Thank you for your interest in our website. The protection of your personal data is very important to us. In the following, you will find information on the handling of your data collected through your use of our website as well as information on the handling of your data if you are a customer, interested party or business partner. Your data will be processed in accordance with the legal regulations on data protection.
When contacting the Data Protection Officer, please state the company to which your enquiry relates. Please refrain from enclosing sensitive information, such as a copy of an ID card, with your request.
Definitions
Our privacy policy is intended to be simple and understandable for everyone. In this privacy policy, the official terms of the General Data Protection Regulation (GDPR) are generally used. The official definitions are explained in Art. 4 GDPR.
General information on data transfers to third countries
Your data may, where applicable, also be processed in countries outside the European Union (EU) and the European Economic Area (EEA).
For data transfers to certain third countries, an adequacy decision of the European Commission pursuant to Art. 45(1) GDPR may exist. Such a decision establishes that the third country ensures an adequate level of data protection. A list of the adequacy decisions adopted so far can be viewed at the following link: Data protection adequacy for non-EU countries.
The scope of an adequacy decision may additionally be limited to a specific group of recipients or be subject to further conditions.
For example, the adequacy decision for data transfers to the USA applies only to companies certified under the EU-U.S. Data Privacy Framework. The certification status of a participating company can be checked at the following link: Participant Search (dataprivacyframework.gov).
Where your data is transferred to recipients in third countries for which no adequacy decision exists, there is a risk that authorities there may access your data for security and surveillance purposes without you being informed or being able to take legal action.
To safeguard an adequate level of data protection when transferring your data to recipients in such third countries, we therefore ensure that appropriate safeguards within the meaning of Art. 46 GDPR are in place.
As a rule, either we or the service providers we use therefore conclude the European Commission's Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR. They oblige the recipient of the data in the third country to process it in line with the European level of protection. The clauses can be viewed at the following link: Publications on the Standard Contractual Clauses (SCCs) - European Commission. If you require further information on the modules of the Standard Contractual Clauses we have concluded in an individual case, or on supplementary measures, we will gladly provide you with a copy. In that case, simply contact us using the contact details given above under “Person responsible within the meaning of the GDPR”.
For certain recipients, data transfers may also be based on binding corporate rules (BCR) approved by the supervisory authorities pursuant to Art. 46(2)(b) GDPR. These can be viewed at the following link: Approved Binding Corporate Rules | European Data Protection Board.
Where the Standard Contractual Clauses or binding corporate rules are not sufficient to ensure the level of protection, additional technical, contractual or organisational measures are taken to safeguard the data transfer. In addition, we regularly review and assess whether these additional measures continue to ensure a sufficient level of data protection or whether further supplementary measures need to be taken.
Further information on data transfers to third countries can be found, where relevant, below in the descriptions of the respective data processing or services used, under “Data Processing in Third Countries”.
Access to and storage of information in terminal equipment
By using our website, information (e.g. IP address) may be accessed or stored (e.g. cookies) in your terminal equipment. With this access or this storage may be associated with further processing of personal data within the meaning of the GDPR.
In cases where such access to information or such storage of information is absolutely necessary for the technically error-free provision of our services, this is done on the basis of Sch. A1 paras. 3–5 PECR.
In cases where such a process serves other purposes (e.g. the needs-based design of our website), this will only be carried out on the basis of reg. 6 PECR with Sch. A1 para. 2 with your consent in accordance with Article 6 para. 1 a GDPR. The consent can be revoked at any time for the future.
For further information on the processing of your personal data and the relevant legal bases in this context, please refer to the section "Cookies" below and the following sections on the specific processing activities on our website.
Web hosting
This website is hosted by an external service provider (Amazon Web Services). This website is hosted in Ireland. Personal data collected on this website is stored on the hoster's servers. This may include, but is not limited to, IP addresses, contact requests, meta and communication data, website traffic and other data generated by a website.
We collect the listed data in order to be able to guarantee a smooth connection setup of the website and a technically error-free provision of our services. The processing of this data is absolutely necessary to provide you with the website. The legal basis for the processing of the data is our legitimate interest in the correct presentation and functionality of our website in accordance with Art. 6 para. 1 lit. f GDPR.
We have concluded an order processing contract with the provider in accordance with the requirements of Art. 28 GDPR, in which we oblige the provider to protect our customers' data and not to pass it on to third parties.
Server log files
When you access our website, it is technically necessary for data to be transmitted to our web server via your internet browser. The following data is recorded during an ongoing connection for communication between your internet browser and our web server:
Date, time and duration of the request
Name of the requested file
Page from which the file was requested
Access status
Web browser and operating system used
(Complete) IP address of the requesting computer
Amount of data transferred
Http-referrer and http-method
We collect the listed data in order to be able to guarantee a smooth connection setup of the website and a technically error-free provision of our services. The processing of this data is absolutely necessary to provide you with the website. The log files are used to evaluate system security and stability as well as for administrative purposes. The legal basis for processing the data is our legitimate interest in the protection and functionality of our website in accordance with Art. 6 para.1 lit. f GDPR.
For technical security reasons, in particular to defend against attempted attacks on our web server, we store this data for a short period of time. After 7 days at the latest, the data is anonymised by shortening the IP address at domain level, so that it is no longer possible to establish a link to the individual user.
In addition, the data is processed anonymously for statistical purposes, if necessary. This data is never stored together with other personal data of the user, compared with other data or passed on to third parties.
We collect and use the following personal data as part of the regular registration and set-up process:
First and last name
E-mail address
Date and time of registration
Telephone number
Accommodation location
In addition, voluntary information can be provided. Mandatory information provided for the purpose of registration is marked in the input mask with an asterisk as a mandatory field.
The legal basis for data processing is Art. 6 para. 1 lit. a GDPR in the case of consent or Art. 6 para. 1lit. b GDPR if the processing is necessary to provide the requested services. Your data will be deleted as soon as the user account is deleted and insofar as no legal retention obligations exist. You can usually make a change and/or delete your user account, including the data you have provided, directly in your user account after logging in or by sending a corresponding message to the responsible person mentioned at the beginning.
Zendesk for answering queries
If you send us a request via the Website or by email, we use the ticketing system "Zendesk" to process these requests, a service provided by Zendesk Inc, 989 Market Street 300, San Francisco, CA 94102.
The data you initially provided in your enquiry will be recorded in Zendesk. This is at least your first and last name, your email address and/or your telephone number. If you have also provided us with your address and other personal data in the course of your enquiry, these will also be processed in the ticketing system. The legal basis for the processing of your data in Zendesk is Art. 6 para. 1 lit. f) GDPR, our legitimate interest in the efficient processing of customer enquiries.
In principle, your personal data is processed in the EU, but since Zendesk is a provider with headquarters in the USA, a transfer of personal data to the USA cannot be ruled out. Accordingly, further protection mechanisms are required to ensure the level of data protection of the GDPR. To ensure this, we have agreed standard data protection clauses with the provider in accordance with Art. 46 para. 2 lit. c GDPR. These oblige the recipient of the data in the USA to process the data in accordance with the level of protection in Europe. In cases where this cannot be ensured even through this contractual extension, we endeavour to obtain additional regulations and commitments from the recipient in the USA.
For more information on data processing by Zendesk, please see Zendesk's privacy policy at: http://www.zendesk.com/company/privacy
Communication via Whatsapp Business
We use Whatsapp Business, a service provided by WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, for communication purposes.
You can contact us, for example, via a button on the website. In doing so, your contact data in the form of your telephone number will be processed, as well as meta/communication data (e.g. device information, IP addresses).
Please note that the content of communications (i.e. the content of the message and attached images) is encrypted from end to end. This means that the content of the messages cannot be viewed, not even by Whatsapp Ireland Limited itself. You should always use an up-to-date version of Messenger with encryption enabled to ensure that message content is encrypted.
However, we would also like to point out that although the messenger providers cannot view the content, they can find out that you are communicating with us and when, as well as technical information about the device used and, depending on the settings of your device, location information(so-called metadata) is processed.
If we ask you for permission before communicating with you via Messenger, the legal basis for our processing of your data is consent pursuant to Art. 6 para. 1 p. 1 lit. a. GDPR. Otherwise, if we do not ask for consent and you contact us, for example, of your own accord, we use Whatsapp in relation to our contractual partners and within the scope of the initiation of the contract as a contractual measure pursuant to Art. 6 para. 1 p. 1 lit. b. GDPR and in the case of other interested parties on the basis of our legitimate interests pursuant to Art. 6 para. 1 p. 1 lit. f. GDPR in fast and efficient communication.
We have concluded an order processing contract with the service provider in which we oblige them to protect our customers' data and not to pass it on to third parties.
Since a transfer of personal data to the USA takes place, further protection mechanisms are required to ensure the level of data protection of the GDPR. To ensure this, we have agreed standard data protection clauses with the provider in accordance with Art. 46 para. 2 lit. c GDPR. These oblige the recipient of the data in the USA to process the data in accordance with the level of protection in Europe. In cases where this cannot be ensured by this contractual extension, we will endeavour to obtain additional regulations and assurances from the recipient.
Whatsapp's terms of use and information on data protection can be accessed via the following links:
You can revoke any consent given at any time and object to Whatsapp communication with us at any time. In this case, we delete the messages in accordance with our general deletion guidelines (i.e., e.g., as described above, after the end of contractual relationships, in the context of archiving requirements, etc.) and otherwise as soon as we can assume that we have answered any information you may have provided, if no reference to a previous conversation is to be expected and the deletion does not conflict with any statutory retention obligations.
Finally, we would like to point out that we reserve the right not to answer enquiries via Whatsapp for reasons of your security. This is the case if, for example, contractual internals require special confidentiality or an answer via Whatsapp does not meet the formal requirements. In such cases, we refer you to more adequate communication channels.
Participation in the Referral programme
Referred Host (Registration via Referral link)
Registration via a referral link (Referral programme)
Insofar as you have registered with Holidu Hosts GmbH via a personal referral link (Referral link), the following information applies in addition to the other data protection information:
Data concerned / source: In addition to the data you enter yourself in the registration form, we process the information that your registration is based on the referral of a host already registered with us and – where the referral was made in the context of an event – the relevant event. This attribution is transmitted via a parameter contained in the referral link (e.g. “ref” and “event”).
Purposes of processing: Attribution of the referral to the referring host; operation, evaluation and settlement of our referral programme; and prevention of misuse.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in operating and evaluating our referral programme and in preventing misuse. Insofar as a bonus or other remuneration has been agreed with the referring host, the processing is carried out to that extent for the performance of the contractual relationship existing with them (Art. 6(1)(b) GDPR).
Recipients: Within the framework of the referral programme, the referring host receives the information that a registration has taken place via their referral link.
Storage period: The attribution data is stored for the duration of the business relationship. Beyond that, we retain the data until the expiry of the statutory limitation periods (regularly three years), insofar as this is necessary to assert or defend claims in connection with the referral programme; data relevant for bonus settlement is furthermore subject to the statutory retention periods under tax and commercial law. After these periods have expired, the data is deleted.
Referring Host (Participation in the Referral programme)
Participation in the referral programme (Referral programme)
Insofar as you, as a host registered with Holidu Hosts GmbH, participate in the referral programme and refer other landlords (“Hosts”), the following information applies in addition to the data protection information set out above:
Data concerned: Your master data (name, contact details), your personal referral link or referral code, the registrations made via your link including their status (e.g. registration completed) and the associated event, as well as the data required to process a bonus. We do not receive the identity of the person you have referred from you, but only once that person registers themselves via your referral link.
Purposes of processing: Provision of your personal referral link; attribution to you of the registrations made via your link; operation, administration and evaluation of the referral programme; notifying you of successful registrations; calculation and payout of bonuses; and prevention of misuse.
Legal basis: Art. 6(1)(b) GDPR (performance of your participation relationship in the referral programme) and Art. 6(1)(f) GDPR (evaluation of the programme and prevention of misuse).
Storage period: We store the data for the duration of your participation in the referral programme or the business relationship. Beyond that, we retain the data until the expiry of the statutory limitation periods (regularly three years), insofar as this is necessary to assert or defend claims arising from the referral programme; the data relevant for bonus settlement is furthermore subject to the statutory retention periods under tax and commercial law. After these periods have expired, the data is deleted.
Writing reviews
On our website you have the possibility to leave reviews for the offered holiday homes. For this we need your name or a pseudonym and your e-mail address (will not be published). Furthermore, your IP address and the time of publication will be logged and stored for 7 days. This storage of the IP and email address is done for security reasons and in case the person concerned violates the rights of third parties or posts illegal content through a submitted comment.
Reviews can be submitted in such a way that it is not possible for other website users to identify you. It is up to you to decide whether you wish to provide personal details over and above the mandatory information. Please note that when choosing your pseudonym, as well as within the free text fields and when uploading photos, it is also possible to provide information that makes it possible to identify you personally. We recommend that you write your review text without providing personal data and upload photos accordingly. We reserve the right not to publish or to (partially) anonymise reviews that contain personal data.
If the review contains personal data, the processing is based on your consent (Art. 6 para. 1 lit. a GDPR). You can revoke your consent at any time. For this purpose, an informal communication by email to us is sufficient. The legality of the data processing operations already carried out remains unaffected by the revocation. In the event of revocation of your consent, we will delete or anonymise the review.
The storage of additional information (IP address and email address) is based on our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR in the possibility of assigning the reviews to the authors.
We reserve the right to delete comments if they are objected to as illegal by third parties. The collected IP and email addresses are deleted after 7 days.
Newsletter (Airship)
If you would like to receive the newsletter offered on the website with regular information about our offers and products, we require your email address as mandatory information.
We use the so-called double opt-in procedure for sending the newsletter. This means that we will only send you our newsletter by email once you have expressly confirmed that you consent to receiving newsletters. In the first step, you will receive an email with a link that you can use to confirm that you, as the owner of the corresponding email address, wish to receive future newsletters. By confirming, you give us your consent in accordance with Art. 6 para. 1 lit. a GDPR that we may use your personal data for the purpose of sending the newsletter you requested.
When you register for the newsletter, we store, in addition to the email address required for sending, the IP address used to register for the newsletter as well as the date and time of registration and confirmation, in order to be able to track possible misuse at a later date. The legal basis for this is our legitimate interest in accordance with §§ 3.1 and 4.1 of the German Data Protection Act. Art. 6 para. 1 lit. f GDPR.
You can unsubscribe from the newsletter at any time via the link included in each newsletter or by sending an e-mail to the responsible person named above. After unsubscribing, your email address will be immediately deleted from our newsletter distribution list, unless you have expressly consented to the continued use of the collected data or the continued processing is otherwise legally permitted.
Our email newsletter is sent via a technical service provider to whom we pass on the data you provided when registering for the newsletter. We have concluded an order processing contract with our email service provider in which we oblige him to protect our customers' data and not to pass it on to third parties.
We offer our guests as well as hosts the possibility to collect and report registration data to the competent authorities via the registration solution of Chekin (Chekin Soluciones Digitales, Avenida República Argentina, 24, 7ª planta, 41011, Sevilla) ("Chekin").
By using the services of Chekin and the associated acceptance of the data protection provisions, you agree that the owner of the accommodation, who is responsible for your personal data, stores and processes the personal data provided by you for the purposes of using the platform. Accordingly, the processing of the guest check-in data is based on your consent pursuant to Art. 6 para. 1 a) GDPR. Please note that Holidu Hosts GmbH only provides the solution. However, any processing of personal guest data is the responsibility of the host.
