PRIVACY POLICY

TFS-Apartment

Privacy Policy

Stand: August 2026

1. Responsible person

The controller responsible for the processing of personal data in connection with this website and the rental of our holiday accommodations is:

Werner Jakob Paul KaltZeibgasse 356648 SaffigGermany

Email: Info@tfs-apartment.de

Website: tfs-apartment.com

2. General Information

We take the protection of your personal data seriously.

We process personal data in accordance with applicable data protection regulations, in particular the General Data Protection Regulation (GDPR) and the applicable Spanish and German data protection regulations.

Personal data is information relating to an identified or identifiable person.

We process personal data in particular for the following purposes:

Provision of our website,
Processing of requests,
Booking process,
Processing of payments,
Execution of the lease agreement,
Organization of the stay,
Conducting the online check-in,
Fulfillment of legal obligations,
as well as to protect legitimate interests.

3. What personal data is processed?

Depending on your use of our website and services, the following data may be processed in particular:

First and Last Name,
Address,
Email address,
Telephone number,
Booking data,
Arrival and departure dates,
Number of guests,
Invoice data
Payment and transaction data,
Communication content,
Data from the online check-in,
legally required identification data,
If necessary, data from an identity document.

We generally only process data that is necessary for the respective purpose.

4. Visit our website

When you visit our website, technically necessary data may be processed.

This may include, in particular:

IP address,
Date and time of access,
pages visited,
browser type,
operating system,
technical information about the terminal device,
Referrer URL.

The processing is carried out for the technical provision, security and stability of our website.

The legal basis, where applicable, is Article 6(1)(f) GDPR.

5. Making contact

When you contact us by email or via a contact form, we process the data you provide.

These can include, in particular:

Name,
Email address,
Telephone number,
Message content,
further information voluntarily submitted.

The data is processed for the purpose of handling and responding to your request.

Depending on the content, the legal basis is Art. 6 para. 1 lit. b GDPR or Art. 6 para. 1 lit. f GDPR.

6. Bookings via Smuboo

We use the Smuboo booking system for processing and managing bookings.

The following data may be processed during the booking process:

Name,
Contact details,
Booking data,
Arrival and departure dates,
Number of guests,
Details of the booked accommodation,
Invoice data
Payment information,
Further information required for booking.

The data is processed for the execution and fulfillment of the rental agreement.

The legal basis is Article 6(1)(b) GDPR.

Where we are legally obliged to process data, the processing is additionally carried out on the basis of Art. 6 para. 1 lit. c GDPR.

Insofar as Smuboo processes personal data on our behalf, the processing is carried out on the basis of a corresponding data processing agreement, insofar as this is legally required.

7. Online check-in via Smuboo

We also use the function provided by Smuboo for online check-in.

Online check-in may be required before arrival.

This may involve processing the data required for the execution of the stay and the legally required registration.

Depending on legal requirements, this may include in particular:

First and Last Name,
Birth date,
Nationality,
Address,
Data from the identity document,
Document number,
Residence data,
further legally required information.

The data is processed for the purpose of executing the rental agreement and fulfilling legal obligations.

The legal basis is in particular Art. 6 para. 1 lit. b and c GDPR.

8. Processing of ID card data

As part of the online check-in process, you may be required to present or upload a valid identification document.

The processing is carried out in particular for identity verification and to fulfill legal obligations in connection with the registration of travelers.

Under Spanish law, accommodation providers are legally obligated to collect and transmit certain guest data. The relevant regulations govern, among other things, the collection of traveler data and its reporting to the competent authorities.

In principle, only data that is necessary for the respective purpose is processed.

Unless legal requirements mandate the permanent storage of a complete copy of an identity document, such a copy should not be stored longer than necessary.

At check-in, the valid identification document may need to be shown again for identity verification.

9. Legal guest registration

Insofar as we are obliged under Spanish legal regulations to collect guest data or transmit it to the competent authorities, this is done to fulfill this legal obligation.

The legal basis is Article 6 paragraph 1 letter c GDPR.

The relevant legal requirements for the registration of travelers are being met.

10. Payment processing with Stripe

We use Stripe to process credit card payments.

