PRIVACY

This English version is provided for convenience. The legally binding version is the German one available at /datenschutz.

We appreciate your interest in STAY MCC Boardinghaus. Data protection is a high priority for us. The STAY MCC website can generally be used without providing any personal data. However, if you wish to use specific services through our website, processing of personal data may become necessary.

1. Data Protection at a Glance

General Information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data with which you can be personally identified. For detailed information on data protection, please refer to the privacy policy listed below this text.

Data Collection on This Website

Who is responsible for data collection?

Data processing on this website is carried out by the website operator. You can find their contact details in the section "Information about the Data Controller" in this privacy policy.

How do we collect your data?

Your data is collected, on the one hand, by you providing it to us — for example via our contact form or by email. Other data is collected automatically or with your consent when you visit the website by our IT systems. This is mainly technical data (e.g. internet browser, operating system, time of page access). Analytics tools are activated only after your explicit consent via the cookie banner.

What rights do you have regarding your data?

You have the right at any time to obtain free information about the origin, recipient and purpose of your stored personal data. You also have the right to request the rectification or erasure of this data. If you have given consent to data processing, you can revoke it at any time with effect for the future. You also have the right, under certain circumstances, to request restriction of the processing of your personal data. Furthermore, you have the right to lodge a complaint with the competent supervisory authority.

2. Hosting

Netlify

This website is hosted by Netlify. The provider is Netlify, Inc., 2325 3rd Street, Suite 296, San Francisco, CA 94107, USA.

When you visit our website, Netlify automatically collects so-called server log files. These contain: IP address, browser type and version, operating system used, referrer URL, hostname of the accessing computer, as well as the date and time of the server request.

Hosting takes place for the purpose of secure, fast and efficient provision of our online offering. The lawful basis is Art. 6(1)(f) GDPR (legitimate interest). Server log files are usually deleted automatically after 30 days.

As Netlify is a US company, data transfers to the USA may occur. Netlify is certified under the EU-US Data Privacy Framework and has concluded the EU Commission's Standard Contractual Clauses. A data processing agreement (DPA) with Netlify is in place; it forms part of Netlify's terms of service as a Data Processing Addendum.

Further information can be found in Netlify's privacy policy: Netlify Privacy Policy (netlify.com)

3. General Information and Mandatory Notices

Data Protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations and this privacy policy. We point out that data transmission over the internet may have security gaps. Complete protection of data against access by third parties is not possible.

Information about the Data Controller

The data controller within the meaning of the General Data Protection Regulation, other data protection laws applicable in EU Member States, and other provisions of a data protection nature is:

Any data subject may contact the named contact person directly at any time with questions or suggestions regarding data protection.

Retention Period

Unless a more specific retention period is mentioned within this privacy policy, your personal data will remain with us until the purpose for processing no longer applies. If you assert a legitimate request for erasure or revoke consent, your data will be deleted unless we have other legally permissible grounds for storage (e.g. tax or commercial retention periods of up to 10 years).

General Information on Lawful Bases

If you have consented to data processing, we process your personal data on the basis of Art. 6(1)(a) GDPR. If your data is necessary for the performance of a contract, we process it on the basis of Art. 6(1)(b) GDPR. For compliance with legal obligations, Art. 6(1)(c) GDPR applies. Processing on the basis of our legitimate interest takes place under Art. 6(1)(f) GDPR. Where the storage of cookies or access to information on your terminal device is concerned, § 25 TDDDG applies in addition.

Revocation of Your Consent to Data Processing

Many data processing operations are only possible with your explicit consent. You can revoke consent already given at any time. The lawfulness of data processing carried out up to revocation remains unaffected. To change your cookie settings, click "Cookie Settings" in the footer.

Right to Object to Data Collection in Special Cases (Art. 21 GDPR)

If data processing takes place on the basis of Art. 6(1)(e) or (f) GDPR, you have the right at any time, on grounds arising from your particular situation, to object to the processing of your personal data; this also applies to profiling based on these provisions. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for processing that override your interests, rights and freedoms, or processing serves the establishment, exercise or defence of legal claims (objection under Art. 21(1) GDPR).

Right to Lodge a Complaint with the Competent Supervisory Authority

In the event of breaches of the GDPR, you have the right to lodge a complaint with a supervisory authority. The competent supervisory authority for North Rhine-Westphalia is:

Right to Data Portability

You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party in a common, machine-readable format.

Information, Rectification and Erasure

Within the framework of applicable statutory provisions, you have the right at any time to free information about your stored personal data, its origin and recipients, and the purpose of data processing, and where applicable a right to rectification or erasure of this data.

SSL / TLS Encryption

For security reasons and to protect the transmission of confidential content, this site uses SSL / TLS encryption. You can recognise an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser bar.