The following data may be processed (there are regions where the collection of some data is not mandatory) to manage your stay and to provide information to the authorities:
First name, last name
Gender
Nationality
Citizenship
Date of birth
Country of birth
Birthplace
Country of residence
Place of residence
Residence address
Identity card type
Identity card number
Date of issue of the identity card
Country of issue of the identity card
Place of issue of the identity card
Purpose of stay
VISA number
Signature
Chekin stores the data for as long as is necessary to carry out the various treatments, but at least, in accordance with tourism regulations, for a period of 3 years.
Cookies
We use cookies and similar technologies on our websites, such as pixels, local storage and SDKs. Some of them are strictly necessary for our websites to work. These do not require your consent. All others only run if you allow them. We use them to understand how our websites are used and to show you relevant advertising. Below, we list each category and each provider we use. For each provider, we explain which data is collected and how long it is kept.
Cookies are small text files that are stored on your device. Session cookies are deleted automatically when you close your browser. Permanent cookies remain on your device until you delete them or your browser deletes them automatically.
Some cookies are technically necessary, because certain functions of our websites would not work without them, for example your language settings. Other cookies help us analyse how visitors use our websites, or show you advertising.
Strictly necessary cookies are stored on your device and read from it on the basis of Sch. A1 paras. 3–5 PECR. We process the personal data involved on the basis of our legitimate interest in providing our services securely and without technical errors (Art. 6(1)(f) GDPR). The purposes and legitimate interests for each service are described below.
All other cookies are stored on your device and read from it only with your consent (reg. 6 PECR with Sch. A1 para. 2). We process the personal data involved on the basis of your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future. To do so, use "Change cookie settings" below.
Withdrawing your consent is as easy as giving it: you can reopen your cookie settings at any time via "Change cookie settings" below or via the link in the footer of our websites, and change your choice there. The withdrawal does not affect the lawfulness of the processing carried out before the withdrawal (Art. 7(3) GDPR). We store your cookie settings for up to 6 months; after that, we ask you again.
Retention periods differ from provider to provider; the entry for each provider states how long the data it collects is kept. Where a provider is located outside the European Economic Area, its entry names the safeguard on which the transfer is based.
Profiling for advertising purposes
Where you consent to marketing cookies, we and our advertising partners analyse your use of our websites in order to infer your likely interests and to show you advertising that matches them, including on other websites and in social networks. This constitutes profiling within the meaning of Art. 4(4) GDPR. It does not involve any automated decision that produces legal effects concerning you or similarly significantly affects you within the meaning of Art. 22 GDPR. You can prevent this profiling at any time by not giving or withdrawing your consent.
You can also find information about the cookies we use in our cookie banner.
You can set your browser so that it
informs you when cookies are set,
allows cookies only in individual cases,
blocks cookies for certain cases or in general,
deletes cookies automatically when you close it.
You can find out how to manage cookies in these browsers:
Many browsers also let you limit tracking, for example with tracking prevention or a "Do Not Track" signal. The available settings differ from browser to browser.
You can find out how to use these settings in these browsers:
You can also block scripts by default. For example, the browser add-on "NoScript" only allows JavaScript and other active content to run on websites you trust. For Mozilla Firefox, NoScript is available at https://addons.mozilla.org/en-GB/firefox/addon/noscript/.
Please note: if you block cookies, some functions of our websites may not work.
Necessary
Required for the site to function — session, security, load balancing, and fraud protection. This category also contains services that deliver functions you request on our websites, such as signing in with an external account, maps, payment and online check-in. Cannot be turned off.
Adyen
We use the service "Adyen" on our websites. The service is provided by Adyen N.V. (the provider). The address of the provider is Simon Carmiggeltstraat 6-50, 1011 DJ Amsterdam, Netherlands.
The service enables us to process the payment for your booking securely and to protect payments against fraud. Your payment details are entered directly into Adyen's payment form, so card data goes straight to Adyen and is not stored by us. You can object to Adyen's fraud checks at any time by contacting Adyen's data protection officer at dpo@adyen.com. For hosts, it also enables us to verify your identity, your business and your bank account before payouts can be made, as payment regulation requires; Adyen does this with identity providers and credit reference agencies.
Payment processing
Fraud prevention
Identity verification
Data processed
User-related data
Payment data
Cardholder name
Billing address
Email address
Transaction data
Order reference
Identity data
Bank account details
Business details
Technical usage data
IP address
Behavioral fraud signals
Page URL
Device and connection data
Device ID
Browser metadata
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
We use this service because the processing is necessary to perform the contract with you or to take steps at your request before entering into a contract (Art. 6(1)(b) GDPR). Where the service stores information on your device or reads information from it, this is strictly necessary to provide a digital service that you have expressly requested. Your consent is therefore not required for this (Sch. A1 paras. 3–5 PECR). You cannot switch this service off in the cookie settings.
Recipients
The provider receives personal data and processes it as an independent controller (Art. 4(7) GDPR). The provider decides for itself on the purposes and means of this processing.
Adyen N.V., Simon Carmiggeltstraat 6-50, 1011 DJ Amsterdam, Netherlands (EU/EEA)
You can find more information on how the provider processes personal data in the provider's privacy policy: www.adyen.com/privacy-policy
Storage and retention
We do not store the data collected by this service in our own systems. The data is stored by the provider. Retention period: Transaction data: 7 years after the transaction (Adyen, most jurisdictions); risk cookie: 30 days
Cookies
Retention
Description
_RP_UID
30 days
Adyen risk ID that helps detect suspicious behaviour when you pay.
_cfuvid
session
Cloudflare firewall cookie on Adyen's payment domain; tells apart visitors who share an IP address
Chekin
We use the service "Chekin" on our websites. The service is provided by Chekin Soluciones Digitales, S.L. (the provider). The address of the provider is Avda. República Argentina, 24 - 7º, 41011 Sevilla, Spain.
The service enables guests to complete online check-in for their stay and enables hosts to register their guests with the police and other authorities, as the law requires in many countries. Guests enter their identity document details in a form that loads from Chekin's servers, and Chekin passes them on to the authority the host has connected.
Guest registration
Online check in
Identity verification
Authority account connection
Data processed
User-related data
Identity document data
Identity document images
Facial images
Email address
Stay details
Booking data
Authority account status
Name
Phone number
Technical usage data
IP address
Device and connection data
Browser metadata
Other data
Locale
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
This service is strictly necessary for us to provide our websites and the services you request on them. Storing information on your device and reading information from it is therefore permitted without your consent (Sch. A1 paras. 3–5 PECR). The further processing of your personal data is based on our legitimate interest in providing our websites and services securely and without technical errors (Art. 6(1)(f) GDPR). You cannot switch this service off in the cookie settings.
Right to object: You have the right to object to this processing at any time, on grounds relating to your particular situation (Art. 21(1) GDPR). We will then stop the processing, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. To object, please use the contact details in this privacy policy.
Recipients
The provider processes personal data on our behalf as a processor (Art. 28 GDPR). We have concluded a data processing agreement with the provider for this purpose. The provider processes the data only on our documented instructions.
You can find more information on how the provider processes personal data in the provider's privacy policy: chekin.com/en/privacy-policy
Storage and retention
The data collected by this service is stored by the provider and also in our own systems. We keep the data in our own systems only as long as we need it for the purposes described above, or as long as statutory retention obligations require. We then delete or anonymise the data. Retention period: Photos of the identity document and the selfie: deleted by Chekin immediately after verification. Other guest data: for the duration of the contract and then for the period required by law.
Cookies
Retention
Description
i18nextLng (local storage)
until you clear your browser data
Language of the online check-in form, stored on the Holidu page's own domain.
Filter settings of the host guest-registration list.
Demodesk
We use the service "Demodesk" on our websites. The service is provided by Demodesk GmbH (the provider). The address of the provider is Isartorplatz 8, 80331 Munich, Germany.
The service enables us to let hosts book an onboarding call with our team directly in the host app, using a scheduling page that loads from Demodesk's servers. For this, Demodesk receives the host's name, email address and host account number and the appointment the host selects.
Meeting scheduling
Data processed
User-related data
Name
Email address
Host account ID
Meeting booking details
Technical usage data
IP address
Device and connection data
Browser metadata
Cookie ID
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
This service is strictly necessary for us to provide our websites and the services you request on them. Storing information on your device and reading information from it is therefore permitted without your consent (Sch. A1 paras. 3–5 PECR). The further processing of your personal data is based on our legitimate interest in providing our websites and services securely and without technical errors (Art. 6(1)(f) GDPR). You cannot switch this service off in the cookie settings.
Right to object: You have the right to object to this processing at any time, on grounds relating to your particular situation (Art. 21(1) GDPR). We will then stop the processing, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. To object, please use the contact details in this privacy policy.
Recipients
The provider processes personal data on our behalf as a processor (Art. 28 GDPR). We have concluded a data processing agreement with the provider for this purpose. The provider processes the data only on our documented instructions.
Personal data is transferred to these countries outside the European Economic Area (EEA): United States. The transfer is not covered by an adequacy decision of the European Commission (Art. 45 GDPR). The transfer is protected by the standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR; Implementing Decision (EU) 2021/914). Where necessary, the clauses are supplemented by additional technical, organisational or contractual measures. You can request a copy of the clauses using the contact details in this privacy policy. The standard text of the clauses is published at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj.
Storage and retention
We do not store the data collected by this service in our own systems. The data is stored by the provider. Retention period: As long as needed to schedule and hold the call.
Stores your choice in Demodesk's cookie banner on its booking page.
Firebase Cloud Messaging
We use the service "Firebase Cloud Messaging" on our websites. The service is provided by Google Ireland Limited (the provider). The address of the provider is Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland.
The provider belongs to a group of companies. The parent company of the group is Google LLC, which is based outside the European Economic Area (EEA). The address of the parent company is 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
The service enables us to send notifications to our host app, for example about new bookings, guest messages and changes to your properties. For this, the app receives a notification token that identifies this installation of the app; we store it with your user account together with the device name, platform and app version, and we only send notifications if you have allowed them in your device settings.
Push notifications
Data processed
Device and connection data
Push token
Device ID
Device type
Technical usage data
App version
Locale
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
This service is strictly necessary for us to provide our websites and the services you request on them. Storing information on your device and reading information from it is therefore permitted without your consent (Sch. A1 paras. 3–5 PECR). The further processing of your personal data is based on our legitimate interest in providing our websites and services securely and without technical errors (Art. 6(1)(f) GDPR). You cannot switch this service off in the cookie settings.
Right to object: You have the right to object to this processing at any time, on grounds relating to your particular situation (Art. 21(1) GDPR). We will then stop the processing, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. To object, please use the contact details in this privacy policy.
Recipients
The provider processes personal data on our behalf as a processor (Art. 28 GDPR). We have concluded a data processing agreement with the provider for this purpose. The provider processes the data only on our documented instructions.
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland (EU/EEA)
Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (third country)
You can find more information on how the provider processes personal data in the provider's privacy policy: firebase.google.com/support/privacy
Transfers to third countries
Personal data is transferred to these countries outside the European Economic Area (EEA): United States. The recipient in the United States is certified under the EU-U.S. Data Privacy Framework (DPF). The certified recipient is Google LLC, which is based in the United States. By its adequacy decision of 10 July 2023, the European Commission decided that the United States ensures an adequate level of protection for personal data transferred to certified companies (Implementing Decision (EU) 2023/1795). The transfer is therefore based on this adequacy decision (Art. 45(1) GDPR). You can check the certification in the official DPF list: https://www.dataprivacyframework.gov/s/participant-search.
Storage and retention
The data collected by this service is stored by the provider and also in our own systems. We keep the data in our own systems only as long as we need it for the purposes described above, or as long as statutory retention obligations require. We then delete or anonymise the data. Retention period: Installation IDs: until deleted, then removed from Google's systems within 180 days. On Android, tokens inactive for 270 days expire. Token copy in your account: as long as needed for notifications.
Cookies
Retention
Description
Firebase installation ID and FCM registration token (app storage)
until the app is uninstalled or its data is cleared; refreshed by the SDK
Identifies this app installation so push notifications can be delivered to it.
Google reCAPTCHA
We use the service "Google reCAPTCHA" on our websites. The service is provided by Google Ireland Limited (the provider). The address of the provider is Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland.
The provider belongs to a group of companies. The parent company of the group is Google LLC, which is based outside the European Economic Area (EEA). The address of the parent company is 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
The service enables us to tell whether a form on our website is being used by a person or by an automated program, so that we can protect our forms against spam, fraud and other automated abuse. We use it on the basis of our legitimate interest in providing our service to hosts securely.
Bot prevention
Form security
Protecting the forms through which hosts use and contact our service, such as sign-up and enquiry forms, against spam, fraud and other automated abuse, so that we can provide our service to hosts securely. For this, Google receives technical data such as the IP address and browser data.
Data processed
Technical usage data
Behavioral bot signals
Device and connection data
Device ID
IP address
Browser metadata
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
We use this service on the basis of our legitimate interest under Art. 6(1)(f) GDPR. We describe this legitimate interest in the purpose section above. Where the service stores information on your device or reads information from it, this is strictly necessary to provide a digital service that you have expressly requested. Your consent is therefore not required for this (Sch. A1 paras. 3–5 PECR).
Right to object: You have the right to object to this processing at any time, on grounds relating to your particular situation (Art. 21(1) GDPR). We will then stop the processing, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. To object, please use the contact details in this privacy policy.
Recipients
The provider processes personal data on our behalf as a processor (Art. 28 GDPR). We have concluded a data processing agreement with the provider for this purpose. The provider processes the data only on our documented instructions.
Google Cloud EMEA Limited (EU/EEA)
Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (third country)
You can find more information on how the provider processes personal data in the provider's privacy policy: policies.google.com/privacy
Transfers to third countries
Personal data is transferred to these countries outside the European Economic Area (EEA): United States. The recipient in the United States is certified under the EU-U.S. Data Privacy Framework (DPF). The certified recipient is Google LLC, which is based in the United States. By its adequacy decision of 10 July 2023, the European Commission decided that the United States ensures an adequate level of protection for personal data transferred to certified companies (Implementing Decision (EU) 2023/1795). The transfer is therefore based on this adequacy decision (Art. 45(1) GDPR). You can check the certification in the official DPF list: https://www.dataprivacyframework.gov/s/participant-search.
Storage and retention
We do not store the data collected by this service in our own systems. The data is stored by the provider. Retention period: 6 months
Cookies
Retention
Description
_GRECAPTCHA
6 months
Set by reCAPTCHA when it runs, to provide its risk analysis
Holidu Necessary
We use the service "Holidu Necessary" on our websites. It is operated by us, Holidu GmbH.
The service enables us to run our website and booking process: it keeps you logged in, remembers your language, currency and cookie choices, and gives you access to your bookings.
Site functionality
Authentication
Consent management
Localisation
Data processed
Device and connection data
Pseudonymous visitor ID
IP address
Browser metadata
User-related data
User ID
Other data
Locale
Currency
Consent choices
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
This service is strictly necessary for us to provide our websites and the services you request on them. Storing information on your device and reading information from it is therefore permitted without your consent (Sch. A1 paras. 3–5 PECR). The further processing of your personal data is based on our legitimate interest in providing our websites and services securely and without technical errors (Art. 6(1)(f) GDPR). You cannot switch this service off in the cookie settings.
