Privacy Policy
As of: 2026
1. Privacy at a Glance & General Information
We take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations (in particular the General Data Protection Regulation GDPR and the German Telecommunications-Digital-Services-Data-Protection-Act TDDDG) as well as this Privacy Policy.
This policy provides a transparent overview of what personal data we collect, why we process it, how long it is retained, and what rights you have as a data subject. Personal data is any data that can be used to personally identify you.
2. Controller / Responsible Entity
The controller responsible for data processing on this website is:
Jeannette Springorum
Waashüs
Waaswai 5
25946 Nebel auf Amrum
Germany
The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data (e.g. names, email addresses, etc.).
3. Domain Management, Web Hosting & Cloud Infrastructure
To provide our web platform www.waashues.de, we rely on a specialized infrastructure:
A. Domain Registration, DNS & Email Services (IONOS)
IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany
The domain www.waashues.de is registered with and resolved via IONOS SE DNS servers. Additionally, our business email accounts (@waashues.de) are hosted on IONOS mail servers. When you access our domain or send an email, technical routing data passes through IONOS servers. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in stable and secure communication infrastructure). A Data Processing Agreement (DPA) pursuant to Art. 28 GDPR has been concluded with IONOS.
B. Web Hosting, Cloud Backend, Server Logs & Database (Google Firebase)
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA)
The web hosting of our application (Firebase App Hosting / Google Cloud Run) and the database for storing booking inquiries, occupancy data, and guestbook entries (Cloud Firestore) are powered by Google Firebase. When visiting our pages, Google Firebase processes technical connection data (including your IP address) and standard server log files to deliver content, balance traffic loads, and protect against cyberattacks (DDoS). Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in high availability, fast delivery, and security) and Art. 6 (1) (b) GDPR for processing booking requests. A Data Processing Agreement (DPA) pursuant to Art. 28 GDPR has been concluded with Google. Google is certified under the EU-US Data Privacy Framework (DPF).
4. Data Collection & Technologies on Our Website
Server Log Files
When accessing our website, the web hosting provider (Google Firebase / Google Cloud) automatically collects and stores information in so-called server log files that your browser automatically transmits. These include:
- Browser type and version
- Operating system and device type
- Referrer URL (previously visited website)
- Host name / IP address of the accessing device
- Date and time of the server request
- Transferred data volume and HTTP status code
This data is not combined with other data sources. Processing is based on Art. 6 (1) (f) GDPR to ensure stable operation and defend against cyberattacks. Server logs are automatically deleted after 7 to 30 days.
Cookie Consent & Local Storage Technologies (LocalStorage / SessionStorage)
Our website uses a GDPR- and TDDDG-compliant Consent Management System (Cookie Banner) as well as local browser storage technologies. We distinguish between two categories:
1. Essential Storage (Always active - Legal basis: § 25 (2) No. 2 TDDDG in conjunction with Art. 6 (1) (f) GDPR):
These entries are stored locally in your browser and are strictly necessary for the operation and security of the website: • 'waashues_cookie_consent_v1' (LocalStorage): Stores your cookie banner choices with timestamp. • 'waashues_lang' (LocalStorage): Stores your chosen language ('de' or 'en'). • 'waashues_theme' (LocalStorage): Stores your display theme. • 'waashues_admin_token' / Session-State (SessionStorage): Stores temporary session credentials for authorized administrative access (deleted upon logout or closing browser). • 'kapitaen_hark_chat_v1' (LocalStorage): Stores the local conversation history of the digital concierge 'Kapitän Hark' so discussions persist during navigation or refreshes (cleared anytime via the trash icon in the chat). • 'hark_waving_session_shown' (SessionStorage): Temporarily records during your session whether the welcome greeting animation has been shown.
2. Analytics & Statistics (Google Analytics - Disabled by default - Basic Consent Mode):
Only if you give your explicit consent in the Cookie Banner (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG), Google Analytics (Google Ireland Limited) is dynamically loaded. If you choose 'Essential Only', no script is loaded and no statistical cookies are set. You can adjust or revoke your preferences at any time via 'Cookie Settings' in the footer.
Contact Form & Booking Inquiries
If you submit booking inquiries via contact form or email, your data is processed to handle your request and answer follow-up questions: • Salutation, First and Last Name • Email address and phone number • Postal address (if provided) • Desired travel dates, number of guests, pets, and your individual message Legal basis: Art. 6 (1) (b) GDPR (pre-contractual measures and contract execution). Data is deleted after your inquiry has been resolved (approx. 6–12 months) if no booking takes place. If a contract is formed, retention follows statutory commercial and tax retention periods (6 years under § 257 HGB, 10 years under § 147 AO).
Guestbook Entries
We provide a public guestbook on our website. When submitting an entry, we record your name (or pseudonym), date, rating, and review message. Legal basis: Art. 6 (1) (a) GDPR (your voluntary consent upon submission). Entries are reviewed prior to publication. Data remains published until you request deletion or the guestbook is discontinued. You can revoke your consent at any time by emailing info@waashues.de.
