1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Gençer, Cüneyt & Gençer, Carmen Vermietungen GbR
Managing Partner: Cüneyt Gençer
Guntherstr. 49
D-90461 Nuremberg

E-mail: vermietung@gunther49.de
Tel.: +49 (0) 171 53 11 315

2. Purposes of data processing

We process personal data of prospective bookers, persons making bookings, and guests in order to:

• respond to inquiries,
• initiate and process bookings,
• make organizational preparations for and handle the stay,
• communicate with guests before, during, and after the stay,
• issue invoices,
• comply with legal obligations,
• prevent or investigate misuse, damage, and disruptions,
• and assert, exercise, or defend our own legal claims.

3. Data we process

Depending on the specific case, we process the following personal data in particular:

• First name and surname
• Contact details, particularly e-mail address and telephone number
• Address, insofar as required for invoicing or processing
• Booking details, particularly arrival and departure dates, number of guests, accommodation, price, and special requests
• Content of communications from e-mails, messages, or telephone calls
• Invoicing and payment details
• Information you voluntarily provide to us in connection with your stay
• Data regarding the handling of specific incidents, e.g., damage, disruptions, or inquiries

In principle, we process only the data necessary for the inquiry, booking, stay, and legal or organizational processing.

4. Source of the Data

We receive the data

• directly from you,
• from the person making the reservation,
• through our website,
• through booking platforms,
• or through Smoobu, the booking service provider we use.

To the extent that bookings are made through third-party platforms, those platforms’ own privacy policies also apply.

5. Legal Bases for Processing

a) Inquiry, Booking, and Stay

Processing is carried out to implement pre-contractual measures and to fulfill the lodging agreement or rental agreement.

Legal basis: Art. 6(1)(b) GDPR

b) Legal Obligations

To the extent that we process data to fulfill legal obligations—such as tax or commercial law retention requirements or other legal requirements—the processing is based on the following:

Legal basis: Art. 6(1)(c) GDPR

c) Legitimate Interests

Where necessary, we also process data to safeguard legitimate interests. These include, in particular:

• the orderly organization of your stay,
• handling inquiries,
• preventing misuse,
• investigating damage or disruptions,
• enforcing or defending against claims,
• communication in urgent cases.

Legal basis: Art. 6(1)(f) GDPR

d) Consent

If you provide us with separate consent for specific processing activities, the processing is based on that consent.

Legal basis: Art. 6(1)(a) GDPR

Consent may be revoked at any time with future effect.

6. Recipients of the Data

Your personal data will only be disclosed to the extent that it is necessary or legally permitted.

Recipients may include, in particular:

• Booking.com, Airbnb, or other booking platforms, to the extent that the booking or communication is processed through them
• Smoobu, to the extent that the service is used for booking management or communication
• Payment service providers or banks, to the extent necessary for processing payments
• Tax advisors, accounting service providers, or other entities involved in billing
• IT and communications service providers
• Cleaning or organizational service providers, to the extent necessary for the stay
• Insurance companies, attorneys, courts, or government agencies, to the extent necessary to enforce claims, defend legal rights, or comply with legal obligations

7. No Routine Disclosure to the Property Management Company

Guest data is not routinely disclosed to the property management company.

A transfer to the property management company may only be considered on a case-by-case basis if it is necessary to handle a specific claim, a malfunction, an access issue, or to assert or defend against legal claims.

8. Retention Period

We store personal data only for as long as necessary for the purposes stated.

As a general rule:

• Data from inquiries without a subsequent booking: generally up to 6 months after the inquiry is closed, provided there are no other reasons for retention
• Booking and stay data: for the duration of contract fulfillment and until the expiration of the statutory limitation periods
• Invoicing and tax-related data: in accordance with statutory retention periods

9. Obligation to Provide Data

Providing the data required for inquiries, bookings, and stays is necessary. Without this data, we may not be able to process an inquiry or carry out a booking.

10. Your Rights

You have the following rights under applicable law:

• Right of access pursuant to Art. 15 GDPR
• Right to rectification pursuant to Art. 16 GDPR
• Erasure pursuant to Art. 17 of the GDPR
• Restriction of processing pursuant to Art. 18 of the GDPR
• Data portability pursuant to Art. 20 of the GDPR
• Objection pursuant to Art. 21 of the GDPR
• Withdrawal of consent pursuant to Art. 7(3) of the GDPR

11. Right to File a Complaint with a Supervisory Authority

You have the right to file a complaint with a data protection supervisory authority regarding the processing of your personal data.

The competent supervisory authority is, in particular:

Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 27
91522 Ansbach

Email: poststelle@lda.bayern.de

12. Right to Object

To the extent that we process your personal data on the basis of Article 6(1)(f) of the GDPR, you have the right to object to the processing for reasons arising from your particular situation.

13. No Automated Decision-Making

Automated decision-making, including profiling, as defined in Article 22 of the GDPR, does not take place.

14. Effective Date

Effective: August 2026