Privacy Policy

1. Controller

Phone: 01573-5532213. Email: kontakt@secret-islands.de

2. General information on processing

As a rule, we collect and use personal data of our users only to the extent necessary to provide a working website along with our content and services. Personal data of our users is regularly collected and used only with the user's consent or in order to perform a contract.

The legal bases are in particular Article 6(1)(a) GDPR (consent), Article 6(1)(b) GDPR (performance of a contract), Article 6(1)(c) GDPR (legal obligation) and Article 6(1)(f) GDPR (legitimate interest).

3. Hosting (Vercel)

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Vercel processes personal data on our behalf (Article 28 GDPR). When our website is accessed, server logs are recorded (IP address, time of access, URL accessed, browser type and version, operating system). This data is stored for a maximum of 30 days. The legal basis is Article 6(1)(f) GDPR.

A data processing agreement is in place with Vercel. Transfers to the USA are based on the EU-US Data Privacy Framework and on supplementary standard contractual clauses.

4. Bookings and database (Supabase)

To manage your booking we store the data given in the booking form (name, address, email, phone number, date of birth, booking details) in a database at Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992. The database itself runs in a data centre within the European Union (Frankfurt am Main region). A data processing agreement is in place with Supabase.

The legal basis is Article 6(1)(b) GDPR (performance of a contract). Data is stored for the duration of the statutory retention periods, in particular 10 years under Section 147 AO (German Fiscal Code).

5. Payment processing

We use the following service providers for payment processing:

• Stripe (Stripe Payments Europe Ltd., Dublin, Ireland), for payment by credit card or SEPA. Privacy policy: stripe.com/privacy
• PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg), for payment by PayPal. Privacy policy: paypal.com

For payment by bank transfer, no data is passed to third parties. The legal basis in each case is Article 6(1)(b) GDPR.

6. Accounting (Lexoffice)

To create and archive invoices, we pass your invoice data to the accounting software Lexoffice (Haufe-Lexware GmbH & Co. KG, Munzinger Str. 9, 79111 Freiburg, Germany). The legal basis is Article 6(1)(c) GDPR (legal obligations under German commercial and tax law).

7. Availability calendar (Google Calendar)

To manage booked dates we use Google Calendar (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The calendar is read exclusively through our own server. Your IP address is not passed to Google, and no Google cookies are set.

After a binding booking we create an entry in this calendar with your name and the booked period, in order to rule out double bookings. The legal basis is Article 6(1)(b) GDPR (performance of a contract).

8. Email (Resend)

Booking confirmations, invoices, access details and emails concerning your account are sent through the service provider Resend (Plus Five Five, Inc., 2261 Market Street, San Francisco, CA 94114, USA). Your email address and the content of the message are transmitted.

A data processing agreement is in place with Resend. The transfer to the USA is based on standard contractual clauses. The legal basis is Article 6(1)(b) GDPR (performance of a contract).

9. Guest book

You are welcome to leave an entry in our guest book. We store the name or nickname you give and your text. An entry is published only after we have read and approved it.

The legal basis is your consent under Article 6(1)(a) GDPR, which you give expressly when submitting. You can withdraw it at any time with effect for the future, and we will then remove the entry. Please do not enter any details that identify you. Entries already published were taken over from the guest book of our previous website.

10. Access details by text message or messenger

We send the access code and the directions to the phone number you provide. On request we send this message through WhatsApp (WhatsApp Ireland Limited, Merrion Road, Dublin 4, Ireland). In that case WhatsApp processes your phone number under its own terms. If you would rather not use that, please tell us and we will send it by text message or email only.

11. Cookies and local storage

This website uses only technically necessary cookies and uses your browser's local storage to keep entries in the booking form for 24 hours, so that nothing is lost if you break off. This data does not leave your device.

12. Your rights

You have the right at any time to:

• access to your stored data (Article 15 GDPR)
• rectification of inaccurate data (Article 16 GDPR)
• erasure of your data (Article 17 GDPR)
• restriction of processing (Article 18 GDPR)
• data portability (Article 20 GDPR)
• object to processing (Article 21 GDPR)
• withdraw consent you have given (Article 7(3) GDPR)

To exercise your rights, please contact us at the address given above.

13. Right to complain

You have the right to complain to a data protection supervisory authority. The authority responsible is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Postfach 20 04 44, 40102 Düsseldorf, Germany.

14. Version

Version: August 2026