Privacy Policy

Privacy Policy

Version: October 2026

This privacy policy explains which personal data we process when you visit our website, send us an enquiry, make a booking and stay in our holiday apartments, for what purposes, on what legal basis, and what rights you have.

 

1. Controller

MaBu Homes GmbH
Am Exerzierplatz 11
31582 Nienburg/Weser, Germany
Managing Director: Martin Bungartz
Phone: +49 156 7963 1618
Email: info@mabu-homes.de
Website: www.mabu-homes.de

Our company is not legally required to appoint a data protection officer. If you have any questions about data protection, please use the contact details above.

 

2. Visiting Our Website

Hosting and Server Log Files

Our website is provided via the website builder of our booking and channel management provider Smoobu GmbH, Berlin. To our knowledge, the technical service provider operating the website is Duda Inc., USA. When you access our website, information transmitted by your browser is collected automatically: IP address, date and time of access, page accessed, referrer URL, browser type and version, and operating system.

This data is technically necessary to display the website and to ensure its stability and security. The legal basis is Art. 6 (1)(f) GDPR (legitimate interest in a secure and functioning website). Log files are deleted after a short period unless they are needed to investigate a security incident. For transfers to the USA, see section 11.

Cookies

Our website only uses technically necessary cookies required for its operation (e.g. to store your language setting or your cookie notice choice). The legal basis is Section 25 (2) of the German Telecommunications Digital Services Data Protection Act (TDDDG) in conjunction with Art. 6 (1)(f) GDPR. We do not use analytics, tracking or marketing cookies. You can delete or block cookies in your browser settings at any time; some website functions may then not be available.

 

3. Contacting Us

Contact Form, Email and Phone

If you contact us via the contact form, by email or by phone, we process the data you provide (e.g. name, email address, phone number, desired travel dates, content of your message) to answer your enquiry. The legal basis is Art. 6 (1)(b) GDPR if your enquiry relates to a booking, otherwise Art. 6 (1)(f) GDPR (legitimate interest in answering enquiries).

WhatsApp Business

You can also reach us via WhatsApp. We use WhatsApp Business, a service of WhatsApp Ireland Limited, Dublin, Ireland. WhatsApp processes your phone number, profile name, message content and metadata (e.g. time of the message). Message content is end-to-end encrypted. A transfer of metadata to Meta Platforms Inc. in the USA cannot be ruled out (see section 11).

Using WhatsApp is voluntary. The legal basis is Art. 6 (1)(b) GDPR insofar as your booking or stay is concerned, otherwise Art. 6 (1)(f) GDPR. If you prefer not to use WhatsApp, you can always reach us by email or phone. More information: www.whatsapp.com/legal/privacy-policy-eea

 

4. Booking and Contract Processing

Data We Process

To process your booking and stay, we process in particular: name, address, email address, phone number, travel dates, number of guests, booked apartment, payment and invoice data, and our communication with you. The legal basis is Art. 6 (1)(b) GDPR (performance of a contract and pre-contractual measures).

Booking Platforms

If you book via a platform such as Airbnb (Airbnb Ireland UC, Dublin, Ireland) or Booking.com (Booking.com B.V., Amsterdam, Netherlands), the platform transmits the data required for the booking to us. The platforms are responsible for their own data processing; their privacy policies also apply.

Channel Manager and Booking System (Smoobu)

We use Smoobu (Smoobu GmbH, Berlin, Germany) to manage bookings, availability and guest communication, and for direct bookings via our website. Smoobu processes booking data on our behalf under a data processing agreement (Art. 28 GDPR).

Payment Processing (Stripe)

Payments by credit card and other payment methods are processed by Stripe (Stripe Payments Europe, Limited, Dublin, Ireland). Your payment data (e.g. card details, name, amount, email address) is transmitted directly to Stripe; we do not receive full card details. Stripe also processes data for fraud prevention and to comply with legal obligations. The legal basis is Art. 6 (1)(b) and (c) GDPR. A transfer to the USA is possible (see section 11). More information: stripe.com/privacy

Cleaning (Turno)

To plan and coordinate cleaning, we use Turno (Turno, 1003 Bishop St, Honolulu, Hawaii 96813, USA). In particular, arrival and departure dates, the booked apartment, the number of guests and, where applicable, your name are processed. Our own cleaning staff and the cleaning companies we commission also receive this information insofar as it is required for cleaning. The legal basis is Art. 6 (1)(b) and (f) GDPR. For transfers to the USA, see section 11.

Corporate Customers

For bookings made by companies, we process the data of contact persons and of the employees staying with us, insofar as this is necessary to perform the contract. The legal basis is Art. 6 (1)(b) and (f) GDPR.

 

5. Online Check-in and Identity Verification

As key handover is contactless, we carry out an online check-in before arrival. For this we use Stellar Check-in (Stellar Tourism Innovations GmbH, Immanuelkirchstraße 37, 10405 Berlin, Germany). We ask for your name, address, nationality, email address, phone number and a photo of your identity document. You will only receive the access code for the apartment once the check-in is complete. Stellar processes the data on our behalf (Art. 28 GDPR).

