1. Privacy at a Glance
General Information
The protection of your personal data is important to us.
The following information provides an overview of what happens to your personal data when you visit our website, submit an enquiry, make a booking, contact us, or use any of our other services.
Personal data means any information relating to an identified or identifiable natural person.
More detailed information about the processing of your personal data can be found below.
2. Controller
The controller responsible for data processing in connection with this website and our accommodation services is:
Flatista Immobilien GmbH
Schleißheimer Str. 96 (RGB)
80797 Munich
Germany
Phone: +49 89 9018 4655
Email: info@flatista.de
The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data.
3. General Information on Data Processing
3.1 Legal Bases
We process personal data only where there is a lawful basis for doing so.
Depending on the specific processing activity, the following legal bases may apply in particular:
Article 6(1)(a) GDPR – Consent
Where you have given us your consent to process personal data, the processing is based on that consent.
You may withdraw your consent at any time with effect for the future.
Article 6(1)(b) GDPR – Contract and Pre-Contractual Measures
Processing is carried out on this basis where it is necessary to process a booking enquiry, complete a booking, or perform an accommodation contract.
Article 6(1)(c) GDPR – Legal Obligation
We process personal data where necessary to comply with a legal obligation, including tax, commercial, registration, or reporting obligations.
Article 6(1)(f) GDPR – Legitimate Interests
Processing may also take place on the basis of our legitimate interests or those of a third party, provided that your interests, fundamental rights and freedoms do not override those interests.
3.2 Access to Terminal Equipment and Cookies
Where information is stored on your device or information already stored on your device is accessed, the legal requirements of Section 25 of the German Telecommunications Digital Services Data Protection Act, or TDDDG, also apply.
Where access to or storage of information is strictly necessary in order to provide a digital service expressly requested by you, such processing may take place without consent under Section 25(2) TDDDG.
For non-essential cookies or comparable technologies, we obtain your prior consent in accordance with Section 25(1) TDDDG.
Where personal data is subsequently processed, such processing is carried out on the applicable legal basis under the GDPR, in particular Article 6(1)(a) GDPR where consent has been given.
3.3 Storage Period
Unless a more specific storage period is stated in this Privacy Policy, we store personal data only for as long as necessary for the relevant processing purpose.
If you validly request deletion or withdraw your consent, the relevant data will be deleted unless we have another lawful reason to retain it.
This does not affect statutory retention obligations, in particular under commercial and tax law.
Booking, contractual and invoicing data may therefore be retained for the periods required by applicable law.
Once the relevant retention reason no longer applies, the data will be deleted or anonymised.
3.4 Recipients of Personal Data
In the course of our business activities, we work with external service providers.
These may include, in particular:
- hosting and infrastructure providers,
- content delivery network providers,
- booking and property management systems,
- payment service providers,
- IT and software providers,
- communication service providers,
- booking platforms,
- tax advisers and other professional advisers,
- public authorities where disclosure is legally required.
Personal data is disclosed only where this is necessary for the performance of a contract, required by law, based on your consent, justified by a legitimate interest, or otherwise permitted by law.
Where service providers process personal data on our behalf, we enter into data processing agreements pursuant to Article 28 GDPR where required.
4. Your Rights
Subject to the applicable legal requirements, you have the following rights in particular.
4.1 Right of Access
Under Article 15 GDPR, you have the right to request information about whether and which personal data we process about you.
4.2 Right to Rectification
Under Article 16 GDPR, you have the right to request correction of inaccurate personal data or completion of incomplete personal data.
4.3 Right to Erasure
Under Article 17 GDPR, you have the right to request the deletion of your personal data where the legal requirements are met.
4.4 Right to Restriction of Processing
Under Article 18 GDPR, you have the right to request restriction of the processing of your personal data where the legal requirements are met.
4.5 Right to Data Portability
Where the legal requirements are met, Article 20 GDPR gives you the right to receive personal data you have provided to us in a structured, commonly used and machine-readable format or to request transmission of that data to another controller.
4.6 Withdrawal of Consent
You may withdraw consent you have given at any time with effect for the future.
The lawfulness of processing carried out before withdrawal remains unaffected.
4.7 Right to Object under Article 21 GDPR
WHERE WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF ARTICLE 6(1)(E) OR ARTICLE 6(1)(F) GDPR, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, TO THE PROCESSING OF YOUR PERSONAL DATA.
