Privacy policy
Privacy Policy
1) Introduction and Contact Details of the Controller
1.1 We are pleased that you are visiting our website and thank you for your interest. Below, we inform you about how we handle your personal data when you use our website. Personal data means any data that can be used to identify you personally.
1.2 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:
Michael Belibasakis
trading as Noah’s Ferienoase
Mühlenweg 91
26419 Schortens
Germany
Email: noahsferienoase@online.de
The controller responsible for the processing of personal data is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.
2) Data Collection When Visiting Our Website
2.1 If you use our website for informational purposes only, i.e. if you do not register or otherwise provide us with information, we only collect data that your browser transmits to the website server (so-called “server log files”). When you access our website, we collect the following data, which is technically necessary for us to display the website to you:
- The website visited
- Date and time of access
- Amount of data sent in bytes
- Source/reference from which you accessed the page
- Browser used
- Operating system used
- IP address used (where applicable, in anonymised form)
Processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data will not be disclosed or used for any other purpose. However, we reserve the right to subsequently review the server log files if there are specific indications of unlawful use.
2.2 For security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or enquiries sent to us), this website uses SSL or TLS encryption. You can recognise an encrypted connection by the character string “https://” and the lock symbol in your browser bar.
3) Hosting & Content Delivery Network
3.1 Amazon Web Services
For the hosting of our website and the display of website content, we use the system of the following provider: AWS EMEA SARL, 38 avenue John F. Kennedy, L-1855 Luxembourg.
Data may also be transferred to: Amazon Web Services, Inc., 410 Terry Avenue North, Seattle, WA 98109, USA.
All data collected on our website is processed on the provider’s servers. We have concluded a data processing agreement with the provider which ensures the protection of our website visitors’ data and prohibits unauthorised disclosure to third parties.
For data transfers to the USA, the provider participates in the EU-U.S. Data Privacy Framework, which, on the basis of an adequacy decision by the European Commission, ensures compliance with the European level of data protection.
3.2 AWS CloudFront
We use a content delivery network provided by: AWS EMEA SARL, 38 avenue John F. Kennedy, L-1855 Luxembourg.
This service enables us to deliver large media files such as graphics, page content or scripts more quickly via a network of regionally distributed servers. Processing is carried out in pursuit of our legitimate interest in improving the stability and functionality of our website pursuant to Art. 6(1)(f) GDPR.
We have concluded a data processing agreement with the provider which ensures the protection of our website visitors’ data and prohibits unauthorised disclosure to third parties.
Data may also be transferred to: Amazon Web Services, Inc., 410 Terry Avenue North, Seattle, WA 98109, USA.
For data transfers to the USA, the provider participates in the EU-U.S. Data Privacy Framework, which, on the basis of an adequacy decision by the European Commission, ensures compliance with the European level of data protection.
3.3 Cloudflare
We use a content delivery network provided by: Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA.
This service enables us to deliver large media files such as graphics, page content or scripts more quickly via a network of regionally distributed servers. Processing is carried out in pursuit of our legitimate interest in improving the stability and functionality of our website pursuant to Art. 6(1)(f) GDPR.
We have concluded a data processing agreement with the provider which ensures the protection of our website visitors’ data and prohibits unauthorised disclosure to third parties.
For data transfers to the USA, the provider participates in the EU-U.S. Data Privacy Framework, which, on the basis of an adequacy decision by the European Commission, ensures compliance with the European level of data protection.
4) Cookies
In order to make visiting our website attractive and to enable the use of certain functions, we use cookies, i.e. small text files that are stored on your device. Some of these cookies are automatically deleted after the browser is closed (so-called “session cookies”), while others remain on your device for a longer period and enable website settings to be stored (so-called “persistent cookies”). In the latter case, you can find the storage duration in the cookie settings overview of your web browser.
Where personal data is also processed by individual cookies used by us, processing is carried out pursuant to Art. 6(1)(b) GDPR either for the performance of a contract, pursuant to Art. 6(1)(a) GDPR where consent has been given, or pursuant to Art. 6(1)(f) GDPR in pursuit of our legitimate interests in the best possible functionality of the website and a user-friendly and effective design of the website visit.
You can configure your browser so that you are informed about the setting of cookies and decide individually whether to accept them, or exclude the acceptance of cookies in certain cases or in general.
Please note that if cookies are not accepted, the functionality of our website may be restricted.
5) Contact
When you contact us (e.g. via contact form or email), personal data is processed exclusively for the purpose of handling and responding to your enquiry and only to the extent necessary for this purpose.