Right to object: You have the right to object to this processing at any time, on grounds relating to your particular situation (Art. 21(1) GDPR). We will then stop the processing, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. To object, please use the contact details in this privacy policy.
Recipients
No other recipients are involved.
Storage and retention
The data collected by this service is stored only in our own systems. We keep the data only as long as we need it for the purposes described above, or as long as statutory retention obligations require. We then delete or anonymise the data. Retention period: up to 365 days
Cookies
Retention
Description
__consent
365 days
Stores your cookie choices for each service listed here.
__acons
365 days
Older record of your choice for analytics cookies.
__ccons
365 days
Older record of your choice for necessary cookies.
__mcons
365 days
Older record of your choice for marketing cookies.
uuid
365 days
Pseudonymous ID that recognises your browser across visits.
userId
365 days
Stores your user ID while you are logged in.
_lo
365 days
Remembers the language you selected for the website.
_cu
365 days
Remembers the currency you selected for showing prices.
auto_login_attempted
session
Prevents repeated automatic sign-in redirects when you open the website.
userStore
365 days
Remembers that you visited before, to personalise the home page.
Gives you access to your booking, limited to that booking's page.
AUTH_SESSION_ID
session
Keeps your Holidu login session on our sign-in server.
KC_AUTH_SESSION_HASH
session
Checks your Holidu login session on our sign-in server.
lastVisitTimestamp (local storage)
until you clear your browser data
Stores the time of your last visit, for analytics.
HAS_SEEN_LIST_TRUSTPILOT
365 days
Remembers an earlier visit so the Trustpilot reviews block can be hidden.
Mandrill
We use the service "Mandrill" on our websites. The service is provided by The Rocket Science Group LLC d/b/a Mailchimp (the provider). The address of the provider is 405 North Angier Ave. NE, Atlanta, GA 30308, USA.
The provider belongs to a group of companies. The parent company of the group is Intuit Inc., which is based outside the European Economic Area (EEA). The address of the parent company is 2800 E Commerce Center Place, Tucson, AZ 85706, USA.
Used in: Website
Purpose of the processing
The service enables us to send you, as a host, emails about your account, your properties and your bookings, for example invitations to collaborate, notices that a property has been published and booking change requests. For this, Mandrill receives your name, your email address and the details that the email contains.
Transactional messages
Data processed
User-related data
Name
Email address
Booking data
Legal basis
This service is strictly necessary for us to provide our websites and the services you request on them. Storing information on your device and reading information from it is therefore permitted without your consent (Sch. A1 paras. 3–5 PECR). The further processing of your personal data is based on our legitimate interest in providing our websites and services securely and without technical errors (Art. 6(1)(f) GDPR). You cannot switch this service off in the cookie settings.
Right to object: You have the right to object to this processing at any time, on grounds relating to your particular situation (Art. 21(1) GDPR). We will then stop the processing, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. To object, please use the contact details in this privacy policy.
Recipients
The provider processes personal data on our behalf as a processor (Art. 28 GDPR). We have concluded a data processing agreement with the provider for this purpose. The provider processes the data only on our documented instructions.
The Rocket Science Group LLC d/b/a Mailchimp, 405 North Angier Ave. NE, Atlanta, GA 30308, USA (third country)
You can find more information on how the provider processes personal data in the provider's privacy policy: www.intuit.com/privacy/statement
Transfers to third countries
Personal data is transferred to these countries outside the European Economic Area (EEA): United States. The recipient in the United States is certified under the EU-U.S. Data Privacy Framework (DPF). The certified recipient is The Rocket Science Group LLC d/b/a Mailchimp, which is based in the United States. By its adequacy decision of 10 July 2023, the European Commission decided that the United States ensures an adequate level of protection for personal data transferred to certified companies (Implementing Decision (EU) 2023/1795). The transfer is therefore based on this adequacy decision (Art. 45(1) GDPR). You can check the certification in the official DPF list: https://www.dataprivacyframework.gov/s/participant-search.
Storage and retention
We do not store the data collected by this service in our own systems. The data is stored by the provider. Retention period: Email content: 30 days; details of bounced emails: 90 days. Aggregate sending statistics are kept without a time limit.
Sentry
We use the service "Sentry" on our websites. The service is provided by Functional Software, Inc. (Sentry) (the provider). The address of the provider is 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA.
The service enables us to detect, analyse and fix technical errors on our website, for example errors that interrupt a booking or a sign-up. Sentry transfers data to countries without an EU adequacy decision only under EU standard contractual clauses.
Error monitoring
Site stability
Detecting and fixing errors that break the booking and sign-up flows. Error reports carry technical browser data only; no cookies are set.
Data processed
Technical usage data
Error reports
IP address
Experiment variation assignment
Page URL
Browser request details, including cookies
Device and connection data
Browser metadata
Pseudonymous visitor ID
User-related data
Email address
User ID
Legal basis
We use this service on the basis of our legitimate interest under Art. 6(1)(f) GDPR. We describe this legitimate interest in the purpose section above. Where the service stores information on your device or reads information from it, this is strictly necessary to provide a digital service that you have expressly requested. Your consent is therefore not required for this (Sch. A1 paras. 3–5 PECR).
Right to object: You have the right to object to this processing at any time, on grounds relating to your particular situation (Art. 21(1) GDPR). We will then stop the processing, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. To object, please use the contact details in this privacy policy.
Recipients
The provider processes personal data on our behalf as a processor (Art. 28 GDPR). We have concluded a data processing agreement with the provider for this purpose. The provider processes the data only on our documented instructions.
Functional Software, Inc. d/b/a Sentry, 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA (third country)
Amazon Web Services, Inc., Seattle, WA, USA (third country)
Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (third country)
Google LLC (Google Cloud Platform), 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (third country)
Intercom, Inc., 55 2nd Street, 4th Floor, San Francisco, CA 94105, USA (third country)
Twilio Inc. (SendGrid), 101 Spear St FL 5, San Francisco, CA 94105, USA (third country)
OpenAI, L.L.C., San Francisco, CA, USA (third country)
Anthropic, PBC, San Francisco, CA, USA (third country)
Functional Software GmbH, Vienna, Austria (EU/EEA)
You can find more information on how the provider processes personal data in the provider's privacy policy: sentry.io/privacy
Transfers to third countries
Personal data is transferred to these countries outside the European Economic Area (EEA): United States. The recipient in the United States is certified under the EU-U.S. Data Privacy Framework (DPF). The certified recipient is Functional Software, Inc. d/b/a Sentry, which is based in the United States. By its adequacy decision of 10 July 2023, the European Commission decided that the United States ensures an adequate level of protection for personal data transferred to certified companies (Implementing Decision (EU) 2023/1795). The transfer is therefore based on this adequacy decision (Art. 45(1) GDPR). You can check the certification in the official DPF list: https://www.dataprivacyframework.gov/s/participant-search.
Storage and retention
We do not store the data collected by this service in our own systems. The data is stored by the provider. Retention period: Error reports and performance data are kept for up to 90 days, then deleted.
Trustpilot
We use the service "Trustpilot" on our websites. The service is provided by Trustpilot A/S (the provider). The address of the provider is Pilestraede 58, 5th floor, 1112 Copenhagen K, Denmark.
The service enables us to show independent customer reviews of Holidu on our website, using a review widget that loads from Trustpilot's servers. When you open a Trustpilot review link from us, Trustpilot receives your name, email address and a reference number so it can match your review to us.
Display reviews
Showing independent customer reviews of Holidu on the page. The widget loads from Trustpilot's servers, which receive the visitor's IP address and browser data; no Holidu cookies are set.
Data processed
Technical usage data
IP address
Page URL
Referrer
Locale
Device and connection data
Browser metadata
Legal basis
We use this service on the basis of our legitimate interest under Art. 6(1)(f) GDPR. We describe this legitimate interest in the purpose section above. Where the service stores information on your device or reads information from it, this is strictly necessary to provide a digital service that you have expressly requested. Your consent is therefore not required for this (Sch. A1 paras. 3–5 PECR).
Right to object: You have the right to object to this processing at any time, on grounds relating to your particular situation (Art. 21(1) GDPR). We will then stop the processing, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. To object, please use the contact details in this privacy policy.
Recipients
The provider receives personal data and processes it as an independent controller (Art. 4(7) GDPR). The provider decides for itself on the purposes and means of this processing.
We do not store the data collected by this service in our own systems. The data is stored by the provider. Retention period: Trustpilot decides as an independent controller: kept only as long as Trustpilot needs it for its purpose or must keep it by law, then deleted or anonymised.
Analytics
Helps us understand how the site is used so we can improve it.
Google Analytics 4
We use the service "Google Analytics 4" on our websites. The service is provided by Google Ireland Limited (the provider). The address of the provider is Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland.
The provider belongs to a group of companies. The parent company of the group is Google LLC, which is based outside the European Economic Area (EEA). The address of the parent company is 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
The service enables us to measure how visitors use our website and booking process, for example which pages they view and at which booking step they leave, so that we can improve both.
Measurement
Analytics
Data processed
Device and connection data
Device ID
IP address
Pseudonymous visitor ID
Approximate location (country or city, from your IP address)
User-related data
User ID
Email address
Phone number
Technical usage data
Page URL
Referrer
Consent choices
Website interaction events
Page views
Session behavior
Searches (destination, dates, filters)
Product view events
Checkout started
Purchase event
Sign-up / contact form submitted
Stay details
Advertising attribution data
Transaction data
Click ID
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
We only use this service if you have consented to it in our cookie banner or cookie settings. Storing information on your device and reading information from it is based on your consent under reg. 6 PECR with Sch. A1 para. 2. The further processing of your personal data is based on your consent under Art. 6(1)(a) GDPR. Your consent is voluntary. You can withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR). You can withdraw or change your consent via .
Recipients
The provider processes personal data on our behalf as a processor (Art. 28 GDPR). We have concluded a data processing agreement with the provider for this purpose. The provider processes the data only on our documented instructions.
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland (EU/EEA)
Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (third country)
You can find more information on how the provider processes personal data in the provider's privacy policy: policies.google.com/privacy
Transfers to third countries
Personal data is transferred to these countries outside the European Economic Area (EEA): United States. The transfer is not covered by an adequacy decision of the European Commission (Art. 45 GDPR). The transfer is protected by the standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR; Implementing Decision (EU) 2021/914). Where necessary, the clauses are supplemented by additional technical, organisational or contractual measures. You can request a copy of the clauses using the contact details in this privacy policy. The standard text of the clauses is published at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj.
Storage and retention
Retention: 14 months
Cookies
Retention
Description
_ga
13 months
Google Analytics cookie used to distinguish users
_ga_<container_id>
13 months
Google Analytics cookie that keeps the state of your current session.
FPID
400 days
Google Analytics ID for your browser, set by our own server.
FPLC
20 hours
Lets Google Analytics recognise your browser across our different domains.
FPGSID
session
Google Analytics session ID, set through our own server.
FPAU
90 days
Google cookie storing ad interaction data to measure ad performance.
Microsoft Clarity
We use the service "Microsoft Clarity" on our websites. The service is provided by Microsoft Ireland Operations Limited (the provider). The address of the provider is One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland.
The provider belongs to a group of companies. The parent company of the group is Microsoft Corporation, which is based outside the European Economic Area (EEA). The address of the parent company is One Microsoft Way, Redmond, Washington 98052, USA.
The service enables us to see how visitors use our website, through recordings of their sessions and heatmaps of where they click and scroll, so that we can find and fix usability problems. For this, Microsoft receives a pseudonymous visitor identifier, the pages viewed and the interactions on those pages.
Session recording
Heatmaps
Usability analytics
Data processed
Device and connection data
Device ID
Session ID
Browser metadata
Your advertising ID, shared with partner ad networks
User-related data
User ID
Technical usage data
Experiment variation assignment
Website interaction events
Page views
Session recordings
Click heatmap data
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
We only use this service if you have consented to it in our cookie banner or cookie settings. Storing information on your device and reading information from it is based on your consent under reg. 6 PECR with Sch. A1 para. 2. The further processing of your personal data is based on your consent under Art. 6(1)(a) GDPR. Your consent is voluntary. You can withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR). You can withdraw or change your consent via .
Recipients
The provider receives personal data and processes it as an independent controller (Art. 4(7) GDPR). The provider decides for itself on the purposes and means of this processing.
Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland (EU/EEA)
Microsoft Corporation, One Microsoft Way, Redmond, Washington 98052, USA (third country)
Personal data is transferred to these countries outside the European Economic Area (EEA): United States. The transfer is not covered by an adequacy decision of the European Commission (Art. 45 GDPR). The transfer is protected by the standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR; Implementing Decision (EU) 2021/914). Where necessary, the clauses are supplemented by additional technical, organisational or contractual measures. You can request a copy of the clauses using the contact details in this privacy policy. The standard text of the clauses is published at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj.
Storage and retention
Retention: Recordings 30 days; click/heatmap data and labelled or favourited sessions 9 months
Cookies
Retention
Description
_clck
1 year
Clarity cookie that persists the Clarity user ID and preferences for this site
_clsk
1 day
Clarity cookie that connects a user's page views into a single Clarity session recording
CLID
13 months
Clarity cookie recording when Clarity first saw this user on any site using Clarity
ANONCHK
1 day
Always set to 0; Clarity does not pass MUID to the advertising cookie ANID
MR
7 days
Flag indicating whether to refresh MUID
MUID
390 days
Microsoft ID that identifies unique browsers visiting Microsoft sites.
SM
session
Microsoft flag that syncs the MUID browser ID.
Vimeo
We use the service "Vimeo" on our websites. The service is provided by Vimeo.com, Inc. (the provider). The address of the provider is 330 West 34th Street, 10th Floor, New York, NY 10001, USA.
DPO: privacy@vimeo.com · EU representative: European Data Protection Office (EDPO), Avenue Huart Hamoir 71, 1030 Brussels, Belgium
Used in: Website
Purpose of the processing
The service enables us to show videos on our website, such as webinar recordings and videos in our host articles, using a video player that loads from Vimeo's servers, and to see how often our videos are watched. The cookies listed here cover video playback, bot protection (which keeps the player safe from automated abuse) and viewing statistics. They are set only after you accept.
Video playback
Bot prevention
Analytics
Data processed
Technical usage data
IP address
Referrer
Video playback events
Device and connection data
Browser metadata
Cookie ID
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
We only use this service if you have consented to it in our cookie banner or cookie settings. Storing information on your device and reading information from it is based on your consent under reg. 6 PECR with Sch. A1 para. 2. The further processing of your personal data is based on your consent under Art. 6(1)(a) GDPR. Your consent is voluntary. You can withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR). You can withdraw or change your consent via .
Recipients
The provider receives personal data and processes it as an independent controller (Art. 4(7) GDPR). The provider decides for itself on the purposes and means of this processing.
Vimeo.com, Inc., 330 West 34th Street, 10th Floor, New York, NY 10001, USA (third country)
You can find more information on how the provider processes personal data in the provider's privacy policy: vimeo.com/legal/privacy/policy
Transfers to third countries
Personal data is transferred to these countries outside the European Economic Area (EEA): United States. The recipient in the United States is certified under the EU-U.S. Data Privacy Framework (DPF). The certified recipient is Vimeo.com, Inc., which is based in the United States. By its adequacy decision of 10 July 2023, the European Commission decided that the United States ensures an adequate level of protection for personal data transferred to certified companies (Implementing Decision (EU) 2023/1795). The transfer is therefore based on this adequacy decision (Art. 45(1) GDPR). You can check the certification in the official DPF list: https://www.dataprivacyframework.gov/s/participant-search.
