top of page

Privacy Policy

Last updated: October 2026

This policy explains which personal data we process when you visit sohana.de, contact us or book with us.

 

1. Controller

Sohana Lifestyle Apartments
Owner: Saskia Heimburger
Franz-Sales-Straße 18, 77977 Rust, Germany
Phone: +49 176 61549291
Email: saskia@sohana.de

We have not appointed a data protection officer because we are not legally required to do so.

 

2. Visiting the website

Our website is hosted by Wix (Wix.com Ltd., Tel Aviv, Israel). When you open a page, Wix processes technically necessary data: IP address, date and time, the page requested, browser, operating system and the page you came from.

We need this data to deliver the website and keep it secure and stable. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is a working and secure website.

Wix processes the data on our behalf (Art. 28 GDPR). For error analysis and performance measurement Wix loads its own services, including a script from the error monitoring service Sentry (Functional Software Inc., USA).

The connection between your browser and the website is encrypted with TLS.

 

3. Cookies and consent

We set technically necessary cookies without consent because the website does not work without them (Section 25(2) no. 2 TDDDG, Art. 6(1)(f) GDPR):

  • XSRF-TOKEN: protection against fraudulent requests, duration: session

  • server-session-bind: protection of technical interfaces, duration: session

  • ssr-caching: fast page delivery, duration: 24 hours at most

  • consent-policy: stores your cookie choice, duration: 12 months

  • fedops.logger.sessionId (local storage): detection of technical errors, duration: 12 months

We load all other cookies and embedded content from other providers only if you have consented via the cookie banner (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). This applies to the Smoobu booking tool and availability calendars, the Google Maps map and the WhatsApp chat button. We currently do not use any analytics or marketing services.

You can change or withdraw your choice at any time. Click “Cookie settings” at the bottom left of any page.

 

4. Contact

If you write to us via the contact form, email, phone or WhatsApp, we process your details to answer your enquiry. These are your name, your email address, your phone number if you provide it, and the content of your message.

The legal basis is Art. 6(1)(b) GDPR if your enquiry concerns a booking. In all other cases it is Art. 6(1)(f) GDPR. Our legitimate interest is answering enquiries.

The contact form is provided by Wix. WhatsApp is a service of WhatsApp Ireland Limited (Ireland). Data may be passed to its parent company Meta in the USA. If you do not want this, you can reach us by email or phone.

 

5. Booking

For bookings we use the Smoobu system (Smoobu GmbH, Pappelallee 78/79, 10437 Berlin, Germany). The booking tool is embedded on the home page and on the “Reservierung” page, and the apartment pages also show an availability calendar. Both are only loaded once you have consented in the cookie banner. Your IP address is then transmitted to Smoobu so that you can see availability. Smoobu loads technical files via the Cloudflare network (Cloudflare, Inc., USA), which therefore also receives your IP address.

When you book, we process your first and last name, address, email address, phone number, travel dates, number of guests, booked services and the chosen payment method. We need this data to conclude and perform the accommodation contract (Art. 6(1)(b) GDPR). Smoobu processes the data on our behalf.

If you book via a platform such as Airbnb or Booking.com, we receive your booking data from that platform. The platform operator is responsible for the processing on the platform.

 

6. Payment

We process payments via Stripe (Stripe Payments Europe, Limited, Dublin, Ireland). You enter your payment details directly with Stripe. We do not see complete card or account details. Stripe also receives the booking details needed for the payment, for example name, email address and amount.

The legal basis is Art. 6(1)(b) GDPR. Stripe is itself the controller for payment processing and may transfer data to Stripe, Inc. in the USA. If you pay by bank transfer, we see the details on our bank statement.

 

7. Guest communication and automation

We use software to help us handle messages you send us by email or via a booking platform. This lets us reply quickly and fix defects promptly. We process your name, your booking data and the content of your message.

We use the following services for this:

  • Make: connects our systems and runs the workflows (provider in the Czech Republic, servers in the EU)

  • Airtable: database for messages, bookings and tasks (provider in the USA)

  • OpenAI: an AI language model classifies messages and drafts replies (provider in Ireland and the USA)

  • Telegram: internal notifications to our team (provider in the United Arab Emirates)

The legal basis is Art. 6(1)(b) GDPR where your booking is concerned, otherwise Art. 6(1)(f) GDPR. Our legitimate interest is fast and reliable guest support. No automated decision with legal effect for you (Art. 22 GDPR) takes place.

 

8. Google Maps and WhatsApp chat button

On the “Contact” page we embed a map from Google Maps (Google Ireland Limited, Ireland). The map is only loaded once you have consented in the cookie banner. Google then receives your IP address and technical information about your browser and may transfer data to the USA.

At the bottom right of our pages we show a chat button that lets you write to us via WhatsApp. The button is provided by the service Chaty (Poptin Ltd., Israel). It is only loaded once you have consented in the cookie banner. Chaty then learns your IP address and technical details about your browser. When you click the button, WhatsApp opens (WhatsApp Ireland Limited, Ireland). WhatsApp is responsible for the processing there.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw it at any time via “Cookie settings”.

 

9. Links to social networks

Our pages contain links to our profiles on Facebook, Instagram and YouTube. These are plain links. Data is only sent to these providers when you click a link.

 

10. Legal obligations

We must process some data and pass it on to authorities because the law requires it. This includes the registration requirement for foreign guests under the German Federal Registration Act, the visitor’s tax and the retention of booking and invoice data for tax purposes. The legal basis is Art. 6(1)(c) GDPR.

 

11. Recipients and transfers to third countries

Your data is only passed to the service providers named in this policy, as well as to our tax advisor and to authorities where we are obliged to do so. We do not sell data.

Some service providers process data outside the EU:

  • Israel (Wix, Chaty): The European Commission has found that Israel provides an adequate level of data protection.

  • USA: The transfer is based on the EU-US Data Privacy Framework if the provider is certified under it. Otherwise we use the European Commission’s standard contractual clauses.

  • United Arab Emirates (Telegram): There is no adequacy decision for this country.

 

12. Storage period

We only store your data for as long as we need it for the respective purpose.

  • We delete enquiries without a booking as soon as they are dealt with and no further questions are to be expected.

  • We keep booking and invoice data for the statutory retention periods, up to ten years depending on the document (Section 147 AO, Section 257 HGB).

  • We keep registration forms for one year and destroy them within three months after that (Section 30 BMG).

  • Your browser stores your cookie choice for twelve months.

 

13. Your rights

You have the following rights:

  • Access to your stored data (Art. 15 GDPR)

  • Rectification of incorrect data (Art. 16 GDPR)

  • Erasure (Art. 17 GDPR)

  • Restriction of processing (Art. 18 GDPR)

  • Receiving your data in a commonly used format (Art. 20 GDPR)

  • Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

Right to object: Where we process data on the basis of Art. 6(1)(f) GDPR, you may object to the processing at any time on grounds relating to your particular situation (Art. 21 GDPR).

To exercise your rights, send an email to saskia@sohana.de.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg, www.baden-wuerttemberg.datenschutz.de.

 

14. Obligation to provide data

For a booking we need the details marked as mandatory in the booking tool. Without them we cannot conclude a contract with you. All other details are voluntary.

 

15. Changes

We update this privacy policy when our website, our service providers or the legal situation change. The version published on this page applies. The German version is authoritative.

bottom of page