Designer vacation homes in the northern Black Forest
Tel: +49-176-99221106
Official Schwarzwaldstrand logo with geometric house shape and lettering on a transparent background
Book now

Data protection

How personal data is processed when you visit and use this website.

Last updated: 20 September 2026

1. Controller

Vihara Familienstiftung (Vihara Family Foundation), represented by its board
Schwimmbadstraße 26
76332 Bad Herrenalb
Germany
Email: booking@schwarzwaldstrand.de
Phone: +49 176 99221106

We have not appointed a data protection officer, as there is no legal obligation to do so.

2. Provision of the website and hosting

This website is hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. IONOS processes the data as a processor on our behalf. When you access the website, technically necessary connection data is processed in server log files, in particular IP address, date and time of access, requested file, browser and operating system information, referrer, amount of data transferred and HTTP status code. This processing is necessary to deliver the website and to ensure its security and stability.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in providing the website securely, stably and efficiently. According to IONOS, IP addresses in the log files are anonymised and the log files are stored for a maximum of eight weeks.

The website runs on the WordPress content management system. To speed it up, we use a page cache (plugin “WP-Optimize”); no personal data is transferred to third parties in the process.

3. SSL/TLS encryption

This website uses SSL/TLS encryption. You can recognise an encrypted connection by “https://” in your browser’s address bar.

4. Cookies and consent management

We use technically necessary cookies and – only with your consent – cookies and similar technologies for statistics, marketing and external content. Storing information on, and accessing information from, your device is based on § 25(2) TDDDG (technically necessary) or § 25(1) TDDDG (consent). The subsequent processing of personal data is based on Art. 6(1)(f) GDPR or on your consent pursuant to Art. 6(1)(a) GDPR.

To manage your consent we use the plugin “Real Cookie Banner” by devowl.io GmbH, Tübingen, Germany. Your choice is stored in a cookie on your device and, as proof (pseudonymous identifier, time, choice), on our server; no data is transferred to devowl.io. The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR. The individual services used are listed in the privacy settings, where you can change or withdraw your choice at any time.

5. Contact by email, phone or WhatsApp

If you contact us by email or phone, we process your details to handle your enquiry and any follow-up questions. The legal basis is Art. 6(1)(b) GDPR where a contract or pre-contractual measures are concerned, otherwise Art. 6(1)(f) GDPR. Our legitimate interest lies in responding to enquiries.

You can also contact us via WhatsApp. The provider is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. WhatsApp processes in particular your phone number, your profile name and the content of your messages; a transfer to the USA is possible. The parent company Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework. Using WhatsApp is voluntary; you can equally reach us by email or phone.

We store the data only for as long as necessary to handle your enquiry or as required by statutory retention obligations.

6. Online booking via Beds24

For availability display and online booking we use the booking system of Beds24 GmbH, c/o EDGE Workspaces Grand Central Berlin, Invalidenstraße 65, 10557 Berlin, Germany. We process in particular your travel dates, number of guests, name, contact and billing details and any further information you provide voluntarily. Beds24 processes the data on our behalf under a data processing agreement pursuant to Art. 28 GDPR. The legal basis is Art. 6(1)(b) GDPR. Where data is processed outside the EU/EEA, this is done only on the basis of an adequacy decision or appropriate safeguards pursuant to Art. 44 et seq. GDPR.

We retain booking and invoice data in accordance with the retention periods under commercial and tax law (up to ten years).

7. Payment

You can pay by bank transfer, via Stripe or via PayPal. If you pay via a payment service, we pass on the data required for the payment (in particular name, amount, booking reference, email address) to the respective provider: Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland, or PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. The providers process your payment data under their own responsibility and privacy policies; a transfer to third countries is possible. The legal basis is Art. 6(1)(b) GDPR.

8. Chat assistant “Book Better Direct”

You can use a chat assistant on this website. The provider is BookBetterDirect Ltd, Florianweg 416, 5753 Saalbach-Hinterglemm, Austria (Company No. 13932517, England and Wales). The chat is only loaded with your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). The messages you enter and technical connection data are processed. The provider may use further service providers, such as AI language models, to answer your messages. Where data is processed outside the EU/EEA, this is done only on the basis of an adequacy decision or appropriate safeguards pursuant to Art. 44 et seq. GDPR. Please do not enter sensitive data such as payment information in the chat.

9. Statistics and marketing (Google)

Only with your consent do we use services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland:

  • Google Tag Manager – to manage and embed the services below. The Tag Manager itself does not create user profiles.
  • Google Analytics – for statistical analysis of the use of this website, such as pages visited, time spent, device information and approximate location.
  • Google Ads – to measure the success of our ads (conversion tracking) and, where applicable, to show interest-based advertising.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you can withdraw at any time with effect for the future in the privacy settings. A transfer to the USA is possible; Google LLC is certified under the EU-US Data Privacy Framework. The data is deleted as soon as it is no longer required for the respective purpose.

10. Session analysis (Microsoft Clarity)

We use Microsoft Clarity, a service of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Clarity helps us understand how this website is used. It records technical connection data and interactions such as mouse movements, clicks and scrolling, and aggregates them into anonymised session recordings and heatmaps. Input in form fields is masked by Clarity by default. A transfer to the USA is possible; Microsoft Corporation is certified under the EU-US Data Privacy Framework. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you can withdraw at any time with effect for the future in the privacy settings.

11. Reviews (Trustindex)

To display Google reviews we use a widget of Trustindex Kft., Nyári Pál utca 15., 2724 Újlengyel, Hungary. When the widget loads, your IP address and technical connection data are transmitted to Trustindex and – for reviewers’ profile pictures – to Google servers. The widget is only loaded with your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

12. Instagram feed

On some pages we display posts from our Instagram account (plugin “Smash Balloon Instagram Feed”). Instagram is provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. When you open these pages, the feed images are loaded directly from Meta’s servers. Your IP address and technical connection data are transmitted to Meta in the process, even if you do not have an Instagram account; a transfer to the USA is possible. Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework. The legal basis is our legitimate interest in presenting our offer attractively (Art. 6(1)(f) GDPR). We are currently changing the integration so that the feed content is only loaded after your consent.

13. Links to social networks and external websites

This website contains simple links to our profiles on Instagram, Facebook and YouTube and to external websites, in particular bahnwaerterhaus.com. Data is only transmitted to the respective provider once you open such a link. The operator of the target site is responsible for data processing there.

14. Spam protection

We protect forms on this website with the plugin “WP Armour – Honeypot Anti Spam”. No data is transmitted to third parties.

15. Your rights

Subject to the statutory requirements, you have the right of access, rectification, erasure, restriction of processing, data portability and the right to object to processing based on Art. 6(1)(f) GDPR. You can withdraw any consent given at any time with effect for the future.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR).

16. Updates to this statement

We update this privacy statement when the website, the services used or the legal situation change.