The online check-in serves to verify your identity for contactless handover, to protect against misuse and fraud, and to comply with the statutory registration obligation. The legal bases are Art. 6 (1)(b) GDPR (performance of contract), Art. 6 (1)(f) GDPR (legitimate interest in the security of our apartments) and Art. 6 (1)(c) GDPR (registration obligation).

The photo of your identity document is taken with your consent (Section 20 (2) German Identity Card Act, PAuswG). Before uploading, you may black out information not required for identity verification (e.g. the card access number and serial number).

For guests with a foreign nationality, we are required under Sections 29 and 30 of the German Federal Registration Act (BMG) to complete a registration form. We complete the registration form digitally via Stellar Check-in. Registration forms are kept for one year from the day of departure and are destroyed within three months thereafter.

 

6. Invoicing and Accounting

We use bnbills (bnbills UG (haftungsbeschränkt), Coburger Straße 7, 96472 Rödental, Germany) to create invoices. Via a link, you can enter your billing address and the email address for receiving the invoice. bnbills processes this data on our behalf (Art. 28 GDPR).

To comply with our tax obligations, we pass invoice and booking data on to our tax advisor and process it in our accounting software. The legal basis is Art. 6 (1)(c) GDPR in conjunction with tax and commercial law provisions.

 

7. Access to the Apartment (Nuki)

Access to our apartments is provided via electronic lock systems from Nuki Home Solutions GmbH, Graz, Austria. Your individual access code and the times of use (access log) are processed. This serves to provide access, to keep the apartment secure and to investigate incidents. The legal basis is Art. 6 (1)(b) and (f) GDPR. Nuki processes the data on our behalf (Art. 28 GDPR).

 

8. Noise and Smoke Sensor (Minut)

A sensor from Minut AB, Malmö, Sweden, is installed in our apartments. The sensor measures the noise level (in decibels), air quality to detect smoke, as well as temperature and humidity. The sensor does not record conversations, sound or images. The content of conversations cannot be captured.

The readings are used to detect noise disturbances, parties and breaches of the smoking ban, to prevent damage to the apartment (e.g. from humidity) and to protect the neighbours. The legal basis is Art. 6 (1)(f) GDPR (legitimate interest in protecting our property, the neighbours and compliance with the House Rules). We inform you about the sensor before booking, in the House Rules and in the apartment. Minut processes the data on our behalf (Art. 28 GDPR).

 

9. Recipients of Your Data

Your data is only shared with parties that need it for the purposes described:

  • Smoobu GmbH (channel manager, booking system, website)
  • Stellar Tourism Innovations GmbH (online check-in, registration form)
  • bnbills UG (haftungsbeschränkt) (invoicing)
  • Stripe Payments Europe, Limited (payment processing)
  • Nuki Home Solutions GmbH (electronic lock systems)
  • Minut AB (noise and smoke sensor)
  • WhatsApp Ireland Limited (communication, if you use WhatsApp)
  • Booking platforms (Airbnb, Booking.com) through which you booked
  • Turno (cleaning coordination) as well as our cleaning staff and commissioned cleaning companies (travel dates and occupancy only, where necessary)
  • Tax advisor and authorities, where we are legally obliged

We have concluded data processing agreements under Art. 28 GDPR with service providers that process data on our behalf. Data is not passed on for advertising purposes.

 

10. Storage Period

Unless a more specific storage period is stated in this privacy policy, your personal data will remain with us until the purpose for processing no longer applies. If you assert a justified request for deletion or withdraw your consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data (e.g. retention periods under tax or commercial law); in the latter case, deletion takes place once these reasons cease to apply.

Statutory retention periods include in particular:

  • Invoices and accounting records: 8 years (Section 147 German Fiscal Code, Section 257 German Commercial Code)
  • Commercial and business letters: 6 years
  • Registration forms: 1 year from departure (Section 30 (4) BMG)

 

11. Transfers to Third Countries

Some of our service providers (in particular Duda, Turno, Stripe and Meta/WhatsApp) also process data in the USA or have group companies there. Transfers to the USA are based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the European Commission’s Standard Contractual Clauses (Art. 46 (2)(c) GDPR).

 

12. Your Rights

You have the right to:

  • access your stored data (Art. 15 GDPR)
  • rectification of inaccurate data (Art. 16 GDPR)
  • erasure of your data (Art. 17 GDPR)
  • restriction of processing (Art. 18 GDPR)
  • data portability (Art. 20 GDPR)
  • withdraw any consent given, with effect for the future (Art. 7 (3) GDPR)

To exercise these rights, simply contact info@mabu-homes.de.

 

13. Right to Object

Where we process your data on the basis of Art. 6 (1)(f) GDPR (legitimate interest), you have the right to object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

 

14. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Die Landesbeauftragte für den Datenschutz Niedersachsen
Prinzenstraße 5
30159 Hannover, Germany
www.lfd.niedersachsen.de

 

15. Obligation to Provide Data

Providing the data required for booking, online check-in and invoicing is necessary to conclude the contract and carry out your stay; in some cases we are legally obliged to collect it (registration form, tax obligations). Without this data we cannot process your booking or send you an access code.

 

16. No Automated Decision-Making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

 

17. Changes to This Privacy Policy

We will update this privacy policy if our data processing or the legal situation changes. The version published on our website applies.

This English version is a convenience translation. In the event of any discrepancy, the German version shall prevail.