Data controller

The controller responsible for processing personal data is Trixi Wustlich, Ferienhaus am Mühlenweg, Unterer Mühlenweg 3, 79865 Grafenhausen, Germany. Email: info@muehlenweg-schwarzwald.de, telephone: +49 173 9898462. Gunnar Kramny assists with guest services and has access to the guest data needed for this purpose.

Website, hosting and technical access data

Our website is provided through Smoobu GmbH, Pappelallee 78/79, 10437 Berlin, Germany. Smoobu uses Duda, Inc., USA, as a subprocessor for the website builder. When you visit the website, the data processed include your IP address, access time, requested pages and files, referring page, browser and device information, and technical error data. Images, fonts and other website files are also delivered through the website provider’s infrastructure. This enables us to provide the website and display it securely and reliably. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the secure operation of our online services.

Further information: Smoobu privacy policy, Smoobu subprocessors and Duda privacy policy. Our domain and email mailbox are managed through STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany.

Enquiries and contact

If you contact us by email, telephone or contact form, we process the contact details and messages you provide to respond to your enquiry. If your enquiry concerns a booking, the legal basis is Article 6(1)(b) GDPR. We handle other relevant enquiries on the basis of our legitimate interest in communication under Article 6(1)(f) GDPR. Messages are transmitted and stored through the communication services used, particularly STRATO and Smoobu. STRATO’s information is available in the STRATO privacy policy.

Online booking and guest services

We use Smoobu to display availability, handle direct bookings, manage bookings and send booking-related messages. The booking form is embedded in the website; when it loads, Smoobu receives the technical access data required to provide it. For an enquiry or booking, we process in particular names, addresses, contact details, travel dates, the number of guests, necessary information about children’s ages, messages, and booking and payment status. This is done to take steps towards entering into a contract and to carry out your stay under Article 6(1)(b) GDPR. Where statutory retention or documentation obligations apply, the basis is Article 6(1)(c) GDPR.

We need the information marked as mandatory for a booking to process and provide your stay. Without this information, we may be unable to process a booking. Automatic booking confirmations and payment requests are used to administer your booking.

Bookings through platforms

For bookings through Airbnb or Booking.com, we receive the guest, contact, travel and booking data needed to fulfil the booking from the respective platform. We process these data for the same contractual purposes. The respective platform’s privacy notice applies to its independent processing. A simple link from our website to a platform is distinct from a booking through that platform.

Payments

For online payments, the information required for the chosen transaction is transmitted to the relevant payment service. This includes, in particular, billing and contact data, amount, currency, booking reference and transaction data, as well as account, card and technical security data depending on the payment method. We receive information about the payment status and the associated transaction. Processing for payment is based on Article 6(1)(b) GDPR; legally required documentation is based on Article 6(1)(c) GDPR.

PayPal is provided by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. Further information: PayPal privacy statement.

For credit cards, payment links and other methods offered during booking, we use Stripe, in particular Stripe Payments Europe, Limited, Ireland. If you select an additional payment service or wallet, its provider and the banks involved may also receive data. The available choices and additional information are displayed during the payment process. Further information: Stripe privacy policy. Payment providers also process some data as independent controllers for their own statutory obligations and fraud prevention. For bank transfers, we process the bank and booking information required to allocate the payment received.

WhatsApp

If you voluntarily contact us using the WhatsApp link, we process your telephone number, profile information and messages to respond to your enquiry. Article 6(1)(b) GDPR applies to booking enquiries and contractual administration; our legitimate interest in communication under Article 6(1)(f) GDPR applies to other enquiries. You can always use email or telephone instead. Please do not send copies of identity documents or full payment details through WhatsApp.

WhatsApp is provided in the European Economic Area by WhatsApp Ireland Limited. WhatsApp also processes communication and usage data for its own purposes. Further information, particularly about recipients and international transfers: WhatsApp privacy policy. The link on our website is not an embedded chat window.

Tourist tax and guest registration

We use the Tramino registration system to administer tourist tax (provider: Tramino, Peter Traskalik, Weststraße 30, 87561 Oberstdorf, Germany). The information required under the applicable tourist tax regulations, particularly identity and stay details and age information needed for reductions, is transmitted to the municipality of Grafenhausen. The legal basis is Article 6(1)(c) GDPR in conjunction with the relevant municipal tax obligations and tourist tax regulations. Additional registration information is collected only where required by law.

Further information: Tramino privacy policy and Grafenhausen municipal regulations.

Technical storage and external services

Cookies or comparable technical storage and access may be required to provide the website and features you expressly request. Where these are strictly necessary for the requested service, access to your device is governed by section 25(2), no. 2 TDDDG. Storage and access beyond this generally require consent under section 25(1) TDDDG. Subsequent processing of personal data also requires a legal basis under the GDPR.

Google reCAPTCHA has been integrated into the contact form to identify automated submissions. This may transmit IP addresses, browser and device information, and interaction data to Google. The provider for users in the European Economic Area is Google Ireland Limited, Ireland; processing by Google LLC in the USA is also possible. Information about Google’s processing: Google privacy policy.

Recipients and transfers outside the EEA

Access is granted to Trixi Wustlich and Gunnar Kramny and to the service providers engaged for each purpose. Necessary tourist tax data are provided to the municipality. Otherwise, we disclose data where necessary to fulfil the contract, required by law, or covered by valid consent.

Some technical service providers and payment or communication providers may process data outside the EU and the European Economic Area. Smoobu identifies the EU–US Data Privacy Framework and, where necessary, standard contractual clauses as the bases for transfers to US subprocessors. The relevant recipient and the procedure actually used are decisive. You may request information and, where applicable, a copy of the relevant safeguards using the contact details above; further information is available in the linked provider notices.

Retention periods

Retention periods depend on the respective purpose and statutory obligations. Enquiries that do not lead to a booking are needed only for as long as required to handle them and, where applicable, resolve any resulting claims. Booking, contract and payment records are retained for administration and for the applicable tax retention and statutory limitation periods. Tourist tax and registration data are subject to the relevant statutory periods. Technical logs are needed only for as long as required for operation, troubleshooting and security. Once the purpose no longer applies or the applicable periods have expired, the data must be deleted unless another legal basis for retention exists.

Your rights

Subject to the statutory conditions, you have the rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20). You may withdraw consent at any time with effect for the future; this does not affect the lawfulness of prior processing.

Where data are processed on the basis of legitimate interests, you may object on grounds relating to your particular situation (Article 21 GDPR). You may object to processing for direct marketing at any time. To exercise your rights, simply send a message to the contact address above.

You may lodge a complaint with a data protection supervisory authority. In Baden-Württemberg, this is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg. Current contact details and ways to complain are available at Contact the data protection authority.

Last updated: 29 September 2026.