Storage and retention
We do not store the data collected by this service in our own systems. The data is stored by the provider. Retention period: Cookies: up to 2 years. Data received by Vimeo: as long as Vimeo has a business or legal reason to keep it.
Cookies
Retention
Description
vuid
2 years
Vimeo ID used to create viewing statistics for the video owner.
player
1 year
player preferences (volume, quality, captions)
LOCAL_STORAGE_ID_VIMEO_PLAYER (local storage)
until you clear your browser data
Remembers the Vimeo player for this browser
LOCAL_STORAGE_ID_PICOX_ID (local storage)
until you clear your browser data
Vimeo player statistics identifier for this browser
PLAYER_PICOX_SAMPLING_SEED (local storage)
until you clear your browser data
Vimeo player statistics sampling value for this browser
__cf_bm
30 minutes
Cloudflare bot check for the video player
_cfuvid
session
Cloudflare rate limiting for the video player
cf_clearance
1 year
Cloudflare bot check for the video player
player_clearance
7 days
Vimeo bot check for the video player
__cf_ob
session
Cloudflare bot check for the video player
Marketing
Used to show you relevant ads on other sites and measure campaign performance.
Adjust
We use the service "Adjust" on our websites. The service is provided by Adjust GmbH (the provider). The address of the provider is Saarbrücker Str. 37a, 10405 Berlin, Germany.
The provider belongs to a group of companies. The parent company of the group is AppLovin Corporation, which is based outside the European Economic Area (EEA).
privacy@adjust.com · postal: Adjust GmbH, Attn: Data Protection, Saarbrücker Str. 37a, 10405 Berlin, Germany
Used in: iOS app, Android app
Purpose of the processing
Adjust measures our app installs and where they came from. In the guest apps, it receives your in-app activity only with marketing consent.
Install attribution
Campaign attribution
Deferred deeplinking
Data processed
Technical usage data
IP address
Install referrer
App install events
Click ID
App version
Device and connection data
Advertising ID
Device ID
Device type
Pseudonymous visitor ID
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
We only use this service if you have consented to it in our cookie banner or cookie settings. Storing information on your device and reading information from it is based on your consent under reg. 6 PECR with Sch. A1 para. 2. The further processing of your personal data is based on your consent under Art. 6(1)(a) GDPR. Your consent is voluntary. You can withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR). You can withdraw or change your consent via .
Recipients
The provider processes personal data on our behalf as a processor (Art. 28 GDPR). We have concluded a data processing agreement with the provider for this purpose. The provider processes the data only on our documented instructions.
Adjust GmbH, Saarbrücker Str. 37a, 10405 Berlin, Germany (EU/EEA)
You can find more information on how the provider processes personal data in the provider's privacy policy: www.adjust.com/terms/privacy-policy
Storage and retention
The data collected by this service is stored by the provider and also in our own systems. We keep the data in our own systems only as long as we need it for the purposes described above, or as long as statutory retention obligations require. We then delete or anonymise the data. Retention period: Data received by Adjust: at most 25 months from the last consent. Data on the device: until the app is uninstalled.
Cookies
Retention
Description
Adjust SDK state (activity state, attribution, adid) (app storage)
until the app is uninstalled or its data is cleared
Stores the Adjust SDK's app state, install attribution and Adjust device ID.
@web_to_app_ids (app storage)
until the app is uninstalled or its data is cleared
Stores the website visitor IDs that Adjust's install link passes to the app.
@first_open_sent (app storage)
until the app is uninstalled or its data is cleared
Holidu's own flag so the first-open event is sent only once
until the app is uninstalled or its data is cleared
Stores Adjust's app state, install attribution and events waiting to be sent.
adj_* (NSUserDefaults) (app storage)
until the app is uninstalled or its data is cleared
Remembers whether the install was counted and which link opened the app.
Awin Affiliate Tracking
We use the service "Awin Affiliate Tracking" on our websites. The service is provided by AWIN AG (the provider). The address of the provider is Otto-Ostrowski-Straße 1A, 10249 Berlin, Germany.
The service enables us to work with affiliate partners in the Awin network: it records which partner referred a visitor and, when a host signs up with us after that referral, attributes the sign-up to the partner so the commission owed can be calculated. For this, Awin receives a click reference, the reference of the sign-up and the commission data.
Affiliate attribution
Conversion tracking
Data processed
Device and connection data
Browser metadata
Website interaction events
Purchase event
Sign-up / contact form submitted
Advertising attribution data
Click ID
Order reference
Commission data
Transaction data
UTM parameters
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
We only use this service if you have consented to it in our cookie banner or cookie settings. Storing information on your device and reading information from it is based on your consent under reg. 6 PECR with Sch. A1 para. 2. The further processing of your personal data is based on your consent under Art. 6(1)(a) GDPR. Your consent is voluntary. You can withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR). You can withdraw or change your consent via .
Recipients
The provider receives personal data and processes it as an independent controller (Art. 4(7) GDPR). The provider decides for itself on the purposes and means of this processing.
You can find more information on how the provider processes personal data in the provider's privacy policy: www.awin.com/gb/privacy
Storage and retention
The data collected by this service is stored by the provider and also in our own systems. We keep the data in our own systems only as long as we need it for the purposes described above, or as long as statutory retention obligations require. We then delete or anonymise the data. Retention period: up to 3 years (pseudonymised up to 5 years for Awin's internal analysis)
Cookies
Retention
Description
AwinChannelCookie
30 days
Records the affiliate channel that referred your visit, for Awin attribution.
_aw_sn_<merchant_id>
1 year
Awin click reference for bookings via cashback or voucher affiliate sites.
_aw_m_<merchant_id>
1 year
Awin click reference that attributes bookings to the referring affiliate.
ServerAwinChannelCookie
30 days
Server-set copy of AwinChannelCookie, recording the referring affiliate channel.
Campaign Attribution Parameters
We use the service "Campaign Attribution Parameters" on our websites. It is operated by us, Holidu GmbH.
The service enables us to record which advertising campaign, ad group and type of device brought a visitor to our website, so that we can assign bookings to the right campaign.
Campaign attribution
Data processed
Device and connection data
Device type
Advertising attribution data
Campaign ID
Ad group ID
UTM parameters
Click ID
Referrer
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
We only use this service if you have consented to it in our cookie banner or cookie settings. Storing information on your device and reading information from it is based on your consent under reg. 6 PECR with Sch. A1 para. 2. The further processing of your personal data is based on your consent under Art. 6(1)(a) GDPR. Your consent is voluntary. You can withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR). You can withdraw or change your consent via .
Recipients
No other recipients are involved.
Storage and retention
The data collected by this service is stored only in our own systems. We keep the data only as long as we need it for the purposes described above, or as long as statutory retention obligations require. We then delete or anonymise the data. Retention period: 30 minutes
Cookies
Retention
Description
sem_adgid
30 minutes
Stores the sem_adgid parameter of your landing URL for campaign attribution.
sem_devi
30 minutes
Stores the sem_devi parameter of your landing URL for campaign attribution.
utm_campaign
30 minutes
Stores the utm_campaign parameter of your landing URL for campaign attribution.
utm_source
30 minutes
Stores the utm_source parameter of your landing URL for campaign attribution.
utm_medium
30 minutes
Stores the utm_medium parameter of your landing URL for campaign attribution.
utm_term
30 minutes
Stores the utm_term parameter of your landing URL for campaign attribution.
Google Ads Conversion Tracking & Remarketing
We use the service "Google Ads Conversion Tracking & Remarketing" on our websites. The service is provided by Google Ireland Limited (the provider). The address of the provider is Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland.
The provider belongs to a group of companies. The parent company of the group is Google LLC, which is based outside the European Economic Area (EEA). The address of the parent company is 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
The service enables us to measure which of our Google ads lead to host sign-ups and to show our ads to people who have visited our site before. For this, Google receives a device identifier, the ad click identifier, the pages you view and the submission of the sign-up form, and, for enhanced conversions, your email address, phone number, name and address, which Google's tag hashes (pseudonymises) before sending them.
Ad personalization
Conversion attribution
Remarketing
Data processed
Device and connection data
Device ID
User-related data
Hashed email
Hashed phone
Website interaction events
Page views
Sign-up / contact form submitted
Advertising attribution data
Click ID
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
We only use this service if you have consented to it in our cookie banner or cookie settings. Storing information on your device and reading information from it is based on your consent under reg. 6 PECR with Sch. A1 para. 2. The further processing of your personal data is based on your consent under Art. 6(1)(a) GDPR. Your consent is voluntary. You can withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR). You can withdraw or change your consent via .
Recipients
The provider receives personal data and processes it as an independent controller (Art. 4(7) GDPR). The provider decides for itself on the purposes and means of this processing.
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland (EU/EEA)
Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (third country)
You can find more information on how the provider processes personal data in the provider's privacy policy: policies.google.com/privacy
Transfers to third countries
Personal data is transferred to these countries outside the European Economic Area (EEA): United States. The recipient in the United States is certified under the EU-U.S. Data Privacy Framework (DPF). The certified recipient is Google LLC, which is based in the United States. By its adequacy decision of 10 July 2023, the European Commission decided that the United States ensures an adequate level of protection for personal data transferred to certified companies (Implementing Decision (EU) 2023/1795). The transfer is therefore based on this adequacy decision (Art. 45(1) GDPR). You can check the certification in the official DPF list: https://www.dataprivacyframework.gov/s/participant-search.
Storage and retention
The data collected by this service is stored by the provider and also in our own systems. We keep the data in our own systems only as long as we need it for the purposes described above, or as long as statutory retention obligations require. We then delete or anonymise the data. Retention period: 12 months
Cookies
Retention
Description
_gcl_au
3 months
Google conversion cookie used by Google Ads and other Google ad products.
_gcl_aw
3 months
Stores the Google Ads click ID to measure conversions from ads.
_gcl_ls (local storage)
until you clear your browser data
Stores Google ad click information in your browser to measure conversions.
IDE
390 days
Google DoubleClick cookie used to show relevant ads and measure conversions.
_gtmeec
90 days
Stores hashed contact details for Google's enhanced conversions.
GSI Ad-Fraud Verification
We use the service "GSI Ad-Fraud Verification" on our websites. The service is provided by GP One GmbH (the provider). The address of the provider is Otto-Wickenhöfer-Str. 7a, 35108 Allendorf (Eder), Germany.
Loaded by the Awin tag after you consent, it detects bot and fraudulent ad clicks we should not pay for.
Fraud prevention
Ad verification
Data processed
Device and connection data
Device ID
IP address
Browser metadata
Technical usage data
Page URL
Website interaction events
Page views
Product view events
Checkout started
Purchase event
Advertising attribution data
Order reference
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
We only use this service if you have consented to it in our cookie banner or cookie settings. Storing information on your device and reading information from it is based on your consent under reg. 6 PECR with Sch. A1 para. 2. The further processing of your personal data is based on your consent under Art. 6(1)(a) GDPR. Your consent is voluntary. You can withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR). You can withdraw or change your consent via .
Recipients
The provider receives personal data and processes it as an independent controller (Art. 4(7) GDPR). The provider decides for itself on the purposes and means of this processing.
GP One GmbH, Otto-Wickenhöfer-Str. 7a, 35108 Allendorf (Eder), Germany (EU/EEA)
The service enables us to attribute bookings and sign-ups more accurately to the ads that led to them. We convert the email address, phone number, name, city, postcode and country you give us, and our internal visitor reference, into hashed (pseudonymised) values, keep them in a cookie on your device and pass them to the Meta, Criteo, Pinterest, TikTok and Reddit services described separately in this policy.
Enhanced conversion matching
Data processed
User-related data
Hashed email
Hashed phone
Hashed name
Hashed city, postcode and country
Device and connection data
Pseudonymous visitor ID
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
We only use this service if you have consented to it in our cookie banner or cookie settings. Storing information on your device and reading information from it is based on your consent under reg. 6 PECR with Sch. A1 para. 2. The further processing of your personal data is based on your consent under Art. 6(1)(a) GDPR. Your consent is voluntary. You can withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR). You can withdraw or change your consent via .
Recipients
No other recipients are involved.
Storage and retention
The data collected by this service is stored only in our own systems. We keep the data only as long as we need it for the purposes described above, or as long as statutory retention obligations require. We then delete or anonymise the data. Retention period: 390 days
Cookies
Retention
Description
_hpii
390 days
Stores hashed contact details so the ad services named here can match bookings.
Kupona
We use the service "Kupona" on our websites. The service is provided by KUPONA GmbH (the provider). The address of the provider is Kothenbachweg 6, 36041 Fulda, Germany.
The service enables us to work with KUPONA, an affiliate partner in the Awin network. Its ReBounce service shows you alternative offers from our site when you are about to leave it, and may show you our offers again later. For this, KUPONA receives a device identifier, the IP address and browser information, the pages, searches and offers you view, the start of a checkout and, if you book, the booking reference and amount, so that Awin can credit KUPONA with a commission.
Retargeting
Affiliate attribution
Data processed
Device and connection data
Device ID
IP address
Browser metadata
Approximate location (country or city, from your IP address)
Technical usage data
Referrer
Website interaction events
Page views
Searches (destination, dates, filters)
Product view events
Checkout started
Purchase event
Advertising attribution data
Order reference
Commission data
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
We only use this service if you have consented to it in our cookie banner or cookie settings. Storing information on your device and reading information from it is based on your consent under reg. 6 PECR with Sch. A1 para. 2. The further processing of your personal data is based on your consent under Art. 6(1)(a) GDPR. Your consent is voluntary. You can withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR). You can withdraw or change your consent via .
Recipients
We and the provider are joint controllers for this processing (Art. 26 GDPR). Joint control covers the collection of your data on our websites and its transmission to the provider. After the transmission, the provider processes the data as an independent controller. In an arrangement under Art. 26 GDPR, we and the provider have agreed which of us fulfils which obligations under the GDPR. You can exercise your rights against us and against the provider (Art. 26(3) GDPR). On request, we will provide you with the essence of this arrangement (Art. 26(2) GDPR).
The UK Trade Desk Ltd, 10th Floor, 1 Bartholomew Close, London EC1A 7BL, United Kingdom (third country)
You can find more information on how the provider processes personal data in the provider's privacy policy: www.kupona.de/datenschutz
Storage and retention
We do not store the data collected by this service in our own systems. The data is stored by the provider. Retention period: cookie up to 365 days; user attributes 90 days
Cookies
Retention
Description
pseudonymous cookie ID (name not published)
up to 365 days
Kupona retargeting cookie with a pseudonymous ID, loaded through Awin.
LinkedIn Insight Tag
We use the service "LinkedIn Insight Tag" on our websites. The service is provided by LinkedIn Ireland Unlimited Company (the provider). The address of the provider is Wilton Plaza, Wilton Place, Dublin 2, Ireland.
The provider belongs to a group of companies. The parent company of the group is LinkedIn Corporation, which is based outside the European Economic Area (EEA). The address of the parent company is 1000 W Maude Ave, Sunnyvale, CA 94085, USA.
The service enables us to measure which visits and bookings come from our LinkedIn ads, and to show our ads on LinkedIn to people who have visited our website. For this, LinkedIn receives the page URL, the referrer, the IP address, device and browser characteristics and a timestamp.
