Privacy Policy

1. General information

This privacy policy provides information about the processing of personal data in connection with the website, user account registration, the booking platform, the payment process for rental price and security deposit, and communication with users.

2. Categories of data processed

• Master data: name, address, email address, telephone number, date of birth, company data.
• User account data: login data, roles, settings, consents, verification status.
• Vehicle and listing data: vehicle details, photos, equipment, availabilities, documents.
• Booking data: rental period, booking number, price components, booking-related communication, handover and return data.
• Payment data: payment status, transaction identifiers, payout data, security deposit status, refunds, chargebacks; sensitive payment data may be processed directly by Stripe.
• Claim and evidence data: damage reports, photos, protocols, statements, retentions and additional claims.
• Usage data: IP address, device data, log data, cookie and consent information, security and error messages.
• Referral and promo data: use of promo links, referrer attribution, referred users, assigned bookings, calculated promo commissions, payout status and payout references.
• Report and complaint data: contents of DSA reports, P2B complaints, reported URLs, listings, profiles, reviews, reasons, evidence, communication histories, decisions and internal case numbers.
• Map, location and geocoding data: search addresses, destinations, campsite data, location and map usage data, insofar as these are required for map, search or geocoding functions.

3. Purposes and legal bases

• Provision of the platform and implementation of pre-contractual measures or contract processing, Art. 6(1)(b) GDPR.
• Security measures, misuse and fraud prevention, IT operations, Art. 6(1)(f) GDPR.
• Compliance with statutory obligations, in particular commercial, tax, platform-related or payment-service-related obligations, Art. 6(1)(c) GDPR.
• Newsletters, marketing cookies or other consent-based processing, Art. 6(1)(a) GDPR.
• Implementation, review and billing of a referral or promo programme, including misuse review, commission calculation, payout, reclaiming and accounting documentation.
• Processing of DSA reports, P2B complaints, moderation decisions, verification disputes and platform complaints.
• Provision of map, search, geocoding and campsite functions, insofar as these are accessed by the user or required for the platform function.

4. Automated service and reminder messages

The platform may send automated transaction-related messages, in particular regarding registration, booking, payment, security deposit, handover, return, cancellation, rebooking, payouts, verification, invoices and support matters. Where reminder, seasonal, weather, regional, reactivation or marketing messages are sent in addition, this is done only on the basis of consent or another permissible legal basis.

5. Registration and user account

When a user account is created, the requested mandatory data is processed in order to enable platform use, authenticate users, manage bookings and enable communication.

6. Bookings, rental processing and security deposit

• To process rental requests and bookings, the operator processes booking and communication data and transmits required data to the respective counterparty to the rental agreement.
• For rental price, security deposit, refunds, retentions, claims and additional claims, the respectively required payment, receipt and evidence data is processed.

7. Payment processing via Stripe

• Stripe or Stripe Connect is used for collection, payment confirmation, payouts, security deposit management, refunds, chargebacks, KYC and compliance processes.
• Stripe may process personal data partly as an independent controller.
• Stripe Payments and Stripe Connect are used to process all payments and to make legally secure payouts to landlords.
• Processing is carried out by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.
• Further information can be found in Stripe’s privacy information.

8. Maps, geocoding and external media

• For map, geocoding, location and search functions, the platform may use Google Maps or Google services. In particular, IP address, search address, location or destination details, device information and usage data may be transmitted to Google.
• For embedded videos or YouTube-related functions, data may be transmitted to Google or YouTube, in particular when embedded content is loaded, played or interactive functions are used.
• Where external media, map or tracking functions require consent, they are activated only in accordance with the cookie and tracking notices and consent given.

9. Verification

• To review landlords, vehicles and payout eligibility, identity, register, bank and vehicle documents may be processed.
• Where verification is carried out directly via the payment service provider, that provider processes the data required for this according to its own compliance requirements.

10. Cookies and similar technologies

• Necessary cookies are used insofar as this is required to provide the website and booked functions.
• Analytics, marketing or external media cookies are set – where required – only on the basis of consent.

11. Recipients

• Hosting and IT service providers
• Stripe or Stripe Connect
• Email and support service providers
• Analytics or consent service providers, insofar as actually used
• Legal and tax advisers
• Authorities
• the respective landlord or renter, insofar as this is required for contract performance

12. Third-country transfers

Where service providers process personal data outside the EEA, this is done only on the basis of suitable safeguards, such as standard contractual clauses, or in the exceptions provided for by law.

13. Storage period

• Personal data is stored only for as long as this is required for the respective purposes, statutory retention periods exist or claims are asserted, exercised or defended.
• Commercial and tax documents may generally have to be retained for up to ten years.
• Security deposit, claim, protocol and payment data must be aligned with the respective purpose, possible dispute periods and statutory retention obligations.

14. Obligation to provide data

• Certain data is required for registration, booking, verification, payout or security deposit processing.
• Without this data, the respective function cannot be provided in whole or in part.

15. Rights of data subjects

• Right of access
• Right to rectification
• Right to erasure
• Right to restriction of processing
• Right to data portability
• Right to object in accordance with the GDPR
• Consents can be withdrawn at any time with effect for the future. There is also a right to lodge a complaint with a data protection supervisory authority.

16. Competent supervisory authority

The data protection supervisory authority responsible for the controller is – subject to any deviating competence rule – the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach.