Privacy Policy

1. Privacy at a glance

General information

The following notes provide an overview of what happens to your personal data when you visit our website or book accommodation with us. Personal data is any data that can be used to identify you personally.

Data collection on this website

Who is responsible for the data collection on this website?
The controller is AS Operations GmbH. The contact details are provided in section 3 of this policy.

How do we collect your data?
Some of your data is collected when you provide it to us – for example via our contact form, a booking request or by email. Other data is collected automatically by our IT systems when you visit the website, primarily technical data (e.g. browser, operating system, time of access).

What do we use your data for?
Part of the data is collected to ensure that the website is provided without errors. Other data is used to process your booking, communicate with you and meet legal obligations.

What rights do you have regarding your data?
You have the right to receive information about the origin, recipients and purpose of your stored personal data free of charge at any time. You also have the right to have this data corrected or deleted and – where consent has been given – to withdraw it at any time with effect for the future. Under certain circumstances, you also have the right to request the restriction of processing. You also have the right to lodge a complaint with the competent supervisory authority.

2. Hosting

We host our website with an external service provider. The personal data collected on this website is stored on the servers of this provider. This may include in particular IP addresses, contact requests, meta and communication data, contract data, contact details, names and other data generated through a website.

Hosting by Contabo

This website is hosted by Contabo GmbH, Welfenstraße 22, 81541 Munich, Germany. A data processing agreement pursuant to Art. 28 GDPR has been concluded with Contabo. According to this agreement, data centre operations are carried out by the designated sub-processor Contabo France SAS, 2 rue Taunus, 67630 Lauterbourg, France. The server location is therefore within the EU. The processing takes place in order to provide the website securely, stably and efficiently pursuant to Art. 6 para. 1 lit. f GDPR.

Domain registration: IONOS

Our domain alegrastay.com is registered with IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. In this context, IONOS processes technical data to provide the domain. For more information, please see www.ionos.de/terms-gtc/terms-privacy.

3. General notes and mandatory information

Data protection

The operators of this website take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.

Please note that data transmitted via the internet (e.g. via email communication) may be subject to security gaps. Complete protection of data from third-party access is not possible.

Note on the controller

The controller responsible for data processing on this website is:

AS Operations GmbH
Heinrich-Budde-Straße 29
04157 Leipzig
Germany

Represented by Managing Director: Alexander Dornheim
Email: info@alegrastay.com
Commercial register: HRB 44789, Local Court of Leipzig
VAT identification number: DE458886461

Storage period

Unless a more specific storage period is mentioned within this privacy policy, your personal data will remain with us until the purpose for which it was processed no longer applies. In the event of a legitimate request for deletion or the withdrawal of consent, your data will be deleted unless statutory retention periods (e.g. under tax or commercial law) prevent this.

General information on the legal bases for data processing

If you have given consent to the processing of your personal data, we process it on the basis of Art. 6 para. 1 lit. a GDPR. If you have consented to the storage of cookies, processing additionally takes place on the basis of Section 25 (1) TDDDG. Consent can be withdrawn at any time.

If your data is required for the performance of a contract or for pre-contractual measures, we process your data on the basis of Art. 6 para. 1 lit. b GDPR. In order to fulfil legal obligations, we process data on the basis of Art. 6 para. 1 lit. c GDPR. Data processing may also take place on the basis of our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR.

Recipients of personal data

In the course of our business activities, we work with various external parties. We only pass on personal data where this is necessary for the performance of a contract, where we are legally obliged to do so, where there is a legitimate interest in the transfer, or where another legal basis permits it. When using processors, we only transfer personal data on the basis of a valid data processing agreement.

Withdrawal of your consent

Many data processing operations are only possible with your express consent. You can withdraw your consent at any time. The legality of the data processing carried out until the withdrawal remains unaffected by the withdrawal.

Right to object to data collection in special cases (Art. 21 GDPR)

If data processing takes place on the basis of Art. 6 para. 1 lit. e or f GDPR, you have the right to object to the processing of your personal data at any time on grounds relating to your particular situation. If you object, we will no longer process the data concerned unless we can demonstrate compelling legitimate grounds for the processing that override your interests, or unless the processing serves the establishment, exercise or defence of legal claims.

Right to lodge a complaint with the competent supervisory authority

In the event of breaches of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority. As our company is based in Saxony, the competent authority is:

Saxon Commissioner for Data Protection and Transparency
(Sächsische Datenschutz- und Transparenzbeauftragte)
Maternistraße 17, 01067 Dresden, Germany
Postal address: Postfach 11 01 32, 01330 Dresden, Germany
Phone: +49 351 85471-101
Website: www.datenschutz.sachsen.de

Right to data portability

You have the right to receive data that we process automatically on the basis of your consent or in fulfilment of a contract, either yourself or via a third party, in a commonly used, machine-readable format. If you request the direct transfer of the data to another controller, this will only take place where it is technically feasible.

Information, correction and deletion

Within the framework of the applicable legal provisions, you have the right at any time to free information about your stored personal data, its origin and recipients, and the purpose of data processing, as well as, where applicable, the right to correct or delete this data. You can contact us at any time for this purpose and for further questions.

Right to restriction of processing

You have the right to request the restriction of the processing of your personal data, for example if you contest the accuracy of the data, if the processing was unlawful, if we no longer need the data but you require it for the establishment of legal claims, or for as long as an objection pursuant to Art. 21 (1) GDPR has not yet been decided.

SSL/TLS encryption

This site uses SSL or TLS encryption for security reasons and to protect the transmission of confidential content. You can recognise an encrypted connection by the change of the browser address bar from "http://" to "https://" and by the lock symbol in the browser line.