4. Data Collection on This Website

Cookies

Our website uses cookies. Cookies are small data packets that your browser stores on your device. We distinguish between:

• Essential cookies: Technically necessary for the operation of the website (e.g. cookie consent storage). Lawful basis: Art. 6(1)(f) GDPR (legitimate interest).
• Analytics cookies (Google Analytics): Set only with your explicit consent. Lawful basis: Art. 6(1)(a) GDPR, § 25(1) TDDDG.
• Marketing cookies: Set only with your explicit consent. Lawful basis: Art. 6(1)(a) GDPR, § 25(1) TDDDG.

If analytics or marketing services are activated, we use the following cookies, subject to your consent. No analytics or marketing services are currently active on this website:

You can revoke your consent at any time with effect for the future. To do so, click "Cookie Settings" in the footer. You can also configure your browser to inform you about the setting of cookies and to allow cookies only on a case-by-case basis.

Contact Form

If you send us inquiries via the contact form, your details from the inquiry form, including the contact data you provide there (name, email address, message, telephone if applicable), will be stored by us for the purpose of processing the inquiry and in case of follow-up questions. This data is only passed on to third parties where there is a lawful basis for doing so — in particular to processors engaged by us (such as our hosting and form provider), for the performance of a contract, to comply with a legal obligation, or on the basis of your consent.

Processing takes place on the basis of Art. 6(1)(b) GDPR if your inquiry is related to the performance of a contract, otherwise on the basis of our legitimate interest (Art. 6(1)(f) GDPR). The data remains with us until you request deletion or the purpose for data storage no longer applies. Statutory retention periods remain unaffected.

Inquiry by Email or Telephone

If you contact us by email or telephone, your inquiry, including all personal data arising from it (name, inquiry), will be stored and processed by us for the purpose of handling your matter. The lawful basis is Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest). The data is deleted after the matter has been completely processed, unless there is a statutory retention obligation.

Newsletter

If you wish to receive our newsletter, we require your email address as well as information that allows us to verify that you are the owner of the email address provided and that you agree to receive the newsletter (double opt-in).

Processing takes place on the basis of your consent (Art. 6(1)(a) GDPR). You can revoke this consent at any time by clicking the unsubscribe link in the newsletter or by sending us an informal message. The lawfulness of data processing operations already carried out remains unaffected by the revocation.

The data you provide for the purpose of receiving the newsletter will be stored by us or by the newsletter service provider until you unsubscribe from the newsletter and will be deleted after unsubscription. Data stored with us for other purposes remains unaffected.

Form Processing (Netlify Forms)

Contact and enquiry forms on this website are processed via Netlify Forms, a service of our hosting provider Netlify, Inc., 2325 3rd Street, Suite 296, San Francisco, CA 94107, USA. For binding online bookings we additionally use an external booking system (see the following section).

Netlify processes the data you enter in the form (name, email address, message, telephone if applicable) solely to deliver your inquiry to us. The lawful basis is Art. 6(1)(b) GDPR (pre-contractual measures). Where data is transferred to the USA, this is based on the EU Commission's Standard Contractual Clauses; Netlify is also certified under the EU-US Data Privacy Framework. You can find Netlify's privacy policy at: Netlify Privacy Policy (netlify.com)

Online booking via an external booking system

Binding bookings are not concluded on this website but through our booking system operated at direct-book.com. The “Book now” and “Check availability” buttons are plain links — no booking system is embedded into this website, and no data is transmitted to the booking system provider when you browse our pages.

Only when you click one of these links do you leave this website and open the booking system. In doing so, your IP address and the usual connection data are transmitted to its servers. The data collected during the booking process (including name, address, contact details, dates of stay and payment details) is processed by us in order to perform the accommodation contract. The lawful basis is Art. 6(1)(b) GDPR (performance of a contract and pre-contractual measures), and for the statutory registration obligation additionally Art. 6(1)(c) GDPR in conjunction with the German Federal Registration Act.

The operator of the booking system acts as our processor pursuant to Art. 28 GDPR; a corresponding agreement is in place. The privacy policy provided within the booking system applies in addition.

Payment Processing (Adyen)

To process payments in connection with a booking we use the payment service provider Adyen N.V., Simon Carmiggeltstraat 6-50, 1011 DJ Amsterdam, Netherlands. The data required for the payment is processed in this context — in particular name, payment method or card details, amount, currency, booking and transaction data as well as technical data such as IP address and device identifiers for fraud prevention.

The lawful basis is Art. 6(1)(b) GDPR (performance of the accommodation contract) as well as Art. 6(1)(c) and Art. 6(1)(f) GDPR insofar as Adyen, as a payment service provider, complies with its own statutory obligations (including anti-money-laundering and payment services supervision) and secures payments against misuse. To that extent Adyen processes the data as an independent controller under its own privacy policy. Full card details are not transmitted to us; we only receive the information required to allocate the payment.

