Das Alpiente
Privacy Policy

Last updated: June 2026

The German version of this privacy policy is the legally authoritative one. This English translation is provided for convenience.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Immobilienservice Arnold
Petra Arnold
Fritz-Bilek-Weg 1a
87549 Rettenberg, Germany
Email: dasalpiente@posteo.de
Phone: +49 151 61400149

2. General

When visiting this website (dasalpiente.com), certain personal data are processed for technical reasons. This privacy policy informs you about which data are collected, for what purpose, on which legal basis, and what rights you have.

Personal data are processed exclusively in accordance with the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

This website is designed to be deliberately data-minimising: no tracking, marketing, or analytics cookies are used, and no web analytics or tracking service is employed. Beyond the mere page request, your IP address is not stored; it arises only for technical reasons in the hosting provider's server logs (see section 3) and may be processed as part of error monitoring (see section 6); when you open a page containing a map, your IP address is additionally transmitted to the OpenStreetMap map service (see section 10). For booking enquiries and newsletter sign-ups, no browser identifier (user-agent) is stored; your IP address is processed there solely as a non-reversible SHA-256 hash for abuse prevention (rate limiting) and deleted after no more than 2 hours (see sections 7 and 8).

3. Hosting

This website is hosted by:

Vercel Inc.
440 N Barranca Avenue #4133
Covina, CA 91723, USA

Each time you access this website, your browser automatically transmits technical connection data to the hosting provider. These server logs contain:

  • IP address of the requesting device
  • Date and time of the request
  • URL accessed
  • HTTP status code and data volume transmitted
  • Browser type and operating system (user-agent)

This data is technically necessary to deliver the website and is automatically deleted after a short period. It is not merged with other data sources.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and uninterrupted operation of the website).

Vercel processes data in the USA and is certified under the EU-US Data Privacy Framework (DPF). A data processing agreement (DPA) pursuant to Art. 28 GDPR is in place with Vercel.

Further information: Vercel Privacy Policy · Vercel DPA

4. Database

The data collected via the enquiry form and the newsletter sign-up are stored in a database operated by the following provider:

Supabase, Inc.
3500 South DuPont Highway
Dover, DE 19901, USA

The database is operated exclusively in a data centre within the European Union (Frankfurt region); your data is therefore stored within the EU. Access to the stored data is technically restricted to the operation of this website and secured against unauthorised access; the data is not publicly accessible.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and reliable storage of enquiry and newsletter data). The underlying processing in each case is governed by sections 7 and 8.

A data processing agreement (DPA) pursuant to Art. 28 GDPR is in place with Supabase.

Further information: Supabase Privacy Policy · Supabase DPA

5. Email Delivery

For the automated sending of emails, we use the following service:

Resend (Plus Five Five, Inc.)
2261 Market Street #5039
San Francisco, CA 94114, USA

On our behalf, Resend sends (a) the notification email to the landlord for each booking enquiry and (b) the confirmation (double opt-in) and unsubscribe emails associated with the newsletter sign-up. The data contained in each case is processed (in particular email address, name, and message content) along with technical sending and delivery information.

Legal basis: Art. 6(1)(b) GDPR for the enquiry notification (pre-contractual measure, see section 7) and Art. 6(1)(a) GDPR for the newsletter emails (consent, see section 8).

Resend processes data in the USA. The data transfer is safeguarded by the EU-US Data Privacy Framework (DPF) and/or the European Commission's Standard Contractual Clauses (SCC). A data processing agreement (DPA) pursuant to Art. 28 GDPR is in place with Resend.

Further information: Resend Privacy Policy · Resend DPA

6. Error Monitoring

To ensure stable and secure operation of this website, we use Sentry to automatically capture and analyse technical errors:

Functional Software, Inc. (dba Sentry)
45 Fremont Street, 8th Floor
San Francisco, CA 94105, USA

If an error occurs during your visit, technical data is transmitted to Sentry, in particular:

  • Error and crash reports (stack traces)
  • IP address
  • Browser and device information
  • The page you accessed

The data is processed and stored exclusively in a data centre within the European Union (EU region, de.sentry.io).

We have configured Sentry in a privacy-friendly manner: no personal data is deliberately collected (sendDefaultPii: false), any parameters contained in the URL are removed before transmission, no session recording (Session Replay) takes place, and local variable values are not captured.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the stable, secure, and error-free operation of the website).

Sentry is operated by a US parent company; insofar as a data transfer to the USA takes place, it is safeguarded by the EU-US Data Privacy Framework (DPF) and/or the European Commission's Standard Contractual Clauses (SCC). A data processing agreement (DPA) pursuant to Art. 28 GDPR is in place with Sentry.

Further information: Sentry Privacy Policy · Sentry DPA

7. Booking Enquiry (Enquiry Form "/buchen")

Using the enquiry form at "/buchen", you can send a non-binding booking enquiry to the landlord. The following data is collected:

  • First and last name
  • Email address
  • Phone number (optional)
  • Selected holiday apartment
  • Check-in and check-out dates
  • Number of adults, children, and toddlers
  • Message (optional)
  • Request for a baby cot (optional)
  • Consent to the privacy notice (required)
  • Consent to the newsletter (optional)
  • Language setting (locale)

This data is stored in the database (see section 4). No browser identifier (user-agent) is stored. For abuse prevention (rate limiting), your IP address is not stored in plain text; it is processed solely as a non-reversible SHA-256 hash and automatically deleted after no more than 2 hours. The legal basis for this is Art. 6(1)(f) GDPR (legitimate interest in preventing abuse). To process your enquiry, a notification email containing the above details together with an automatically calculated price summary is also sent to the landlord via the Resend service (see section 5).

