Privacy Policy

Data Controller

Uwe Otte Katrinstrasse 11, 71665 Vaihingen an der Enz, Germany Email: mail@rate-a-place.com

Principles of Data Processing

We process personal data only to the extent necessary to provide a functional website and the offered content and services. Processing is based on Art. 6(1)(a) (consent), (b) (contract performance) and (f) (legitimate interests) GDPR.

Hosting (Hetzner Online GmbH)

This website is hosted on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Server location: Falkenstein (Germany, EU). As part of hosting, Hetzner automatically processes connection data (IP address, timestamps, requested URL, HTTP status code, transferred data volume, referrer, browser type and operating system) stored in server log files. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in stable, secure operation of the website). Log file retention: maximum 14 days, then automatic deletion or anonymisation.

A data processing agreement (DPA) according to Art. 28 GDPR is in place with Hetzner.

Registration and User Account

Registration is required to submit room reviews. We collect:

• Username (freely chosen, does not have to be a real name)
• Email address (for account confirmation and password recovery)
• Password (stored as a secure hash, never in plain text)
• Date and time of registration

Legal basis: Art. 6(1)(b) GDPR. Retention: Until account deletion. Reviews still active at the time of account deletion are anonymized.

Sign-in via Third-Party Providers (Google)

Optionally, you may sign in via the external identity provider Google. If you use this feature, you are redirected to the respective provider and, after successful authentication, sent back to us. From the provider we receive:

• A unique provider ID (e.g. Google account ID) to recognise returning logins
• Your email address (to link with your account on our platform)
• Display name and profile picture URL (if provided by the provider; not further processed)

Third-country transfer: The provider is Google LLC, based in the USA. Data transfer is based on the EU-US Data Privacy Framework (adequacy decision of the EU Commission of 10 July 2023) and, supplementarily, on Standard Contractual Clauses (Art. 46(2)(c) GDPR). Legal basis for processing on our side: Art. 6(1)(a) GDPR (your consent by actively selecting the provider) and (b) (performance of contract). You can disconnect the link at any time in your profile settings.

Google Privacy Policy

Room Reviews and Uploaded Photos

When submitting a review, we store the review data, uploaded photos, the submission timestamp and the link to the user account. Users confirm at upload that photos do not show identifiable persons and that they hold the copyright. Legal basis: Art. 6(1)(b) GDPR.

Image Storage (Hetzner Object Storage)

Uploaded photos as well as hotel images we automatically retrieve from publicly accessible sources (e.g. a hotel website's header image) are stored in object storage operated by Hetzner Online GmbH (S3-compatible object storage, location: Falkenstein, Germany). For resilience, a backup copy is additionally kept in a second data centre of the provider in Helsinki (Finland). Both locations lie within the EU; no processing takes place outside the EU. Legal basis: Art. 6(1)(b) GDPR (contract performance for registered users) or (f) GDPR (legitimate interest in meaningful hotel profiles).

Retention: As long as the hotel or the review is published on the platform. When a review or hotel is deleted, the associated images are irrevocably removed from storage within 30 days.

Email Delivery

For transactional emails (e.g. registration confirmation, password reset, change notifications) we use the delivery provider Plus Five Five, Inc. (trading as “Resend”), 2261 Market Street #5039, San Francisco, CA 94114, USA. Sending takes place via the provider's EU infrastructure (data-centre region Ireland); Amazon Web Services (Amazon SES) acts as the technical sub-processor. The provider processes the submitted email address solely to deliver the respective message. The following data is processed:

• Your email address
• Subject and content of the respective system email
• Delivery log (timestamp, success/failure) for troubleshooting

Legal basis: Art. 6(1)(b) GDPR (contract performance) or (f) GDPR (reliable delivery of security-relevant messages such as password reset). We do not run a newsletter and do not send promotional emails without your explicit consent. A data processing agreement (DPA) pursuant to Art. 28 GDPR has been concluded with the provider. As the provider is based in the USA, a transfer to a third country occurs; it is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), which form part of the DPA; the EU-US Data Privacy Framework may apply additionally where the provider is certified. A list of the sub-processors used is available at https://resend.com/legal/subprocessors.

Browsing Without Registration

Reading reviews and browsing the platform is possible without registration. Only technically necessary server log files are generated (see Hosting section). No tracking cookies or analytics tools are used.

Cookies

We use only technically necessary cookies (so-called essential cookies) which are strictly required for operating the website. No tracking, advertising or analytics cookies are currently used. As only strictly necessary cookies are in use, no consent is required under § 25(2) no. 2 TTDSG / TDDDG. The following cookies are used:

Legal basis: § 25(2) no. 2 TTDSG / TDDDG in conjunction with Art. 6(1)(f) GDPR (legitimate interest in a functional, secure login system).

Note: Should we use tracking, analytics or advertising cookies in the future, a full opt-in consent banner will be shown beforehand and this privacy policy will be amended accordingly.

Your Rights

• Access (Art. 15): What data we have stored about you
• Rectification (Art. 16): Correction of inaccurate data
• Erasure (Art. 17): Right to be forgotten
• Restriction (Art. 18): Restrict processing
• Data portability (Art. 20): Receive your data in a machine-readable format
• Objection (Art. 21): Object to processing based on legitimate interests
• Withdrawal (Art. 7(3)): Withdraw consent at any time

To exercise your rights, contact: mail@rate-a-place.com

Right to Lodge a Complaint

You have the right to lodge a complaint with the competent data protection supervisory authority. For international visitors, please contact the authority in your country of residence.

Changes to This Privacy Policy

We reserve the right to update this privacy policy. Registered users will be notified by email of material changes.