Conversion attribution
Ad personalization
Data processed
Device and connection data
Device ID
IP address
Browser metadata
Technical usage data
Page URL
Referrer
Website interaction events
Page views
Sign-up / contact form submitted
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
We only use this service if you have consented to it in our cookie banner or cookie settings. Storing information on your device and reading information from it is based on your consent under reg. 6 PECR with Sch. A1 para. 2. The further processing of your personal data is based on your consent under Art. 6(1)(a) GDPR. Your consent is voluntary. You can withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR). You can withdraw or change your consent via .
Recipients
The provider processes personal data on our behalf as a processor (Art. 28 GDPR). We have concluded a data processing agreement with the provider for this purpose. The provider processes the data only on our documented instructions.
Personal data is transferred to these countries outside the European Economic Area (EEA): United States. The transfer is not covered by an adequacy decision of the European Commission (Art. 45 GDPR). The transfer is protected by the standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR; Implementing Decision (EU) 2021/914). Where necessary, the clauses are supplemented by additional technical, organisational or contractual measures. You can request a copy of the clauses using the contact details in this privacy policy. The standard text of the clauses is published at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj.
Storage and retention
Retention: Direct identifiers removed within 7 days; pseudonymised data deleted within 180 days
Cookies
Retention
Description
li_sugr
90 days
LinkedIn cookie used to make a probabilistic match of a user's identity
bcookie
1 year
LinkedIn browser identifier cookie; identifies devices accessing LinkedIn to detect abuse, and for diagnostics
UserMatchHistory
30 days
Stores when LinkedIn last synced ad IDs, to avoid repeated syncing.
lidc
24 hours
LinkedIn cookie that facilitates data center selection
AnalyticsSyncHistory
30 days
LinkedIn cookie storing the time of a sync with the lms_analytics cookie
Meta Pixel & Custom Audiences
We use the service "Meta Pixel & Custom Audiences" on our websites. The service is provided by Meta Platforms Ireland Limited (the provider). The address of the provider is Merrion Road, Dublin 4, D04 X2K5, Ireland.
The provider belongs to a group of companies. The parent company of the group is Meta Platforms, Inc., which is based outside the European Economic Area (EEA). The address of the parent company is 1 Meta Way, Menlo Park, CA 94025, USA.
FAO Privacy Operations (post) · DPO via Meta web form
Used in: Website
Purpose of the processing
The service enables us to measure which of our ads on Facebook and Instagram lead to host sign-ups, to show our ads again to people who have visited our website, and to reach people whose contact details we share with Meta in hashed (pseudonymised) form. For this, Meta receives a device identifier, the pages you view and the submission of the sign-up form, as well as your email address, phone number, name, city, postcode and country and our internal visitor reference in hashed (pseudonymised) form.
Ad personalization
Conversion attribution
Custom audiences
Data processed
Device and connection data
Device ID
User-related data
Hashed email
Hashed phone
Website interaction events
Page views
Sign-up / contact form submitted
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
We only use this service if you have consented to it in our cookie banner or cookie settings. Storing information on your device and reading information from it is based on your consent under reg. 6 PECR with Sch. A1 para. 2. The further processing of your personal data is based on your consent under Art. 6(1)(a) GDPR. Your consent is voluntary. You can withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR). You can withdraw or change your consent via .
Recipients
We and the provider are joint controllers for this processing (Art. 26 GDPR). Joint control covers the collection of your data on our websites and its transmission to the provider. After the transmission, the provider processes the data as an independent controller. In an arrangement under Art. 26 GDPR, we and the provider have agreed which of us fulfils which obligations under the GDPR. You can exercise your rights against us and against the provider (Art. 26(3) GDPR). On request, we will provide you with the essence of this arrangement (Art. 26(2) GDPR).
Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025, USA (third country)
You can find more information on how the provider processes personal data in the provider's privacy policy: www.facebook.com/privacy/policy
Transfers to third countries
Personal data is transferred to these countries outside the European Economic Area (EEA): United States. The transfer is not covered by an adequacy decision of the European Commission (Art. 45 GDPR). The transfer is protected by the standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR; Implementing Decision (EU) 2021/914). Where necessary, the clauses are supplemented by additional technical, organisational or contractual measures. You can request a copy of the clauses using the contact details in this privacy policy. The standard text of the clauses is published at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj.
Storage and retention
We do not store the data collected by this service in our own systems. The data is stored by the provider. Retention period: Event data: up to 2 years. Custom audiences: until Holidu removes them.
Cookies
Retention
Description
_fbp
3 months
Meta Pixel first-party cookie holding a unique browser identifier
_fbc
3 months
Meta Pixel cookie storing the ad click ID once one is available
Microsoft Advertising (Bing) UET
We use the service "Microsoft Advertising (Bing) UET" on our websites. The service is provided by Microsoft Ireland Operations Limited (the provider). The address of the provider is One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland.
The provider belongs to a group of companies. The parent company of the group is Microsoft Corporation, which is based outside the European Economic Area (EEA). The address of the parent company is One Microsoft Way, Redmond, Washington 98052, USA.
The service enables us to measure which of our ads on Microsoft Advertising (Bing) lead to host sign-ups on our website and to show our ads again to people who have already visited our website. For this, Microsoft receives a device identifier, the ad click identifier, the pages you view and the submission of the sign-up form, and, when you sign up, your email address and phone number, which Microsoft's tag hashes (pseudonymises) before sending them.
Ad personalization
Conversion attribution
Data processed
Device and connection data
Device ID
User-related data
Hashed email
Hashed phone
Website interaction events
Page views
Sign-up / contact form submitted
Advertising attribution data
Click ID
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
We only use this service if you have consented to it in our cookie banner or cookie settings. Storing information on your device and reading information from it is based on your consent under reg. 6 PECR with Sch. A1 para. 2. The further processing of your personal data is based on your consent under Art. 6(1)(a) GDPR. Your consent is voluntary. You can withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR). You can withdraw or change your consent via .
Recipients
The provider receives personal data and processes it as an independent controller (Art. 4(7) GDPR). The provider decides for itself on the purposes and means of this processing.
Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland (EU/EEA)
Microsoft Corporation, One Microsoft Way, Redmond, Washington 98052, USA (third country)
Personal data is transferred to these countries outside the European Economic Area (EEA): United States. The recipient in the United States is certified under the EU-U.S. Data Privacy Framework (DPF). The certified recipient is Microsoft Corporation, which is based in the United States. By its adequacy decision of 10 July 2023, the European Commission decided that the United States ensures an adequate level of protection for personal data transferred to certified companies (Implementing Decision (EU) 2023/1795). The transfer is therefore based on this adequacy decision (Art. 45(1) GDPR). You can check the certification in the official DPF list: https://www.dataprivacyframework.gov/s/participant-search.
Storage and retention
We do not store the data collected by this service in our own systems. The data is stored by the provider. Retention period: 13 months
Cookies
Retention
Description
_uetsid
1 day
Microsoft Advertising (UET) device identifier; used for conversion tracking and remarketing
_uetvid
13 months
Microsoft Advertising (UET) device identifier; used for conversion tracking and remarketing
MUID
13 months
Microsoft ID that identifies your browser for advertising and site analytics.
SRM_B
390 days
Microsoft Bing cookie that identifies unique web browsers.
MR
7 days
Microsoft flag that indicates whether to refresh the MUID browser ID.
_uetsid_exp / _uetvid_exp (local storage)
until you clear your browser data
Stores expiry dates of Microsoft Advertising's UET tracking cookies.
Reddit Pixel
We use the service "Reddit Pixel" on our websites. The service is provided by Reddit, Inc. (the provider). The address of the provider is 548 Market Street, #16093, San Francisco, CA 94104-5401, USA.
EU: Reddit Netherlands B.V., Euro Business Center, Looiersgracht 43, 1016 VR Amsterdam, Netherlands
Used in: Website
Purpose of the processing
The service enables us to measure which visits and host sign-ups come from our Reddit ads. For this, Reddit receives a device identifier, the pages viewed on our website, the submission of the sign-up form and, where available, your email address, phone number and our internal visitor reference in hashed (pseudonymised) form; Reddit also uses this data to measure its ads and to show more relevant ads on Reddit.
Conversion attribution
Data processed
Device and connection data
Device ID
Pseudonymous visitor ID
IP address
User-related data
Hashed email
Hashed phone
Website interaction events
Page views
Sign-up / contact form submitted
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
We only use this service if you have consented to it in our cookie banner or cookie settings. Storing information on your device and reading information from it is based on your consent under reg. 6 PECR with Sch. A1 para. 2. The further processing of your personal data is based on your consent under Art. 6(1)(a) GDPR. Your consent is voluntary. You can withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR). You can withdraw or change your consent via .
Recipients
Reddit, Inc., 548 Market Street, #16093, San Francisco, CA 94104-5401, USA (third country)
Personal data is transferred to these countries outside the European Economic Area (EEA): United States. The transfer is not covered by an adequacy decision of the European Commission (Art. 45 GDPR). The transfer is protected by the standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR; Implementing Decision (EU) 2021/914). Where necessary, the clauses are supplemented by additional technical, organisational or contractual measures. You can request a copy of the clauses using the contact details in this privacy policy. The standard text of the clauses is published at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj.
Storage and retention
Retention: 13 months
Cookies
Retention
Description
Reddit advertising identifiers
13 months
Reddit's own advertising identifiers, set on reddit.com by the Reddit Pixel.
_rdt_uuid
90 days
Reddit Pixel cookie that links site actions to Reddit ad campaigns.
Roeye
We use the service "Roeye" on our websites. The service is provided by SingleView Tech Ltd (formerly R.O.EYE Limited) (the provider). The address of the provider is 4th Floor, 2 Thomas More Square, London E1W 1YN, United Kingdom.
SingleView, loaded through the Awin tag, tells us which marketing channels brought you to our site and which led to a booking.
Conversion attribution
Campaign attribution
Data processed
Device and connection data
Cookie ID
IP address
Browser metadata
Technical usage data
Referrer
Page URL
Website interaction events
Purchase event
Advertising attribution data
Order reference
Transaction data
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
We only use this service if you have consented to it in our cookie banner or cookie settings. Storing information on your device and reading information from it is based on your consent under reg. 6 PECR with Sch. A1 para. 2. The further processing of your personal data is based on your consent under Art. 6(1)(a) GDPR. Your consent is voluntary. You can withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR). You can withdraw or change your consent via .
Recipients
SingleView Tech Ltd, 4th Floor, 2 Thomas More Square, London E1W 1YN, United Kingdom (third country)
You can find more information on how the provider processes personal data in the provider's privacy policy: privacy.awin.com
Transfers to third countries
Personal data is transferred to these countries outside the European Economic Area (EEA): United Kingdom. For the countries concerned, the European Commission has decided that they ensure an adequate level of data protection (adequacy decision, Art. 45(1) GDPR). The transfer is based on this adequacy decision. You can find the adequacy decisions on the website of the European Commission: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en.
Storage and retention
We do not store the data collected by this service in our own systems. The data is stored by the provider. Retention period: cookies 30-182 days
Cookies
Retention
Description
lantern
30 days
Stores a random visit ID to credit bookings to marketing channels.
singleview_lantern
182 days
SingleView's cookie with a visit ID to credit bookings to marketing channels.
RTB House
We use the service "RTB House" on our websites. The service is provided by RTB House S.A. (the provider). The address of the provider is ul. Złota 61/101, 00-819 Warsaw, Poland.
The service enables us to show people who have looked at holiday rentals on our site ads for those offers on other websites, and to measure whether these ads lead to bookings. For this, RTB House receives a device identifier and information on the pages and offers viewed on our site.
Retargeting
Conversion attribution
Data processed
Device and connection data
Device ID
IP address
Browser metadata
Approximate location (country or city, from your IP address)
Your advertising ID, shared with partner ad networks
User-related data
User ID
Website interaction events
Page views
Product view events
Checkout started
Purchase event
Sign-up / contact form submitted
Stay details
Searches (destination, dates, filters)
Advertising attribution data
Order reference
Transaction data
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
We only use this service if you have consented to it in our cookie banner or cookie settings. Storing information on your device and reading information from it is based on your consent under reg. 6 PECR with Sch. A1 para. 2. The further processing of your personal data is based on your consent under Art. 6(1)(a) GDPR. Your consent is voluntary. You can withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR). You can withdraw or change your consent via .
Recipients
The provider processes personal data on our behalf as a processor (Art. 28 GDPR). We have concluded a data processing agreement with the provider for this purpose. The provider processes the data only on our documented instructions.
RTB HOUSE S.A., ul. Złota 61/101, 00-819 Warsaw, Poland (EU/EEA)
You can find more information on how the provider processes personal data in the provider's privacy policy: www.rtbhouse.com/privacy-policy
Storage and retention
We do not store the data collected by this service in our own systems. The data is stored by the provider. Retention period: Impressions and interactions: up to 500 days, plus 65 days in backups; bid-request data: up to 100 days; then anonymised.
Cookies
Retention
Description
u
365 days
Stores a random ID so RTB House can recognise this browser later.
ts
365 days
Records a timestamp so RTB House can work out the cookie's age.
c
365 days
RTB House advertising cookie, set by its tag.
g
365 days
RTB House advertising cookie, set by its tag.
__rtbh.lid (cookie + local storage)
365 days
Random RTB House ID for this browser, renewed each time its tag runs.
XANDR_PANID / anj / uuid2
90 days
Random Xandr IDs that tell browsers apart, loaded through RTB House.
Taboola
We use the service "Taboola" on our websites. The service is provided by Taboola Europe Limited (the provider). The address of the provider is Aldgate House, 2nd Floor, 33 Aldgate High Street, London EC3N 1DL, United Kingdom.
The service enables us to measure which visits and host sign-ups come from our Taboola ads, and to show our ads as recommended content on other websites to people who may be interested in them.
Ad personalization
Conversion attribution
Content recommendation
Data processed
Device and connection data
Device ID
Website interaction events
Page views
Sign-up / contact form submitted
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
We only use this service if you have consented to it in our cookie banner or cookie settings. Storing information on your device and reading information from it is based on your consent under reg. 6 PECR with Sch. A1 para. 2. The further processing of your personal data is based on your consent under Art. 6(1)(a) GDPR. Your consent is voluntary. You can withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR). You can withdraw or change your consent via .
Recipients
The provider receives personal data and processes it as an independent controller (Art. 4(7) GDPR). The provider decides for itself on the purposes and means of this processing.
Taboola.com Ltd. (third country)
Taboola Europe Limited, Aldgate House, 2nd Floor, 33 Aldgate High Street, London EC3N 1DL, United Kingdom (third country)
Taboola, Inc., 1209 Orange Street, Wilmington, DE 19801, USA (third country)
You can find more information on how the provider processes personal data in the provider's privacy policy: policies.taboola.com/privacy-policy
Transfers to third countries
Personal data is transferred to these countries outside the European Economic Area (EEA): Israel, United Kingdom. For the countries concerned, the European Commission has decided that they ensure an adequate level of data protection (adequacy decision, Art. 45(1) GDPR). The transfer is based on this adequacy decision. You can find the adequacy decisions on the website of the European Commission: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en.
Personal data is transferred to these countries outside the European Economic Area (EEA): United States. The transfer is not covered by an adequacy decision of the European Commission (Art. 45 GDPR). The transfer is protected by the standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR; Implementing Decision (EU) 2021/914). Where necessary, the clauses are supplemented by additional technical, organisational or contractual measures. You can request a copy of the clauses using the contact details in this privacy policy. The standard text of the clauses is published at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj.
