Legal

Privacy Policy

Here we explain in plain language which data we process when you book and stay with us, why we need it and what rights you have.

1. Controller and contact

This privacy policy applies to the website www.dundtprojekt.com, the booking site dundtprojekt.guestybookings.com, the guest app and all data we process in connection with your booking and your stay in our apartments in Bonn and Meckenheim. We are not required to appoint a data protection officer. If you have any questions about data protection, you can reach us using the contact details above.

2. Basics

Legal bases. We only process your data if one of the following bases under the General Data Protection Regulation (GDPR) applies:

• Art. 6 (1) (b) GDPR: to perform the accommodation contract with you or to answer your enquiry before booking,
• Art. 6 (1) (c) GDPR: to comply with legal obligations, for example under the German Federal Registration Act, tax law or municipal tax regulations,
• Art. 6 (1) (f) GDPR: to protect our legitimate interests, for example in the secure operation of the website, the protection of our apartments and the prevention of fraud and misuse,
• Art. 6 (1) (a) GDPR: on the basis of your consent, for example for a newsletter or optional cookies. You can withdraw consent at any time with effect for the future.

Required information. For a booking we need your name, address, email address, mobile number and the number of people travelling with you. Without this information we cannot conclude the contract or send you an access code. All other information is voluntary and marked as such.

Security. We protect your data against unauthorised access, loss and alteration through technical and organisational measures. The website and the booking site are encrypted via HTTPS. Only the management and the people entrusted with looking after the apartments have access to guest data, and only to the extent they need it for their work.

Processors. For individual tasks we use service providers who process data on our behalf and according to our instructions. We have data processing agreements with them in accordance with Art. 28 GDPR. These service providers are named in the following sections.

3. Website

Hosting. Our website is operated via Guesty Websites, a service of Guesty Inc. that technically runs on the platform of Duda, Inc. (Palo Alto, USA). When you visit the website, your data is processed on this provider's servers. The legal basis is our legitimate interest in providing the website securely and quickly (Art. 6 (1) (f) GDPR). We have a data processing agreement with the provider; transfers to the USA are covered by the EU standard contractual clauses and the EU-US Data Privacy Framework (see section 10).

Server logs. Each time the website is accessed, the server automatically stores: the page accessed, date and time, the amount of data transferred, the browser and operating system, the previously visited page and your IP address. This data is used for the stability and security of the website and for troubleshooting. It is not combined with other data and is deleted after 30 days at the latest, unless a security incident requires longer retention.

Cookies. The website only sets technically necessary cookies, for example for language selection and website security. These cookies do not require consent (Section 25 (2) TDDDG). We do not use statistics or marketing cookies. Should this change, we will ask for your consent beforehand via a cookie notice. You can delete or block cookies at any time in your browser settings.

Fonts. The website's fonts are loaded from the hosting provider's server. No connection to Google is established.

Statistics. We do not use a web analytics tool such as Google Analytics. The hosting provider only provides us with anonymous visitor numbers without any personal reference.

Amazon Associates Programme. On the pages of our host shop (Ongoing Supplies, Initial Setup, Tech, Turnover) we link to products on Amazon.de. We take part in the affiliate programme of Amazon EU S.à r.l.; through these links we earn a commission on qualifying purchases, and the price does not change for you. Only when you click such a link are you taken to Amazon; there Amazon processes your data and sets cookies to attribute the referral. No data is collected and no cookies are set for this on our website itself. Amazon's privacy policy applies to processing by Amazon.

Booking site. The "Book now" button takes you to our booking site dundtprojekt.guestybookings.com. Section 4 describes what happens to your data there.

4. Booking, contract handling and payment

Booking and management system. We manage all bookings in the property management system of Guesty Inc. (Guesty). There we store your name, your contact details, the booking data (apartment, period, number of guests, price), the message history with you and the information from the registration form. Guesty is our processor. The data is processed on servers in the EU and the USA; the safeguards in section 10 apply to the USA. The legal basis is the performance of the contract (Art. 6 (1) (b) GDPR).

Direct booking via our booking site. If you book via dundtprojekt.guestybookings.com, you enter your data directly with Guesty. Payment is handled by Guesty Pay, a payment service technically based on Stripe Payments Europe Ltd. (Dublin, Ireland). Your card details are processed exclusively by the payment service provider; we ourselves only see the last four digits, the card type and the payment status. The legal basis is the performance of the contract (Art. 6 (1) (b) GDPR).

Fraud screening. For direct bookings, the payment service provider automatically checks the payment for signs of fraud, for example unusual combinations of card, address and email address. Suspicious bookings are reported to us; we then decide ourselves whether to request further proof or to decline the booking. The legal basis is our legitimate interest in avoiding payment defaults and misuse (Art. 6 (1) (f) GDPR).

