Privacy Policy

T&T Vermietung GbR · www.t-und-t-gbr.de · Version: September 2026

This English version is provided for your convenience. In the event of any discrepancy, the German version („Datenschutzerklärung“) is authoritative.

We take the protection of your personal data seriously. This website is used to handle booking and contact enquiries for our accommodations – the workers‘ rooms in Oßmaritz (www.monteurzimmer-bei-jena.de) and the holiday apartment in Bad Klosterlausnitz (www.fewo-bad-klosterlausnitz.de). Below we explain which personal data we process when you visit this website and use the enquiry form, for what purposes we do so, and what rights you have. The privacy policies of the respective accommodation apply in addition to the further processing of a booking and to your stay (see Section 6).

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection laws is:

T&T Vermietung GbR represented by its partners Tina Grätscher and Tony Grätscher Talweg 14 07639 Bad Klosterlausnitz Germany

Phone/WhatsApp: +49 171 7720722 Fax: +49 36601 935658 E-mail: info@t-und-t-gbr.de

For questions regarding data protection, please contact: datenschutz@t-und-t-gbr.de

We are not legally required to appoint a data protection officer and have not done so.

2. Your rights as a data subject

With regard to the personal data concerning you, you have the following rights against us:

  • Access to the data stored about you and its processing (Art. 15 GDPR),
  • Rectification of inaccurate or incomplete data (Art. 16 GDPR),
  • Erasure of your data, unless statutory retention obligations prevent this (Art. 17 GDPR),
  • Restriction of processing (Art. 18 GDPR),
  • Data portability, where processing is based on consent or a contract and is carried out by automated means (Art. 20 GDPR),
  • Objection to processing based on Art. 6(1)(e) or (f) GDPR (Art. 21 GDPR, see Section 9).

You may withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR). The lawfulness of processing carried out before the withdrawal remains unaffected.

To exercise your rights, an informal message to the contact details above is sufficient.

Right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The supervisory authority responsible for us is:

Thüringer Landesbeauftragter für den Datenschutz und die Informationsfreiheit (TLfDI) Häßlerstraße 8 99096 Erfurt, Germany www.tlfdi.de

You may also contact the supervisory authority of your place of residence. An overview is available at: https://www.bfdi.bund.de/DE/Service/Anschriften/anschriften_table-node.html

3. General information on legal bases, recipients and retention periods

Legal bases: We process personal data on the basis of Art. 6(1)(b) GDPR (performance of a contract and pre-contractual measures), Art. 6(1)(c) GDPR (legal obligation) and Art. 6(1)(f) GDPR (legitimate interest).

Recipients: Within our company, only those persons who need your data to process your enquiry have access to it. Enquiries relating to a specific accommodation are passed on to the company operating that accommodation (see Section 6). Beyond this, data is disclosed only to public authorities where legally required and to lawyers or courts for the enforcement of or defence against legal claims.

Hosting: We operate this website and our e-mail systems on our own servers in a data centre within the European Union. Data is not passed on to external hosting providers or other third parties.

Retention period: We store personal data only for as long as necessary for the respective purpose or as required by statutory retention obligations. Enquiries that do not result in a booking are deleted no later than 12 months after final processing. If a booking is made, further storage is governed by the privacy policy of the respective accommodation.

4. Visiting this website

4.1 Server log files

Nature and purpose: When you access this website, our server automatically records technical information: IP address, date and time of access, page or file requested, amount of data transferred, HTTP status code, browser type and version, operating system and the previously visited page (referrer). This data is not combined with other data sources and is not analysed to identify individual visitors. We reserve the right to review the log files retrospectively if there are concrete indications of unlawful use or an attack on our systems.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the technical provision, stability and security of the website and in the prevention and investigation of attacks.

Retention period: Log files are deleted after 90 days at the latest. In the event of security-relevant incidents, the relevant entries are retained until the incident has been fully investigated.

Provision: Provision is neither required by law nor by contract; however, the website cannot technically be accessed without an IP address.

4.2 SSL/TLS encryption

This website uses SSL/TLS encryption to protect the transmission of confidential content (in particular the details entered in the enquiry form). You can recognise an encrypted connection by „https://“ in the address bar and the padlock symbol in your browser.

4.3 Cookies

Nature and purpose: We use only technically necessary cookies that are required for the operation of the website and the functioning of the enquiry form (e.g. session cookies of the content management system). We do not use cookies requiring consent for analytics, marketing or other third-party purposes; no user profiles are created.

Legal basis: Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG) in conjunction with Art. 6(1)(f) GDPR; our legitimate interest lies in providing a functioning website.

Retention period: Session cookies are deleted when you close your browser; any other technically necessary cookies have a short, function-related lifetime.

4.4 Locally hosted fonts

For a consistent appearance, we use fonts that are stored locally on our own server. No connection to third-party servers is established when the fonts are loaded.

4.5 No third-party services

This website does not use analytics or marketing services, social media plugins, embedded map or video services, or any other services that transmit data to third-party servers. No reach measurement or tracking takes place.