Storage and retention
Retention: up to 13 months after the last interaction
Cookies
Retention
Description
t_gid
1 year
Taboola user ID used for ad attribution, reporting and recommendations.
taboola_fp_user_id
1 year
Taboola advertising cookie.
t_gid / t_pt_gid
365 days
Taboola user IDs used for attribution and reporting.
taboola_session_id
session
Temporary Taboola session ID that avoids repeating the same recommendations.
taboola / eng_mt (local storage)
until you clear your browser data
Stores an ID Taboola uses to identify users for targeted ads.
Tangoo
We use the service "Tangoo" on our websites. The service is provided by Tangoo S.r.l. (the provider). The address of the provider is Via Lentasio 9, 20122 Milano, Italy.
The service enables us to show people who have looked at holiday rentals on our site ads for those offers on other websites, and to measure whether these ads lead to bookings. For this, Tangoo receives a cookie and session identifier, the IP address, the pages visited, browsing and booking activity on our site and interactions with its ads.
Retargeting
Programmatic advertising
Conversion tracking
Data processed
Device and connection data
Cookie ID
IP address
Session ID
Technical usage data
Page URL
Website interaction events
Browsing and purchase activity
Ad interactions
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
We only use this service if you have consented to it in our cookie banner or cookie settings. Storing information on your device and reading information from it is based on your consent under reg. 6 PECR with Sch. A1 para. 2. The further processing of your personal data is based on your consent under Art. 6(1)(a) GDPR. Your consent is voluntary. You can withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR). You can withdraw or change your consent via .
Recipients
The provider receives personal data and processes it as an independent controller (Art. 4(7) GDPR). The provider decides for itself on the purposes and means of this processing.
Tangoo S.r.l., Via Lentasio 9, 20122 Milano, Italy (EU/EEA)
We do not store the data collected by this service in our own systems. The data is stored by the provider. Retention period: data up to 90 days; cookies 60 days to 12 months
Cookies
Retention
Description
fingerprint
12 months
Tangoo ID that recognises a returning browser for targeted ads.
Record products viewed, ad impressions, clicks and on-site behaviour for Tangoo ads.
adc_opt_out
12 months
Remembers that you opted out of Tangoo ads.
__cf_bm
30 minutes
Cloudflare bot management on Tangoo domains
IDE
390 days
Google DoubleClick ad cookie, matched with Tangoo to show relevant ads.
TradeTracker Affiliate Tracking
We use the service "TradeTracker Affiliate Tracking" on our websites. The service is provided by TradeTracker International B.V. (the provider). The address of the provider is De Strubbenweg 7, 1327 GA Almere, Netherlands (KvK 39092006).
The service enables us to recognise when a visitor reaches our website through a link from one of our affiliate partners and, if a host sign-up follows, to assign it to that partner and calculate their commission.
Affiliate attribution
Conversion tracking
Data processed
Device and connection data
Browser metadata
Website interaction events
Purchase event
Sign-up / contact form submitted
Advertising attribution data
Click ID
Order reference
Commission data
Transaction data
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
We only use this service if you have consented to it in our cookie banner or cookie settings. Storing information on your device and reading information from it is based on your consent under reg. 6 PECR with Sch. A1 para. 2. The further processing of your personal data is based on your consent under Art. 6(1)(a) GDPR. Your consent is voluntary. You can withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR). You can withdraw or change your consent via .
Recipients
The provider receives personal data and processes it as an independent controller (Art. 4(7) GDPR). The provider decides for itself on the purposes and means of this processing.
TradeTracker International B.V., De Strubbenweg 7, 1327 GA Almere, Netherlands (EU/EEA)
You can find more information on how the provider processes personal data in the provider's privacy policy: tradetracker.com/privacy-policy
Storage and retention
The data collected by this service is stored by the provider and also in our own systems. We keep the data in our own systems only as long as we need it for the purposes described above, or as long as statutory retention obligations require. We then delete or anonymise the data. Retention period: Record of a click-through and any resulting purchase: up to 365 days; other data as long as needed for the service.
Cookies
Retention
Description
TT2_<campaign id>
30 days
Holds the TradeTracker click reference that credits sales and sign-ups to partners.
Services with separate consent
Services we work with where your consent or sign-up is given separately, case by case, and not through the cookie banner.
Apple Sign-In
We use the service "Apple Sign-In" on our websites. The service is provided by Apple Distribution International Limited (the provider).
The provider belongs to a group of companies. The parent company of the group is Apple Inc., which is based outside the European Economic Area (EEA).
Used in: Website
Purpose of the processing
The service enables us to let you sign in to or register your Holidu account with your Apple account instead of a separate password. For this, you are redirected to Apple to sign in. Apple then passes us an identifier of your Apple account, your email address, which can be a private relay address from Apple if you choose to hide your email address, and, at your first sign-in only, your name. We store these details in your Holidu account. Signing in this way is your choice; you can always register with your email address and a password instead.
Authentication
Data processed
User-related data
Apple account ID
Name
Email address
Legal basis
We only use this service if you choose to sign in with it. By clicking the sign-in button, you consent to its use. Storing information on your device and reading information from it is based on your consent under reg. 6 PECR with Sch. A1 para. 2. The further processing of your personal data is based on your consent under Art. 6(1)(a) GDPR. Your consent is voluntary. You can withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR). You can withdraw your consent by removing the connection to our website in your account with the provider or by contacting us.
Recipients
The provider receives personal data and processes it as an independent controller (Art. 4(7) GDPR). The provider decides for itself on the purposes and means of this processing.
Apple Distribution International Limited (EU/EEA)
Apple Inc. (third country)
You can find more information on how the provider processes personal data in the provider's privacy policy: www.apple.com/legal/privacy
Transfers to third countries
Personal data is transferred to these countries outside the European Economic Area (EEA): United States. The transfer is not covered by an adequacy decision of the European Commission (Art. 45 GDPR). The transfer is protected by the standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR; Implementing Decision (EU) 2021/914). Where necessary, the clauses are supplemented by additional technical, organisational or contractual measures. You can request a copy of the clauses using the contact details in this privacy policy. The standard text of the clauses is published at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj.
Storage and retention
The data collected by this service is stored by the provider and also in our own systems. We keep the data in our own systems only as long as we need it for the purposes described above, or as long as statutory retention obligations require. We then delete or anonymise the data. Retention period: Until your Holidu account is deleted.
Customer.io (Host)
We use the service "Customer.io (Host)" on our websites. The service is provided by Peaberry Software Inc. (Customer.io) (the provider). The address of the provider is 9450 SW Gemini Dr., Suite 43920, Beaverton, OR 97008-7105, USA.
Creating a host account, not visiting the site, subscribes you to emails and in-app messages (onboarding, webinars, news, referral offers, surveys) and some account emails (invoices, messages, collaboration requests, agreements). In the Holidu host app, if you allow notifications, we also send you push notifications. Customer.io also receives account data from our systems, for example contact and personal details, contract and payout data, and performance scores, plus your device token and which screens you open in the host app. Emails include an unsubscribe link.
Marketing emails
Host onboarding
Product updates
Surveys
In app messaging
Push notifications
Transactional messages
Data processed
User-related data
Account data from our systems (for example contact and personal details, contract and payout data)
Host account ID
Device and connection data
Cookie ID
Push token
Technical usage data
Page views
Session behavior
Message engagement
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
We only use this service if you have consented to it in our cookie banner or cookie settings. Storing information on your device and reading information from it is based on your consent under reg. 6 PECR with Sch. A1 para. 2. The further processing of your personal data is based on your consent under Art. 6(1)(a) GDPR. Your consent is voluntary. You can withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR). You can withdraw or change your consent via .
Recipients
The provider processes personal data on our behalf as a processor (Art. 28 GDPR). We have concluded a data processing agreement with the provider for this purpose. The provider processes the data only on our documented instructions.
Peaberry Software Inc. (Customer.io), 9450 SW Gemini Dr., Suite 43920, Beaverton, OR 97008-7105, USA (third country)
Google LLC (Google Cloud Platform, sub-processor), 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (third country)
Snowflake Inc. (sub-processor) (third country)
Mailgun Technologies, Inc. (sub-processor) (third country)
Amazon Web Services (sub-processor) (third country)
You can find more information on how the provider processes personal data in the provider's privacy policy: customer.io/legal/privacy-policy
Transfers to third countries
Personal data is transferred to these countries outside the European Economic Area (EEA): United States. The recipient in the United States is certified under the EU-U.S. Data Privacy Framework (DPF). The certified recipient is Peaberry Software Inc. (Customer.io), which is based in the United States. By its adequacy decision of 10 July 2023, the European Commission decided that the United States ensures an adequate level of protection for personal data transferred to certified companies (Implementing Decision (EU) 2023/1795). The transfer is therefore based on this adequacy decision (Art. 45(1) GDPR). You can check the certification in the official DPF list: https://www.dataprivacyframework.gov/s/participant-search.
Storage and retention
The data collected by this service is stored by the provider and also in our own systems. We keep the data in our own systems only as long as we need it for the purposes described above, or as long as statutory retention obligations require. We then delete or anonymise the data. Retention period: Profile and message history: at most 2 years; profiles with no contact are removed from the system.
Cookies
Retention
Description
ajs_anonymous_id
1 year
Customer.io: random identifier of this browser on the host platform
ajs_user_id
1 year
Customer.io: your customer identifier, set after you log in
Customer.io: copies of the two identifiers and the attributes sent with them
Customer.io SDK identifiers (app storage)
until the app is uninstalled or its data is cleared
Customer.io: your customer identifier and the notification token of this installation of the app
Facebook Login
We use the service "Facebook Login" on our websites. The service is provided by Meta Platforms Ireland Limited (the provider). The address of the provider is Merrion Road, Dublin 4, D04 X2K5, Ireland.
The provider belongs to a group of companies. The parent company of the group is Meta Platforms, Inc., which is based outside the European Economic Area (EEA). The address of the parent company is 1 Meta Way, Menlo Park, CA 94025, USA.
FAO Privacy Operations (post) · DPO via Meta web form
Used in: Website
Purpose of the processing
The service enables us to let you sign in to or register your Holidu account with your Facebook account instead of a separate password. For this, you are redirected to Facebook to sign in. Facebook then passes us an identifier of your Facebook account, your first and last name and your email address. We store these details in your Holidu account. Signing in this way is your choice; you can always register with your email address and a password instead.
Authentication
Data processed
User-related data
Facebook account ID
Name
Email address
Legal basis
We only use this service if you choose to sign in with it. By clicking the sign-in button, you consent to its use. Storing information on your device and reading information from it is based on your consent under reg. 6 PECR with Sch. A1 para. 2. The further processing of your personal data is based on your consent under Art. 6(1)(a) GDPR. Your consent is voluntary. You can withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR). You can withdraw your consent by removing the connection to our website in your account with the provider or by contacting us.
Recipients
The provider receives personal data and processes it as an independent controller (Art. 4(7) GDPR). The provider decides for itself on the purposes and means of this processing.
Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025, USA (third country)
You can find more information on how the provider processes personal data in the provider's privacy policy: www.facebook.com/privacy/policy
Transfers to third countries
Personal data is transferred to these countries outside the European Economic Area (EEA): United States. The transfer is not covered by an adequacy decision of the European Commission (Art. 45 GDPR). The transfer is protected by the standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR; Implementing Decision (EU) 2021/914). Where necessary, the clauses are supplemented by additional technical, organisational or contractual measures. You can request a copy of the clauses using the contact details in this privacy policy. The standard text of the clauses is published at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj.
Storage and retention
The data collected by this service is stored by the provider and also in our own systems. We keep the data in our own systems only as long as we need it for the purposes described above, or as long as statutory retention obligations require. We then delete or anonymise the data. Retention period: Until your Holidu account is deleted.
Google Maps
We use the service "Google Maps" on our websites. The service is provided by Google Ireland Limited (the provider). The address of the provider is Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland.
The provider belongs to a group of companies. The parent company of the group is Google LLC, which is based outside the European Economic Area (EEA). The address of the parent company is 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
The service enables us to show on a map where a holiday home or a destination is and what is nearby, using maps that load from Google's servers. For this, Google receives the visitor's IP address, browser data and the map area shown.
Map display
Data processed
Technical usage data
IP address
Map viewport
Device and connection data
Browser metadata
Legal basis
We only load this service after you click the button that shows it (for example “Show map”). By clicking the button, you consent to its use. Storing information on your device and reading information from it is based on your consent under reg. 6 PECR with Sch. A1 para. 2. The further processing of your personal data is based on your consent under Art. 6(1)(a) GDPR. Your consent is voluntary. You can withdraw your consent at any time with effect for the future by contacting us using the contact details in this privacy policy. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR).
Recipients
The provider receives personal data and processes it as an independent controller (Art. 4(7) GDPR). The provider decides for itself on the purposes and means of this processing.
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland (EU/EEA)
Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (third country)
You can find more information on how the provider processes personal data in the provider's privacy policy: policies.google.com/privacy
Transfers to third countries
Personal data is transferred to these countries outside the European Economic Area (EEA): United States. The recipient in the United States is certified under the EU-U.S. Data Privacy Framework (DPF). The certified recipient is Google LLC, which is based in the United States. By its adequacy decision of 10 July 2023, the European Commission decided that the United States ensures an adequate level of protection for personal data transferred to certified companies (Implementing Decision (EU) 2023/1795). The transfer is therefore based on this adequacy decision (Art. 45(1) GDPR). You can check the certification in the official DPF list: https://www.dataprivacyframework.gov/s/participant-search.
Storage and retention
We do not store the data collected by this service in our own systems. The data is stored by the provider. Retention period: Google decides as an independent controller: kept until no longer needed for its purpose, or longer for limited purposes such as security or legal duties; deletion takes about 2 months, backups up to 6 months.
Google Sign-In
We use the service "Google Sign-In" on our websites. The service is provided by Google Ireland Limited (the provider). The address of the provider is Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland.
The provider belongs to a group of companies. The parent company of the group is Google LLC, which is based outside the European Economic Area (EEA). The address of the parent company is 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
The service enables us to let you sign in to or register your Holidu account with your Google account instead of a separate password. On our website for guests, Google's sign-in prompt (One Tap) is loaded from Google's servers and may appear without you clicking anything; you can also choose Google when you sign in and are then redirected to Google. When you sign in, Google passes us your Google account ID, your name, your email address, whether Google has verified that address, a link to your profile picture and, for a Google Workspace account, its domain. We store your name, your email address and the connection to your Google account in your Holidu account. A cookie stores whether you closed the prompt, so that it is not shown again straight away. Signing in this way is your choice; you can always register with your email address and a password instead.
Authentication
Data processed
User-related data
Google account ID
Name
Email address
Profile picture
Device and connection data
IP address
Browser metadata
Technical usage data
Page URL
The service stores information on your device or reads information from your device. It does this, for example, with cookies, pixels, local storage or SDKs. You can find each cookie and similar technology, and how long it is stored, in the table below.
Legal basis
We only use this service if you choose to sign in with it. By clicking the sign-in button, you consent to its use. Storing information on your device and reading information from it is based on your consent under reg. 6 PECR with Sch. A1 para. 2. The further processing of your personal data is based on your consent under Art. 6(1)(a) GDPR. Your consent is voluntary. You can withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR). You can withdraw your consent by removing the connection to our website in your account with the provider or by contacting us.
