented instructions.
Twilio Inc., 101 Spear Street, 5th Floor, San Francisco, CA 94105, USA (third country)
You can find more information on how the provider processes personal data in the provider's privacy policy: www.twilio.com/en-us/legal/privacy
Transfers to third countries
Personal data is transferred to these countries outside the European Economic Area (EEA): United States. The recipient in the United States is certified under the EU-U.S. Data Privacy Framework (DPF). The certified recipient is Twilio Inc., which is based in the United States. By its adequacy decision of 10 July 2023, the European Commission decided that the United States ensures an adequate level of protection for personal data transferred to certified companies (Implementing Decision (EU) 2023/1795). The transfer is therefore based on this adequacy decision (Art. 45(1) GDPR). You can check the certification in the official DPF list: https://www.dataprivacyframework.gov/s/participant-search.
Storage and retention
We do not store the data collected by this service in our own systems. The data is stored by the provider.
Sentry
We use the service "Sentry" on our websites. The service is provided by Functional Software, Inc. (Sentry) (the provider). The address of the provider is 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA.
The service enables us to detect, analyse and fix technical errors on our website, for example errors that interrupt a booking or a sign-up. Sentry transfers data to countries without an EU adequacy decision only under EU standard contractual clauses.
Error monitoring
Site stability
Detecting and fixing errors that break the booking and sign-up flows. Error reports carry technical browser data only; no cookies are set.
Data processed
Technical usage data
Error reports
IP address
Experiment variation assignment
Page URL
Browser request details, including cookies
Device and connection data
Browser metadata
Pseudonymous visitor ID
User-related data
Email address
User ID
Legal basis
We use this service on the basis of our legitimate interest under Art. 6(1)(f) GDPR. We describe this legitimate interest in the purpose section above. Where the service stores information on your device or reads information from it, this is strictly necessary to provide a digital service that you have expressly requested. Your consent is therefore not required for this (§ 25 Abs. 2 Nr. 2 TDDDG).
Right to object: You have the right to object to this processing at any time, on grounds relating to your particular situation (Art. 21(1) GDPR). We will then stop the processing, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. To object, please use the contact details in this privacy policy.
Recipients
The provider processes personal data on our behalf as a processor (Art. 28 GDPR). We have concluded a data processing agreement with the provider for this purpose. The provider processes the data only on our documented instructions.
Functional Software, Inc. d/b/a Sentry, 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA (third country)
Amazon Web Services, Inc., Seattle, WA, USA (third country)
Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (third country)
Google LLC (Google Cloud Platform), 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (third country)
Intercom, Inc., 55 2nd Street, 4th Floor, San Francisco, CA 94105, USA (third country)
Twilio Inc. (SendGrid), 101 Spear St FL 5, San Francisco, CA 94105, USA (third country)
OpenAI, L.L.C., San Francisco, CA, USA (third country)
Anthropic, PBC, San Francisco, CA, USA (third country)
Functional Software GmbH, Vienna, Austria (EU/EEA)
You can find more information on how the provider processes personal data in the provider's privacy policy: sentry.io/privacy
Transfers to third countries
Personal data is transferred to these countries outside the European Economic Area (EEA): United States. The recipient in the United States is certified under the EU-U.S. Data Privacy Framework (DPF). The certified recipient is Functional Software, Inc. d/b/a Sentry, which is based in the United States. By its adequacy decision of 10 July 2023, the European Commission decided that the United States ensures an adequate level of protection for personal data transferred to certified companies (Implementing Decision (EU) 2023/1795). The transfer is therefore based on this adequacy decision (Art. 45(1) GDPR). You can check the certification in the official DPF list: https://www.dataprivacyframework.gov/s/participant-search.
Storage and retention
We do not store the data collected by this service in our own systems. The data is stored by the provider. Retention period: Error reports and performance data are kept for up to 90 days, then deleted.
Trustpilot
We use the service "Trustpilot" on our websites. The service is provided by Trustpilot A/S (the provider). The address of the provider is Pilestraede 58, 5th floor, 1112 Copenhagen K, Denmark.
The service enables us to show independent customer reviews of Holidu on our website, using a review widget that loads from Trustpilot's servers. When you open a Trustpilot review link from us, Trustpilot receives your name, email address and a reference number so it can match your review to us.
Display reviews
Showing independent customer reviews of Holidu on the page. The widget loads from Trustpilot's servers, which receive the visitor's IP address and browser data; no Holidu cookies are set.
Data processed
Technical usage data
IP address
Page URL
Referrer
Locale
Device and connection data
Browser metadata
Legal basis
We use this service on the basis of our legitimate interest under Art. 6(1)(f) GDPR. We describe this legitimate interest in the purpose section above. Where the service stores information on your device or reads information from it, this is strictly necessary to provide a digital service that you have expressly requested. Your consent is therefore not required for this (§ 25 Abs. 2 Nr. 2 TDDDG).
Right to object: You have the right to object to this processing at any time, on grounds relating to your particular situation (Art. 21(1) GDPR). We will then stop the processing, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. To object, please use the contact details in this privacy policy.
Recipients
The provider receives personal data and processes it as an independent controller (Art. 4(7) GDPR). The provider decides for itself on the purposes and means of this processing.
We do not store the data collected by this service in our own systems. The data is stored by the provider. Retention period: Trustpilot decides as an independent controller: kept only as long as Trustpilot needs it for its purpose or must keep it by law, then deleted or anonymised.
Analytics
Helps us understand how the site is used so we can improve it.
Google Analytics 4
We use the service "Google Analytics 4" on our websites. The service is provided by Google Ireland Limited (the provider). The address of the provider is Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland.
The provider belongs to a group of companies. The parent company of the group is Google LLC, which is based outside the European Economic Area (EEA). The address of the parent company is 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
The service enables us to measure how visitors use our website and booking process, for example which pages they view and at which booking step they leave, so that we can improve both.
Measurement
Analytics
Data processed
Device and connection data
Device ID
IP address
Pseudonymous visitor ID
Approximate location (country or city, from your IP address)
User-related data
User ID
Email address
Phone number
Technical usage data
Page URL
Referrer
Consent choices
Website interaction events
Page views
Session behavior
Searches (destination, dates, filters)
Product view events
Checkout started
Purchase event
Sign-up / contact form submitted
Stay details
Advertising attribution data
Transaction data
Click ID
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
We only use this service if you have consented to it in our cookie banner or cookie settings. Storing information on your device and reading information from it is based on your consent under § 25 Abs. 1 TDDDG. The further processing of your personal data is based on your consent under Art. 6(1)(a) GDPR. Your consent is voluntary. You can withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR). You can withdraw or change your consent via .
Recipients
The provider processes personal data on our behalf as a processor (Art. 28 GDPR). We have concluded a data processing agreement with the provider for this purpose. The provider processes the data only on our documented instructions.
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland (EU/EEA)
Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (third country)
You can find more information on how the provider processes personal data in the provider's privacy policy: policies.google.com/privacy
Transfers to third countries
Personal data is transferred to these countries outside the European Economic Area (EEA): United States. The transfer is not covered by an adequacy decision of the European Commission (Art. 45 GDPR). The transfer is protected by the standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR; Implementing Decision (EU) 2021/914). Where necessary, the clauses are supplemented by additional technical, organisational or contractual measures. You can request a copy of the clauses using the contact details in this privacy policy. The standard text of the clauses is published at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj.
Storage and retention
Retention: 14 months
Cookies
Retention
Description
_ga
13 months
Google Analytics cookie used to distinguish users
_ga_<container_id>
13 months
Google Analytics cookie that keeps the state of your current session.
FPID
400 days
Google Analytics ID for your browser, set by our own server.
FPLC
20 hours
Lets Google Analytics recognise your browser across our different domains.
FPGSID
session
Google Analytics session ID, set through our own server.
FPAU
90 days
Google cookie storing ad interaction data to measure ad performance.
Marketing
Used to show you relevant ads on other sites and measure campaign performance.
Adjust
We use the service "Adjust" on our websites. The service is provided by Adjust GmbH (the provider). The address of the provider is Saarbrücker Str. 37a, 10405 Berlin, Germany.
The provider belongs to a group of companies. The parent company of the group is AppLovin Corporation, which is based outside the European Economic Area (EEA).
privacy@adjust.com · postal: Adjust GmbH, Attn: Data Protection, Saarbrücker Str. 37a, 10405 Berlin, Germany
Used in: iOS app, Android app
Purpose of the processing
Adjust measures our app installs and where they came from. In the guest apps, it receives your in-app activity only with marketing consent.
Install attribution
Campaign attribution
Deferred deeplinking
Data processed
Technical usage data
IP address
Install referrer
App install events
Click ID
App version
Device and connection data
Advertising ID
Device ID
Device type
Pseudonymous visitor ID
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
We only use this service if you have consented to it in our cookie banner or cookie settings. Storing information on your device and reading information from it is based on your consent under § 25 Abs. 1 TDDDG. The further processing of your personal data is based on your consent under Art. 6(1)(a) GDPR. Your consent is voluntary. You can withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR). You can withdraw or change your consent via .
Recipients
The provider processes personal data on our behalf as a processor (Art. 28 GDPR). We have concluded a data processing agreement with the provider for this purpose. The provider processes the data only on our documented instructions.
Adjust GmbH, Saarbrücker Str. 37a, 10405 Berlin, Germany (EU/EEA)
You can find more information on how the provider processes personal data in the provider's privacy policy: www.adjust.com/terms/privacy-policy
Storage and retention
The data collected by this service is stored by the provider and also in our own systems. We keep the data in our own systems only as long as we need it for the purposes described above, or as long as statutory retention obligations require. We then delete or anonymise the data. Retention period: Data received by Adjust: at most 25 months from the last consent. Data on the device: until the app is uninstalled.
