Skip to content

Privacy Policy

Note: This is a translation of our German privacy policy. In case of doubt, the German version applies.

We take the protection of your personal data seriously. In accordance with the General Data Protection Regulation (GDPR), this policy tells you which data is processed when you visit this website, for what purpose and on what legal basis. This website is deliberately built to collect as little data as possible: no cookies for analytics or marketing purposes, no tracking and no external font or analytics services.

1. Controller

The controller within the meaning of the GDPR is:
Balazs Kinal
Bahnweg 7
92318 Neumarkt in der Oberpfalz
Email: balazs@kinal.de
Phone: +49 9181 2705617

A data protection officer is not legally required and has not been appointed. If you have questions about data protection, please use the contact details above.

2. General information on data processing

We process personal data only to the extent necessary. Depending on the process, the legal basis is Art. 6(1)(b) GDPR (contract or pre-contractual measures), Art. 6(1)(f) GDPR (legitimate interest in a secure, functioning website) or Art. 6(1)(a) GDPR (consent), and additionally the German Federal Data Protection Act (BDSG).

3. Hosting (Cloudflare Pages)

This website is delivered as a static site via the platform Cloudflare Pages of Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). In doing so, Cloudflare processes the technically necessary connection data on our behalf (see server log files). The legal basis is our legitimate interest in secure and high-performing operation (Art. 6(1)(f) GDPR).

We have a data processing agreement with Cloudflare under Art. 28 GDPR. Because Cloudflare is a US company, data may be transferred to the USA; this is safeguarded by Cloudflare's certification under the EU-U.S. Data Privacy Framework and, in addition, by Standard Contractual Clauses.

4. Server log files

Each time you visit the site, information that your browser transmits is processed automatically, in particular:

  • IP address
  • date and time of access
  • page or file requested and amount of data transferred
  • referrer URL (the page you visited before)
  • browser used, language and operating system

This data serves exclusively technical operation, security and stability (Art. 6(1)(f) GDPR). It is not combined with other data sources and not evaluated in a way that identifies you.

5. SSL/TLS encryption

For security reasons, this website uses TLS encryption. You can recognise an encrypted connection by the "https://" in your browser's address bar.

6. Cookies and web analytics

This website sets no cookies for analytics, marketing or tracking purposes and uses no web analytics services (e.g. Google Analytics). A cookie banner is therefore not required.

7. Fonts

All fonts are delivered exclusively from our own server (local hosting). There is no connection to external font services such as Google Fonts; as a result, no data is transferred to third parties.

8. Contacting us

If you contact us by email or phone, we process your details (e.g. name, contact details, content of your enquiry) to deal with your request. The legal basis is Art. 6(1)(b) GDPR (where the enquiry concerns a contract) or Art. 6(1)(f) GDPR (legitimate interest in answering). The data is deleted as soon as it is no longer required and no statutory retention obligations prevent this.

If we offer contact via WhatsApp (see legal notice) and you use it voluntarily, your data (e.g. phone number, message content) is additionally processed by WhatsApp Ireland Ltd. or Meta Platforms in accordance with their privacy terms; this may involve a transfer of data to the USA. Alternatively, you can always reach us by email or phone.

9. Booking tool and availability calendar

Bookings are made through our service provider Xentra (Stellar Tourism Innovations GmbH, Torstraße 105–107, 10119 Berlin). The "Book now" buttons lead to booking.hive-homes.de, a subdomain of ours that is technically operated by Xentra. This website itself does not embed a booking form; data only flows once you follow the link. On the booking page, the booking data you enter and your IP address are processed, and technically necessary cookies are set. The legal basis is Art. 6(1)(b) GDPR (initiating and performing the accommodation contract) and our legitimate interest in offering direct booking (Art. 6(1)(f) GDPR).

On the accommodation page, an availability calendar from the same provider is also embedded. It shows the free dates and is therefore, unlike the booking tool, loaded when the page is opened (as an embedded window from app.myxentra.com); your IP address is transmitted to Xentra in the process. The legal basis is our legitimate interest in displaying availability (Art. 6(1)(f) GDPR).

Payment on the booking page is handled by Stripe (Stripe Payments Europe, Ltd., Ireland), integrated via Xentra. Credit card, Apple Pay, Google Pay and Stripe Link are offered. Your payment data, such as the card number, is processed directly by Stripe; we do not receive it ourselves, only the information whether a payment was successful. If you use Apple Pay or Google Pay, the respective provider (Apple or Google) additionally processes the data needed to authorise the payment. The legal basis is Art. 6(1)(b) GDPR (performance of the contract); the privacy notices of the respective provider also apply.