Providing the data marked as required is necessary in order to process your enquiry. Confirming the privacy notice serves as acknowledgement; any newsletter consent is independent of this and is voluntary.

Legal basis: Art. 6(1)(b) GDPR (performance of pre-contractual measures carried out at the data subject's request).

Retention period: Enquiries that do not result in a booking are deleted after 12 months, unless statutory retention obligations apply.

8. Newsletter (Double Opt-In)

You can optionally subscribe to our newsletter. Sign-up takes place via the double opt-in procedure: after signing up, you receive a confirmation email; your sign-up only becomes effective after you click the confirmation link it contains.

For the newsletter, the following data is stored in a separate data set:

  • Email address
  • An irreversible hash value of your email address (SHA-256) for stable recognition
  • The exact wording of the consent declaration shown to you
  • Time of consent
  • Language setting (locale)
  • A confirmation token valid for 30 days and a non-expiring unsubscribe token
  • Timestamps for confirmation, sending, and unsubscribing

No browser identifier (user-agent) is stored. When you open the confirmation or unsubscribe link, your IP address is likewise not stored in plain text but processed solely as a non-reversible SHA-256 hash for abuse prevention (rate limiting) and automatically deleted after no more than 2 hours (Art. 6(1)(f) GDPR — legitimate interest in preventing abuse). The confirmation and unsubscribe emails are sent via the Resend service (see section 5).

Upon unsubscribing, your email address is deleted; only the irreversible hash value is retained to suppress further mailings. This hash value is retained on the basis of Art. 6(1)(f) GDPR (legitimate interest in permanently honouring your unsubscribe request). A renewed sign-up therefore triggers a fresh double opt-in procedure.

Legal basis: Art. 6(1)(a) GDPR (consent).

Withdrawal: You can withdraw your consent at any time with effect for the future, via the unsubscribe link contained in every newsletter email. The lawfulness of the processing carried out up to the point of withdrawal remains unaffected.

Retention period: until consent is withdrawn.

9. Availability Synchronisation (Airbnb iCal)

To correctly display free and blocked periods on the website, an automated server-to-server synchronisation periodically imports the availability calendar (iCal feed) from Airbnb. The booking summaries imported in this process may occasionally contain reservation data and are held exclusively in internal availability records.

This is not data of website visitors; nor is this data displayed on the website.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in an accurate availability display).

10. Map Display (OpenStreetMap)

On several pages of this website (home page, apartment pages, region page, and arrival page) we embed an interactive map to clearly illustrate the location of the accommodation. The map material used for this (map tiles) is retrieved client-side directly from the servers of the OpenStreetMap Foundation when the map loads:

OpenStreetMap Foundation (OSMF)
St John's Innovation Centre
Cowley Road
Cambridge CB4 0WS
United Kingdom

In order to deliver the map tiles to your browser, your IP address is necessarily transmitted to the OpenStreetMap Foundation in the process. Beyond this, the map embed sets no cookies and stores no data in your browser. All marker and icon graphics on the map are served from our own server; no transfer to third parties takes place in this respect.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in clearly illustrating the location of the accommodation).

The OpenStreetMap Foundation is based in the United Kingdom. An adequacy decision of the European Commission exists for the United Kingdom; an adequate level of data protection is thereby ensured.

Further information: OpenStreetMap Foundation Privacy Policy

11. Web Analytics (currently not active)

This website currently uses no web analytics or tracking service (in particular no Vercel Analytics, Google Analytics, or Plausible). Should such a service be introduced in the future, this privacy policy will be updated accordingly beforehand.

12. Cookies & Local Storage

This website does not use any tracking, marketing, or analytics cookies, and stores no data in your browser's local storage (localStorage).

Only hosting services may set short-lived, technically necessary cookies as part of their technical infrastructure. These do not contain personal data and are not used for advertising purposes.

As only technically necessary storage is used, no consent is required for this pursuant to § 25(2)(2) TDDDG.

13. Your Rights as a Data Subject

As a data subject, you have the following rights against the controller:

  • Right of access (Art. 15 GDPR): You may request information about the personal data we process.
  • Right to rectification (Art. 16 GDPR): You may request correction of inaccurate or incomplete data.
  • Right to erasure (Art. 17 GDPR): You may request deletion of your data, provided no statutory retention obligations apply.
  • Right to restriction of processing (Art. 18 GDPR): You may request restriction of processing under certain conditions.
  • Right to data portability (Art. 20 GDPR): You may request your data in a structured, machine-readable format.
  • Right to object (Art. 21 GDPR): You may object to processing where it is based on Art. 6(1)(f) GDPR (legitimate interest).
  • Right to withdraw consent (Art. 7(3) GDPR): You may withdraw any consent given (e.g. for the newsletter) at any time with effect for the future.

To exercise your rights, please contact us by email: dasalpiente@posteo.de. Requests are handled manually.

14. Right to Lodge a Complaint

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with the competent data protection supervisory authority:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 27
91522 Ansbach, Germany
Tel.: +49 (0) 981 53 1300
Email: poststelle@lda.bayern.de
Website: https://www.lda.bayern.de

15. Currency and Changes

This privacy policy is current as of June 2026. As this website develops or legal requirements change, updates may be necessary. The current version is always available at https://dasalpiente.com/datenschutz.