Cookies
Retention
Description
Adjust SDK state (activity state, attribution, adid) (app storage)
until the app is uninstalled or its data is cleared
Stores the Adjust SDK's app state, install attribution and Adjust device ID.
@web_to_app_ids (app storage)
until the app is uninstalled or its data is cleared
Stores the website visitor IDs that Adjust's install link passes to the app.
@first_open_sent (app storage)
until the app is uninstalled or its data is cleared
Holidu's own flag so the first-open event is sent only once
until the app is uninstalled or its data is cleared
Stores Adjust's app state, install attribution and events waiting to be sent.
adj_* (NSUserDefaults) (app storage)
until the app is uninstalled or its data is cleared
Remembers whether the install was counted and which link opened the app.
Awin Affiliate Tracking
We use the service "Awin Affiliate Tracking" on our websites. The service is provided by AWIN AG (the provider). The address of the provider is Otto-Ostrowski-Straße 1A, 10249 Berlin, Germany.
The service enables us to work with affiliate partners in the Awin network: it records which partner referred a visitor and, when a booking is made, attributes that booking to the partner so the commission owed can be calculated. For this, Awin receives a click reference, the order reference of the booking and the commission data.
Affiliate attribution
Conversion tracking
Data processed
Device and connection data
Browser metadata
Website interaction events
Purchase event
Sign-up / contact form submitted
Advertising attribution data
Click ID
Order reference
Commission data
Transaction data
UTM parameters
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
We only use this service if you have consented to it in our cookie banner or cookie settings. Storing information on your device and reading information from it is based on your consent under § 25 Abs. 1 TDDDG. The further processing of your personal data is based on your consent under Art. 6(1)(a) GDPR. Your consent is voluntary. You can withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR). You can withdraw or change your consent via .
Recipients
The provider receives personal data and processes it as an independent controller (Art. 4(7) GDPR). The provider decides for itself on the purposes and means of this processing.
You can find more information on how the provider processes personal data in the provider's privacy policy: www.awin.com/gb/privacy
Storage and retention
The data collected by this service is stored by the provider and also in our own systems. We keep the data in our own systems only as long as we need it for the purposes described above, or as long as statutory retention obligations require. We then delete or anonymise the data. Retention period: up to 3 years (pseudonymised up to 5 years for Awin's internal analysis)
Cookies
Retention
Description
AwinChannelCookie
30 days
Records the affiliate channel that referred your visit, for Awin attribution.
_aw_sn_<merchant_id>
1 year
Awin click reference for bookings via cashback or voucher affiliate sites.
_aw_m_<merchant_id>
1 year
Awin click reference that attributes bookings to the referring affiliate.
ServerAwinChannelCookie
30 days
Server-set copy of AwinChannelCookie, recording the referring affiliate channel.
Campaign Attribution Parameters
We use the service "Campaign Attribution Parameters" on our websites. It is operated by us, Holidu GmbH.
The service enables us to record which advertising campaign, ad group and type of device brought a visitor to our website, so that we can assign bookings to the right campaign.
Campaign attribution
Data processed
Device and connection data
Device type
Advertising attribution data
Campaign ID
Ad group ID
UTM parameters
Click ID
Referrer
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
We only use this service if you have consented to it in our cookie banner or cookie settings. Storing information on your device and reading information from it is based on your consent under § 25 Abs. 1 TDDDG. The further processing of your personal data is based on your consent under Art. 6(1)(a) GDPR. Your consent is voluntary. You can withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR). You can withdraw or change your consent via .
Recipients
No other recipients are involved.
Storage and retention
The data collected by this service is stored only in our own systems. We keep the data only as long as we need it for the purposes described above, or as long as statutory retention obligations require. We then delete or anonymise the data. Retention period: 30 minutes
Cookies
Retention
Description
sem_adgid
30 minutes
Stores the sem_adgid parameter of your landing URL for campaign attribution.
sem_devi
30 minutes
Stores the sem_devi parameter of your landing URL for campaign attribution.
utm_campaign
30 minutes
Stores the utm_campaign parameter of your landing URL for campaign attribution.
utm_source
30 minutes
Stores the utm_source parameter of your landing URL for campaign attribution.
utm_medium
30 minutes
Stores the utm_medium parameter of your landing URL for campaign attribution.
utm_term
30 minutes
Stores the utm_term parameter of your landing URL for campaign attribution.
Criteo
We use the service "Criteo" on our websites. The service is provided by Criteo SA (the provider). The address of the provider is 5 Place de la Gare, L-1616 Luxembourg.
DPO: dpo@criteo.com · Criteo – Data Protection Office, 32 rue Blanche, 75009 Paris
Used in: Website
Purpose of the processing
The service enables us to show people who have looked at holiday rentals on our site ads for those offers on other websites, and to measure whether these ads lead to bookings. For this, Criteo receives a device identifier, the pages, searches and offers you view on our site, the start of a checkout and your booking with its booking reference, and, where available, your email address and phone number in hashed (pseudonymised) form and your postcode.
Ad personalization
Retargeting
Conversion attribution
Data processed
Device and connection data
Device ID
IP address
Browser metadata
Approximate location (country or city, from your IP address)
Your advertising ID, shared with partner ad networks
User-related data
Hashed email
Hashed phone
Postcode
Technical usage data
Page URL
Website interaction events
Page views
Searches (destination, dates, filters)
Product view events
Checkout started
Purchase event
Advertising attribution data
Order reference
Transaction data
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
We only use this service if you have consented to it in our cookie banner or cookie settings. Storing information on your device and reading information from it is based on your consent under § 25 Abs. 1 TDDDG. The further processing of your personal data is based on your consent under Art. 6(1)(a) GDPR. Your consent is voluntary. You can withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR). You can withdraw or change your consent via .
Recipients
We and the provider are joint controllers for this processing (Art. 26 GDPR). Joint control covers the collection of your data on our websites and its transmission to the provider. After the transmission, the provider processes the data as an independent controller. In an arrangement under Art. 26 GDPR, we and the provider have agreed which of us fulfils which obligations under the GDPR. You can exercise your rights against us and against the provider (Art. 26(3) GDPR). On request, we will provide you with the essence of this arrangement (Art. 26(2) GDPR).
Criteo SA, 5 Place de la Gare, L-1616 Luxembourg, Grand Duchy of Luxembourg (EU/EEA)
You can find more information on how the provider processes personal data in the provider's privacy policy: www.criteo.com/privacy
Storage and retention
We do not store the data collected by this service in our own systems. The data is stored by the provider. Retention period: 13 months
Cookies
Retention
Description
cto_bundle
13 months
Criteo identification cookie, set by Criteo's OneTag script.
cto_bidid
13 months
Criteo advertising cookie.
uid
390 days
Criteo cookie holding the identifier Criteo assigns to your browser.
Criteo partner cookie syncing (pixel)
set by each partner (14 to 395 days)
Identifiers set by Criteo's advertising partners to recognise your browser.
Google Ads Conversion Tracking & Remarketing
We use the service "Google Ads Conversion Tracking & Remarketing" on our websites. The service is provided by Google Ireland Limited (the provider). The address of the provider is Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland.
The provider belongs to a group of companies. The parent company of the group is Google LLC, which is based outside the European Economic Area (EEA). The address of the parent company is 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
The service enables us to measure which of our Google ads lead to bookings and to show ads for our offers to people who have visited our site before. For this, Google receives a device identifier, the ad click identifier, the pages, searches and offers you view, the start of a checkout and your booking, and, for enhanced conversions, your email address, phone number, name and address, which Google's tag hashes (pseudonymises) before sending them.
Ad personalization
Conversion attribution
Remarketing
Data processed
Device and connection data
Device ID
IP address
Your advertising ID, shared with partner ad networks
User-related data
Hashed email
Hashed phone
User ID
Hashed name
Hashed address
Technical usage data
Page URL
Referrer
Consent choices
Website interaction events
Page views
Searches (destination, dates, filters)
Product view events
Checkout started
Purchase event
Stay details
Advertising attribution data
Click ID
Transaction data
Order reference
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
We only use this service if you have consented to it in our cookie banner or cookie settings. Storing information on your device and reading information from it is based on your consent under § 25 Abs. 1 TDDDG. The further processing of your personal data is based on your consent under Art. 6(1)(a) GDPR. Your consent is voluntary. You can withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR). You can withdraw or change your consent via .
Recipients
The provider receives personal data and processes it as an independent controller (Art. 4(7) GDPR). The provider decides for itself on the purposes and means of this processing.
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland (EU/EEA)
Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (third country)
You can find more information on how the provider processes personal data in the provider's privacy policy: policies.google.com/privacy
Transfers to third countries
Personal data is transferred to these countries outside the European Economic Area (EEA): United States. The recipient in the United States is certified under the EU-U.S. Data Privacy Framework (DPF). The certified recipient is Google LLC, which is based in the United States. By its adequacy decision of 10 July 2023, the European Commission decided that the United States ensures an adequate level of protection for personal data transferred to certified companies (Implementing Decision (EU) 2023/1795). The transfer is therefore based on this adequacy decision (Art. 45(1) GDPR). You can check the certification in the official DPF list: https://www.dataprivacyframework.gov/s/participant-search.
Storage and retention
The data collected by this service is stored by the provider and also in our own systems. We keep the data in our own systems only as long as we need it for the purposes described above, or as long as statutory retention obligations require. We then delete or anonymise the data. Retention period: 12 months
Cookies
Retention
Description
_gcl_au
3 months
Google conversion cookie used by Google Ads and other Google ad products.