5. Plugins, External Tools & Services
Digital AI Concierge ('Kapitän Hark') & Google Gemini API
We provide an interactive digital concierge named 'Kapitän Hark' on our website. This assistant answers questions regarding our holiday home, individual apartments, seasonal pricing, arrival logistics, and island activities on Amrum. Functionality & Data Processing: When you enter a question in the chat dialog, your query along with preceding dialog context and language preference is securely transmitted via a server-side route to the Google Gemini API (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The system generates an answer tailored to our official Waashüs information and returns it to your browser. Confidentiality & No Model Training: No profile or tracking identifiers are transmitted. We advise against submitting sensitive personal data (e.g., postal addresses or payment details) in the chat. Under Google Cloud Enterprise API terms, conversational inputs are not used to train public AI models. No persistent chat logs are retained on our servers after request completion. Local Browser Storage: To maintain the conversation while browsing between pages, the dialogue is stored locally in your browser ('kapitaen_hark_chat_v1' in LocalStorage). You can delete this history at any time using the trash icon in the chat header. The session flag 'hark_waving_session_shown' (SessionStorage) is automatically removed upon closing your browser tab. Voluntary Use & Legal Basis: Using the chatbot is completely voluntary. Inquiries, bookings, and direct contact can always be made without the chatbot via our booking form, email, or telephone. Legal basis: Art. 6 (1) (b) GDPR (pre-contractual inquiries and information requests) and Art. 6 (1) (f) GDPR (legitimate interest in modern, barrier-free guest support). Google is certified under the EU-US Data Privacy Framework; a Data Processing Agreement (DPA under Art. 28 GDPR) has been concluded with Google.
Google reCAPTCHA Enterprise (On-Demand Spam Protection)
To safeguard our interactive forms (booking inquiry, guestbook, admin login) against automated abuse (spam bots), we use Google reCAPTCHA Enterprise (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). reCAPTCHA is not loaded sitewide on page load, but only loaded on demand when forms are used. It analyzes user interactions (e.g. IP address, mouse behavior). Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in spam defense and website security). Google is certified under the EU-US Data Privacy Framework.
Google Analytics (in Basic Consent Mode)
Upon receiving your explicit consent, we use Google Analytics (Google Ireland Limited). We operate Google Analytics strictly in 'Basic Consent Mode' with IP anonymization ('anonymize_ip: true'). Your IP address is truncated within EU member states prior to transmission and is not merged with other Google data. No advertising or retargeting profiles are created. Legal basis: Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG. Consent can be revoked at any time.
Notice regarding Google Maps (No embedded maps)
Our website does not embed interactive Google Maps (e.g. via iframe or scripts). Addresses and POIs link as standard external hyperlinks to Google Maps (https://www.google.com/maps). Only when you actively click such a link, you leave our site and open Google Maps in a separate tab or application.
Weather & Tide Data (Server-Side Proxy Only)
Weather and tide forecasts for Nebel/Amrum are fetched and cached exclusively server-side (German Weather Service DWD / Open-Meteo). No direct connection is established between your browser and external weather APIs; no personal user IP addresses are transferred.
6. Data Recipients & Third-Country Transfers
To operate our website and process inquiries, we cooperate with the following service providers:
Google Ireland Limited / Google LLC (USA)
Zweck: Web hosting (Firebase App Hosting), Cloud server logs, database (Firestore), reCAPTCHA Enterprise, Google Analytics (only upon opt-in), Google Gemini API (for optional digital concierge 'Kapitän Hark')
Rechtsgrundlage / Garantie: Data Processing Agreement (DPA under Art. 28 GDPR), adequacy decision EU-US Data Privacy Framework (DPF) under Art. 45 GDPR, and Standard Contractual Clauses (SCC) under Art. 46 GDPR.
IONOS SE (Germany)
Zweck: Domain registration, DNS servers, and business email mailboxes
Rechtsgrundlage / Garantie: Data Processing Agreement (DPA under Art. 28 GDPR), server location in Germany.
7. Actual Retention Periods
8. Data Subject Rights (Your Rights)
Under applicable data protection law, you have the following rights regarding your personal data:
Right of Access (Art. 15 GDPR)
You have the right to obtain free information about your stored personal data, its origin, recipients, and purpose of processing.
Right to Rectification (Art. 16 GDPR)
You have the right to request the correction of incorrect data or completion of incomplete personal data.
Right to Erasure (Art. 17 GDPR)
You have the right to request deletion of your data, provided no statutory retention obligations apply.
Right to Restriction of Processing (Art. 18 GDPR)
You have the right to request restriction of the processing of your personal data.
Right to Data Portability (Art. 20 GDPR)
You have the right to receive personal data processed automatically on the basis of consent or contract in a structured, machine-readable format.
Right to Object (Art. 21 GDPR)
Where processing is based on Art. 6 (1) (f) GDPR (legitimate interest), you have the right to object at any time for reasons arising from your particular situation.
Right to Revoke Consent (Art. 7 (3) GDPR)
You can revoke any granted consent at any time with future effect by emailing info@waashues.de or via the Cookie Settings.
Right to Lodge a Complaint (Art. 77 GDPR)
You have the right to lodge a complaint with a supervisory authority. Competent for Schleswig-Holstein: Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany (https://www.datenschutzzentrum.de).
9. SSL and TLS Encryption
This website uses modern SSL/TLS encryption (HTTPS) for security and to protect confidential transmission of inquiries. You can recognize an encrypted connection by 'https://' in the address bar and the lock icon in your browser.