In the context of payment processing, payment, transaction and invoice data may be processed in particular.

Stripe processes personal data, among other things, in connection with processing payment transactions, fraud prevention, and fulfilling legal obligations. The specific processing is governed by Stripe's privacy policy.

The legal basis for processing by us is in particular Art. 6 para. 1 lit. b GDPR.

Further information on data protection at Stripe can be found in Stripe's privacy policy.

11. Payment processing with PayPal

We can offer PayPal for processing payments.

When selecting PayPal as the payment method, the data required for payment processing will be transmitted to PayPal.

PayPal's processing of personal data is governed by PayPal's privacy policy. PayPal processes personal data, among other things, in connection with payment services and the execution of transactions.

For more information, please see PayPal's privacy policy.

12. Recipients of personal data

Personal data may be transferred to the following recipients, if necessary:

Smuboo as a booking and online check-in provider,
Stripe as a payment service provider,
PayPal as a payment service provider,
Hosting providers,
IT service provider,
Tax advisors and accounting service providers,
competent authorities,
responsible security authorities,
other service providers that are required to carry out the booking.

Data will only be shared if there is a legal basis for doing so or if sharing is necessary for the performance of the contract.

13. Order processing

Insofar as external service providers process personal data on our behalf, they are used – where legally required – on the basis of appropriate data processing agreements.

14. Transfer to third countries

Insofar as service providers used by us process personal data outside the European Union or the European Economic Area, this is done only in compliance with the legal requirements of Art. 44 et seq. GDPR.

Some service providers, particularly internationally operating payment and technology providers, may process or transfer personal data to third countries. The applicable data protection information and appropriate safeguards of the providers used must be observed. Stripe and PayPal provide information about international data transfers and the safeguards used in their own privacy policies.

15. Storage duration

We only store personal data for as long as is necessary for the respective purpose.

Furthermore, there may be statutory retention obligations.

Data will be deleted after the respective retention periods have expired, unless there is another legal obligation or a legitimate reason for further storage.

Legally required guest data is subject to the respective statutory retention periods.

16. Your rights

You have the following rights in accordance with the legal provisions:

Right to information,
Right to rectification,
Right to erasure,
Right to restriction of processing,
Right to data portability,
Right to object.

Insofar as processing is based on your consent, you can revoke this consent at any time with effect for the future.

The lawfulness of the processing carried out until the revocation remains unaffected.

Please note that deletion or restriction of processing is not always possible if there are statutory retention requirements or other legal obligations.

17. Right of appeal

You have the right to lodge a complaint with a data protection supervisory authority if you believe that your personal data is being processed unlawfully.

In particular, you can contact the data protection authority of your habitual residence, your place of work or the location of a possible data protection breach.

18. Data security

We take appropriate technical and organizational measures to protect personal data from loss, destruction, manipulation and unauthorized access.

19. Cookies

Our website may use cookies and similar technologies.

We generally distinguish between:

technically necessary cookies,
functional cookies,
Analytics and statistics cookies,
Marketing and tracking technologies.

Technically necessary cookies may be used insofar as they are necessary for the operation of the website.

Non-essential cookies and tracking technologies will only be used after obtaining the appropriate consent, where legally required.

Important: Which specific cookies and services are actually used on tfs-apartment.com must be checked using the technical website configuration.

20. Analysis and Marketing Services

Insofar as we use analysis, statistics or marketing services, their use is subject to the applicable data protection regulations.

Where consent is required, these services will only be activated after such consent has been given.

Important: Before publication, the services actually used, such as Google Analytics, Google Tag Manager, Meta Pixel or similar services, must be specifically added here, provided they are active on the website.

21. Video surveillance

Video surveillance may be in place on the premises or in certain public or communal areas of the holiday resort by the respective operator or person responsible for the resort.

Insofar as this video surveillance is not operated by TFS-Apartment, TFS-Apartment is not responsible for the processing of personal data collected through this video surveillance.

For more detailed information on the purpose, legal basis, storage period and data subject rights, please refer to the data protection notices posted on site by the respective controller.

22. Changes to the Privacy Policy

We reserve the right to amend this privacy policy if legal requirements, technical procedures or our services change.

The version published on our website is the applicable one.