_gcl_aw
3 months
Stores the Google Ads click ID to measure conversions from ads.
_gcl_ls (local storage)
until you clear your browser data
Stores Google ad click information in your browser to measure conversions.
IDE
390 days
Google DoubleClick cookie used to show relevant ads and measure conversions.
_gtmeec
90 days
Stores hashed contact details for Google's enhanced conversions.
GSI Ad-Fraud Verification
We use the service "GSI Ad-Fraud Verification" on our websites. The service is provided by GP One GmbH (the provider). The address of the provider is Otto-Wickenhöfer-Str. 7a, 35108 Allendorf (Eder), Germany.
Loaded by the Awin tag after you consent, it detects bot and fraudulent ad clicks we should not pay for.
Fraud prevention
Ad verification
Data processed
Device and connection data
Device ID
IP address
Browser metadata
Technical usage data
Page URL
Website interaction events
Page views
Product view events
Checkout started
Purchase event
Advertising attribution data
Order reference
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
We only use this service if you have consented to it in our cookie banner or cookie settings. Storing information on your device and reading information from it is based on your consent under § 25 Abs. 1 TDDDG. The further processing of your personal data is based on your consent under Art. 6(1)(a) GDPR. Your consent is voluntary. You can withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR). You can withdraw or change your consent via .
Recipients
The provider receives personal data and processes it as an independent controller (Art. 4(7) GDPR). The provider decides for itself on the purposes and means of this processing.
GP One GmbH, Otto-Wickenhöfer-Str. 7a, 35108 Allendorf (Eder), Germany (EU/EEA)
The service enables us to attribute bookings and sign-ups more accurately to the ads that led to them. We convert the email address, phone number, name, city, postcode and country you give us, and our internal visitor reference, into hashed (pseudonymised) values, keep them in a cookie on your device and pass them to the Meta, Criteo, Pinterest, TikTok and Reddit services described separately in this policy.
Enhanced conversion matching
Data processed
User-related data
Hashed email
Hashed phone
Hashed name
Hashed city, postcode and country
Device and connection data
Pseudonymous visitor ID
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
We only use this service if you have consented to it in our cookie banner or cookie settings. Storing information on your device and reading information from it is based on your consent under § 25 Abs. 1 TDDDG. The further processing of your personal data is based on your consent under Art. 6(1)(a) GDPR. Your consent is voluntary. You can withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR). You can withdraw or change your consent via .
Recipients
No other recipients are involved.
Storage and retention
The data collected by this service is stored only in our own systems. We keep the data only as long as we need it for the purposes described above, or as long as statutory retention obligations require. We then delete or anonymise the data. Retention period: 390 days
Cookies
Retention
Description
_hpii
390 days
Stores hashed contact details so the ad services named here can match bookings.
Kupona
We use the service "Kupona" on our websites. The service is provided by KUPONA GmbH (the provider). The address of the provider is Kothenbachweg 6, 36041 Fulda, Germany.
The service enables us to work with KUPONA, an affiliate partner in the Awin network. Its ReBounce service shows you alternative offers from our site when you are about to leave it, and may show you our offers again later. For this, KUPONA receives a device identifier, the IP address and browser information, the pages, searches and offers you view, the start of a checkout and, if you book, the booking reference and amount, so that Awin can credit KUPONA with a commission.
Retargeting
Affiliate attribution
Data processed
Device and connection data
Device ID
IP address
Browser metadata
Approximate location (country or city, from your IP address)
Technical usage data
Referrer
Website interaction events
Page views
Searches (destination, dates, filters)
Product view events
Checkout started
Purchase event
Advertising attribution data
Order reference
Commission data
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
We only use this service if you have consented to it in our cookie banner or cookie settings. Storing information on your device and reading information from it is based on your consent under § 25 Abs. 1 TDDDG. The further processing of your personal data is based on your consent under Art. 6(1)(a) GDPR. Your consent is voluntary. You can withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR). You can withdraw or change your consent via .
Recipients
We and the provider are joint controllers for this processing (Art. 26 GDPR). Joint control covers the collection of your data on our websites and its transmission to the provider. After the transmission, the provider processes the data as an independent controller. In an arrangement under Art. 26 GDPR, we and the provider have agreed which of us fulfils which obligations under the GDPR. You can exercise your rights against us and against the provider (Art. 26(3) GDPR). On request, we will provide you with the essence of this arrangement (Art. 26(2) GDPR).
The UK Trade Desk Ltd, 10th Floor, 1 Bartholomew Close, London EC1A 7BL, United Kingdom (third country)
You can find more information on how the provider processes personal data in the provider's privacy policy: www.kupona.de/datenschutz
Storage and retention
We do not store the data collected by this service in our own systems. The data is stored by the provider. Retention period: cookie up to 365 days; user attributes 90 days
Cookies
Retention
Description
pseudonymous cookie ID (name not published)
up to 365 days
Kupona retargeting cookie with a pseudonymous ID, loaded through Awin.
Meta Pixel & Custom Audiences
We use the service "Meta Pixel & Custom Audiences" on our websites. The service is provided by Meta Platforms Ireland Limited (the provider). The address of the provider is Merrion Road, Dublin 4, D04 X2K5, Ireland.
The provider belongs to a group of companies. The parent company of the group is Meta Platforms, Inc., which is based outside the European Economic Area (EEA). The address of the parent company is 1 Meta Way, Menlo Park, CA 94025, USA.
FAO Privacy Operations (post) · DPO via Meta web form
Used in: Website
Purpose of the processing
The service enables us to measure which of our ads on Facebook and Instagram lead to bookings, to show our ads again to people who have visited our website, and to reach people whose contact details we share with Meta in hashed (pseudonymised) form. For this, Meta receives a device identifier, the pages you view, your searches, the offers you look at, the start of a checkout and your booking, as well as your email address, phone number, name, city, postcode and country and our internal visitor reference in hashed (pseudonymised) form. Events are also passed to Meta through a server-side gateway (Conversions API Gateway).
Ad personalization
Conversion attribution
Custom audiences
Data processed
Device and connection data
Device ID
Pseudonymous visitor ID
Browser metadata
IP address
User-related data
Hashed email
Hashed phone
Hashed name
Hashed city, postcode and country
Technical usage data
Page URL
Website interaction events
Page views
Searches (destination, dates, filters)
Product view events
Checkout started
Purchase event
Stay details
Advertising attribution data
Transaction data
Click ID
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
We only use this service if you have consented to it in our cookie banner or cookie settings. Storing information on your device and reading information from it is based on your consent under § 25 Abs. 1 TDDDG. The further processing of your personal data is based on your consent under Art. 6(1)(a) GDPR. Your consent is voluntary. You can withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR). You can withdraw or change your consent via .
Recipients
We and the provider are joint controllers for this processing (Art. 26 GDPR). Joint control covers the collection of your data on our websites and its transmission to the provider. After the transmission, the provider processes the data as an independent controller. In an arrangement under Art. 26 GDPR, we and the provider have agreed which of us fulfils which obligations under the GDPR. You can exercise your rights against us and against the provider (Art. 26(3) GDPR). On request, we will provide you with the essence of this arrangement (Art. 26(2) GDPR).
Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025, USA (third country)
You can find more information on how the provider processes personal data in the provider's privacy policy: www.facebook.com/privacy/policy
Transfers to third countries
Personal data is transferred to these countries outside the European Economic Area (EEA): United States. The transfer is not covered by an adequacy decision of the European Commission (Art. 45 GDPR). The transfer is protected by the standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR; Implementing Decision (EU) 2021/914). Where necessary, the clauses are supplemented by additional technical, organisational or contractual measures. You can request a copy of the clauses using the contact details in this privacy policy. The standard text of the clauses is published at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj.
Storage and retention
We do not store the data collected by this service in our own systems. The data is stored by the provider. Retention period: Event data: up to 2 years. Custom audiences: until Holidu removes them.
Cookies
Retention
Description
_fbp
3 months
Meta Pixel first-party cookie holding a unique browser identifier
_fbc
3 months
Meta Pixel cookie storing the ad click ID once one is available
Microsoft Advertising (Bing) UET
We use the service "Microsoft Advertising (Bing) UET" on our websites. The service is provided by Microsoft Ireland Operations Limited (the provider). The address of the provider is One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland.
The provider belongs to a group of companies. The parent company of the group is Microsoft Corporation, which is based outside the European Economic Area (EEA). The address of the parent company is One Microsoft Way, Redmond, Washington 98052, USA.
The service enables us to measure which of our ads on Microsoft Advertising (Bing) lead to bookings on our website and to show our ads again to people who have already visited our website. For this, Microsoft receives a device identifier, the ad click identifier, the pages you view, the start of a checkout and your booking, and, when you book, your email address and phone number, which Microsoft's tag hashes (pseudonymises) before sending them.
Ad personalization
Conversion attribution
Data processed
Device and connection data
Device ID
Your advertising ID, shared with partner ad networks
IP address
Approximate location (country or city, from your IP address)
User-related data
Hashed email
Hashed phone
Technical usage data
Page URL
Referrer
Website interaction events
Page views
Checkout started
Purchase event
Advertising attribution data
Click ID
Transaction data
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
We only use this service if you have consented to it in our cookie banner or cookie settings. Storing information on your device and reading information from it is based on your consent under § 25 Abs. 1 TDDDG. The further processing of your personal data is based on your consent under Art. 6(1)(a) GDPR. Your consent is voluntary. You can withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR). You can withdraw or change your consent via .
Recipients
The provider receives personal data and processes it as an independent controller (Art. 4(7) GDPR). The provider decides for itself on the purposes and means of this processing.
Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland (EU/EEA)
Microsoft Corporation, One Microsoft Way, Redmond, Washington 98052, USA (third country)
Personal data is transferred to these countries outside the European Economic Area (EEA): United States. The recipient in the United States is certified under the EU-U.S. Data Privacy Framework (DPF). The certified recipient is Microsoft Corporation, which is based in the United States. By its adequacy decision of 10 July 2023, the European Commission decided that the United States ensures an adequate level of protection for personal data transferred to certified companies (Implementing Decision (EU) 2023/1795). The transfer is therefore based on this adequacy decision (Art. 45(1) GDPR). You can check the certification in the official DPF list: https://www.dataprivacyframework.gov/s/participant-search.
Storage and retention
We do not store the data collected by this service in our own systems. The data is stored by the provider. Retention period: 13 months
Cookies
Retention
Description
_uetsid
1 day
Microsoft Advertising (UET) device identifier; used for conversion tracking and remarketing
_uetvid
13 months
Microsoft Advertising (UET) device identifier; used for conversion tracking and remarketing
MUID
13 months
Microsoft ID that identifies your browser for advertising and site analytics.
SRM_B
390 days
Microsoft Bing cookie that identifies unique web browsers.
MR
7 days
Microsoft flag that indicates whether to refresh the MUID browser ID.
_uetsid_exp / _uetvid_exp (local storage)
until you clear your browser data
Stores expiry dates of Microsoft Advertising's UET tracking cookies.
Pinterest Tag
We use the service "Pinterest Tag" on our websites. The service is provided by Pinterest Europe Ltd. (the provider). The address of the provider is Waterloo Exchange, 3rd Floor, Waterloo Road, Dublin 4, Ireland.
The provider belongs to a group of companies. The parent company of the group is Pinterest, Inc., which is based outside the European Economic Area (EEA). The address of the parent company is 651 Brannan Street, San Francisco, CA 94107, USA.
The service enables us to measure which visits and bookings come from our Pinterest ads, and to show our ads on Pinterest to people who have visited our website or who have similar interests. For this, Pinterest receives a device identifier, the pages, searches and offers you view, the start of a checkout and your booking with its booking reference, and your email address in hashed (pseudonymised) form.
Ad personalization
Conversion attribution
Lookalike audiences
Data processed
Device and connection data
Device ID
Browser metadata
User-related data
Hashed email
Technical usage data
Page URL
Referrer
Website interaction events
Page views
Searches (destination, dates, filters)
Product view events
Checkout started
Purchase event
Sign-up / contact form submitted
Advertising attribution data
Order reference
Transaction data
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
We only use this service if you have consented to it in our cookie banner or cookie settings. Storing information on your device and reading information from it is based on your consent under § 25 Abs. 1 TDDDG. The further processing of your personal data is based on your consent under Art. 6(1)(a) GDPR. Your consent is voluntary. You can withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR). You can withdraw or change your consent via .
Recipients
We and the provider are joint controllers for this processing (Art. 26 GDPR). Joint control covers the collection of your data on our websites and its transmission to the provider. After the transmission, the provider processes the data as an independent controller. In an arrangement under Art. 26 GDPR, we and the provider have agreed which of us fulfils which obligations under the GDPR. You can exercise your rights against us and against the provider (Art. 26(3) GDPR). On request, we will provide you with the essence of this arrangement (Art. 26(2) GDPR).
Personal data is transferred to these countries outside the European Economic Area (EEA): United States. The transfer is not covered by an adequacy decision of the European Commission (Art. 45 GDPR). The transfer is protected by the standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR; Implementing Decision (EU) 2021/914). Where necessary, the clauses are supplemented by additional technical, organisational or contractual measures. You can request a copy of the clauses using the contact details in this privacy policy. The standard text of the clauses is published at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj.
Storage and retention
Retention: 12 months
Cookies
Retention
Description
_pin_unauth
1 year
Pinterest first-party cookie that groups actions for users Pinterest cannot identify
_pinterest_ct_ua
1 year
Pinterest cookie that groups actions for users Pinterest cannot identify; the third-party counterpart of _pin_unauth
_pinterest_sess
1 year
Pinterest login cookie; only present if the visitor is logged in to Pinterest
Roeye
We use the service "Roeye" on our websites. The service is provided by SingleView Tech Ltd (formerly R.O.EYE Limited) (the provider). The address of the provider is 4th Floor, 2 Thomas More Square, London E1W 1YN, United Kingdom.
SingleView, loaded through the Awin tag, tells us which marketing channels brought you to our site and which led to a booking.
Conversion attribution
Campaign attribution
Data processed
Device and connection data
Cookie ID
IP address
Browser metadata
Technical usage data
Referrer
Page URL
Website interaction events
Purchase event
Advertising attribution data
Order reference
Transaction data
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
We only use this service if you have consented to it in our cookie banner or cookie settings. Storing information on your device and reading information from it is based on your consent under § 25 Abs. 1 TDDDG. The further processing of your personal data is based on your consent under Art. 6(1)(a) GDPR. Your consent is voluntary. You can withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR). You can withdraw or change your consent via .
Recipients
SingleView Tech Ltd, 4th Floor, 2 Thomas More Square, London E1W 1YN, United Kingdom (third country)
You can find more information on how the provider processes personal data in the provider's privacy policy: privacy.awin.com
Transfers to third countries
Personal data is transferred to these countries outside the European Economic Area (EEA): United Kingdom. For the countries concerned, the European Commission has decided that they ensure an adequate level of data protection (adequacy decision, Art. 45(1) GDPR). The transfer is based on this adequacy decision. You can find the adequacy decisions on the website of the European Commission: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en.
Storage and retention
We do not store the data collected by this service in our own systems. The data is stored by the provider. Retention period: cookies 30-182 days
Cookies
Retention
Description
lantern
30 days
Stores a random visit ID to credit bookings to marketing channels.
singleview_lantern
182 days
SingleView's cookie with a visit ID to credit bookings to marketing channels.
RTB House
We use the service "RTB House" on our websites. The service is provided by RTB House S.A. (the provider). The address of the provider is ul. Złota 61/101, 00-819 Warsaw, Poland.
The service enables us to show people who have looked at holiday rentals on our site ads for those offers on other websites, and to measure whether these ads lead to bookings. For this, RTB House receives a device identifier and information on the pages and offers viewed on our site.
Retargeting
Conversion attribution
Data processed
Device and connection data
Device ID
IP address
Browser metadata
Approximate location (country or city, from your IP address)
Your advertising ID, shared with partner ad networks
User-related data
User ID
Website interaction events
Page views
Product view events
Checkout started
Purchase event
Sign-up / contact form submitted
Stay details
Searches (destination, dates, filters)
Advertising attribution data
Order reference
Transaction data
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
We only use this service if you have consented to it in our cookie banner or cookie settings. Storing information on your device and reading information from it is based on your consent under § 25 Abs. 1 TDDDG. The further processing of your personal data is based on your consent under Art. 6(1)(a) GDPR. Your consent is voluntary. You can withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR). You can withdraw or change your consent via .
Recipients
The provider processes personal data on our behalf as a processor (Art. 28 GDPR). We have concluded a data processing agreement with the provider for this purpose. The provider processes the data only on our documented instructions.
RTB HOUSE S.A., ul. Złota 61/101, 00-819 Warsaw, Poland (EU/EEA)
You can find more information on how the provider processes personal data in the provider's privacy policy: www.rtbhouse.com/privacy-policy
Storage and retention
We do not store the data collected by this service in our own systems. The data is stored by the provider. Retention period: Impressions and interactions: up to 500 days, plus 65 days in backups; bid-request data: up to 100 days; then anonymised.
Cookies
Retention
Description
u
365 days
Stores a random ID so RTB House can recognise this browser later.
ts
365 days
Records a timestamp so RTB House can work out the cookie's age.
c
365 days
RTB House advertising cookie, set by its tag.
g
365 days
RTB House advertising cookie, set by its tag.
__rtbh.lid (cookie + local storage)
365 days
Random RTB House ID for this browser, renewed each time its tag runs.
XANDR_PANID / anj / uuid2
90 days
Random Xandr IDs that tell browsers apart, loaded through RTB House.
Taboola
We use the service "Taboola" on our websites. The service is provided by Taboola Europe Limited (the provider). The address of the provider is Aldgate House, 2nd Floor, 33 Aldgate High Street, London EC3N 1DL, United Kingdom.
The service enables us to measure which visits and bookings come from our Taboola ads, and to show our ads as recommended content on other websites to people who may be interested in them.
Ad personalization
Conversion attribution
Content recommendation
Data processed
Device and connection data
Device ID
IP address
Approximate location (country or city, from your IP address)
Your advertising ID, shared with partner ad networks
User-related data
Hashed email
Technical usage data
Page URL
Referrer
Website interaction events
Page views
Searches (destination, dates, filters)
Product view events
Checkout started
Purchase event
Stay details
Advertising attribution data
Order reference
Transaction data
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
We only use this service if you have consented to it in our cookie banner or cookie settings. Storing information on your device and reading information from it is based on your consent under § 25 Abs. 1 TDDDG. The further processing of your personal data is based on your consent under Art. 6(1)(a) GDPR. Your consent is voluntary. You can withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR). You can withdraw or change your consent via .
Recipients
The provider receives personal data and processes it as an independent controller (Art. 4(7) GDPR). The provider decides for itself on the purposes and means of this processing.