Booking via Airbnb or Booking.com. If you book via a platform, the platform first processes your data in accordance with its own privacy policy (Airbnb Ireland UC, Dublin; Booking.com B.V., Amsterdam). We receive from the platform the data needed to carry out your stay: name, contact details, booking period, number of guests and messages. In these cases payment is made via the platform. We transmit to the platform the booking status, messages to you and, where applicable, a review.

Reviews. After your stay you can review us on the respective platform, and we can review you as a guest. This is done according to the platform's rules.

5. Guest communication, self check-in and electronic door locks

Messages before and during your stay. We send you the booking confirmation, check-in instructions, the access code and information during your stay by email, SMS or via the messaging function of the booking platform. Messages are sent via Guesty. Some messages are automated, for example the check-in reminder on the day of arrival. The legal basis is the performance of the contract (Art. 6 (1) (b) GDPR).

Guest app. For your stay you receive a personal link to the Guesty guest app. There you can see your booking, the check-in instructions and the house rules, and you can book additional services such as a later check-out. The app processes your booking data and, if you book something, the payment data as described in section 4. The link is intended for you only and is valid for the duration of your stay.

Access codes and electronic door locks. Our apartments have electronic door locks. For each booking we generate a separate access code that only works during the booked period and is automatically deleted afterwards. The locks are made by Nuki (Nuki Home Solutions GmbH, Graz, Austria) for the apartment doors and Ring (Amazon) for the front door; they are connected to Guesty via an interface. The system logs when a code was used to open a door. We use these logs only to help with check-in problems, to investigate damage or unauthorised access and to secure access. The legal bases are the performance of the contract (Art. 6 (1) (b) GDPR) and our legitimate interest in protecting the apartments (Art. 6 (1) (f) GDPR). The logs are deleted no later than 90 days after your stay, unless an incident requires longer retention.

No video surveillance. There are no cameras and no audio recording in the apartments. The front doorbell may contain a camera; it only records when the bell is rung, and only the entrance area in front of the front door. The use of such a doorbell is indicated by a sign.

Additional services. If you book a later check-out or an additional cleaning via the guest app, we process the booking and the payment as described in section 4.

6. Registration form and identity verification

Registration form. Under Sections 29 and 30 of the German Federal Registration Act, we must have guests who are not German nationals complete a registration form on the day of arrival; for guests with German nationality the registration form has no longer been required since 1 January 2025. Foreign guests complete it digitally via the check-in link and identify themselves with a valid ID document. The following data is collected: arrival and departure dates, surname, first name, date of birth, nationality, address, number of accompanying guests and their nationality, and, for guests from abroad, the number of the identity card or passport. The legal basis is the legal obligation (Art. 6 (1) (c) GDPR). We keep the registration forms for one year from the day of arrival and delete them within three months thereafter, as required by law. Authorities may inspect the registration forms within the legal framework.

Identity verification. As you check in without a personal handover, we may require verification of your identity before the access code is activated, usually by means of a photo of your ID via the check-in link. We use this photo only to match it with the booking. The legal basis is our legitimate interest in only admitting the booked guests to the apartment and in preventing fraud (Art. 6 (1) (f) GDPR). We delete the ID photo no later than 30 days after departure.

Accommodation tax. In Bonn we collect the municipal accommodation tax together with the booking price. For this we must report the number of overnight stays and the purpose of the trip to the city. If you are travelling for business and wish to be exempted from the tax, we need a confirmation from your employer; we keep this with our tax records (Art. 6 (1) (c) GDPR).

7. Contact, newsletter, WhatsApp

Contact form and email. If you write to us via the website's contact form or by email, we store your details and your message in order to answer your enquiry. Our emails run via Microsoft 365 (Microsoft Ireland Operations Ltd., Dublin). The legal basis is answering your enquiry before a booking (Art. 6 (1) (b) GDPR) or our legitimate interest in communicating with you (Art. 6 (1) (f) GDPR). We delete enquiries without a booking no later than 12 months after the last message.

Phone. If you call us, we store your phone number and the content of the conversation only to the extent necessary to deal with your request. Calls are not recorded.

WhatsApp. We offer you the option of contacting us via WhatsApp Business. If you use this channel, WhatsApp Ireland Ltd. (Dublin) processes your phone number and metadata in accordance with its own privacy policy; the content is end-to-end encrypted. We do not upload contact lists to WhatsApp and do not use WhatsApp for advertising. If you do not wish to use WhatsApp, you can reach us at any time by email, SMS or via the guest app. The legal basis is your decision to use this channel (Art. 6 (1) (b) and (f) GDPR).

