This information provides you with an overview of the processing of your personal data when you visit the website stayFritz.com or wish to book one of our accommodations. We inform you about the data we collect from you and how we use it. Additionally, we clarify your rights under applicable data protection law and inform you whom to contact with any questions.
I. Who is responsible for data processing? The controller within the meaning of the General Data Protection Regulation and other national data protection laws of the Member States as well as other data protection provisions is: stayFritz GmbH Seestrasse 9a 83727 Schliersee Germany Email: booking@stayfritz.com
II. Whom can you contact with questions regarding data processing? You can address questions regarding the processing of your data to the data protection officer at any time. The address of the data protection officer is: stayFritz GmbH Data Protection Officer Seestrasse 9a 83727 Schliersee If you have questions regarding your data subject rights (such as data access, data deletion, or objection to advertising) and for further data protection-related questions, please contact: thomas.langenberg@stayfritz.com
III. What data do we process from you? We process your personal data when you book one of our accommodations, provide us with information via a contact form on our website, or wish to contact us in any other way. In particular, this may include the following data: Data about the accommodations rented from stayFritz GmbH Data required for booking one of our accommodations (billing address, check-in and check-out dates, mobile phone number, email address) Data for payment processing (credit card details, bank account details, and other payment information) Data received when redeeming coupons Data generated when placing products in your shopping cart with us Data generated by cookies when using our website Location data Newsletter data Data from contact forms Application data
IV. Is there an obligation to provide the data? The provision of your data is not legally required. However, some of the mentioned data is necessary to conclude and perform contracts for our services. Without providing the data required for contract performance, we are unable to enter into a contract with you for services of stayFritz GmbH.
V. For what purposes do we process your data?
Processing of orders in the online shop We process your data for the processing of bookings in our online shop. The legal basis is Art. 6(1)(b) of the General Data Protection Regulation (contract performance).
Payment processing Card payments and comparable electronic payment methods are processed via Stripe. Payments you make on site are processed via SumUp. For reconciling bank transfers and account movements we use Revolut and finAPI. All data is transmitted encrypted; full card details are processed by the payment providers and are not stored in our own systems.
Guest portal For every booking we provide you with a personal guest portal. There you can view your arrival details, complete the legally required registration form, add fellow travellers, pay outstanding amounts and access your invoices. You can also ask questions there, which are answered first by an AI assistant; our staff can take over at any time. The legal basis is Art. 6(1)(b) GDPR (contract performance) and, for the registration form, additionally Art. 6(1)(c) GDPR in conjunction with German hotel registration law.
Cookies and comparable technologies Necessary cookies, without which the website does not work, are set under Section 25(2) TDDDG without consent. Cookies for analysing website use and for advertising are set only if you have agreed; both categories are switched off by default. You can change your choice at any time via the cookie notice. The legal basis is Section 25(1) TDDDG and Art. 6(1)(a) GDPR.
Connecting your booking to an AI assistant (e.g. ChatGPT) You can voluntarily connect your booking to an AI assistant such as ChatGPT to look up details of your stay there and pay outstanding amounts. Everything this connection offers is also available to you without it in the guest portal.
To sign in, you enter the email address you booked with on a stayFritz page. We send a six-digit one-time code only to the email address stored in your booking; it is valid for ten minutes. After you enter the code, we show you which information the assistant may access, and you decide whether to agree. The access the assistant then receives is limited to exactly one booking.
When you ask the assistant a question about your booking, we transmit to it, depending on the question: your name, arrival and departure dates, the number of travellers, status and booking channel, the booked accommodation with its address and check-in and check-out times, outstanding amounts with individual items, and a time-limited link to your guest portal or to our payment page. This information is processed by the provider of the assistant and appears in your conversation history there. For ChatGPT this is OpenAI OpCo, LLC, and for users in the European Economic Area OpenAI Ireland Ltd. The provider is itself responsible for the processing in its service, including any transfer to the United States; its privacy notice applies.
We never disclose door codes, key-safe codes, the location of the key safe or Wi-Fi passwords this way, not even once everything has been paid; instead you receive a link to your guest portal. We do not accept card details in the conversation; payment takes place only on our payment page.
The legal basis for the transmission to the assistant is your consent under Art. 6(1)(a) GDPR.
The assistant receives access for one hour at a time and can renew it on its own, at most until 30 days after your departure and never for longer than 90 days from the connection. You can withdraw your consent at any time by disconnecting in the assistant's settings or by writing to booking@stayfritz.com; we then also block the access on our side. The withdrawal takes effect for the future. We cannot remove information that is already in your conversation history with the provider.
For this feature we store: the email address you entered, the one-time code, your IP address and the access keys issued, each only as a hash value (not in plain text), together with the booking concerned, the scope of the permission, the identifier of the assistant and the times of request, confirmation, consent and withdrawal. These records serve as proof of your consent (Art. 7(1) GDPR) and to protect against misuse (Art. 6(1)(f) GDPR). We delete them no later than three years after the access ends.
Advertising We also use your data for advertising purposes. You can object to the processing of your data for advertising purposes at any time.
VI. Who has access to your data? Within stayFritz, only individuals who require access to your data to fulfill the tasks assigned to them have access. In addition, we use service providers who process data on our behalf. These are essentially: payment processing — Stripe, SumUp, Revolut, finAPI; booking management — Smoobu; invoicing and accounting — Easybill; email and messaging — Google (Gmail), Resend, 360dialog (WhatsApp); hosting, database and file storage — Hetzner, Neon, Amazon Web Services; AI-assisted answering of guest enquiries — OpenAI, Anthropic. Beyond these service providers we pass on your data only where we are legally obliged to do so, for example to registration authorities under hotel registration law or to tax authorities, or where you yourself initiate it, for example when you connect your booking to an AI assistant (see Section V).
VII. Are data processed outside the EU? Some of the service providers named above process data in the United States, in particular Stripe, Google, Amazon Web Services, Resend, OpenAI and Anthropic. Where a recipient is certified under the EU-US Data Privacy Framework, the transfer is based on the European Commission's adequacy decision of 10 July 2023. Otherwise it is based on the European Commission's standard contractual clauses pursuant to Art. 46(2)(c) GDPR. You can request a copy of the respective safeguards at thomas.langenberg@stayfritz.com. We have taken special measures to ensure that your data is processed in these third countries as securely as within the European Union.
VIII. How long will the data be stored? We store your data for as long as we need it for the purposes described, and beyond that for as long as we are legally obliged to retain it. Invoices, booking records, payment transactions and the associated booking details are subject to commercial and tax retention periods of ten years (Section 257 German Commercial Code, Section 147 German Fiscal Code). We cannot delete this data before that period expires, not even on request. Registration forms are subject to the retention and destruction periods of the German Federal Registration Act. Data for which no statutory retention obligation exists — such as messages from the guest portal, details from contact forms or your newsletter data — is deleted once the purpose of processing no longer applies; newsletter data at the latest when you withdraw your consent. If you would like to know what data we hold about you, or wish to have it deleted, write to thomas.langenberg@stayfritz.com.
IX. What rights do you have? Right to information Right to rectification Right to erasure Right to restriction of processing Right to object Right to lodge a complaint Data portability Right to withdraw your consent The supervisory authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 27, 91522 Ansbach, Germany.