GRANDVILLEN PRIVACY AND COOKIE POLICY

1. Data Controller

Data controller for the processing of personal data:

GrandVillen GmbH
Flottenstraße 56
13407 Berlin, Germany

Email: info@grandvillen.de
Phone: +49 176 100350010

Data Protection Officer:
Email: info@grandvillen.de

2. Purpose of this Privacy Policy

This Privacy Policy informs you about how we collect, use, and protect your personal data when you use our website or avail yourself of our services.

3. Categories of personal data

We process the following data:

• Identity data (name, date of birth, ID details)
• Contact data (address, email, phone number)
• Payment data
• Transaction data
• Technical data (IP address, browser, device)
• Usage data
• Profile data
• Marketing and communication data

4. Purposes and Legal Bases for Processing

We process your data for the following purposes:

a) Contract performance (Art. 6(1)(b) GDPR)

• Booking and processing of services
• Payment processing
• Customer account management

b) Legal obligations (Art. 6(1)(c) GDPR)

• Tax and retention obligations

c) Legitimate interests (Art. 6(1)(f) GDPR)

• IT security and fraud prevention
• Improvement of our services
• Direct marketing (where permitted)

d) Consent (Art. 6(1)(a) GDPR)

• Newsletter
• Marketing by third-party providers
• Non-essential cookies

5. Obligation to provide data

The provision of certain data is required:

• to fulfill a contract
• to use our services

Without this data, we cannot:

• make no reservations
• provide any services

6. Recipients of the data

Your data will be shared with:

• hotels, airlines, and service providers
• Payment providers
• IT and hosting service providers
• Marketing partners
• Government agencies (where required by law)

7. International data transfers

Your data may be transferred to countries outside the United Kingdom or the European Economic Area.

In doing so, we ensure that an adequate level of data protection is maintained through:

• Adequacy decisions
• Standard contractual clauses
• Legal exceptions (e.g., contract performance for bookings)

8. Retention Period

We store data only for as long as necessary:

• Contract and booking data: up to 10 years
• Account data: until the account is deleted
• Marketing data: until revoked
• Support data: up to 3 years
• Technical log data: short-term (usually max. 14 days)

After that, data is deleted or anonymized.

9. Automated Decisions and Profiling

We use profiling to personalize offers and advertising.

No decisions with legal effects are made exclusively by automated means within the meaning of Article 22 of the GDPR.

You may at any time:

• object to processing for marketing purposes
• withdraw your consent

10. Cookies and Tracking

We use cookies:

• Essential cookies (technically necessary)
• Analytics cookies
• Marketing cookies

Non-essential cookies are only set with your consent.

You can:

• Disable cookies at any time
• Withdraw your consent

11. Your Rights

You have the following rights:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection (Art. 21 GDPR)
• Withdrawal of consent

 You may object to direct marketing at any time.

12. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority.

13. Data Security

We use technical and organizational measures to protect your data (e.g., encryption, access restrictions).

14. Changes to this Privacy Policy

We reserve the right to amend this Privacy Policy. The current version is available on our website.