Skip to content
Harztraveler

Privacy policy

This English translation is provided for convenience. The German version is legally binding.

We take the protection of your personal data seriously. This policy explains which data we process when you use this website or send us a booking enquiry, why we do so and what rights you have.

1. Who is responsible for your data

Harztraveler is the joint name under which four landlords offer their holiday apartments:

  • Robert Hoffmann (Harztraveler), Bahnhofstraße 14, 38667 Bad Harzburg, Germany
  • Luisa Jordan, Bahnhofstraße 14, 38667 Bad Harzburg, Germany
  • Hoffmann Vermögensverwaltung GmbH, Bahnhofstraße 14, 38667 Bad Harzburg, Germany
  • Robert Hoffmann and Denny Lüttgau (co-ownership Hoffmann/Lüttgau), reachable via Harztraveler, Bahnhofstraße 14, 38667 Bad Harzburg, Germany

Which landlord lets your apartment and is therefore your contractual partner is shown before you send an enquiry or booking through this website and in the confirmation; for other bookings, the contact point will tell you.

For enquiries, bookings and looking after your stays, the landlords jointly use this website, the same booking channels and the same software. They are joint controllers for this (Art. 26 GDPR). The essence of their arrangement:

  • Your contact point for all data protection questions is Harztraveler, Robert Hoffmann, Bahnhofstraße 14, 38667 Bad Harzburg, Germany, email info@harztraveler.de, phone 0173 5976137. He answers your requests for access, rectification, erasure and your other rights on behalf of all landlords.
  • Robert Hoffmann is responsible for this privacy policy and for the security of the shared software, and reports personal data breaches to the supervisory authority. He is also responsible, on behalf of all landlords, for all other information in this privacy policy (purposes, legal bases, recipients, storage periods).
  • Each landlord is solely responsible for their own accounting and taxes, their own payment accounts and for registering their guests with the town. The cameras at all our houses are operated by Robert Hoffmann alone.
  • Booking.com and other booking portals also process your data themselves and are independently responsible for this.
  • You can also exercise your rights with each individual landlord; your request will then be passed on to the contact point.

2. Visiting this website

When you open our pages, your browser automatically transmits technical data to the server: IP address, date and time of the request, the page requested, the referring page, browser type and operating system. We need this data to deliver the website and to keep it secure (Art. 6 (1) (f) GDPR). The server log files are deleted after 14 days at the latest unless a specific incident requires them to be kept longer as evidence.

The website is hosted on our behalf by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, under a data processing agreement (Art. 28 GDPR). Cloudflare may also process data outside the EU, in particular in the USA. This is based on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR), under which Cloudflare is certified; should this certification lapse, the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR), which are already agreed in the contract with Cloudflare, apply.

3. No cookies, no tracking

We do not use cookies, third-party analytics tools, advertising networks or social media plug-ins. Our server only counts how often each page is opened per day, how often each audio story is started and how many enquiries arrive – without IP addresses, cookies or any other identifier, so no visit can be traced back to a person. Fonts are loaded from our own server; no data is sent to Google or other font providers. Links to OpenStreetMap and Google Maps only transfer data to these services when you click them.

4. Search on the Harz map

The search box on the Harz map first works only in your browser: the page recognises topics, places and keywords itself, and your search text does not leave your device. If the page cannot match a search text itself, it sends the text to our server, which forwards it to TypeSafe AI, Inc., San Francisco (USA). Their AI model “Jev” matches it to the topics of the map, for example “with kids” or “adventure”; we label such results “AI-assisted”. TypeSafe only receives the search text, not your IP address or any other details about you. The purpose is to let the search understand freely worded requests; the legal basis is our legitimate interest in a search that understands such requests (Art. 6 (1) (f) GDPR).

TypeSafe processes the data in the USA. The transfer is based on the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR), which form part of TypeSafe's contract terms. According to TypeSafe, it does not train AI models on the inputs and keeps the data for as long as necessary for the purpose of the processing; it does not state a fixed period. Our server keeps the search text and its matching in memory for no more than 24 hours so that identical searches are not sent again, and your IP address for no more than eleven minutes to block mass requests. We do not store or log search texts permanently. Please do not enter personal details in the search box.

If you search for something that is not on our map, the page offers a link “Search Google Maps”. Your search text only goes to Google when you tap this link.