Newsletter. If you sign up for our newsletter, we store your email address and send you information about our apartments and offers. You confirm your registration via a link in a confirmation email (double opt-in). We log the registration and confirmation with time and IP address so that we can prove your consent. The legal basis is your consent (Art. 6 (1) (a) GDPR). You can unsubscribe from the newsletter at any time via the link at the end of each email or by sending us a message.

Existing customers. If you have already stayed with us, we may occasionally send you offers for our apartments by email (Section 7 (3) of the German Unfair Competition Act, UWG). You can object to this at any time, for example by emailing kontakt@dundtprojekt.com; the only costs incurred are the transmission costs at basic rates.

8. Accounting, taxes and disclosure to third parties

Invoices and accounting. We transfer booking and invoice data from Guesty to our accounting software (Bnbills, Xentra) and to our tax advisor, who works with DATEV. This data includes name, address, invoice amount, period and apartment. The legal basis is our obligations under commercial and tax law (Art. 6 (1) (c) GDPR). The retention period is 8 years for booking records and 10 years for invoices and annual financial statements.

Cleaning and caretaking. The people entrusted with cleaning and looking after the apartments only receive the data they need for their work: apartment, arrival and departure dates, number of guests and special requests. They do not receive your name or contact details unless this is necessary to make arrangements with you.

Apartment owners. We operate some apartments on behalf of their owners. The owners receive statements from us with occupancy periods and amounts, but no names or contact details of guests.

Authorities. We disclose data to authorities where we are legally obliged to do so, for example to the tax office, the City of Bonn for the accommodation tax, the registration authority, or the police and public prosecutor's office in the context of an investigation (Art. 6 (1) (c) GDPR).

Legal enforcement. In the event of damage, outstanding claims or violations of our house rules, we may pass your data on to our lawyer, a debt collection agency or our insurer to the extent necessary to enforce our claims (Art. 6 (1) (f) GDPR).

No other disclosure. Beyond this, we do not sell or rent your data and do not pass it on to third parties for advertising purposes.

9. Retention periods

We only store your data for as long as is necessary for the respective purpose or as required by law. After that we delete it.

Data	Retention period
Booking and invoice data	10 years after the end of the year of booking (tax retention)
Message history with you	3 years after departure (limitation period for possible claims)
Registration forms	1 year from arrival, then deletion within 3 months
ID photo for identity verification	no later than 30 days after departure
Access codes	automatically at check-out
Door lock logs	no later than 90 days after departure
Website server logs	no later than 30 days
Enquiries without a booking	no later than 12 months after the last message
Newsletter data	until you unsubscribe, proof of consent for a further 3 years

If legal proceedings or official proceedings are pending, we retain the data concerned until they are concluded.

10. Transfers to third countries

Some of our service providers are based or have servers outside the EU, mainly in the USA (Guesty, Duda, Microsoft, WhatsApp/Meta, Ring/Amazon). Data is only transferred there if an adequate level of data protection is ensured:

• through certification of the provider under the EU-US Data Privacy Framework (adequacy decision of the EU Commission of 10 July 2023), or
• through the EU standard contractual clauses under Art. 46 (2) (c) GDPR, supplemented by additional safeguards such as encryption.

You can request a copy of the applicable safeguards using the contact details in section 1.

11. Your rights

You have the following rights towards us with regard to your personal data:

• Access(Art. 15 GDPR): you can find out which data we store about you and request a copy.
• Rectification(Art. 16 GDPR): you can have incorrect or incomplete data corrected.
• Erasure(Art. 17 GDPR): you can request the deletion of your data, provided no legal retention obligation prevents this.
• Restriction of processing(Art. 18 GDPR): you can request that we only store your data and no longer process it further.
• Data portability(Art. 20 GDPR): you can receive the data you have given us in a common, machine-readable format.
• Objection(Art. 21 GDPR): if we process data on the basis of our legitimate interest, you can object for reasons arising from your particular situation. You can object to processing for direct marketing at any time without giving reasons.
• Withdrawal of consent(Art. 7 (3) GDPR): you can withdraw any consent you have given at any time with effect for the future.

To exercise your rights, write to us at kontakt@dundtprojekt.com or by post to the address in section 1. We will reply within one month at the latest. To protect your data, we may first ask for proof of your identity.

Right to lodge a complaint. You can also lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.

No automated decisions. We do not make any decisions based solely on automated processing that have legal effect on you. The fraud screening for payments (section 4) only provides indications; we make the decision on a booking ourselves.

12. Changes to this policy

We will adapt this privacy policy if our processes, the service providers we use or the legal situation change. The current version can always be found on this page. The version published at the time of booking applies to your booking; we will inform you of significant changes during an ongoing stay via the guest app.

Last updated: October 2026 · This English version is provided for convenience. In case of discrepancies, the German version applies.

← Back to home