Taboola.com Ltd. (third country)
Taboola Europe Limited, Aldgate House, 2nd Floor, 33 Aldgate High Street, London EC3N 1DL, United Kingdom (third country)
Taboola, Inc., 1209 Orange Street, Wilmington, DE 19801, USA (third country)
You can find more information on how the provider processes personal data in the provider's privacy policy: policies.taboola.com/privacy-policy
Transfers to third countries
Personal data is transferred to these countries outside the European Economic Area (EEA): Israel, United Kingdom. For the countries concerned, the European Commission has decided that they ensure an adequate level of data protection (adequacy decision, Art. 45(1) GDPR). The transfer is based on this adequacy decision. You can find the adequacy decisions on the website of the European Commission: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en.
Personal data is transferred to these countries outside the European Economic Area (EEA): United States. The transfer is not covered by an adequacy decision of the European Commission (Art. 45 GDPR). The transfer is protected by the standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR; Implementing Decision (EU) 2021/914). Where necessary, the clauses are supplemented by additional technical, organisational or contractual measures. You can request a copy of the clauses using the contact details in this privacy policy. The standard text of the clauses is published at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj.
Storage and retention
Retention: up to 13 months after the last interaction
Cookies
Retention
Description
t_gid
1 year
Taboola user ID used for ad attribution, reporting and recommendations.
taboola_fp_user_id
1 year
Taboola advertising cookie.
t_gid / t_pt_gid
365 days
Taboola user IDs used for attribution and reporting.
taboola_session_id
session
Temporary Taboola session ID that avoids repeating the same recommendations.
taboola / eng_mt (local storage)
until you clear your browser data
Stores an ID Taboola uses to identify users for targeted ads.
Tangoo
We use the service "Tangoo" on our websites. The service is provided by Tangoo S.r.l. (the provider). The address of the provider is Via Lentasio 9, 20122 Milano, Italy.
The service enables us to show people who have looked at holiday rentals on our site ads for those offers on other websites, and to measure whether these ads lead to bookings. For this, Tangoo receives a cookie and session identifier, the IP address, the pages visited, browsing and booking activity on our site and interactions with its ads.
Retargeting
Programmatic advertising
Conversion tracking
Data processed
Device and connection data
Cookie ID
IP address
Session ID
Technical usage data
Page URL
Website interaction events
Browsing and purchase activity
Ad interactions
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
We only use this service if you have consented to it in our cookie banner or cookie settings. Storing information on your device and reading information from it is based on your consent under § 25 Abs. 1 TDDDG. The further processing of your personal data is based on your consent under Art. 6(1)(a) GDPR. Your consent is voluntary. You can withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR). You can withdraw or change your consent via .
Recipients
The provider receives personal data and processes it as an independent controller (Art. 4(7) GDPR). The provider decides for itself on the purposes and means of this processing.
Tangoo S.r.l., Via Lentasio 9, 20122 Milano, Italy (EU/EEA)
We do not store the data collected by this service in our own systems. The data is stored by the provider. Retention period: data up to 90 days; cookies 60 days to 12 months
Cookies
Retention
Description
fingerprint
12 months
Tangoo ID that recognises a returning browser for targeted ads.
Record products viewed, ad impressions, clicks and on-site behaviour for Tangoo ads.
adc_opt_out
12 months
Remembers that you opted out of Tangoo ads.
__cf_bm
30 minutes
Cloudflare bot management on Tangoo domains
IDE
390 days
Google DoubleClick ad cookie, matched with Tangoo to show relevant ads.
TikTok Pixel
We use the service "TikTok Pixel" on our websites. The service is provided by TikTok Technology Limited (the provider). The address of the provider is 10 Earlsfort Terrace, Dublin, D02 T380, Ireland.
UK joint controller: Kaleidoscope, 4 Lindsey Street, London EC1A 9HP · DPO via TikTok web form
Used in: Website
Purpose of the processing
The service enables us to measure which visits and bookings come from our TikTok ads, and to improve and personalise how our ads are shown on TikTok. For this, TikTok receives a device identifier, the pages, searches and offers you view, the start of a checkout and your booking, and your email address, phone number and our internal visitor reference in hashed (pseudonymised) form.
Ad personalization
Conversion attribution
Data processed
Device and connection data
Device ID
Pseudonymous visitor ID
IP address
Browser metadata
User-related data
Hashed email
Hashed phone
Postcode
Website interaction events
Page views
Searches (destination, dates, filters)
Product view events
Checkout started
Purchase event
Stay details
Advertising attribution data
Transaction data
Order reference
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
We only use this service if you have consented to it in our cookie banner or cookie settings. Storing information on your device and reading information from it is based on your consent under § 25 Abs. 1 TDDDG. The further processing of your personal data is based on your consent under Art. 6(1)(a) GDPR. Your consent is voluntary. You can withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR). You can withdraw or change your consent via .
Recipients
We and the provider are joint controllers for this processing (Art. 26 GDPR). Joint control covers the collection of your data on our websites and its transmission to the provider. After the transmission, the provider processes the data as an independent controller. In an arrangement under Art. 26 GDPR, we and the provider have agreed which of us fulfils which obligations under the GDPR. You can exercise your rights against us and against the provider (Art. 26(3) GDPR). On request, we will provide you with the essence of this arrangement (Art. 26(2) GDPR).
Personal data is transferred to these countries outside the European Economic Area (EEA): United Kingdom. For the countries concerned, the European Commission has decided that they ensure an adequate level of data protection (adequacy decision, Art. 45(1) GDPR). The transfer is based on this adequacy decision. You can find the adequacy decisions on the website of the European Commission: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en.
Personal data is transferred to these countries outside the European Economic Area (EEA): United States, Singapore, Malaysia. The transfer is not covered by an adequacy decision of the European Commission (Art. 45 GDPR). The transfer is protected by the standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR; Implementing Decision (EU) 2021/914). Where necessary, the clauses are supplemented by additional technical, organisational or contractual measures. You can request a copy of the clauses using the contact details in this privacy policy. The standard text of the clauses is published at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj.
Storage and retention
Retention: 13 months
Cookies
Retention
Description
_ttp
13 months from last use
TikTok Pixel cookie that measures ad performance and personalises TikTok ads.
_tt_enable_cookie
390 days
Checks whether the browser accepts TikTok's tracking cookies.
ttcsid / ttcsid_<pixel_id>
13 months from last use
TikTok Pixel cookie that measures ad performance and personalises TikTok ads.
ttclid
13 months from last use
Stores the TikTok click ID that links a visit to the ad.
TradeTracker Affiliate Tracking
We use the service "TradeTracker Affiliate Tracking" on our websites. The service is provided by TradeTracker International B.V. (the provider). The address of the provider is De Strubbenweg 7, 1327 GA Almere, Netherlands (KvK 39092006).
The service enables us to recognise when a visitor reaches our website through a link from one of our affiliate partners and, if a booking follows, to assign it to that partner and calculate their commission.
Affiliate attribution
Conversion tracking
Data processed
Device and connection data
Browser metadata
Website interaction events
Purchase event
Sign-up / contact form submitted
Advertising attribution data
Click ID
Order reference
Commission data
Transaction data
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
We only use this service if you have consented to it in our cookie banner or cookie settings. Storing information on your device and reading information from it is based on your consent under § 25 Abs. 1 TDDDG. The further processing of your personal data is based on your consent under Art. 6(1)(a) GDPR. Your consent is voluntary. You can withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR). You can withdraw or change your consent via .
Recipients
The provider receives personal data and processes it as an independent controller (Art. 4(7) GDPR). The provider decides for itself on the purposes and means of this processing.
TradeTracker International B.V., De Strubbenweg 7, 1327 GA Almere, Netherlands (EU/EEA)
You can find more information on how the provider processes personal data in the provider's privacy policy: tradetracker.com/privacy-policy
Storage and retention
The data collected by this service is stored by the provider and also in our own systems. We keep the data in our own systems only as long as we need it for the purposes described above, or as long as statutory retention obligations require. We then delete or anonymise the data. Retention period: Record of a click-through and any resulting purchase: up to 365 days; other data as long as needed for the service.
Cookies
Retention
Description
TT2_<campaign id>
30 days
Holds the TradeTracker click reference that credits sales and sign-ups to partners.
Services with separate consent
Services we work with where your consent or sign-up is given separately, case by case, and not through the cookie banner.
Apple Sign-In
We use the service "Apple Sign-In" on our websites. The service is provided by Apple Distribution International Limited (the provider).
The provider belongs to a group of companies. The parent company of the group is Apple Inc., which is based outside the European Economic Area (EEA).
Used in: Website
Purpose of the processing
The service enables us to let you sign in to or register your Holidu account with your Apple account instead of a separate password. For this, you are redirected to Apple to sign in. Apple then passes us an identifier of your Apple account, your email address, which can be a private relay address from Apple if you choose to hide your email address, and, at your first sign-in only, your name. We store these details in your Holidu account. Signing in this way is your choice; you can always register with your email address and a password instead.
Authentication
Data processed
User-related data
Apple account ID
Name
Email address
Legal basis
We only use this service if you choose to sign in with it. By clicking the sign-in button, you consent to its use. Storing information on your device and reading information from it is based on your consent under § 25 Abs. 1 TDDDG. The further processing of your personal data is based on your consent under Art. 6(1)(a) GDPR. Your consent is voluntary. You can withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR). You can withdraw your consent by removing the connection to our website in your account with the provider or by contacting us.
Recipients
The provider receives personal data and processes it as an independent controller (Art. 4(7) GDPR). The provider decides for itself on the purposes and means of this processing.
Apple Distribution International Limited (EU/EEA)
Apple Inc. (third country)
You can find more information on how the provider processes personal data in the provider's privacy policy: www.apple.com/legal/privacy
Transfers to third countries
Personal data is transferred to these countries outside the European Economic Area (EEA): United States. The transfer is not covered by an adequacy decision of the European Commission (Art. 45 GDPR). The transfer is protected by the standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR; Implementing Decision (EU) 2021/914). Where necessary, the clauses are supplemented by additional technical, organisational or contractual measures. You can request a copy of the clauses using the contact details in this privacy policy. The standard text of the clauses is published at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj.