WE WILL THEN NO LONGER PROCESS THE RELEVANT PERSONAL DATA UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING IS NECESSARY FOR THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.
WHERE PERSONAL DATA IS PROCESSED FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO PROCESSING FOR SUCH MARKETING.
4.8 Right to Lodge a Complaint
You have the right to lodge a complaint with a data protection supervisory authority.
For companies based in Bavaria, the competent supervisory authority is generally:
Bavarian State Office for Data Protection Supervision – BayLDA
Promenade 18
91522 Ansbach
Germany
You may also lodge a complaint with any other supervisory authority competent under Article 77 GDPR.
5. Data Security
SSL or TLS Encryption
Our website uses SSL or TLS encryption for security purposes and to protect the transmission of confidential content.
This applies in particular to information transmitted through booking forms, contact forms and payment processes.
You can usually identify an encrypted connection by the fact that the website address begins with “https://”.
Please note that data transmission over the internet may generally involve security risks. Complete protection against access by third parties cannot be guaranteed.
6. Hosting and Technical Infrastructure
6.1 Netlify
Our website is hosted using services provided by:
Netlify, Inc.
San Francisco, California
USA
When you access our website, technically necessary information may be processed, including:
- IP address,
- date and time of access,
- requested URL or file,
- referrer URL,
- browser type and version,
- operating system,
- technical status and log information.
The processing serves the secure, stable and efficient provision of our website.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in providing a secure and reliable online service.
Where information is stored on or accessed from the user's device and this is strictly technically necessary, the processing is also based on Section 25(2) TDDDG.
Where personal data is transferred to countries outside the EU or EEA, such transfers take place only in accordance with Articles 44 et seq. GDPR, including on the basis of an adequacy decision or appropriate safeguards where applicable.
Further information can be found in Netlify's privacy information.
6.2 Cloudflare
We use services provided by:
Cloudflare, Inc.
101 Townsend Street
San Francisco, CA 94107
USA
Cloudflare may provide content delivery, security and performance services for our website.
In this context, the following information may be processed in particular:
- IP address,
- browser and device information,
- requested content,
- date and time of access,
- technical connection information.
The processing is carried out in order to deliver website content efficiently, maintain the stability of our website, and protect against attacks and misuse.
The legal basis is Article 6(1)(f) GDPR.
Our legitimate interest lies in ensuring the security, stability and performance of our online services.
Where access to or storage of information on the user's device is strictly technically necessary, Section 25(2) TDDDG also applies.
Where data is transferred to the USA or another third country, the transfer is carried out in accordance with Articles 44 et seq. GDPR.
6.3 Turso / Database Infrastructure
We use a database solution provided by Turso for the technical storage and management of customer, enquiry and booking data.
According to our current technical configuration, the relevant data is hosted on Amazon Web Services, AWS, infrastructure in the eu-west-1 region in Ireland.
The following data may be processed in particular:
- contact details,
- customer master data,
- booking data,
- stay information,
- technical booking information,
- other information required to perform the contract.
The processing is carried out for the performance of bookings and accommodation contracts under Article 6(1)(b) GDPR and for the reliable and secure management of data under Article 6(1)(f) GDPR.
Where the data is processed exclusively within the EU or EEA, no third-country transfer takes place in this respect.
7. Cookies and Consent Management
Our website uses cookies and comparable technologies.
Cookies are small data files that are stored on your device or allow access to information already stored on your device.
We distinguish in particular between technically necessary and optional technologies.
7.1 Technically Necessary Technologies
Technologies that are strictly necessary to provide functions expressly requested by you may be used without prior consent.
These may include, for example:
- storage of your language preference,
- storage of your cookie and privacy preferences,
- technically necessary booking functions,
- security functions,
- session management functions.
Access to or storage of information on your device is based on Section 25(2) TDDDG.
Where personal data is processed in this context, the legal basis depends on the purpose and may include Article 6(1)(b) or Article 6(1)(f) GDPR.
7.2 Optional Technologies
Analytics, tracking and other non-essential technologies are generally used only after you have given your consent through our consent or cookie banner.
The legal basis for access to or storage of information on your device is Section 25(1) TDDDG.
