Privacy policy

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR):
Kevin Deobald, Hummelhaus Weimar, Marienstraße 8, 99423 Weimar
Phone: +49 3643 499067 · E-mail: kontakt@hummelhaus-weimar.de

2. Visiting the website

When you visit the website, the web server processes technically necessary information (IP address, date and time, page accessed, amount of data transferred, browser and operating system) in server logs. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and stable operation of the site. Transmission is encrypted via TLS.

Fonts and all other components of the site are delivered from our own server. No analytics or advertising services are used, and no third-party content is loaded.

3. Cookies and consent

We only use technically necessary cookies: a session cookie so that forms (booking, contact, customer account login) work securely – it is deleted when you close your browser or when the session expires – and the cookie “einwilligung”, which stores your choice in the cookie notice for six months (content: version, selected categories, timestamp; no identifier for recognising you). The legal basis is Section 25(2) no. 2 TDDDG and Art. 6(1)(f) GDPR.

We do not currently embed content from other providers (for example maps or videos). Should we do so in future, we will only load it after you have given your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR); until then, a placeholder is shown in its place.

You can change or withdraw your choice at any time via the “Cookie settings” link at the bottom of every page.

4. Contact form and e-mail

When you write to us, we process your details (name, e-mail address, phone number, message) in order to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR (pre-contractual enquiry) or Art. 6(1)(f) GDPR. The data are deleted once they are no longer needed to deal with your enquiry and no retention obligations apply.

5. Room booking and customer account

To book a room, we process your contact details and billing address, the rental period and your information about the event (for example number of participants and seating arrangement). With your booking you receive access to a customer account with a booking overview, invoices and messages. The legal basis is Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR (legal obligations, such as tax-related retention). We retain invoice data for up to ten years in accordance with the periods laid down in commercial and tax law.

6. Online payment

If you pay online by card or direct debit, we process the payment via Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland). You enter your payment details directly with Stripe; we only receive confirmation of the payment and the information required for our accounts. The legal basis is Art. 6(1)(b) GDPR. Stripe’s privacy notice also applies: stripe.com/de/privacy.

If you pay with PayPal, we process the payment via PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg). For this purpose we transmit to PayPal the amount, the booking or order number and a short description of the service; you enter your login and payment details directly with PayPal. We only receive confirmation of the payment and the information required for our accounts. The legal basis is Art. 6(1)(b) GDPR. PayPal’s privacy notice also applies: paypal.com/de/legalhub/paypal/privacy-full.

7. Programme and organisers

In our programme we publish courses and events that take place in the house. This includes the contact details the respective organiser has provided for registration (name, e-mail address, phone number or website). Organisers who submit their dates via the customer account decide for themselves which details are shown publicly. The legal basis is Art. 6(1)(b) and (f) GDPR. Registration for an event is handled directly by the organiser, whose privacy notice applies.

8. Your rights

You have the right of access, rectification, erasure, restriction of processing and data portability, as well as the right to object to processing based on Art. 6(1)(f) GDPR. You may also lodge a complaint with a data protection supervisory authority, such as the Thuringian State Commissioner for Data Protection and Freedom of Information (Thüringer Landesbeauftragter für den Datenschutz und die Informationsfreiheit).