Storage and retention
The data collected by this service is stored by the provider and also in our own systems. We keep the data in our own systems only as long as we need it for the purposes described above, or as long as statutory retention obligations require. We then delete or anonymise the data. Retention period: Until your Holidu account is deleted.
Customer.io (Guest)
We use the service "Customer.io (Guest)" on our websites. The service is provided by Peaberry Software Inc. (Customer.io) (the provider). The address of the provider is 9450 SW Gemini Dr., Suite 43920, Beaverton, OR 97008-7105, USA.
We send emails you signed up for via the newsletter form, a marketing option when booking or a promotion. Customer.io processes your email address, a customer identifier and your interactions with our emails, plus profile data from our booking and website systems, for example contact details, booking and search history. In the Holidu app, if you allow notifications, we also send you push notifications, and Customer.io receives your device token and events from the app. Each email has an unsubscribe link.
Newsletter
Personalised offers
Push notifications
Data processed
User-related data
Profile data from our booking and website systems (for example contact details, booking and search history)
Technical usage data
Message engagement
Device and connection data
Pseudonymous visitor ID
Push token
Legal basis
We use this service to send you the emails you signed up for. You gave your consent when you signed up, for example through the newsletter form, a marketing option during your booking or a promotion (Art. 6(1)(a) GDPR). This is separate from the cookie banner. Your consent is voluntary. You can withdraw it at any time with effect for the future, using the unsubscribe link in every email. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR).
Recipients
The provider processes personal data on our behalf as a processor (Art. 28 GDPR). We have concluded a data processing agreement with the provider for this purpose. The provider processes the data only on our documented instructions.
Peaberry Software Inc. (Customer.io), 9450 SW Gemini Dr., Suite 43920, Beaverton, OR 97008-7105, USA (third country)
Google LLC (Google Cloud Platform, sub-processor), 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (third country)
Snowflake Inc. (sub-processor) (third country)
Mailgun Technologies, Inc. (sub-processor) (third country)
Amazon Web Services (sub-processor) (third country)
You can find more information on how the provider processes personal data in the provider's privacy policy: customer.io/legal/privacy-policy
Transfers to third countries
Personal data is transferred to these countries outside the European Economic Area (EEA): United States. The recipient in the United States is certified under the EU-U.S. Data Privacy Framework (DPF). The certified recipient is Peaberry Software Inc. (Customer.io), which is based in the United States. By its adequacy decision of 10 July 2023, the European Commission decided that the United States ensures an adequate level of protection for personal data transferred to certified companies (Implementing Decision (EU) 2023/1795). The transfer is therefore based on this adequacy decision (Art. 45(1) GDPR). You can check the certification in the official DPF list: https://www.dataprivacyframework.gov/s/participant-search.
Storage and retention
We do not store the data collected by this service in our own systems. The data is stored by the provider. Retention period: Profile and email history: at most 2 years; profiles with no contact are removed from the system.
Facebook Login
We use the service "Facebook Login" on our websites. The service is provided by Meta Platforms Ireland Limited (the provider). The address of the provider is Merrion Road, Dublin 4, D04 X2K5, Ireland.
The provider belongs to a group of companies. The parent company of the group is Meta Platforms, Inc., which is based outside the European Economic Area (EEA). The address of the parent company is 1 Meta Way, Menlo Park, CA 94025, USA.
FAO Privacy Operations (post) · DPO via Meta web form
Used in: Website
Purpose of the processing
The service enables us to let you sign in to or register your Holidu account with your Facebook account instead of a separate password. For this, you are redirected to Facebook to sign in. Facebook then passes us an identifier of your Facebook account, your first and last name and your email address. We store these details in your Holidu account. Signing in this way is your choice; you can always register with your email address and a password instead.
Authentication
Data processed
User-related data
Facebook account ID
Name
Email address
Legal basis
We only use this service if you choose to sign in with it. By clicking the sign-in button, you consent to its use. Storing information on your device and reading information from it is based on your consent under § 25 Abs. 1 TDDDG. The further processing of your personal data is based on your consent under Art. 6(1)(a) GDPR. Your consent is voluntary. You can withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR). You can withdraw your consent by removing the connection to our website in your account with the provider or by contacting us.
Recipients
The provider receives personal data and processes it as an independent controller (Art. 4(7) GDPR). The provider decides for itself on the purposes and means of this processing.
Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025, USA (third country)
You can find more information on how the provider processes personal data in the provider's privacy policy: www.facebook.com/privacy/policy
Transfers to third countries
Personal data is transferred to these countries outside the European Economic Area (EEA): United States. The transfer is not covered by an adequacy decision of the European Commission (Art. 45 GDPR). The transfer is protected by the standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR; Implementing Decision (EU) 2021/914). Where necessary, the clauses are supplemented by additional technical, organisational or contractual measures. You can request a copy of the clauses using the contact details in this privacy policy. The standard text of the clauses is published at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj.
Storage and retention
The data collected by this service is stored by the provider and also in our own systems. We keep the data in our own systems only as long as we need it for the purposes described above, or as long as statutory retention obligations require. We then delete or anonymise the data. Retention period: Until your Holidu account is deleted.
Google Maps
We use the service "Google Maps" on our websites. The service is provided by Google Ireland Limited (the provider). The address of the provider is Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland.
The provider belongs to a group of companies. The parent company of the group is Google LLC, which is based outside the European Economic Area (EEA). The address of the parent company is 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
The service enables us to show on a map where a holiday home or a destination is and what is nearby, using maps that load from Google's servers. For this, Google receives the visitor's IP address, browser data and the map area shown.
Map display
Data processed
Technical usage data
IP address
Map viewport
Device and connection data
Browser metadata
Legal basis
We only load this service after you click the button that shows it (for example “Show map”). By clicking the button, you consent to its use. Storing information on your device and reading information from it is based on your consent under § 25 Abs. 1 TDDDG. The further processing of your personal data is based on your consent under Art. 6(1)(a) GDPR. Your consent is voluntary. You can withdraw your consent at any time with effect for the future by contacting us using the contact details in this privacy policy. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR).
Recipients
The provider receives personal data and processes it as an independent controller (Art. 4(7) GDPR). The provider decides for itself on the purposes and means of this processing.
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland (EU/EEA)
Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (third country)
You can find more information on how the provider processes personal data in the provider's privacy policy: policies.google.com/privacy
Transfers to third countries
Personal data is transferred to these countries outside the European Economic Area (EEA): United States. The recipient in the United States is certified under the EU-U.S. Data Privacy Framework (DPF). The certified recipient is Google LLC, which is based in the United States. By its adequacy decision of 10 July 2023, the European Commission decided that the United States ensures an adequate level of protection for personal data transferred to certified companies (Implementing Decision (EU) 2023/1795). The transfer is therefore based on this adequacy decision (Art. 45(1) GDPR). You can check the certification in the official DPF list: https://www.dataprivacyframework.gov/s/participant-search.
Storage and retention
We do not store the data collected by this service in our own systems. The data is stored by the provider. Retention period: Google decides as an independent controller: kept until no longer needed for its purpose, or longer for limited purposes such as security or legal duties; deletion takes about 2 months, backups up to 6 months.
Google Sign-In
We use the service "Google Sign-In" on our websites. The service is provided by Google Ireland Limited (the provider). The address of the provider is Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland.
The provider belongs to a group of companies. The parent company of the group is Google LLC, which is based outside the European Economic Area (EEA). The address of the parent company is 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
The service enables us to let you sign in to or register your Holidu account with your Google account instead of a separate password. On our website for guests, Google's sign-in prompt (One Tap) is loaded from Google's servers and may appear without you clicking anything; you can also choose Google when you sign in and are then redirected to Google. When you sign in, Google passes us your Google account ID, your name, your email address, whether Google has verified that address, a link to your profile picture and, for a Google Workspace account, its domain. We store your name, your email address and the connection to your Google account in your Holidu account. A cookie stores whether you closed the prompt, so that it is not shown again straight away. Signing in this way is your choice; you can always register with your email address and a password instead.
Authentication
Data processed
User-related data
Google account ID
Name
Email address
Profile picture
Device and connection data
IP address
Browser metadata
Technical usage data
Page URL
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
We only use this service if you choose to sign in with it. By clicking the sign-in button, you consent to its use. Storing information on your device and reading information from it is based on your consent under § 25 Abs. 1 TDDDG. The further processing of your personal data is based on your consent under Art. 6(1)(a) GDPR. Your consent is voluntary. You can withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR). You can withdraw your consent by removing the connection to our website in your account with the provider or by contacting us.
Recipients
The provider receives personal data and processes it as an independent controller (Art. 4(7) GDPR). The provider decides for itself on the purposes and means of this processing.
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland (EU/EEA)
Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (third country)
You can find more information on how the provider processes personal data in the provider's privacy policy: policies.google.com/privacy
Transfers to third countries
Personal data is transferred to these countries outside the European Economic Area (EEA): United States. The recipient in the United States is certified under the EU-U.S. Data Privacy Framework (DPF). The certified recipient is Google LLC, which is based in the United States. By its adequacy decision of 10 July 2023, the European Commission decided that the United States ensures an adequate level of protection for personal data transferred to certified companies (Implementing Decision (EU) 2023/1795). The transfer is therefore based on this adequacy decision (Art. 45(1) GDPR). You can check the certification in the official DPF list: https://www.dataprivacyframework.gov/s/participant-search.