The legal basis for processing this data is our legitimate interest in responding to your enquiry pursuant to Art. 6(1)(f) GDPR. If your contact is aimed at entering into a contract, an additional legal basis for processing is Art. 6(1)(b) GDPR. Your data will be deleted when it can be inferred from the circumstances that the matter in question has been conclusively resolved and provided that there are no statutory retention obligations to the contrary.
6) Data Processing for Contract Performance
6.1 For the performance of contracts, we cooperate with the service provider(s) listed below, who support us wholly or partly in carrying out concluded contracts. Certain personal data is transmitted to these service providers in accordance with the following information.
6.2 Use of Payment Service Providers
PayPal
One or more online payment methods from the following provider are available on this website: PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.
If you select a payment method offered by the provider for which you make an advance payment, the payment data provided by you during the ordering process (including name, address, bank and payment card information, currency and transaction number) as well as information about the content of your order will be transmitted to the provider pursuant to Art. 6(1)(b) GDPR. Your data will only be transmitted for the purpose of processing the payment and only to the extent necessary for this purpose.
If you select a payment method for which we make an advance payment, you may also be asked during the ordering process to provide certain personal data (first and last name, street, house number, postal code, city, date of birth, email address, telephone number and, where applicable, information about an alternative payment method).
In such cases, in order to safeguard our legitimate interest in determining your ability to pay, this data will be transmitted by us to the provider pursuant to Art. 6(1)(f) GDPR for the purpose of carrying out a credit check. Based on the personal data provided by you as well as other data (such as shopping basket, invoice amount, order history and payment experience), the provider assesses whether the payment option selected by you can be granted with regard to payment and/or default risks.
The credit report may contain probability values (so-called score values). Where score values are included in the result of the credit assessment, they are based on a scientifically recognised mathematical-statistical procedure. The calculation of score values may include address data, among other factors.
You may object to this processing of your data at any time by contacting us or the provider. However, the provider may remain entitled to process your personal data where this is necessary for contractual payment processing.
6.3 Smoobu
For contract processing, we use the services of the following provider: Smoobu GmbH, Pappelallee 78/79, 10437 Berlin, Germany.
Name, address and, where applicable, other personal data are transmitted to the provider pursuant to Art. 6(1)(b) GDPR for the purpose of contract processing. Your data will only be transmitted to the extent actually necessary for contract processing.
We also use Smoobu to create and manage invoices in connection with bookings and stays. Where personal data is processed in this context, processing is carried out pursuant to Art. 6(1)(b) GDPR for the performance of the respective contract and, where applicable, pursuant to Art. 6(1)(c) GDPR for compliance with statutory retention and documentation obligations.
7) Website Functions
7.1 Mapbox
This website uses an online map service provided by: MapBox Inc., 740 15th St NW, Suite 500, Washington, DC 20005, USA.
The online map service is a tool for displaying interactive maps in order to visually present geographical information. By using this service, our location is displayed to you and any geolocation is facilitated.
When you access pages on which the provider’s map is embedded, information about your use of our website (such as your IP address) may be transmitted to and stored on the provider’s servers.
Your personal data is processed pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in designing our website in line with user needs. If you do not agree to the future transmission of your data to the provider, you may completely deactivate the provider’s online map service by disabling JavaScript in your browser. The online map service on this website can then no longer be used.
Where legally required, we have obtained your consent pursuant to Art. 6(1)(a) GDPR for the processing described above. You may withdraw your consent at any time with effect for the future.
For data transfers to the USA, the provider relies on the European Commission’s Standard Contractual Clauses, which are intended to ensure compliance with the European level of data protection.
7.2 Google Web Fonts
This website uses so-called web fonts for the uniform display of fonts, provided by: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.
When a page is accessed, your browser loads the required web fonts into its browser cache in order to display texts and fonts correctly and establishes a direct connection to the provider’s servers. Certain browser information, including your IP address, is transmitted to the provider.
Data may also be transferred to: Google LLC, USA.
Personal data is processed in connection with the establishment of a connection to the font provider only if you have given us your express consent pursuant to Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future by deactivating this service via the “Cookie Consent Tool” provided on the website. If your browser does not support web fonts, a standard font from your computer will be used.
For data transfers to the USA, the provider participates in the EU-U.S. Data Privacy Framework, which, on the basis of an adequacy decision by the European Commission, ensures compliance with the European level of data protection.
7.3 Google reCAPTCHA
On this website, we use the CAPTCHA service provided by: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.
Data may also be transferred to: Google LLC, USA. Fonts loaded by Google from the internet are used for the visual design of the CAPTCHA window. No further information is processed beyond the information already transmitted to Google through the functionality of reCAPTCHA.
The service checks whether an input is made by a natural person or abusively through automated machine processing and blocks spam, DDoS attacks and similar automated harmful access. To determine whether an action is being performed by a human rather than an automated bot, the provider collects the IP address of the device used, identification data relating to the browser and operating system type used, as well as the date and duration of the visit, and transmits this information to the provider’s servers for evaluation. Cookies may be used in this context.
Where the processing described above is based on cookies, these cookies will only be set if you have given us your express consent pursuant to Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future by deactivating this service in the “Cookie Consent Tool” provided on the website.
Where the processing described above takes place without the use of cookies, the legal basis is our legitimate interest in determining individual personal responsibility on the internet and preventing misuse and spam pursuant to Art. 6(1)(f) GDPR.
We have concluded a data processing agreement with the provider which ensures the protection of our website visitors’ data and prohibits unauthorised disclosure to third parties.
For data transfers to the USA, the provider participates in the EU-U.S. Data Privacy Framework, which, on the basis of an adequacy decision by the European Commission, ensures compliance with the European level of data protection.
8) Tools and Other Services
Cookie Consent Tool
This website uses a so-called “Cookie Consent Tool” to obtain valid user consent for cookies and cookie-based applications that require consent. When you access the website, the Cookie Consent Tool is displayed in the form of an interactive user interface through which you can grant consent for certain cookies and/or cookie-based applications.
By using the tool, all cookies and services requiring consent are only loaded if you give the corresponding consent. This ensures that such cookies are only placed on your device where consent has been granted.
The tool sets technically necessary cookies in order to store your cookie preferences. As a general rule, personal user data is not processed in this context.
If personal data such as an IP address is nevertheless processed in individual cases for the purpose of storing, assigning or logging cookie settings, such processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in legally compliant, user-specific and user-friendly consent management and therefore in the legally compliant design of our website.
A further legal basis for processing is Art. 6(1)(c) GDPR. As the controller, we are subject to the legal obligation to make the use of technically non-essential cookies dependent on the respective user’s consent.
Where required, we have concluded a data processing agreement with the provider which ensures the protection of our website visitors’ data and prohibits unauthorised disclosure to third parties.
Further information about the operator and the settings available in the Cookie Consent Tool can be found directly in the corresponding user interface on our website.
9) Rights of the Data Subject
9.1 Applicable data protection law grants you the following rights with regard to the processing of your personal data:
- Right of access pursuant to Art. 15 GDPR;
- Right to rectification pursuant to Art. 16 GDPR;
- Right to erasure pursuant to Art. 17 GDPR;
- Right to restriction of processing pursuant to Art. 18 GDPR;
- Right to notification pursuant to Art. 19 GDPR;
- Right to data portability pursuant to Art. 20 GDPR;
- Right to withdraw consent pursuant to Art. 7(3) GDPR;
- Right to lodge a complaint pursuant to Art. 77 GDPR.
9.2 Right to Object
IF, AS PART OF A BALANCING OF INTERESTS, WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST, YOU HAVE THE RIGHT AT ANY TIME, FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION, TO OBJECT TO SUCH PROCESSING WITH EFFECT FOR THE FUTURE.
IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED. HOWEVER, FURTHER PROCESSING MAY REMAIN PERMITTED IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.
IF YOUR PERSONAL DATA IS PROCESSED BY US FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH MARKETING.
IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.
10) Duration of Storage of Personal Data
The duration for which personal data is stored is determined by the applicable legal basis, the purpose of processing and, where applicable, additionally by the relevant statutory retention period (e.g. retention periods under commercial and tax law).
Where personal data is processed on the basis of express consent pursuant to Art. 6(1)(a) GDPR, the data concerned will be stored until you withdraw your consent.
Where statutory retention periods apply to data processed within the framework of contractual or similar obligations on the basis of Art. 6(1)(b) GDPR, such data will be routinely deleted after the expiry of the retention periods, provided that it is no longer required for the performance or initiation of a contract and/or we have no continuing legitimate interest in further storage.
Where personal data is processed on the basis of Art. 6(1)(f) GDPR, such data will be stored until you exercise your right to object pursuant to Art. 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
Where personal data is processed for direct marketing purposes on the basis of Art. 6(1)(f) GDPR, such data will be stored until you exercise your right to object pursuant to Art. 21(2) GDPR.
Unless otherwise stated in the other information contained in this Privacy Policy regarding specific processing situations, stored personal data will otherwise be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.
Copyright Notice: This Privacy Policy was created by the specialist lawyers of IT-Recht Kanzlei and is protected by copyright ( https://www.it-recht-kanzlei.de)
Last updated: 09 September 2026