The subsequent processing of personal data is based on Article 6(1)(a) GDPR.
You may withdraw or amend your consent at any time with effect for the future through the cookie settings.
8. Contacting Us
8.1 Contact Form
If you contact us using a contact form, we process the information you provide, including your contact details, for the purpose of responding to your enquiry and any follow-up questions.
This may include:
- name,
- email address,
- telephone number,
- content of your message,
- any additional information voluntarily provided.
Where your enquiry relates to an existing or potential contract, the processing is based on Article 6(1)(b) GDPR.
In other cases, processing is based on our legitimate interest in efficiently handling enquiries under Article 6(1)(f) GDPR.
8.2 Email Communication via Alfahosting
We use email services provided by:
Alfahosting GmbH
Edmund-von-Lippmann-Straße 13–15
06112 Halle (Saale)
Germany
When you contact us or we communicate with you in connection with an enquiry or booking, personal data may be processed through the technical infrastructure of our email service provider.
Depending on the purpose, the legal basis is Article 6(1)(b) GDPR or Article 6(1)(f) GDPR.
Our legitimate interest lies in reliable and secure electronic communication.
8.3 Enquiries by Email or Telephone
If you contact us by email or telephone, we process your enquiry and the personal data contained in it for the purpose of handling your request.
Where the enquiry relates to the conclusion or performance of a contract, processing is based on Article 6(1)(b) GDPR.
In other cases, processing is based on Article 6(1)(f) GDPR.
9. Bookings and Accommodation Contracts
9.1 Processing of Customer and Booking Data
When you enquire about or book accommodation with Flatista, we process the personal data required to handle and perform the booking.
This may include:
- first and last name,
- title,
- email address,
- telephone number,
- postal address,
- country,
- arrival and departure dates,
- booked accommodation,
- number of guests,
- information about accompanying guests where required,
- booking and payment status,
- billing information,
- company name,
- VAT identification number,
- special booking requests,
- communication relating to the booking.
The processing is necessary to take steps prior to entering into a contract and to perform the accommodation contract and is therefore based on Article 6(1)(b) GDPR.
Where certain information must be collected or retained due to legal obligations, processing is additionally based on Article 6(1)(c) GDPR.
9.2 Bookings via External Booking Platforms
Our accommodation may also be bookable through external booking platforms, including Booking.com and Airbnb.
Where you make a booking through such a platform, Flatista receives the personal data required to process and perform the booking from the relevant platform.
This may include:
- name,
- contact details,
- booking period,
- booked accommodation,
- number of guests,
- booking reference,
- payment or billing information,
- booking-related messages.
The processing by Flatista is based on Article 6(1)(b) GDPR.
The respective booking platform processes personal data independently in accordance with its own privacy policy.
10. Payment Processing via Stripe
We use Stripe for online payment processing.
Depending on the specific service and contractual structure, companies within the Stripe group may be involved, including European and, where applicable, international Stripe entities.
The following information may be processed as part of the payment process:
- name,
- contact details,
- booking or order information,
- billing information,
- payment amount,
- selected payment method,
- technical transaction information,
- information required for fraud prevention.
Depending on availability, Stripe may offer payment methods including credit card, Apple Pay, Google Pay and other payment options.
Payment information is processed using Stripe's payment infrastructure.
We generally do not receive or store your full credit card information. Instead, we receive information concerning the status of the payment and transaction information required for booking and accounting purposes.
The processing is necessary for the performance of the payment and accommodation contract and is based on Article 6(1)(b) GDPR.
Stripe may process personal data outside the EU or EEA.
Where personal data is transferred to the United States, the transfer is carried out in accordance with Articles 44 et seq. GDPR.
Where applicable, such transfers may in particular be based on the EU-U.S. Data Privacy Framework and, where necessary, additional safeguards such as the Standard Contractual Clauses approved by the European Commission.
Further information can be found in Stripe's privacy documentation.
11. Accommodation and Booking Management with iLoca
We use the iLoca management system to manage our accommodation and reservations.
Following a booking or booking confirmation, the data required to manage the reservation and stay may be processed in or transmitted through iLoca.
This may include:
- name,
- contact details,
- booked accommodation,
- arrival and departure dates,
- number of guests,
- booking status,
- pricing and payment information,
- internal reservation information,
- communication required to organise the stay.
iLoca may also be used to manage reservations and synchronise availability and booking information with connected booking channels and platforms.