Questions for Papa Casimir

In the “Ask Casimir” window you can ask questions about our apartments, getting here, house rules, prices and free dates, and trips in the Harz. Your question goes to our server and is answered there by an AI language model that our hosting provider Cloudflare runs in its own network (Cloudflare Workers AI). It is sent together with up to three previous questions and answers from the same window, so that Casimir understands follow-up questions, and with our own texts that match the question: descriptions, house rules, information about the area, and prices and free days from our booking calendar. Casimir only answers from these texts; our server checks every answer before you see it, and it is marked “worded with AI”. Cloudflare processes the data on our behalf as a processor, as for hosting (see section 2), and according to Cloudflare does not use it to train AI models or to improve its services. If this does not work, the model “Jev” of TypeSafe AI, Inc. (USA) assigns your question to one of our prepared answers; TypeSafe then only receives the text of the question, as for the search above. Purpose and legal basis are the same as for the search above. Our server keeps the question and the answer in its working memory for at most 24 hours and your IP address for at most eleven minutes; we do not store or log questions permanently. Please do not enter any personal details.

5. Booking enquiries

When you send an enquiry, we process the details you enter: name, email address, phone number, optionally your address, the dates, the number of guests and dogs, the extras chosen, your expected arrival time and your message. We use them to check availability, to answer you and, if you book, to perform the rental contract (Art. 6 (1) (b) GDPR). Your enquiry is stored with Cloudflare (see section 2) and deleted there automatically after six months; any other copies of enquiries that do not lead to a booking are also deleted after six months. Invoices and other accounting records are kept for eight years and business correspondence for six years because the law requires it (Section 147 of the German Fiscal Code, Section 257 of the German Commercial Code, Section 14b of the German VAT Act; Art. 6 (1) (c) GDPR). When you send an enquiry, the server keeps your IP address in memory for no more than eleven minutes to block mass submissions.

6. Contact by email or phone

If you contact us by email or phone, we process your details to handle your request (Art. 6 (1) (b) GDPR or, for general questions, Art. 6 (1) (f) GDPR).

7. Guest registration and tourist tax

The towns' tourist tax statutes require us to collect the details of all guests, collect the tourist tax and report the guests: name, address, date of birth or age, arrival and departure dates and, where applicable, grounds for exemption or reduction. We receive the details of fellow travellers from the person who books or fills in the registration. The report is made through the systems of the town of Bad Harzburg, Wernigerode Tourismus GmbH (for the town of Wernigerode) and Goslar Marketing GmbH (for the town of Goslar). The legal basis is Art. 6 (1) (c) GDPR together with the relevant statute. We keep this data for as long as the statute requires (in Goslar until the end of the calendar year following your stay) and after that only where it must be kept as an accounting record.

8. Registration form

For guests who do not hold German citizenship, we are required as an accommodation business to complete a registration form. Where the town has its own online registration form (currently Wernigerode), you fill it in through the town's registration system (see section 7); we do not need a photo of your ID there. In the other places (currently Bad Harzburg and Vienenburg), you upload a photo of your passport or ID card in the guest area before arrival. From it, we create the registration form containing only the details required by the German Federal Registration Act (Section 30 (2) BMG): dates of arrival and expected departure, surname and first names, date of birth, nationalities, address, the number of foreign fellow travellers and their nationality, and the serial number of your passport or ID card. We only use the photo to create the form and to check the details; after that we delete it immediately. The legal basis is the statutory registration obligation (Art. 6 (1) (c) GDPR together with Sections 29 and 30 of the Federal Registration Act). We keep the registration form for one year after your departure and destroy it within the following three months. Only the landlords and our team have access to it; it is only passed on to authorities where the law requires it.

9. Video surveillance at our houses

The outdoor areas of all our houses are monitored by cameras; a sign at each house points this out. The purpose is to protect the houses, our guests and their property against burglary, theft and damage; the legal basis is our legitimate interest in this (Art. 6 (1) (f) GDPR). The inside of the apartments is not filmed. The recordings are overwritten automatically after 72 hours at the latest unless a specific incident requires them to be kept longer as evidence.

10. Recipients

We only pass on your data where this is necessary: to our hosting provider Cloudflare (see section 2), the search text of the Harz map search to TypeSafe AI, Inc., and as a fallback also your questions for Papa Casimir (see section 4), to our bank or PayPal for payments, to our tax adviser and, where required by law, to the towns of Bad Harzburg, Wernigerode or Goslar and to other authorities (see sections 7 and 8).

11. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Just write to info@harztraveler.de.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is: Der Landesbeauftragte für den Datenschutz Niedersachsen.

Last updated: September 2026