5. Enquiry form and other means of contact

5.1 Enquiry form

Nature and purpose: Via the enquiry form on this website you can submit a booking enquiry for one of our accommodations or send us a general message. We process the data you enter in the form (in particular name, address, e-mail address, telephone number, for companies the company name and contact person, the requested accommodation, the requested period, the number of persons and the content of your message) as well as the date, time and IP address of submission, in order to review your enquiry, prepare a quotation for you and clarify any questions. The IP address is used solely for traceability in the event of misuse.

You will usually reach this form via a link („Enquiry“) from one of our accommodation websites. No personal data is transferred during this redirect; you only enter your data here.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures at your request). For general enquiries without reference to a booking, Art. 6(1)(f) GDPR; our legitimate interest lies in the proper processing of and response to enquiries.

Recipients: The enquiry is transmitted by e-mail to our inbox and passed on to the company operating the requested accommodation (Section 6).

Retention period: See Section 3.

Provision: Providing your data is voluntary. However, we cannot process your enquiry without the details marked as mandatory fields.

5.2 Protection of the enquiry form (ALTCHA)

Nature and purpose: To protect the enquiry form against automated submissions (spam, bots, abusive harvesting of data), we use the open-source ALTCHA method, which is operated entirely on our own servers. Before the form is submitted, your browser solves a small cryptographic computational task (proof of work) in the background, the result of which is verified by our server. No cookies are set, no behavioural data or device characteristics are analysed (no fingerprinting), and no data is transmitted to third parties. Only the technically required connection data (IP address, time) and the verification result are processed. The verification is a prerequisite for submitting the form; it runs without any action on your part. In addition, we use server-side measures against mass requests (rate limiting).

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting the form and our systems against misuse, spam and automated attacks, and in protecting the data of other users submitted via the form. Access to your device is strictly necessary under Section 25(2) no. 2 TDDDG for the function you have requested (submitting an enquiry); consent is therefore not required.

Recipients: None. Processing takes place exclusively on our own servers.

Retention period: Verification data is deleted after the enquiry has been processed, at the latest after 7 days. Further information on ALTCHA: https://altcha.org

5.3 E-mail, telephone, fax and WhatsApp

If you contact us by e-mail, telephone, fax or WhatsApp, we process the data provided (name, contact details, content of the enquiry) and the usual technical connection data in order to handle your enquiry. E-mails are processed on our own mail servers.

When using WhatsApp (provider: WhatsApp Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland, part of the Meta group of companies), WhatsApp processes metadata (e.g. telephone numbers, time of communication, device information) under its own responsibility and may transfer it to servers in the USA; this is done on the basis of the European Commission’s adequacy decision for the EU-US Data Privacy Framework, to which Meta Platforms, Inc. has subscribed. Further information: https://www.whatsapp.com/legal/privacy-policy-eea. Use of WhatsApp is voluntary; please do not transmit particularly sensitive data (e.g. copies of ID documents) via WhatsApp.

Legal basis: Art. 6(1)(b) GDPR (booking-related enquiries) or Art. 6(1)(f) GDPR (legitimate interest in uncomplicated communication).

Retention period: See Section 3.

6. Transfer to the operating companies and further processing

Our accommodations are operated by the following companies, each of which is independently responsible under data protection law for the further processing of your booking (quotation, contract, registration requirements, payment, stay):

If your enquiry relates to one of these accommodations, we pass the enquiry, together with the details you have provided, on to the operating company. That company then processes your data in accordance with its own privacy policy; there you will find in particular the information on credit checks, registration requirements, booking platforms, payment processing and your stay.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures at your request – the transfer is necessary so that the operating company can prepare a quotation for you).

All of the companies named are managed by the same partners and have their registered office at the same address; your enquiry is handled by the same persons. Insofar as we jointly determine the purposes and means of processing your enquiry data together with one of the operating companies, we are joint controllers within the meaning of Art. 26 GDPR. In this regard, we have agreed that we, as the operator of this website, fulfil the information obligations towards you and receive your requests under Section 2; however, you may exercise your rights against any of the companies involved. We will make the essence of this arrangement available to you on request.

7. Disclosure to public authorities and enforcement of claims

We disclose personal data to public authorities only where we are legally obliged to do so or where an official request for information exists on a statutory basis (Art. 6(1)(c) GDPR). Where necessary, we process your data for the establishment, exercise or defence of legal claims (Art. 6(1)(f) GDPR); recipients may then include lawyers and courts.

8. Automated decision-making

No automated individual decision-making, including profiling, within the meaning of Art. 22 GDPR takes place on this website.

9. Your right to object under Art. 21 GDPR

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6(1)(f) GDPR (balancing of interests). If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Recipient of an objection: T&T Vermietung GbR, Talweg 14, 07639 Bad Klosterlausnitz, Germany, e-mail: datenschutz@t-und-t-gbr.de

We do not carry out direct marketing.

10. Data security

We implement technical and organisational measures under Art. 32 GDPR to protect your data against loss, manipulation and unauthorised access. These include in particular encrypted transmission (TLS), operation of our systems on our own servers in the EU, access restrictions, regular backups and keeping the software we use up to date.

11. Changes to this privacy policy

We reserve the right to amend this privacy policy so that it always complies with current legal requirements or to reflect changes to our services. The version published on this website at the time applies.

12. Questions about data protection

If you have any questions about data protection or wish to exercise your rights, please contact: datenschutz@t-und-t-gbr.de or the contact details given in Section 1.