Privacy policy
Updated: 16 October 2026
Controller and contact
K.&A.Haacke GmbH & Co.KG
Am Sande 10
31303 Burgdorf, Germany
mail@bgs-info.de
05136 89 21 36
Website delivery and security
We use servers from Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. IP address, request time and resource, and technical browser and connection information are processed to deliver and secure the website. Article 6(1)(f) GDPR applies to our legitimate interest in a secure, reliable website.
Connections use HTTPS. Fonts, images and the map library are served locally. We do not use Google Fonts, Google Analytics, advertising pixels or embedded social media plugins.
Cookies and local storage
i18n_redirected remembers your language for up to one year. auth_token is used only for administrator login, for up to seven days. Optional private-preview access uses pagelock_access for up to 30 days. These functions provide the requested language and access security under Section 25(2)(2) TDDDG and Article 6(1)(f) GDPR. Ordinary visitors do not need to log in.
Your analytics choice, including refusal, is stored with its timestamp and consent-text version in browser localStorage under baltic-analytics-consent-v1. It is valid for 180 days. Expired, invalid or superseded entries are removed on your next visit, during periodic checks while the page is open and when the page becomes active again. We cannot delete local data while the website is closed, and browser restrictions can prevent deletion. An invalid entry never authorizes analytics. This necessary storage respects your decision and is not used for advertising identification. Change it through Privacy settings or delete website data in your browser. Material consent-version changes require a fresh choice.
Contact and booking enquiries
For non-binding enquiries we process your name, email, travel dates, guest count, quote and any optional phone number and message. Required information is needed to process and answer your online enquiry. It is stored in our booking database and emailed to the people handling enquiries and commissioned technical support.
Article 6(1)(b) GDPR applies to pre-contractual steps and contract performance. Other correspondence is handled under Article 6(1)(f), our legitimate interest in answering your message. Analytics consent is not required. We do not make solely automated decisions with legal or similarly significant effects.
Email delivery and recipients
We use Resend, operated by Plus Five Five, Inc., USA, for notifications and acknowledgements. Sender and recipient addresses, subject and enquiry information needed for processing are sent to this provider for the pre-contractual or contractual purposes above. This does not subscribe you to newsletters or advertising.
Access is limited to responsible staff and hosting, email and IT providers within their duties. Data is not sold for advertising. Providers or subprocessors outside the European Economic Area may involve international transfers. These require the safeguards in Articles 44 onwards GDPR, including an applicable adequacy decision or appropriate safeguards such as EU Standard Contractual Clauses. Contact us for information about the safeguards used for your data and a copy.
Availability synchronization
Our server retrieves calendar feeds from Airbnb, Traum-Ferienwohnungen and Ferienhausmiete. Public availability contains blocked date ranges only, without guest names, reservation numbers or private calendar links. Your browser does not contact these providers directly for calendar synchronization. Article 6(1)(f) GDPR applies to our legitimate interest in accurate availability and preventing overlapping bookings.
Optional PostHog analytics
After explicit consent we may use PostHog, Inc., USA, with its EU cloud to understand public page visits and our enquiry process. Without consent neither the analytics SDK nor analytics events are sent. Accepting and rejecting are equally accessible; the website and enquiries work without analytics.
Events contain public page paths, language, timestamps, random identifiers and selected enquiry steps including night count. We do not send names, contact details, messages, specific travel dates, price amounts, URL query strings or fragments. Automatic click capture, person profiles, session recordings, error recordings, surveys and administrator pages are excluded.
Identifiers are held in memory only and regenerated on reload. Our integration does not set persistent tracking cookies. PostHog can technically see the connection IP; IP-based location enrichment is disabled. EU storage does not rule out access by the US provider or subprocessors. The international-transfer safeguards above apply.
The legal bases are Article 6(1)(a) GDPR and, where device information is stored or accessed, Section 25(1) TDDDG. Withdraw consent at any time through Privacy settings in the footer or on this page. Withdrawal does not affect earlier lawful processing. Do Not Track and Global Privacy Control are respected.
No automatic deletion procedure with a fixed deadline is currently configured for analytics events. Data may remain at PostHog until separately deleted; we cannot currently promise a maximum storage period. The plan-dependent query window is not a deletion guarantee. Withdrawal stops new collection but does not delete previously transmitted data. Contact us with deletion requests. Because we do not create person profiles and random identifiers change on reload, we may be unable to associate earlier events with you.
Optional map and external directions
OpenStreetMap connects only after you select “Load map”. The provider is the OpenStreetMap Foundation, United Kingdom. Its worldwide map servers receive your IP address, technical browser information, request time and requested map areas. We do not request your device location. Your consent is the legal basis under Article 6(1)(a) GDPR and, where applicable, Section 25(1) TDDDG.
The map choice lasts only for the current page. “Remove map” stops further map requests but cannot recall information already transmitted. The address and directions remain available without it. Google Maps and Apple Maps buttons open those external services only when clicked; their privacy policies then apply.
Retention
Enquiries and emails are needed while handling the request, any resulting booking, and the establishment or defence of legal claims. They are then deleted unless statutory retention requires keeping the affected records for the applicable period. Technical logs and backups are retained according to their operational purpose; a specific security incident may require longer preservation.
Consent choices and functional cookies have the lifetimes above. Information about retention of active analytics events appears in the PostHog section. Contact us for access to, or deletion of, information stored about your enquiry.
Your rights and complaints
Subject to the legal requirements, you have rights of access (Article 15 GDPR), rectification (16), erasure (17), restriction (18) and portability (20). Under Article 21 you may object to legitimate-interest processing for reasons relating to your particular situation. Consent can be withdrawn at any time. Contact mail@bgs-info.de or write to the address above.
You may complain to a supervisory authority, particularly where you live, work or believe an infringement occurred. The authority for our registered office is the State Commissioner for Data Protection of Lower Saxony, Germany.