10. Reviews on our website

On the home page and on the accommodation pages we show guest reviews from booking portals. For this purpose, a display component from our service provider Xentra is embedded, technically delivered via its infrastructure provider Supabase. The component is loaded when the page is opened; in the process, your IP address is transmitted to this provider together with the usual details of your browser (identifier, language setting) and the address of our website.

Supabase, Inc. is based in the USA and is used by Xentra as a sub-processor; the contractual safeguards follow our data processing agreement with Xentra. According to our measurements, the component is delivered from a data centre in the European Union; a transfer to the USA can nevertheless not be ruled out.

No cookies are set and no further data is loaded in the process: the reviews shown are already contained in the file retrieved once. Expanding further reviews also does not trigger any further transmission.

The first name, review text, date, portal and rating of the respective guests are displayed. This information has already been published on the booking portals.

The legal basis is our legitimate interest in displaying genuine guest reviews (Art. 6(1)(f) GDPR).

11. Booking handling and invoicing

To handle your booking and to issue invoices as required by law, we process your booking and invoice data (e.g. name, address, stay and booking details). For this we use the following service provider as processor:

  • sevDesk – invoice creation and accounting; sevDesk GmbH, Germany.

The legal basis is Art. 6(1)(b) GDPR (performance of the accommodation contract) and Art. 6(1)(c) GDPR (fulfilment of our tax and commercial-law obligations for invoicing and record keeping). We have a data processing agreement with this service provider (Art. 28 GDPR). We keep invoice documents for the statutory periods and delete them afterwards.

To handle your booking we may send you booking-related text messages (SMS) (e.g. booking confirmation and access and check-in information) to the mobile number you provided. They are sent through our processor seven.io (seven communications GmbH & Co. KG, Kiel, Germany); your mobile number and the message content are processed in the process. These are transactional messages for performing the contract (Art. 6(1)(b) GDPR); they are to be distinguished from advertising messages (see section 18). We have a data processing agreement with seven.io (Art. 28 GDPR).

To handle bookings and manage guest communication (e.g. central processing of your messages about a booking and the automation of booking and invoicing processes), we use our own, self-operated systems. They run on servers of Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) in data centres in Germany; Hetzner processes the data stored there solely as a hosting provider on our behalf. The legal basis is Art. 6(1)(b) GDPR; we have a data processing agreement with Hetzner (Art. 28 GDPR).

12. Recipients / service providers used

We pass on personal data only to the extent necessary to provide our services. In particular, the following are used:

  • Hosting / delivery and DNS (website): Cloudflare, Inc. (USA) – see section 3
  • Server hosting (booking and communication systems): Hetzner Online GmbH, Germany – see section 11
  • Email: Hetzner Online GmbH, Germany – see section 11
  • Booking system: Xentra – Stellar Tourism Innovations GmbH, Germany – see section 9
  • Delivery of the review component: Supabase, Inc. (USA) – infrastructure provider of Xentra, delivery from the EU – see section 10
  • Payment: Stripe Payments Europe, Ltd., Ireland – integrated via Xentra, see section 9
  • Invoicing / accounting: sevDesk GmbH, Germany – see section 11
  • SMS delivery: seven.io – seven communications GmbH & Co. KG, Germany – see section 11

We have processing agreements under Art. 28 GDPR with our processors. Data is not passed on for any purposes other than those stated.

13. Retention period

We store personal data only for as long as is necessary for the respective purpose or as statutory retention periods (e.g. under commercial and tax law) require. After that, the data is deleted.

14. Your rights as a data subject

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20), as well as the right to withdraw consent you have given with effect for the future (Art. 7(3) GDPR). To exercise them, an informal message to the controller named in section 1 is sufficient.

15. Right to object

Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR).

16. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority is:

Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA)
Promenade 18, 91522 Ansbach, Germany
www.lda.bayern.de

17. No automated decision-making

There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

18. Advertising and direct marketing (email, WhatsApp, SMS)

If we send you advertising for our own offers, this is done as follows:

  • Email to existing customers: If you have booked with us, we may use your email address for advertising for our own, similar services (Section 7(3) of the German Unfair Competition Act (UWG), Art. 6(1)(f) GDPR). You may object to this at any time – no costs arise other than the transmission costs at basic rates.
  • Email, WhatsApp or SMS on the basis of consent: We send other advertising messages – in particular by WhatsApp or SMS – only with your express consent (Art. 6(1)(a) GDPR). With WhatsApp, data may be transferred to WhatsApp Ireland Ltd. or Meta (USA).

You can withdraw consent you have given at any time with effect for the future; you can object to the use of your contact details for advertising at any time – informally to the contact details in section 1 or via the unsubscribe link in the respective message.

19. Currency and changes to this privacy policy

This privacy policy is currently valid. Further development of the website or changes in the law may make amendments necessary.

Last updated: October 2026.