1 Who is responsible
The controller responsible for processing your data on this website is Tempel & Tempel GmbH, Mühlenstraße 8a, 14167 Berlin, Germany. CityLuxx is our brand for holiday apartments in Berlin.
If you have questions about data protection, write to booking@cityluxx.com.
This notice covers the website cityluxx.com. The site shows information, free dates and prices. You can book and pay for a stay here.
2 Visiting the website
Each time you open a page, your browser sends the server the data it needs to deliver that page:
- your IP address
- the date and time of the request
- the address you opened and the page you came from
- the amount of data transferred and whether the request succeeded
- your browser and operating system
The server records these details in log files. We use them only to fix faults and to fend off attacks. We do not combine them with other data and do not build profiles from them. The logs are deleted as soon as they are no longer needed for this.
Our server fetches free dates and prices from our booking system. For this, only the chosen dates and the number of guests are sent there, nothing about you. To keep anyone from overloading this lookup, the website counts how often prices are requested and booking steps are submitted from one IP address. For this it keeps a checksum of the address, not the address itself. The checksum is valid for one minute and is deleted by the following day at the latest.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is running the website securely and without disruption.
The website is hosted on servers in Germany by ALL-INKL.COM – Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. The provider processes the data on our behalf (Art. 28 GDPR).
The connection to the website is encrypted. We use no analytics and no advertising services. Fonts and images come from our own server. Only the payment page loads content from another provider: the payment form from Stripe (see “Booking and payment”).
3 Cookies
The website only sets cookies it needs in order to work. These do not require consent (section 25(2) no. 2 of the German TDDDG).
- website_locale remembers the language you click in the language menu. The cookie is only created by that click and is deleted after one year.
- website_preview is only given to people we invite to a preview before opening, through a personal link. It is deleted after 180 days.
Neither cookie contains information about you as a person. You can delete them in your browser at any time.
On the payment page, Stripe also sets two cookies: __stripe_mid (valid for one year) and __stripe_sid (valid for 30 minutes). Stripe needs them to detect attempted fraud. They are only created when you open the payment page.
4 When you write to us
When you write to us, we process your email address, your name and the content of your message in order to answer you.
The legal basis is Art. 6(1)(b) GDPR where your message concerns a booking or a booking request, and otherwise Art. 6(1)(f) GDPR. Our legitimate interest is answering enquiries.
Our mailboxes are hosted with Google Workspace. The provider is Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland. It processes the data on our behalf. In the course of this, data may be transferred to Google LLC in the USA. This is based on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework, under which Google LLC is certified, and on the Commission’s standard contractual clauses.
We keep your message for as long as we need it to deal with your request, and beyond that where the law requires it. For messages relating to a booking this is up to ten years (Art. 6(1)(c) GDPR).
5 Booking and payment
When you click “Reserve”, we create a draft of your booking on our server. It contains the apartment, the dates of your stay, the number of guests and the language of the page.
In the steps that follow, we add what you choose and enter there:
- extras, baby cot and high chair
- your approximate arrival time and the occasion of your trip
- first name, last name, email address, phone number and country
- for a company booking, the company’s name, address and VAT ID, and your reference
- your message to us and a voucher code
We store the draft so that you can move between the steps and continue later. What you enter in the steps is kept encrypted in our database.
We set no cookie for this. The draft is tied to a random key in the address of the page. Anyone who knows that address can open the draft, so please do not pass it on.
The legal basis is Art. 6(1)(b) GDPR: we process the details in order to prepare a contract at your request.
If you do not complete the booking, we delete the draft seven days after its last change.
When you click “Book and pay”, the draft becomes a booking. We store it with a booking number, your selection, the details you entered (encrypted), the price in detail and the payment plan.
We pass the reservation on to our booking system, where we also manage the bookings from other platforms: name, email address, phone number and country, the dates of your stay, the number of guests, your arrival time, your message and the price. The provider of the booking system processes these data on our behalf (Art. 28 GDPR).
Payment is handled by Stripe. The provider is Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. The payment page loads the payment form from Stripe’s servers. In doing so, Stripe receives your IP address and details of your browser and device, and sets the cookies named above.
You enter your card or account details directly in Stripe’s form. They go to Stripe and do not reach our server; we neither see nor store your full card number. We send Stripe your name, email address and phone number, the booking number, the amount, the apartment and the dates of your stay. Stripe tells us whether the payment succeeded and gives us identifiers of the payment, which we store with the booking.
If you first pay a deposit, Stripe stores your payment method so that we can charge the balance on the date you are told when booking.
Stripe also processes the data on its own responsibility, mainly to detect fraud and to meet its own legal obligations. In the course of this, data may be transferred to Stripe, Inc. in the USA. This is based on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework, under which Stripe, Inc. is certified, and on the Commission’s standard contractual clauses. You can find more in Stripe’s privacy policy at stripe.com/privacy.
The legal basis for booking and payment is Art. 6(1)(b) GDPR: we perform our contract with you. For protection against fraud it is Art. 6(1)(f) GDPR; our legitimate interest is secure payment.
After the booking we send a confirmation to your email address. The confirmation page stays available at the address of your booking until the day of departure. Anyone who knows that address can open it, so please do not pass it on.
If a booking does not come about, because the payment is not completed or the dates are no longer free, we delete it after seven days, together with the customer record created at Stripe for the payment.
We keep completed bookings and the records of their payments for as long as tax and commercial law require. This is up to ten years (Art. 6(1)(c) GDPR).
6 Your rights
You have the right to ask us for:
- access to your data (Art. 15 GDPR)
- correction (Art. 16 GDPR)
- deletion (Art. 17 GDPR)
- restriction of processing (Art. 18 GDPR)
- your data in a commonly used format (Art. 20 GDPR)
Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object on grounds relating to your particular situation (Art. 21 GDPR).
For any of this, a message to booking@cityluxx.com is enough.
You can also lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, Germany.
You do not have to give us any data. Without your email address, however, we cannot reply to you. We make no decisions by automated means alone.
7 Changes
We update this notice when the website or the law changes. The version on this page applies; its date is at the top.