Skip to content
Allgäu Living

Privacy policy

This English version is a translation provided for your convenience. Only the German version is legally binding. Read the German version

The protection of your personal data is a particular concern for us. We process your data exclusively on the basis of the statutory provisions (GDPR, BDSG, TDDDG). In this privacy policy we inform you about the most important aspects of data processing on our website and when you book.

1. Controller

Braun & Pabst GbR (Allgäu Living) represented by Tina Pabst and Andreas Pabst Kästobel 13 87509 Immenstadt, Germany Phone: +49 157 92478155 Email: office@allgaeuliving.de

2. Hosting and server logs

Our website is hosted on a server of Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) in a data centre in Germany. When a page is accessed, the server processes technically necessary data: IP address, date and time, the address accessed, referrer, browser and operating system. These logs serve exclusively the secure operation and troubleshooting, are not combined with other data and are automatically deleted after a short time. A data processing agreement has been concluded with Hetzner. The legal basis is our legitimate interest in a secure, functioning website (Art. 6 (1) (f) GDPR).

Images from our content management system Storyblok (Storyblok GmbH, Linz, Austria) are delivered via our own server; your browser does not establish a connection to Storyblok. Fonts are also embedded locally; no Google Fonts are loaded.

3. Contact via form or email

If you write to us via the contact form or by email, we process your details (e.g. name, email address, phone number, subject and message) in order to answer your enquiry and for any follow-up questions. This also applies to applications that you send us by email; we delete application documents no later than six months after the end of the procedure, unless you consent to longer storage. Our emails run via the mail server of Hetzner Online GmbH. The legal basis is the initiation or performance of a contract or our legitimate interest in communicating with you (Art. 6 (1) (b) or (f) GDPR; for applications § 26 BDSG).

4. Booking and payment

For a booking we need your name, email address, phone number and address, the travel dates, the number of guests and any comments. We use this data to process the booking, to send you the booking confirmation and all arrival information by email and to look after you during your stay. The legal basis is the performance of the contract (Art. 6 (1) (b) GDPR). We keep booking and invoice data for as long as required by commercial and tax retention periods (up to ten years).

Booking management (Smoobu). We record your booking in our software for managing the holiday apartments, provided by Smoobu GmbH (Pappelallee 78/79, 10437 Berlin, Germany). Via Smoobu we synchronise availability and prices with the booking portals and communicate with you about your stay. Only our server connects to Smoobu; when you visit our website, your browser does not load anything from Smoobu and no Smoobu cookies are set. A data processing agreement has been concluded with Smoobu. Further information: Smoobu’s privacy policy.

Payment (Stripe). Payment is made via the payment service provider Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Dublin 2, Ireland). For this purpose, Stripe’s payment form is loaded on the booking page. Your card details are entered directly into Stripe and processed by Stripe itself; we do not see them. Stripe receives your payment details, name, email address, the amount and technical data about your device that serve to prevent fraud. If you choose PayPal, Klarna, Apple Pay or Google Pay, Stripe forwards you to that provider or passes on the data required for payment; that provider’s privacy policy also applies. A transfer to the USA cannot be ruled out; it takes place on the basis of the EU-U.S. Data Privacy Framework or the EU Standard Contractual Clauses. The legal basis is the performance of the contract (Art. 6 (1) (b) GDPR) and our legitimate interest in secure payment processing (Art. 6 (1) (f) GDPR). Further information: Stripe’s privacy policy.

Incomplete booking. If you have already entered your email address in the booking form but not completed the payment, we send you a short email once with a link to continue the booking. The legal basis is the initiation of the contract or our legitimate interest in helping you with technical problems (Art. 6 (1) (b) and (f) GDPR). You can object to this email at any time.

Cancellation and refund. You can cancel your booking within the deadline via your personal booking page (/my-booking). If a refund to the original payment method is no longer possible, we ask you there for the account holder and IBAN; we use this information exclusively for transferring the refund (Art. 6 (1) (b) GDPR).

5. Review after your stay

After a direct booking, we send you an email once after your departure asking for a review. The legal basis is our legitimate interest in feedback on our accommodation or § 7 (3) UWG (you can object to this use of your email address at any time). If you submit a review, we store the stars, your text and the name you provided and may publish them on our website. You can have your review deleted at any time via the link in our confirmation email.

6. Bike route planner

If you search for a place or calculate a route in the route planner, our server queries the places or coordinates entered from OpenStreetMap services (place search: Nominatim of the OpenStreetMap Foundation; route calculation: routing.openstreetmap.de of FOSSGIS e. V.) and, for the weather forecast, from Bright Sky (data from the German Weather Service). These services only see our server, not your IP address.

If you use the “record ride” function, your browser asks you for permission to access your location beforehand. The recording remains on your device unless you send it to us yourself. If you submit a tour, we store the route (start and end automatically shortened by 300 metres each), your description and – if provided – your name, check it and only publish it after our approval. The legal basis is your consent (Art. 6 (1) (a) GDPR), which you can withdraw at any time by email to us.

7. Cookies

Apart from the Google Ads cookies described in section 8, we do not set any tracking, marketing or analytics cookies. On the booking page, Stripe sets technically necessary cookies to prevent fraud (§ 25 (2) TDDDG). We store your choice in the cookie banner in your browser so that the banner does not appear every time you open a page. Further information can be found in our cookie policy.