Further information can be found in Adyen's privacy policy: Adyen Privacy Policy (adyen.com)

5. Analytics Tools and Advertising

Google Tag Manager

If activated, this website uses Google Tag Manager (GTM, container ID GTM-XXXXXXX). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Tag Manager is a tag management system that allows us to centrally manage tracking and analytics tools (e.g. Google Analytics 4, Google Ads). Google Tag Manager is currently not activated on this website.

Google Tag Manager itself does not set cookies and does not collect personal data. It only controls the firing of other tags configured by us. These are activated only after your consent via the cookie banner (Google Consent Mode v2: default state "denied" until granted). When the Tag Manager script is delivered, your IP address is transmitted to Google but is not used for tracking purposes.

The lawful basis for using Google Tag Manager is Art. 6(1)(f) GDPR (legitimate interest in efficient and secure management of tracking tools). The tools loaded by the Tag Manager are themselves activated only on the basis of your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

Google Tag Manager privacy policy: https://policies.google.com/privacy

Google Analytics 4

If activated, this website uses Google Analytics 4 (GA4, measurement ID G-XXXXXXXXXX). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Integration takes place via Google Tag Manager. Google Analytics is currently not activated on this website.

Google Analytics enables us to analyse the behaviour of website visitors. We thereby receive various usage data such as page views, time on page, operating systems used and origin of users. Google Analytics uses technologies that allow recognition of the user (e.g. cookies or device fingerprinting). Information collected by Google is generally transferred to a Google server in the USA and stored there.

Google Analytics is activated only after your explicit consent. The lawful basis is Art. 6(1)(a) GDPR and § 25(1) TDDDG. Consent can be revoked at any time (cookie settings in the footer).

No cross-domain tracking: Measurement ends on stay-mcc.de. When you move on to our external booking system, your Google Analytics client ID is not passed on, not even via the URL parameter _gl. In any case, the client ID would be a random, pseudonymous identifier without direct personal reference.

We use the following privacy-friendly configurations: IP anonymisation, automated masking of URL parameters that may contain personal data (function ads_data_redaction) as well as a default consent state of "denied" in line with Google Consent Mode v2 until explicit approval is given.

Data transfer to the USA is based on the EU Commission's Standard Contractual Clauses. Google is certified under the EU-US Data Privacy Framework. Google's data processing terms, which form part of the terms of service, apply to the use of Google Analytics.

Google privacy policy: https://policies.google.com/privacy

Google Ads (Conversion Tracking)

If activated, this website uses the conversion tracking tag from Google Ads (account ID AW-XXXXXXXXXX). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. With the help of Google Ads conversion tracking, Google and we can recognise that a person has interacted with certain ads and was redirected to a correspondingly tagged page (e.g. the contact form confirmation page). Google Ads conversion tracking is currently not activated on this website.

Conversion tracking is activated only after your consent. The lawful basis is Art. 6(1)(a) GDPR and § 25(1) TDDDG. We use the privacy-friendly function ads_data_redaction, through which personal data in URL parameters is automatically removed.

6. Plugins and Tools

Google Fonts (Self-Hosted)

This site uses Google Fonts for the consistent display of typefaces. The typeface in use (Poppins) is installed locally on our server and served from there. No connection to Google servers takes place. Further information: Google Fonts FAQ (developers.google.com)

Google Material Symbols (Self-Hosted)

This website uses Google Material Symbols icons. The icon font is stored locally on our server as a subset and served from there. No connection to Google servers takes place, and your IP address is not transmitted.

7. Data Processing Agreements

Where service providers process personal data on our behalf, data processing agreements (DPA) under Art. 28 GDPR are in place:

• Netlify, Inc. (hosting and form processing) — San Francisco, USA. The DPA forms part of Netlify's terms of service as a Data Processing Addendum.
• Operator of the booking system (online booking via direct-book.com) — on the basis of the service agreement concluded with us.
• Google Ireland Limited (Google Tag Manager, Google Analytics 4 and Google Ads) — Dublin, Ireland. These services are currently not activated. If they are activated, Google's data processing terms apply, which form part of the respective terms of service.

Our payment service provider Adyen N.V. does not act as a processor but as an independent controller (see section 4, “Payment Processing”).

8. Your Rights as a Data Subject

Under the GDPR, you have the following rights:

• Access (Art. 15 GDPR): You may request information about the personal data stored by us.
• Rectification (Art. 16 GDPR): You may request the correction of inaccurate or completion of incomplete data.
• Erasure (Art. 17 GDPR): You may request the erasure of your personal data, provided no statutory retention obligations stand in the way.
• Restriction of processing (Art. 18 GDPR): You may request the restriction of the processing of your data.
• Data portability (Art. 20 GDPR): You may request the release of your data in a machine-readable format.
• Objection (Art. 21 GDPR): You may object to the processing of your data, where it is based on Art. 6(1)(e) or (f) GDPR.
• Withdrawal of consent (Art. 7(3) GDPR): You may revoke consent given at any time with effect for the future.

To exercise your rights, please contact: stay@mcc-rheinbach.de

Status: August 2026 — Version 1.1 (draft)