Storage and retention
The data collected by this service is stored by the provider and also in our own systems. We keep the data in our own systems only as long as we need it for the purposes described above, or as long as statutory retention obligations require. We then delete or anonymise the data. Retention period: Your name, email address and the connection to your Google account: until your Holidu account is deleted. g_state cookie: 180 days.
Cookies
Retention
Description
g_state
180 days
Remembers if you closed Google's sign-in prompt, so it stays hidden for a while.
Microsoft Sign-In
We use the service "Microsoft Sign-In" on our websites. The service is provided by Microsoft Ireland Operations Limited (the provider). The address of the provider is One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland.
The provider belongs to a group of companies. The parent company of the group is Microsoft Corporation, which is based outside the European Economic Area (EEA). The address of the parent company is One Microsoft Way, Redmond, Washington 98052, USA.
The service enables us to let you sign in to or register your Holidu account with your Microsoft account instead of a separate password. For this, you are redirected to Microsoft to sign in. Microsoft then passes us an identifier of your Microsoft account, your first and last name and your email address or, if the account has none, its sign-in name. We store these details in your Holidu account.
Authentication
Data processed
User-related data
Microsoft account ID
Name
Email address
Legal basis
We only use this service if you choose to sign in with it. By clicking the sign-in button, you consent to its use. Storing information on your device and reading information from it is based on your consent under § 25 Abs. 1 TDDDG. The further processing of your personal data is based on your consent under Art. 6(1)(a) GDPR. Your consent is voluntary. You can withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR). You can withdraw your consent by removing the connection to our website in your account with the provider or by contacting us.
Recipients
The provider receives personal data and processes it as an independent controller (Art. 4(7) GDPR). The provider decides for itself on the purposes and means of this processing.
Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland (EU/EEA)
Microsoft Corporation, One Microsoft Way, Redmond, Washington 98052, USA (third country)
Personal data is transferred to these countries outside the European Economic Area (EEA): United States. The transfer is not covered by an adequacy decision of the European Commission (Art. 45 GDPR). The transfer is protected by the standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR; Implementing Decision (EU) 2021/914). Where necessary, the clauses are supplemented by additional technical, organisational or contractual measures. You can request a copy of the clauses using the contact details in this privacy policy. The standard text of the clauses is published at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj.
Storage and retention
The data collected by this service is stored by the provider and also in our own systems. We keep the data in our own systems only as long as we need it for the purposes described above, or as long as statutory retention obligations require. We then delete or anonymise the data. Retention period: Until your Holidu account is deleted.
Customer.io
We use the service Customer.io, provided by Peaberry Software Inc. (Customer.io), based in the USA. Customer.io is used to manage, automate and analyse email, in-app and push notifications and to optimise our marketing communications and advertising measures.
Where you have given us your consent pursuant to Art. 6(1)(a) GDPR, we process the following personal data:
First and last name
Email address
Device and browser identification number, IP address, MAC address and, where applicable, other IDs and the associated information and telemetry data
Interactions with emails (open rates, clicks, unsubscribes)
Usage behaviour within our services (e.g. in the Property Management Platform)
This data is processed so that we can send you personalised messages based on your interactions and your use of the Holidu services, and carry out automated marketing campaigns. We also analyse your data to create so-called "lookalike audiences", in order to identify and specifically address similar target groups based on existing customer data. Wherever possible, your data is aggregated, pseudonymised or anonymised.
As the use of Customer.io may involve a transfer of personal data to countries outside the EU and the EEA (USA), further safeguards are required to ensure the level of data protection of the GDPR. For the USA, an adequacy decision of the European Commission pursuant to Art. 45(1) GDPR exists in respect of companies certified under the EU-U.S. Data Privacy Framework. Customer.io is certified under the EU-U.S. Data Privacy Framework and has accordingly committed to complying with appropriate data protection standards, which can be verified at the following link: https://www.dataprivacyframework.gov/s/participant-search
The data is stored only for as long as is necessary for the respective communication purpose. As soon as the data is no longer needed for sending or you withdraw your consent, it is deleted.
On our website, we offer you the option of completing your payment via Sofortüberweisung (Klarna) and PayPal. To do this, we work with the payment service provider Adyen N.V. (hereinafter "Adyen"), Simon Carmiggeltstraat 6-50, 1011 DJ, Amsterdam, Netherlands. Adyen is a payment service provider that handles the processing of payments for us.
Depending on the payment method you have chosen, the data required for that payment method is transmitted to Adyen, unless it is collected directly by the payment service. This concerns the following data:
First and last name
Address
Payment data
Invoice amount
Transaction data
Information about your order
This is necessary to verify your identity and process the payment. The legal basis for the processing of your personal data is Art. 6(1)(b) GDPR, the necessity of the payment for the conclusion of a contract with us, as well as Art. 6(1)(f) GDPR, our legitimate interest in using a payment service provider to simplify the administration of payments on our website.
In the context of an identity and credit check based on your data, Adyen and we have a legitimate interest in the transmission of the personal data of the user concerned. Adyen and we require this data in order to obtain information from credit reference agencies for the purpose of identity and credit checks (Art. 6(1)(f) GDPR). We delete the data arising in this context once storage is no longer required, or restrict the processing if statutory retention obligations apply.
You have a right to object on grounds relating to your particular situation, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims (Art. 21(1) GDPR). However, Adyen remains entitled to process and transmit the customer data where this is necessary for the contractual processing of payments or required by law or by an authority or court. Adyen can be contacted at https://www.adyen.com/en_GB/contact
Social networks (Instagram, Facebook, LinkedIn, Google, Github) are only integrated on our website as links to the corresponding services. After clicking on the embedded text/image link, you will be redirected to the page of the respective provider. User information is only transferred to the respective provider after the forwarding. For information on the handling of your personal data when using these websites, please refer to the respective data protection provisions of the providers you use
Data sharing and recipients
Your personal data will not be transferred to third parties, unless
we have explicitly referred to this in the description of the respective data processing,
you have given your express consent to this in accordance with Art. 6(1)(a) GDPR,
disclosure is necessary in accordance with Art. 6(1)(f) GDPR for the assertion, exercise or defence of legal claims and there is no reason to assume that you have an overriding interest worthy of protection in the non-disclosure of your data,
in the event that a legal obligation exists for the disclosure pursuant to Art. 6(1)(c) GDPR and
insofar as this is necessary for the processing of contractual relationships with you in accordance with Art. 6(1)(b) GDPR.
In addition, we use external service providers for the processing of our services, which we have carefully selected, commissioned in writing and with whom we have concluded order processing agreements in accordance with Article 28 of the GDPR, if necessary. These service providers are bound by our instructions and are regularly monitored by us. These are, among others, service providers for hosting, sending e-mails as well as maintenance and care of our IT systems, etc. The service providers will not pass this data on to third parties.
Data security
We take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk in accordance with Article 32 of the GDPR, taking into account the state of the art, the costs of implementation and the nature, scope, circumstances and purposes of the processing, as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons. This website uses SSL encryption for security reasons and to protect the transmission of confidential content.
Duration of the storage of personal data
The duration of the storage of personal data is determined by the relevant statutory retention periods (e.g. from commercial law and tax law). After expiry of the respective period, the corresponding data is routinely deleted. If data is required to fulfil or initiate a contract or if we have a legitimate interest in continuing to store it, the data will be deleted when it is no longer required for these purposes or you have exercised your right of revocation or objection.
Your rights
In the following, you will find information on which data subject rights the applicable data protection law grants you and the controller with regard to the processing of your personal data:
The right to request information about your personal data processed by us in accordance with Art. 15 GDPR. In particular, you can request information about the processing purposes, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right of complaint, the origin of your data if it has not been collected by us, as well as the existence of automated decision-making, including profiling, and, if applicable, meaningful information about its details.
The right to request the correction of inaccurate or incomplete personal data stored by us without delay in accordance with Art. 16 GDPR.
The right to request the erasure of your personal data stored by us in accordance with Article 17 of the GDPR, unless the processing is necessary for the exercise of the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the assertion, exercise or defence of legal claims.
The right to request the restriction of the processing of your personal data in accordance with Art. 18 GDPR, insofar as the accuracy of the data is disputed by you, the processing is unlawful, but you object to its erasure and we no longer require the data, but you need it for the assertion, exercise or defence of legal claims or you have objected to the processing in accordance with Art. 21 GDPR.
The right, in accordance with Art. 20 GDPR, to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format or to request that it be transferred to another controller.
The right to complain to a supervisory authority in accordance with Art. 77 GDPR. As a rule, you can contact the supervisory authority of the federal state where our registered office is located or, if applicable, that of your usual place of residence or workplace.
Supervisory authority: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
The right to revoke consent given in accordance with Art. 7 (3) GDPR: You have the right to revoke consent to the processing of data once given at any time with effect for the future. In the event of revocation, we will immediately delete the data concerned unless further processing can be based on a legal basis for processing without consent. The revocation of the consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.
Right of objection
Insofar as your personal data is processed by us on the basis of legitimate interests pursuant to Art. 6(1)(f) GDPR, you have the right to object to the processing of your personal data pursuant to Art. 21 GDPR, insofar as this is done for reasons arising from your particular situation. Insofar as the objection is directed against the processing of personal data for the purpose of direct marketing, you have a general right of objection without the requirement to specify a particular situation.
If you would like to exercise your right of revocation or objection, simply send an e-mail to service@holidu.com.
Legal obligations
The provision of personal data for the decision on the conclusion of a contract, the fulfilment of a contract or for the implementation of pre-contractual measures is voluntary. However, we can only make the decision in the context of contractual measures if you provide such personal data that is required for the conclusion of the contract, the performance of the contract or pre-contractual measures.