4. Data collection on this website

Cookies

Our internet pages use so-called "cookies". Cookies are small data packages and do not cause any damage to your device. Session cookies are automatically deleted after your visit; permanent cookies remain stored until you or your browser delete them.

Necessary cookies are stored on the basis of Art. 6 para. 1 lit. f GDPR. Where consent has been requested, processing takes place exclusively on this basis (Art. 6 para. 1 lit. a GDPR, Section 25 (1) TDDDG); consent can be withdrawn at any time.

Cookie consent

Our website uses its own cookie consent tool to obtain your consent before non-essential cookies are set. When you visit our website, you are informed about the cookie categories used and can either consent to or refuse storage. Your settings are stored so that this query does not have to be repeated each time you visit. The storage takes place on the basis of Art. 6 para. 1 lit. f GDPR. You can withdraw your consent at any time with effect for the future via "Cookie settings" in the footer.

Google Analytics 4

Provided you have given your consent, this website uses the web analytics service Google Analytics 4. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics is only activated after you have consented via our cookie consent tool; without your consent, no data is transmitted to Google.

Google Analytics uses cookies that enable an analysis of the use of the website. The information generated in this way is transmitted to Google servers and processed there. IP addresses are processed in truncated form.

Processing takes place exclusively on the basis of your consent (Art. 6 para. 1 lit. a GDPR, Section 25 (1) TDDDG). A data processing agreement pursuant to Art. 28 GDPR has been concluded with Google. You can withdraw your consent at any time via the cookie settings. Further information: policies.google.com/privacy

Server log files

The provider of the pages automatically collects and stores information in server log files:

• Browser type and version
• Operating system used
• Referrer URL
• Hostname of the accessing computer
• Time of the server request
• IP address

This data is not merged with other data sources. Legal basis: Art. 6 para. 1 lit. f GDPR.

Contact form

If you send us enquiries via the contact form, your details including the contact data you provide will be stored by us for the purpose of processing the enquiry and in case of follow-up questions. We do not pass on this data without your consent. Legal basis: Art. 6 para. 1 lit. b GDPR (where contract-related), otherwise Art. 6 para. 1 lit. f or lit. a GDPR.

Enquiry by email

If you contact us by email, your enquiry, including all personal data resulting from it, will be stored and processed for the purpose of handling your request.

5. Online booking and payment processing

Booking processing via Smoobu

When you make a booking on our website, the data required for this (name, address, email address, travel dates, number of guests and any further details) is collected and processed via the Smoobu booking platform. Smoobu acts on our behalf on the basis of a data processing agreement pursuant to Art. 28 GDPR. Processing takes place for the purpose of contract execution in accordance with Art. 6 para. 1 lit. b GDPR.

The Smoobu calendar widget is only loaded after you have given your consent via our cookie consent tool or have actively opened the calendar using the “Load calendar” button. The widget displays the availability of the apartments in real time and establishes a connection to Smoobu's servers for this purpose. Without your consent, the widget is not loaded and no data is transmitted to Smoobu.

Payment service: Stripe

The payment service Stripe is integrated on our website. The provider for customers within the EU is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Payment data is transmitted directly to Stripe; we ourselves do not gain knowledge of your full payment data. Legal basis: Art. 6 para. 1 lit. b GDPR. Details: stripe.com/privacy

Payment service: PayPal (in preparation)

If we offer PayPal as an additional payment option in the future, the data required for this will be transmitted to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. Details: paypal.com/de/webapps/mpp/ua/privacy-full

Online check-in and identity verification: Guestway (in preparation)

We plan to introduce the digital check-in and identity verification service Guestway in order to fulfil legal reporting obligations towards the authorities electronically and to verify the identity of guests. The provider is Guestway BV, Soenenspark 1, 9051 Ghent, Belgium (contact for data protection enquiries: gdpr.support@guestway.io).

At the time of this version, the service is not yet in active use. Before activation, this privacy policy will be supplemented with the specific processing details (categories of data processed, legal basis, storage period, status of the data processing agreement pursuant to Art. 28 GDPR).

6. Plug-ins and tools

Interactive map (OpenStreetMap)

On the apartment pages we initially show a static preview image of the location. Only after you click "Load map" is an interactive map of the OpenStreetMap Foundation (OSMF), St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom, embedded.

When the map is loaded, a connection to OSMF servers is established, whereby technically necessary data such as your IP address is transmitted. The OSMF processes this data as an independent controller on the basis of its legitimate interest in the stable operation of its services. The processing takes place partly in the United Kingdom, for which an adequacy decision of the EU Commission dated 28 June 2021 exists. The embedding itself takes place on our side on the basis of Art. 6 para. 1 lit. f GDPR (only after your active click). Details: osmfoundation.org/wiki/Privacy_Policy

In addition, on some pages we link to Google Maps as an external map service. This is a plain link; when you click it, you leave our website. No automatic data transfer to Google takes place as long as you do not click the link. Google is responsible for the data processing that takes place after the click: policies.google.com/privacy

Web fonts

Our website uses fonts hosted locally on our own server. No connection to third-party servers (e.g. Google) is established; when you visit our website, no personal data is therefore transmitted to third parties for the purpose of displaying fonts.

7. Currency of this privacy policy

This privacy policy is currently valid and dated 03 August 2026. As our website and offers continue to develop, or due to changes in legal or regulatory requirements, it may become necessary to amend this privacy policy. The current version can be accessed at any time on the website at alegrastay.com.