Recipients
The provider receives personal data and processes it as an independent controller (Art. 4(7) GDPR). The provider decides for itself on the purposes and means of this processing.
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland (EU/EEA)
Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (third country)
You can find more information on how the provider processes personal data in the provider's privacy policy: policies.google.com/privacy
Transfers to third countries
Personal data is transferred to these countries outside the European Economic Area (EEA): United States. The recipient in the United States is certified under the EU-U.S. Data Privacy Framework (DPF). The certified recipient is Google LLC, which is based in the United States. By its adequacy decision of 10 July 2023, the European Commission decided that the United States ensures an adequate level of protection for personal data transferred to certified companies (Implementing Decision (EU) 2023/1795). The transfer is therefore based on this adequacy decision (Art. 45(1) GDPR). You can check the certification in the official DPF list: https://www.dataprivacyframework.gov/s/participant-search.
Storage and retention
The data collected by this service is stored by the provider and also in our own systems. We keep the data in our own systems only as long as we need it for the purposes described above, or as long as statutory retention obligations require. We then delete or anonymise the data. Retention period: Your name, email address and the connection to your Google account: until your Holidu account is deleted. g_state cookie: 180 days.
Cookies
Retention
Description
g_state
180 days
Remembers if you closed Google's sign-in prompt, so it stays hidden for a while.
Microsoft Sign-In
We use the service "Microsoft Sign-In" on our websites. The service is provided by Microsoft Ireland Operations Limited (the provider). The address of the provider is One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland.
The provider belongs to a group of companies. The parent company of the group is Microsoft Corporation, which is based outside the European Economic Area (EEA). The address of the parent company is One Microsoft Way, Redmond, Washington 98052, USA.
The service enables us to let you sign in to or register your Holidu account with your Microsoft account instead of a separate password. For this, you are redirected to Microsoft to sign in. Microsoft then passes us an identifier of your Microsoft account, your first and last name and your email address or, if the account has none, its sign-in name. We store these details in your Holidu account.
Authentication
Data processed
User-related data
Microsoft account ID
Name
Email address
Legal basis
We only use this service if you choose to sign in with it. By clicking the sign-in button, you consent to its use. Storing information on your device and reading information from it is based on your consent under reg. 6 PECR with Sch. A1 para. 2. The further processing of your personal data is based on your consent under Art. 6(1)(a) GDPR. Your consent is voluntary. You can withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR). You can withdraw your consent by removing the connection to our website in your account with the provider or by contacting us.
Recipients
The provider receives personal data and processes it as an independent controller (Art. 4(7) GDPR). The provider decides for itself on the purposes and means of this processing.
Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland (EU/EEA)
Microsoft Corporation, One Microsoft Way, Redmond, Washington 98052, USA (third country)
Personal data is transferred to these countries outside the European Economic Area (EEA): United States. The transfer is not covered by an adequacy decision of the European Commission (Art. 45 GDPR). The transfer is protected by the standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR; Implementing Decision (EU) 2021/914). Where necessary, the clauses are supplemented by additional technical, organisational or contractual measures. You can request a copy of the clauses using the contact details in this privacy policy. The standard text of the clauses is published at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj.
Storage and retention
The data collected by this service is stored by the provider and also in our own systems. We keep the data in our own systems only as long as we need it for the purposes described above, or as long as statutory retention obligations require. We then delete or anonymise the data. Retention period: Until your Holidu account is deleted.
Sentry
We use the service Sentry (Sentry, 1501 Mariposa St #408, San Francisco, CA 94107, USA) to ensure and improve the technical stability of our service.
Sentry enables us to detect errors in our application that have led to a malfunction or crash. Sentry uses cookies for this purpose, which transmit technical data such as browser data and the calling IP address in anonymised form to Sentry in the event of an error. Sentry will use this information on our behalf to evaluate your usage, identify the source of the error and thus enable us to fix the error and optimise our application. The legal basis is our legitimate interest according to Art. 6 para. 1 S. 1 lit. f GDPR to the technical stability of our website. Sentry stores this data for as long as necessary for error analysis, but for a maximum of 90 days.
As a transfer of personal data by Sentry to affiliated companies and sub-service providers in countries outside the EU and the EEA is possible, further protection mechanisms are required to ensure the level of data protection of the GDPR. For the U.S., there is an adequacy decision of the EU Commission pursuant to Art. 45 para. 1 of the GDPR with respect to companies certified under the EU-U.S. Data Privacy Framework. Sentry.io is certified according to the EU-U.S. Data Privacy Framework and is therefore committed to compliance with adequate data protection standards, which can be viewed at the following link: https://www.dataprivacyframework.gov/s/participant-search
For potential transfers to other third countries outside the EU and the EEA for which there is no EU Commission adequacy decision, we have also agreed standard data protection clauses with the provider in accordance with Art. 46 para. 2 lit. c GDPR. These oblige the recipient of the data in the third country to process the data in accordance with the level of protection in Europe.
For further information on the use of your data by the providers and your rights and settings options in this regard, please refer to Sentry's privacy policy:
This website uses DoubleClick from the Google Marketing Platform, a service of Google Ireland Limited, Google Building Gordon House, Barrow St, Dublin 4, Ireland ("Google").
DoubleClick uses cookies to present you with ads that are relevant to you. A pseudonymous identification number (ID) is assigned to your browser or device in order to check which ads have been displayed in your browser and which ads have been viewed. This can improve campaign performance or, for example, prevent you from seeing the same ad more than once. In addition, Google can use cookie IDs to record so-called conversions that are related to ad requests. This is the case, for example, when a user sees a Campaign Manager ad and later visits the advertiser's website with the same browser and makes a purchase. According to Google, the cookies do not contain any personal information. If you have given us your consent, the processing of the data is based on Art. 6 para. 1 lit. a GDPR.
Due to the technology used, your browser automatically establishes a direct connection with Google's server. We have no influence on the scope and further use of the data collected by Google through the use of this tool and therefore inform you according to our state of knowledge: Through the integration of DoubleClick, Google receives the information that you have called up the corresponding part of our website or that you have sent a request or that you have clicked on an advertisement from us. If you are registered with a Google service, Google can assign the visit to your account. Even if you are not registered with Google or have not logged in, it is possible that the provider will find out and store your IP address.
Since a transfer of personal data by Google to affiliated companies and sub-service providers in countries outside the EU and the EEA is possible, further protection mechanisms are required to ensure the level of data protection of the GDPR. For the USA, there is an adequacy decision of the EU Commission pursuant to Art. 45 para. 1 of the GDPR in relation to companies with certification under the EU-U.S. Data Privacy Framework. Google LLC is certified under the EU-U.S. Data Privacy Framework and is therefore committed to compliance with adequate data protection standards, which can be viewed at the following link: https://www.dataprivacyframework.gov/s/participant-search
For potential transfers to other third countries outside the EU and the EEA for which there is no EU Commission adequacy decision, we have also agreed standard data protection clauses with the provider in accordance with Art. 46 para. 2 lit. c GDPR. These oblige the recipient of the data in the third country to process the data in accordance with the level of protection in Europe.
The web analysis and optimisation service "Google Optimize" is used on our website (hereinafter "Google Optimize"). The operating company of the Google Optimize services is Google Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Insofar as you have given your consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR, we use the Google Optimize service to increase the attractiveness, content and functionality of our website by playing new functions and content to a percentage of our users and statistically evaluating the change in usage (so-called A/B testing). Google Optimize is a sub-service of Google Analytics (see section Google Analytics).
Google Optimize uses cookies to optimise and analyse your use of our website.
We use Google Optimize with IP anonymisation activated so that your IP address is shortened beforehand by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Google will use this information for the purpose of evaluating your use of our website, compiling reports on optimisation tests and related website activity and providing other services relating to website activity and internet usage to us.
We have concluded an order processing contract with the service provider in which we oblige them to protect our customers' data and not to pass it on to third parties.
Since a transfer of personal data by Google to affiliated companies and sub-service providers in countries outside the EU and the EEA is possible, further protection mechanisms are required to ensure the level of data protection of the GDPR. For the USA, there is an adequacy decision of the EU Commission pursuant to Art. 45 para. 1 of the GDPR in relation to companies with certification under the EU-U.S. Data Privacy Framework. Google LLC is certified under the EU-U.S. Data Privacy Framework and is therefore committed to compliance with adequate data protection standards, which can be viewed at the following link: https://www.dataprivacyframework.gov/s/participant-search
For potential transfers to other third countries outside the EU and the EEA for which there is no EU Commission adequacy decision, we have also agreed standard data protection clauses with the provider in accordance with Art. 46 para. 2 lit. c GDPR. These oblige the recipient of the data in the third country to process the data in accordance with the level of protection in Europe.
The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. Deletion of user and event level data linked to cookies, user identifiers (e.g. User ID) and advertising IDs (e.g. DoubleClick cookies, Android advertising ID, IDFA [Apple identifier for advertisers]) takes place no later than 2 months after their collection.
You can prevent the storage of cookies by setting your internet browser accordingly. In addition, you can prevent the collection of the data generated by the cookie and related to your use of our website (incl. your IP address) to Google as well as the processing of this data by Google by downloading and installing the browser plugin available under the following link: https://tools.google.com/dlpage/gaoptout?hl=en. For more information on data collection and processing by Google, please refer to Google's privacy policy, which can be accessed at http://www.google.com/policies/privacy.
Google Fonts
We use "Google Fonts" on our website, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter referred to as: "Google"). Google Fonts enables us to use external fonts. For this purpose, the required Google Fonts are loaded into your browser cache by your web browser when you access our website. This is necessary so that your browser can also display a visually improved representation of our texts. If your browser does not support this function, a standard font will be used by your computer for display. The integration of these Google Fonts takes place via a server call, usually a Google server in the USA. This transmits to the server which page of our website you have visited. The IP address of the browser of the visitor's terminal device is also stored by Google.
We use Google Fonts for optimization purposes, in particular to improve the use of our website for you and to make its design more user-friendly. The processing is carried out in accordance with Art. 6 para. 1 lit. a GDPR on the basis of your consent. This consent can be revoked at any time with effect for the future.
Since a transfer of personal data by Google to affiliated companies and sub-service providers in countries outside the EU and the EEA is possible, further protection mechanisms are required to ensure the level of data protection of the GDPR. For the USA, there is an adequacy decision of the EU Commission pursuant to Art. 45 para. 1 of the GDPR in relation to companies with certification under the EU-U.S. Data Privacy Framework. Google LLC is certified under the EU-U.S. Data Privacy Framework and is therefore committed to compliance with adequate data protection standards, which can be viewed at the following link: https://www.dataprivacyframework.gov/s/participant-search
For potential transfers to other third countries outside the EU and the EEA for which there is no EU Commission adequacy decision, we have also agreed standard data protection clauses with the provider in accordance with Art. 46 para. 2 lit. c GDPR. These oblige the recipient of the data in the third country to process the data in accordance with the level of protection in Europe.
Further information on data protection can be found in Google's privacy policy:
Our homepage uses the online map service provider Google Maps via an interface. This allows us to show you interactive maps directly on the website and enables you to use the map function conveniently. The provider of the map service is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. To use the functionalities of Google Maps, it is necessary to save your IP address.
Google uses cookies to collect information about user behaviour. The legal basis for the processing of your personal data is your consent in accordance with Art. 6 Para. 1 lit. a GDPR, reg. 6 PECR with Sch. A1 para. 2.
Since a transfer of personal data by Google to affiliated companies and sub-service providers in countries outside the EU and the EEA is possible, further protection mechanisms are required to ensure the level of data protection of the GDPR. For the USA, there is an adequacy decision of the EU Commission pursuant to Art. 45 para. 1 of the GDPR in relation to companies with certification under the EU-U.S. Data Privacy Framework. Google LLC is certified under the EU-U.S. Data Privacy Framework and is therefore committed to compliance with adequate data protection standards, which can be viewed at the following link: https://www.dataprivacyframework.gov/s/participant-search
For potential transfers to other third countries outside the EU and the EEA for which there is no EU Commission adequacy decision, we have also agreed standard data protection clauses with the provider in accordance with Art. 46 para. 2 lit. c GDPR. These oblige the recipient of the data in the third country to process the data in accordance with the level of protection in Europe.
For more information on the handling of user data, please refer to Google's privacy policy:
This website uses the Google Tag Manager of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). This service allows website tags to be managed via an interface. The Google Tag Manager only implements tags. This means that no cookies are used and only the user's IP address is transmitted to Google to establish the connection. The Google Tag Manager triggers other tags, which in turn may collect data. However, the Google Tag Manager does not access this data. If a deactivation has been made at domain or cookie level, it remains in place for all tracking tags, insofar as these are implemented with the Google Tag Manager.
We use the Google Tag Manager on the basis of your consent pursuant to Art. 6 para. 1 lit. a GDPR.
Since a transfer of personal data by Google to affiliated companies and sub-service providers in countries outside the EU and the EEA is possible, further protection mechanisms are required to ensure the level of data protection of the GDPR. For the USA, there is an adequacy decision of the EU Commission pursuant to Art. 45 para. 1 of the GDPR with regard to companies with certification under the EU-U.S. Data Privacy Framework. Google LLC is certified under the EU-U.S. Data Privacy Framework and is therefore committed to compliance with adequate data protection standards, which can be viewed at the following link: https://www.dataprivacyframework.gov/s/participant-search
For potential transfers to other third countries outside the EU and the EEA for which there is no EU Commission adequacy decision, we have also agreed standard data protection clauses with the provider in accordance with Art. 46 para. 2 lit. c GDPR. These oblige the recipient of the data in the third country to process the data in accordance with the level of protection in Europe.
Fullstory
On our website, we use the web analysis service "Fullstory" from the provider FullStory Inc, 1745 Peachtree St NE, Atlanta, GA, USA.
Through Fullstory, we aim to track the user behaviour of our website visitors by tracking and recording visitor sessions on the website. The recordings help us to improve our website presence. As far as possible, we try not to record any personal data, but only anonymised movements. However, it cannot be ruled out that Fullstory occasionally processes personal data provided by you within forms on our website. These are used solely for the purpose of tracking movements such as clicks or calls on the website. Processing for other purposes does not take place.
We use Fullstory based on your consent in accordance with Art. 6 para. 1 lit. a) GDPR. This can be revoked at any time via the cookie settings.
Since a transfer of personal data to the USA may take place, further protection mechanisms are required to ensure the level of data protection of the GDPR. To ensure this, we have agreed standard data protection clauses with the provider in accordance with Art. 46 para. 2 lit. c GDPR. These oblige the recipient of the data in the USA to process the data in accordance with the level of protection in Europe. In cases where this cannot be ensured even through this contractual extension, we endeavour to obtain additional regulations and commitments from the recipient in the USA.
Our website uses the Hotjar web analytics service provided by Hotjar Ltd, Level 2, St Julians Business Centre, 3, Elia Zammit Street, St Julians STJ 1000, Malta, Europe ("Hotjar").
Using Hotjar 's technology, we get a better understanding of our users' experiences (e.g. how much time users spend on which pages, which links they click on, etc.). This helps us to tailor our offering to our users' feedback. Hotjar uses cookies and other technologies to collect information about the behaviour of our users and their devices, in particular the IP address of the device (only collected and stored anonymously during your use of the website), screen size, device type (unique device identifiers), information about the browser used, location (country only), preferred language for viewing our website. Hotjar stores this information on our behalf in a pseudonymised user profile.