Automated decision making
No automated decision-making within the meaning of Art. 22 GDPR takes place, that is, no decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you. Where you have consented to marketing cookies, your use of our websites is analysed in order to show you relevant advertising; this is described in the section "Cookies".
Additional information for customers, interested parties, hosts and business partners
Purposes and legal bases of the processing of customer, prospective customer and business partner data
We process your personal data in accordance with the provisions of the European Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG), insofar as this is necessary for the establishment, implementation or fulfilment of a contract or for the implementation of pre-contractual measures. Insofar as personal data is required for the initiation or implementation of a contractual relationship or in the context of the implementation of pre-contractual measures, processing is lawful pursuant to Art. 6(1)(b) GDPR.
If you give us express consent to process personal data for specific purposes (e.g. forwarding to third parties, evaluation for marketing purposes or advertising by e-mail), this processing is lawful on the basis of your consent pursuant to Art. 6 (1) a GDPR. Consent given can be revoked at any time with effect for the future (see section 9 of this data protection information).
If necessary and legally permissible, we process your data beyond the actual contractual purposes for the fulfilment of legal obligations pursuant to Art. 6(1)(c) GDPR. In addition, processing may be carried out to protect the legitimate interests of us or third parties and to defend and assert legal claims in accordance with Art. 6 (1) f GDPR. If necessary, we will inform you separately, stating the legitimate interest, insofar as this is required by law.
Categories of data processed
We only process data that is related to the establishment of the contract or the pre-contractual measures. This can be general data about you or persons in your company (name, address, contact details, etc.) as well as any other data that you provide to us in the context of establishing the contract.
Data sources
We process personal data that we receive from you in the course of contacting you or establishing a contractual relationship or in the course of pre-contractual measures or that you provide via our website or forms. In some cases, we also process data from publicly accessible sources.
Recipient of the data
We only pass on your personal data within our company to those areas and persons who need this data to fulfil contractual and legal obligations or to implement our legitimate interest.
We may transfer your personal data to our affiliates to the extent permitted by the purposes and legal bases set out in section 3 of this privacy notice.
Your personal data is processed on our behalf on the basis of order processing contracts in accordance with Art. 28 GDPR. In these cases, we ensure that the processing of personal data is carried out in accordance with the provisions of the GDPR. The categories of recipients in this case are CRM system providers, telephony providers, newsletter dispatch service providers, payment providers.
Otherwise, data is only forwarded to recipients outside the company if this is permitted or required by law, if the forwarding is necessary for the processing and thus the fulfilment of the contract or, at your request, for the implementation of pre-contractual measures, if we have your consent or if we are authorised to provide information. Under these conditions, recipients of personal data may be, for example:
External tax consultant
Public bodies and institutions (e.g. public prosecutor's office, police, supervisory authorities, tax office) if there is a legal or official obligation,
Recipients to whom the disclosure is directly necessary to establish or fulfil the contract, such as partners.
Transfer to a third country
A transfer to a third country is not intended. If one of our processors is located in a third country, we ensure that either an adequacy decision of the European Commission is in place or, in the case of transfers pursuant to Art. 46 et seq. appropriate safeguards such as standard contractual clauses are in place to ensure an essentially equivalent level of protection for your personal data.
Duration of data storage of customer, prospective customer and business partner data
As far as necessary, we process and store your personal data for the duration of our business relationship or for the fulfilment of contractual purposes. This also includes, among other things, the initiation and execution of a contract.
In addition, we are subject to various storage and documentation obligations, which result, among other things, from the German Commercial Code (HGB) and the German Fiscal Code (AO). The periods prescribed there for storage and documentation are two to ten years.
Finally, the storage period also depends on the statutory limitation periods, which, for example, according to §§ 195 et seq. of the German Civil Code (BGB), are usually three years, but in certain cases can be up to thirty years.
Your rights as a customer, interested party or business partner
You have a number of data protection rights that you can assert against us. You can find a detailed list in the section "Your rights" above in this data protection declaration.
Necessity of the provision of personal data
The provision of personal data for the decision on the conclusion of a contract, the fulfilment of a contract or for the implementation of pre-contractual measures is voluntary. However, we can only make a decision within the framework of contractual measures if you provide such personal data that is required for the conclusion of the contract, the fulfilment of the contract or pre-contractual measures.
Automated decision-making in connection with customer, prospect and business partner data
For the establishment, fulfilment or implementation of the business relationship as well as for pre-contractual measures, we generally do not use fully automated decision-making pursuant to Art. 22 GDPR. Should we use these procedures in individual cases, we will inform you about this separately or obtain your consent if this is required by law.
Property Management Platform
As a host, your user account gives you the opportunity to use our Property Management Platform.
When you make full use of our property management platform, the following data will be processed in addition to the data you provided during registration:
Holiday home data (e.g. address, equipment, object pictures)
Invoice address
Bank details
VAT number
The legal basis for data processing is Art. 6(1)(a) GDPR in the case of consent or Art. 6(1)(b) GDPR if processing is necessary to provide the requested services. Your data will be deleted as soon as the user account is deleted and insofar as no legal retention obligations exist.
Partner Portal
If you are a partner of Holidu or would like to enter into a partnership with us, we provide our partner portal for communication, registration, and the management of listings. In order to use the partner portal, we require the following information from you:
Data relating to your company, including your registration details, tax number, and bank account details
Data relating to the accommodations managed by you
Information regarding your website
Information regarding the configuration of your partnership with us, such as the preferred payment method and cancellation conditions
Email addresses and telephone numbers for contact purposes
Date of birth, if you are registered as an individual person
We process your personal data based on Art. 6(1)(b) GDPR, namely the necessity of the data for the performance of your contract or partnership with us, as well as based on Art. 6(1)(c) GDPR in order to comply with our statutory reporting and due diligence obligations under the Platform Tax Transparency Act (PStTG). Further information can be found in the section “Reporting under the Platform Tax Transparency Act (DAC7)” below.
Furthermore, we use cookies on the page of our Partner Portal. These are used for authentication, login, and assignment to the provider selected by you. We therefore process your data based on § 25 Abs. 2 Nr. 2 TDDDG in conjunction with Art. 6(1)(f) GDPR, our legitimate interest in providing you with an expressly requested service that enables the functionality of the Partner Portal.
We store your data for the duration of your partnership and beyond for as long as this is necessary to fulfill our retention and documentation obligations; see also “Duration of Data Storage” in this privacy policy.
Reporting under the Platform Tax Transparency Act (DAC7)
As the operator of a digital platform, we are legally obliged under Directive (EU) 2021/514 (DAC7) in conjunction with the German Platform Tax Transparency Act (Plattformen-Steuertransparenzgesetz – PStTG) to collect certain information about you as a partner, the accommodations offered by you via our Partner Portal and the transactions processed via our platform, and to report this information annually to the competent tax authority.
Data concerned (§ 14 PStTG):
your master data: first name and surname or registered company name, address of your residence or registered office;
for natural persons: your date of birth and any taxpayer identification number (TIN) issued to you, together with the Member State of the European Union that issued it or, where no TIN is available, your place of birth;
for entities: any TIN issued and the Member State that issued it, the business registration number and, where applicable, any permanent establishment in the European Union through which the rental activity is carried out, together with the Member State in which it is located;
where applicable, your VAT identification number;
the identifier of your financial account and, where you are not the account holder, the name of the account holder and any other information enabling the account holder to be identified;
the Member States of the European Union in which you are resident or in which your rented properties are located;
per quarter: the consideration paid or credited to you, the number of bookings in respect of which consideration was paid or credited, and any fees, commissions or taxes withheld or charged by us;
information on the rented properties: address, consideration per quarter and number of bookings per property and, where applicable, the type of property, the number of days on which it was rented and the land registration number or its equivalent under the law of the Member State in which the property is located;
where your identity and tax residence have been confirmed by means of a government identification service of a Member State or of the European Union: the identifier of that service and the Member State that issued it.
Purposes of processing: Compliance with our statutory reporting and due diligence obligations under the PStTG for the purposes of carrying out the taxation procedure.
Legal basis: Art. 6(1)(c) GDPR in conjunction with §§ 13 et seq. PStTG.
Recipients: Federal Central Tax Office (Bundeszentralamt für Steuern – BZSt), for onward transmission to the competent tax authorities of the German federal states (Länder) and, where applicable, to the competent authorities of other Member States of the European Union.
Storage period: We retain the records created in the course of our reporting and due diligence obligations for a period of ten years in accordance with § 24(3) PStTG. Upon expiry of this period, the data will be deleted unless a further statutory retention obligation applies.
We will provide you with the reported information relating to you annually by 31 January of the year following the reporting period.
Existing customer advertising
We reserve the right to process the e-mail address provided by you in the context of the booking in accordance with the statutory provisions in order to send you the following content, among other things, by e-mail during or following the processing of the contract, provided you have not already objected to this processing of your e-mail address:
\- other interesting offers from our portfolio,
\- Overview of possible leisure activities.
The legal basis for the processing is Art. 6(1)(f) GDPR). We carry out the aforementioned processing for customer care and to increase our services. We delete your data when you terminate the newsletter subscription, but no later than two years after termination of the contract.
We would like to point out that you can object to receiving direct advertising at any time without incurring any costs other than the transmission costs according to the basic rates. You have a general right to object without giving reasons (Art. 21 (2) GDPR). To do so, click on the unsubscribe link in the newsletter or send us your objection to the contact details listed in the "Person responsible" section.
Subject to change
We reserve the right to adapt or update this data protection declaration if necessary in compliance with the applicable data protection regulations. In this way, we can adapt it to the current legal requirements and take into account changes to our services, e.g. when introducing new services. The current version applies to your visit.