The processing is necessary for the performance of the accommodation contract and is based on Article 6(1)(b) GDPR.
Where iLoca processes personal data on our behalf, such processing is carried out on the basis of a data processing agreement pursuant to Article 28 GDPR where legally required.
12. Google Analytics
Where you have given your consent through our consent banner, we use Google Analytics, a web analytics service provided by Google.
For users within the European Economic Area, the relevant Google entity is generally:
Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland
Google Analytics enables us to statistically analyse the use of our website and improve our services.
The following information may be processed in particular:
- pages and content viewed,
- time and duration of visits,
- approximate geographic information,
- browser and device information,
- operating system,
- interactions with the website,
- source of website traffic,
- technical usage and event data.
Google Analytics is only activated on our website where you have given the relevant consent.
Access to or storage of information on your device is based on Section 25(1) TDDDG.
The processing of personal data is based on your consent under Article 6(1)(a) GDPR.
You may withdraw your consent at any time with effect for the future through the cookie settings.
Google may process information outside the EU or EEA in the course of providing its services.
Third-country transfers are carried out in accordance with Articles 44 et seq. GDPR and may, where applicable, be based on an adequacy decision under the EU-U.S. Data Privacy Framework or other appropriate safeguards.
Further information can be found in Google's privacy documentation.
13. Google Fonts
We use Google Fonts to ensure consistent typography across our website.
According to our current technical configuration, the fonts are hosted locally on our own or our contracted hosting infrastructure.
Therefore, merely loading our website does not establish a connection to Google's servers for the purpose of loading fonts.
14. Maps and Location Services
14.1 OpenStreetMap / CARTO
We may use map data from OpenStreetMap to display the location of our accommodation, with the map infrastructure technically provided through a service provider such as CARTO.
When an interactive map is loaded, a connection may be established to the servers of the relevant map provider.
The following information may be processed in particular:
- IP address,
- browser and device information,
- time of access,
- technical connection information,
- information about the map or location viewed.
Where the map is only loaded after your consent or where non-essential information is accessed on your device, the processing is based on your consent under Section 25(1) TDDDG and Article 6(1)(a) GDPR.
Where a specific map function is implemented without an access requiring consent and the processing is necessary to display location information expressly requested by you, another legal basis may apply depending on the technical configuration.
14.2 External Links to Google Maps
We may provide external links to Google Maps, for example to show the location of an accommodation or provide route planning.
A connection to Google Maps is generally only established after you actively click the relevant external link.
From that point onward, further processing of your data is governed by Google's applicable privacy terms.
15. Airport Transfers / Welcome Pickups
On our website or booking confirmation pages, we may offer you the option to book an airport transfer through our external partner Welcome Pickups.
Where we merely provide a link to Welcome Pickups, personal data is generally only transferred to Welcome Pickups after you actively click the link and enter your information on the provider's website.
The privacy terms of Welcome Pickups apply to the subsequent processing of your personal data by that provider.
If we actively transmit booking data to Welcome Pickups in the future, we will provide the information required under applicable data protection law.
16. Statutory Registration Obligations for Accommodation
In connection with the accommodation of guests, we may be legally required to collect, document or disclose certain personal information.
Where such a statutory obligation exists, the processing is based on Article 6(1)(c) GDPR in conjunction with the applicable legal provisions.
The relevant data is processed only to the extent legally required and retained in accordance with applicable statutory retention periods.
17. Security and Fraud Prevention
We may process personal data where necessary to protect our website, booking systems, accommodation and other systems against misuse, fraud, unauthorised access or other security risks.
This may include the processing of technical log, access and security information.
The processing is based on Article 6(1)(f) GDPR.
Our legitimate interest lies in ensuring the security of our systems, preventing fraud and misuse, and protecting our company, guests and third parties.
18. Changes to this Privacy Policy
We may update this Privacy Policy where necessary due to changes in applicable law, our website, the services we use, technical processes or our business activities.
The version currently published on our website shall apply.
Last updated: July 2026
Flatista Immobilien GmbH
Schleißheimer Str. 96 (RGB)
80797 Munich
Germany
Phone: +49 89 9018 4655
Email: info@flatista.de