We take special care to protect your personal data when using this tool. For example, we can only track which buttons are clicked, mouse history, how far is scrolled, device screen size, device type and browser information, geographic location (country only) and preferred language used to display our website. Areas of the websites that display personally identifiable information about you or third parties are automatically hidden by Hotjar and are therefore not trackable at any time. The use of Hotjar and the associated processing of personal data takes place on the basis of your consent pursuant to Art. 6 para. 1 lit. a GDPR.
Hotjar generally stores customer data in the European Union. However, there may also be a transfer of personal data to third countries outside the EU and the EEA. In these cases, the adoption of further protective mechanisms is necessary to ensure the level of data protection in accordance with the requirements of the GDPR. To ensure this, we have agreed standard data protection clauses with the provider in accordance with Art. 46 para. 2 lit. c GDPR. These oblige the recipient in the third country to process the data in accordance with the level of protection in the EU.
Hotjar offers every user the option of using a "Do Not Track header" to prevent the use of the Hotjar tool so that no data is recorded about the visit to the respective website. This is a setting that is supported by all common browsers in current versions. To do this, your browser sends a request to Hotjar with the information to deactivate the tracking of the respective user. If you use our websites with different browsers/computers, you must set up the "Do Not Track header" separately for each of these browsers/computers. You can prevent the use of Hotjar by going to the opt-out page https://www.hotjar.com/policies/do-not-track/ and clicking "Disable Hotjar".
Videos from "Vimeo" are embedded on this website. "Vimeo" is operated by Vimeo.com Inc., 330 West 34th Street, 5th Floor, New York, New York 10001, USA.
If you have given us your consent to do so, the processing is carried out for the optimal marketing of our offer in accordance with Art. 6 para. 1 p. 1 lit. a GDPR.
The Google Analytics tracking tool is automatically integrated into videos from "Vimeo" that are embedded on our website. We have no influence on the tracking settings and the analysis results collected via this and cannot view them. In addition, web beacons are set for website visitors via the embedding of "Vimeo videos".
To prevent the setting of Google Analytics tracking cookies, you can prevent the storage of cookies by selecting the appropriate settings on your browser software; however, please note that if you do this, you may not be able to use the full functionality of this website.
You can also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) by Google and the processing of this data by Google by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=en
Since a transfer of personal data to the USA takes place, further protection mechanisms are required to ensure the level of data protection of the GDPR. To ensure this, we have agreed standard data protection clauses with the provider in accordance with Art. 46 para. 2 lit. c GDPR. These oblige the recipient of the data in the USA to process the data in accordance with the level of protection in Europe. In cases where this cannot be ensured even through this contractual extension, we endeavour to obtain additional regulations and commitments from the recipient in the USA.
For the purpose and scope of the data collection and the further processing and use of the data by the providers, as well as your rights in this respect and setting options for protecting your privacy, please refer to the data protection information of "Vimeo": https://vimeo.com/privacy
Adyen
On our website, we offer you the option to complete your payment via Sofortüberweisung (Klarna) and PayPal. To do this, we work together with the payment service provider Adyen N.V. (hereinafter "Adyen"), Simon Carmiggeltstraat 6-50, 1011 DJ, Amsterdam, the Netherlands. Adyen is a payment service provider that handles the processing of payments for us.
Depending on the type of payment you have chosen, the data required for the type of payment will be transmitted to Adyen, unless this data is collected directly from the payment service. This is the following data:
First and last name
Address
Payment data
Invoice amount
Transaction data
Information about your order
This is necessary to verify your identity and process the payment. The legal basis for the processing of your personal data is Art. 6 para. 1 lit. b GDPR, the necessity of the payment for the conclusion of a contract with us, as well as Art. 6 para. 1 lit f GDPR, our legitimate interest in using a payment service provider for the easier administration of payments on our website.
In the context of an identity and credit check based on your data, Adyen and we have a legitimate interest in the transmission of the personal data of the user concerned. Adyen and we require this in order to obtain information from credit agencies for the purpose of the identity and credit check (Art. 6 para. 1 sentence 1 lit. f) GDPR). We delete the data accruing in this context after the storage is no longer necessary or restrict the processing if there are statutory retention obligations.
You have the right to object on grounds relating to your particular situation, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or where the processing is necessary for the establishment, exercise or defence of legal claims (Art. 21para. 1 GDPR). However, Adyen remains entitled to process and transmit customer data if this is necessary for the contractual processing of payments or is required by law or by official or judicial authorities. Contact can be made with Adyen at https://www.adyen.com/contact.
Social networks (Instagram, Facebook, LinkedIn, Google, Github) are only integrated on our website as links to the corresponding services. After clicking on the embedded text/image link, you will be redirected to the page of the respective provider. User information is only transferred to the respective provider after the forwarding. For information on the handling of your personal data when using these websites, please refer to the respective data protection provisions of the providers you use.
Data sharing and recipients
Your personal data will not be transferred to third parties unless
if we have explicitly referred to this in the description of the respective data processing,
if you have given your express consent to this in accordance with Art. 6 Para. 1 S. 1 lit. a GDPR,
the disclosure is necessary in accordance with Art. 6 para. 1 p. 1 lit. f GDPR for the assertion, exercise or defence of legal claims and there is no reason to assume that you have an overriding interest worthy of protection in the non-disclosure of your data,
in the event that a legal obligation exists for the disclosure pursuant to Art. 6 para. 1 sentence 1 lit. c GDPR and
insofar as this is necessary for the processing of contractual relationships with you in accordance with Art. 6 para. 1 p. 1 lit. b GDPR.
In addition, we use external service providers for the processing of our services, which we have carefully selected, commissioned in writing and with whom we have concluded order processing agreements in accordance with Article 28 of the GDPR, if necessary. These are bound by our instructions and are regularly monitored by us. These are, among others, service providers for hosting, sending e-mails as well as maintenance and care of our IT systems, etc. The service providers will not pass this data on to third parties.
Data security
We take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk in accordance with Article 32 of the GDPR, taking into account state-of-the-art technology, the costs of implementation and the nature, scope, circumstances and purposes of the processing, as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons. This website uses SSL encryption for security reasons and to protect the transmission of confidential content.
Duration of the storage of personal data
The duration of the storage of personal data is determined by the relevant statutory retention periods (e.g. from commercial law and tax law). After expiry of the respective period, the corresponding data is routinely deleted. If data is required to fulfil or initiate a contract or if we have a legitimate interest in continuing to store it, the data will be deleted when it is no longer required for these purposes or you have exercised your right of revocation or objection.
Your rights
Below you will find information on which data subject rights the applicable data protection law grants you vis-à-vis the controller with regard to the processing of your personal data:
The right to request information about your personal data processed by us in accordance with Art. 15 GDPR. In particular, you can request information about the processing purposes, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right of complaint, the origin of your data if it has not been collected by us, as well as the existence of automated decision-making, including profiling, and, if applicable, meaningful information about its details.
The right to request the correction of inaccurate or incomplete personal data stored by us without delay in accordance with Art. 16 GDPR.
The right to request the erasure of your personal data stored by us in accordance with Art. 17 GDPR, unless the processing is necessary for the exercise of the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of legal claims.
The right to request the restriction of the processing of your personal data in accordance with Art. 18 GDPR, insofar as the accuracy of the data is disputed by you, the processing is unlawful, but you object to its erasure and we no longer require the data, but you need it for the assertion, exercise or defence of legal claims or you have objected to the processing in accordance with Art. 21 GDPR.
The right, in accordance with Art. 20 GDPR, to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format or to request that it be transferred to another controller.
The right to complain to a supervisory authority in accordance with Art. 77 GDPR. As a rule, you can contact the supervisory authority of the federal state of our registered office stated above or, if applicable, that of your usual place of residence or workplace.
Supervisory authority: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
The right to revoke consent given in accordance with Art. 7 para. 3 GDPR: You have the right to revoke consent to the processing of data once given at any time with effect for the future. In the event of revocation, we will immediately delete the data concerned unless further processing can be based on a legal basis for processing without consent. The revocation of the consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.
Right of objection
Insofar as your personal data is processed by us on the basis of legitimate interests pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR, you have the right to object to the processing of your personal data pursuant to Art. 21 GDPR, insofar as this is done for reasons arising from your particular situation. Insofar as the objection is directed against the processing of personal data for the purpose of direct marketing, you have a general right of objection without the requirement to specify a particular situation
If you wish to exercise your right of revocation or objection, simply send an e-mail to support@holidu.com .
Legal obligations
The provision of personal data for the decision on the conclusion of a contract, the fulfilment of a contract or for the implementation of pre-contractual measures is voluntary. However, we can only make the decision in the context of contractual measures if you provide such personal data that is required for the conclusion of the contract, the performance of the contract or pre-contractual measures.
Automated decision making
No automated decision-making within the meaning of Art. 22 GDPR takes place, that is, no decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you. Where you have consented to marketing cookies, your use of our websites is analysed in order to show you relevant advertising; this is described in the section "Cookies".
Additional information for customers, interested parties, hosts and business partners
Purposes and legal bases of the processing of customer, prospective customer and business partner data
We process your personal data in accordance with the provisions of the European Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG), insofar as this is necessary for the establishment, implementation or fulfillment of a contract or for the implementation of pre-contractual measures. Insofar as personal data is required for the initiation or implementation of a contractual relationship or in the context of the implementation of pre-contractual measures, processing is lawful pursuant to Art. 6 para. 1 lit. b GDPR.
If you give us express consent to process personal data for certain purposes (e.g. forwarding to third parties, evaluation for marketing purposes or advertising by e-mail), the lawfulness of this processing is given on the basis of your consent in accordance with Art. 6 para. 1 lit. a GDPR. Consent given can be revoked at any time with effect for the future (see section 9 of this data protection information).
If necessary and legally permissible, we process your data beyond the actual contractual purposes for the fulfillment of legal obligations pursuant to Art. 6 para. 1 lit. c GDPR. In addition, processing may be carried out to protect the legitimate interests of us or third parties and to defend and assert legal claims in accordance with Art. 6 para. 1 f GDPR. If necessary, we will inform you separately, stating the legitimate interest, insofar as this is required by law.
Categories of data processed
We only process data that is related to the establishment of the contract or the pre-contractual measures. This can be general data about you or persons in your company (name, address, contact details, etc.) as well as any other data that you provide to us in the course of establishing the contract.
Data sources
We process personal data that we receive from you in the course of contacting you or establishing a contractual relationship or in the course of pre-contractual measures or that you provide via our website or forms. In some cases, we also process data from publicly accessible sources.
Recipient of the data
We only pass on your personal data within our company to those areas and persons who need this data to fulfil contractual and legal obligations or to implement our legitimate interest.
We may transfer your personal data to our affiliates to the extent permitted by the purposes and legal bases set out in section 3 of this privacy notice.
Your personal data is processed on our behalf on the basis of order processing contracts in accordance with Art. 28 GDPR. In these cases, we ensure that the processing of personal data is carried out in accordance with the provisions of the GDPR. The categories of recipients in this case are CRM system providers, telephony providers, newsletter dispatch service providers and check-in solutions for querying guest data.
Otherwise, data is only forwarded to recipients outside the company if this is permitted or required by law, if the forwarding is necessary for the processing and thus the fulfilment of the contract or, at your request, for the implementation of pre-contractual measures, if we have your consent or if we are authorised to provide information. Under these conditions, recipients of personal data can be, for example:
External tax consultant
Public bodies and institutions (e.g. public prosecutor's office, police, supervisory authorities, tax office) if there is a legal or official obligation,
Recipients to whom the disclosure is directly necessary to establish or fulfil the contract, such as partners.
Transfer to a third country
A transfer to a third country is not intended. If one of our processors is located in a third country, we ensure that either an adequacy decision of the European Commission is in place or, in the case of transfers pursuant to Art. 46 et seq. appropriate safeguards such as standard contractual clauses are in place to ensure an essentially equivalent level of protection for your personal data.
Duration of data storage of customer, prospect and business partner data
As far as necessary, we process and store your personal data for the duration of our business relationship or for the fulfilment of contractual purposes. This also includes, among other things, the initiation and execution of a contract.
In addition, we are subject to various storage and documentation obligations, which result, among other things, from the German Commercial Code (HGB) and the German Fiscal Code (AO). The periods prescribed there for storage and documentation are two to ten years.
Finally, the storage period also depends on the statutory limitation periods, which, for example, according to §§ 195 et seq. of the German Civil Code (BGB), are usually three years, but in certain cases can be up to thirty years.
Your rights as a customer, interested party or business partner
You have a number of data protection rights that you can assert against us. You can find a detailed list in the section "Your rights" above in this data protection declaration.
Necessity of the provision of personal data
The provision of personal data for the decision on the conclusion of a contract, the fulfilment of a contract or for the implementation of pre-contractual measures is voluntary. However, we can only make a decision within the framework of contractual measures if you provide such personal data that is required for the conclusion of the contract, the fulfilment of the contract or pre-contractual measures.
Automated decision-making in connection with customer, prospect and business partner data
For the establishment, fulfilment or implementation of the business relationship as well as for pre-contractual measures, we generally do not use fully automated decision-making pursuant to Art. 22 GDPR. Should we use these procedures in individual cases, we will inform you about this separately or obtain your consent if this is required by law.
Property Management Platform
With your user account as a host, you are given the opportunity to use our property management platform.
When you make full use of our property management platform, the following data will be processed in addition to the data you provided during registration:
Holiday home data (e.g. address, equipment, object pictures)
Invoice address
Bank details
VAT number
The legal basis for data processing is Art. 6 para. 1 lit. a GDPR in the case of consent or Art. 6 para. 1 lit. b GDPR if processing is necessary to provide the requested services. Your data will be deleted as soon as the user account is deleted and insofar as no legal retention obligations exist.
Existing customer advertising
We reserve the right to process the e-mail address provided by you within the scope of the booking in accordance with the statutory provisions in order to send you the following content, among other things, by e-mail during or following the processing of the contract, provided that you have not already objected to this processing of your e-mail address:
other interesting offers from our portfolio,
Overview of possible leisure activities.
The legal basis for the processing is Art. 6 para. 1 p. 1 lit. f) GDPR. We carry out the aforementioned processing for customer care and to increase our services. We delete your data when you terminate the newsletter subscription, but no later than two years after termination of the contract.
We would like to point out that you can object to receiving direct advertising at any time without incurring any costs other than the transmission costs according to the basic rates. You have a general right to object without giving reasons (Art. 21 para. 2 GDPR). To do so, click on the unsubscribe link in the newsletter or send us your objection to the contact details listed in the "Person responsible" section.
Trustpilot
We use the review portal Trustpilot (Trustpilot A/S, Trommesalen 5, 3rd sal, 1614 Copenhagen, Denmark) to publish reviews from our customers.
A user profile on Trustpilot is required to submit a rating or to record customer feedback. In addition to a rating for the inviting company, ratings for other companies can then also be recorded on the Trustpilot rating portal. If you voluntarily wish to leave a rating on Trustpilot, we will pass on your e-mail address, first name and an internal booking number to Trustpilot. Your rating will be published on the website of Trustpilot and possible partners in accordance with their own guidelines. The legal basis for the processing of your rating is Art. 6 para. 1 lit. a) GDPR, your consent.
We reserve the right to adapt or update this data protection declaration if necessary in compliance with the applicable data protection regulations. In this way, we can adapt it to the current legal requirements and take into account changes to our services, e.g. when introducing new services. The current version applies to your visit.