8. Conversion tracking (Google Ads and OpenAI Ads)

We use the Google Ads service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, USA) to measure the effectiveness of our advertisements (conversion tracking). This records whether you reached our website via one of our Google ads and carried out a certain action there (e.g. a booking). Cookie or device identifiers and interaction data with our ads are processed; we do not directly identify you.

The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). Google Ads only becomes active when you click “Accept” in the cookie banner; we use the “Consent Mode” provided by Google for this: before your consent, all advertising cookies are technically set to “denied” and no corresponding cookies are set. You can withdraw your consent at any time with effect for the future via the “Cookie settings” button in the footer of our website.

As Google Ireland Limited belongs to the Google group, a transfer of data to Google LLC (USA) cannot be ruled out. This takes place on the basis of the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework. Further information can be found in Google’s privacy policy.

OpenAI Ads conversion tracking

We also run ads with OpenAI (e.g. in ChatGPT) and measure their success with OpenAI Ads conversion tracking. For users in the European Economic Area, the provider is OpenAI Ireland Limited (Dublin, Ireland); the parent company is OpenAI, L.L.C. (San Francisco, USA). For this, your browser loads a script from bzrcdn.openai.com. It records whether you reached our website via an OpenAI ad and completed a booking here. Cookie or device identifiers, technical information about your browser and the event “booking completed” with booking value, currency and a random transaction identifier are processed; we do not transmit your name, email address or payment details.

The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). The script is only loaded when you click “Accept” in the cookie banner; without your consent, no data is transmitted to OpenAI. You can withdraw your consent at any time with effect for the future via the “Cookie settings” button in the footer. A transfer of data to the USA cannot be ruled out; it takes place on the basis of the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework. Further information can be found in OpenAI’s privacy policy.

In addition, our server reports every completed direct booking to the OpenAI Ads conversions interface. Without your consent, this report only includes information without any reference to your person: a random transaction identifier, time, booking value, currency, the apartment booked and the number of nights (legal basis: our legitimate interest in measuring the success of our advertising, Art. 6 (1) (f) GDPR). Only if you have consented in the cookie banner do we add, for attribution to the ad: the browser identifier of the OpenAI pixel, your email address and phone number in irreversibly encrypted form (SHA-256 hash), your IP address, the browser identifier (user agent) and your country (Art. 6 (1) (a) GDPR).

9. Reach measurement with Umami

For the statistical evaluation of the use of our website, we use Umami, a privacy-friendly analytics software that we operate ourselves on our own server. The data collected therefore remains entirely with us and is not transmitted to third parties. Umami works without cookies and without storing personal data. Only anonymised, aggregated information is recorded, such as pages visited, approximate origin (country/region), browser used and device type. Your IP address is not stored; it is not possible to identify individual visitors.

In the booking process we additionally record anonymous steps so that we can improve it: selected period (nights, month of arrival, lead time), number of guests, price displayed, discount code, selected payment method, technical errors, the completed booking with amount and booking identifier, and input errors in the booking form (only which field was missing, never its content). In addition, the origin of your visit: the referring website (domain only), campaign parameters from the link (utm_source, utm_medium, utm_campaign), whether the link contained an advertising click identifier from Google or Meta (only yes/no, not the identifier itself) and the landing page. Names, email addresses, phone numbers or addresses are never sent to Umami. So that a booking is counted even with ad blockers, our server additionally reports the completed booking directly to Umami without personal data. We also store the origin as a note on your booking in our booking system (Smoobu).

Only if you click “Accept” in the cookie banner does Umami additionally record the course of your visit (mouse movements, clicks, scrolling, page layout) so that we can identify usability problems (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). Entries in form fields such as name, address, email address and phone number are masked and not transmitted, and payment fields are not recorded at all; displayed personal details such as your email address on the confirmation page are also hidden. A recording ends after a maximum of five minutes per page view and is stored only on our own server. Without consent, no recording takes place; you can withdraw via “Cookie settings” in the footer.

The legal basis is our legitimate interest in statistical analysis and the needs-based design of our website (Art. 6 (1) (f) GDPR). Umami itself does not store or read any information on your device, so no consent is required for this. Only if you have consented in the cookie banner do we remember the origin of your first visit in your browser’s storage (localStorage, entry “al_attr”, and for the current visit sessionStorage, entry “al_attr_s”) so that it can also be attributed after reloading the page or for a booking on a later day (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). Without consent, the origin only applies to the current visit and is not stored anywhere on your device.

Heatmaps and session recording with UXWizz

Only if you click “Accept” in the cookie banner do we additionally use UXWizz. We operate the software ourselves on our own server (uxwizz.pabst-andreas.de); the data is not transmitted to third parties. UXWizz creates heatmaps and records the course of individual visits (pages visited, mouse movements, clicks, scrolling, device and browser) so that we can identify usability problems. For this, UXWizz stores an identifier in cookies or in your browser’s local storage. Entries in form fields (booking, payment, contact) are masked and not recorded; Stripe payment fields are not captured. The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG), which you can withdraw at any time via “Cookie settings” in the footer.

10. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on our legitimate interest. You can withdraw any consent given at any time with effect for the future. Simply write to us at office@allgaeuliving.de. You can also lodge a complaint with a data protection supervisory authority; the authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, Germany).

11. Changes to this policy

We adapt this privacy policy as soon as our website or the services used change. The current version on this page always applies. Last updated: September 2026.