Privacy Policy

This English version is a courtesy translation. Only the German version (Datenschutzerklärung) is legally binding.

This privacy policy explains which personal data we process when you visit this website, send an enquiry or make a booking, for what purpose and on what legal basis.

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Benedikt Schröder
Gut Stohrerhof
Neuwiese 2
86911 Dießen am Ammersee
Germany
Phone: +49 151 16768931
Email: kontakt@stohrerhof.de

You can reach us at these contact details with any questions about data protection and to exercise your rights (section 9). We have not appointed a data protection officer, as there is no legal obligation to do so (fewer than 20 people are regularly involved in processing personal data, Section 38 of the German Federal Data Protection Act, BDSG).

General principles: We only process personal data where there is a legal basis: your consent (Art. 6 (1)(a) GDPR), the performance of a contract or pre-contractual steps such as a booking request (point b), legal obligations such as tax record-keeping (point c), or our legitimate interest in a secure and functioning website (point f). Storing information on your device is additionally governed by Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG).

2. Hosting, server log files and security

Hosting: Our website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. STRATO processes the data on our behalf under a data processing agreement (Art. 28 GDPR) and exclusively in Germany.

Server log files: Each time a page is accessed, the server automatically records: the page requested, date and time, amount of data transferred, browser and operating system, the previously visited page and the IP address. This is necessary for secure operation (Art. 6 (1)(f) GDPR). STRATO shortens (anonymises) the IP address in the log files and keeps the log files for no more than six weeks; they are then deleted unless they are needed to investigate a security incident.

Protection against attacks: We use the security plugin Wordfence by Defiant Inc., Seattle (USA). It checks requests for attack patterns and processes the IP address, the requested address and the browser identifier for this purpose; to compare them with known attackers, IP addresses may be transferred to Defiant in the USA. The legal basis is our legitimate interest in a secure website (Art. 6 (1)(f) GDPR); the transfer is based on the EU standard contractual clauses.

Redirects: The plugin “Redirection” forwards old addresses to new pages. It logs redirects and failed requests without IP addresses and deletes these logs after seven days.

Backups: We back up the website regularly with UpdraftPlus. The backups also contain stored enquiries and guestbook entries and are stored with Dropbox (Dropbox International Unlimited Company, One Park Place, Floor 5, Upper Hatch Street, Dublin 2, Ireland). A transfer to Dropbox, Inc. in the USA is possible; Dropbox is certified under the EU-US Data Privacy Framework. The backups serve to restore the website after an outage (Art. 6 (1)(f) GDPR) and are replaced continuously: the database (with enquiries and guestbook entries) is backed up daily and kept for 14 days, the files weekly with the last three backups retained.

Encryption: All pages are transmitted with SSL/TLS encryption, which you can recognise by the “https://” in the address bar.

Fonts and content: We deliver fonts, images and the video on the home page from our own server. No data is transferred to Google Fonts or other third parties when you simply view a page.

3. Cookies and consent

We use only a few cookies. Non-essential services only load once you have given your consent in the cookie banner.

Cookie / service	Purpose	Storage period	Legal basis
Real Cookie Banner	stores your choice in the cookie banner	1 year	Section 25 (2) TDDDG, Art. 6 (1)(c) GDPR
pll_language (Polylang)	remembers your chosen language, German or English	1 year	Section 25 (2) TDDDG, Art. 6 (1)(f) GDPR
Google Maps	map on the home and contact pages	see section 7	consent, Section 25 (1) TDDDG, Art. 6 (1)(a) GDPR

Consent management: Your choice is managed by the plugin Real Cookie Banner by devowl.io GmbH, Tannet 12, 94539 Grafling, Germany. It stores your decision in a cookie and, as proof of consent, on our server together with a shortened IP address and the time; these records are deleted after 120 days. No data is sent to devowl.io. You can change or withdraw your consent at any time via the “Cookie settings” link at the bottom of every page.

You can also delete or block cookies in your browser; some functions of the website may then not be available.

4. Contact forms and email

If you write to us using one of our forms (contact, event enquiry, corporate enquiry) or by email, we process your details in order to answer your enquiry.

Data: name, email address, optionally phone number, company, preferred dates, number of guests, budget and your message.
Purpose and legal basis: answering your enquiry and, where applicable, preparing a contract (Art. 6 (1)(b) GDPR), otherwise our legitimate interest in answering it (point f).
Technology: The forms run with the plugin Contact Form 7 on our own server. The details are not stored in the website database but sent to us by email. Our email mailboxes are also hosted by STRATO in Germany, which processes them on our behalf (Art. 28 GDPR).
Storage period: We delete the enquiry once it has been dealt with and there is no obligation to retain it; if it leads to a booking, the periods in section 8 apply.

Required fields are marked. Without this information we cannot process your enquiry.

5. Booking calendar, enquiries and payment

Availability: The calendar shows available dates. To do so, our server retrieves the occupancy from our own Google calendars (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland). No data about you is transferred to Google when the calendar is displayed; the retrieval takes place only between our server and Google.

Booking request and non-binding enquiry: When you send a request, we process:

name, email address, phone or mobile number, and for binding requests the billing address,
dates, unit, number of adults and children by age group, price, and a special guest code if applicable,
your message, the preferred payment method, the language of the request and the time at which you accepted the terms of booking.

The request is stored in our WordPress database and sent by email to us and, as a confirmation, to you. We enter confirmed bookings with dates and the guest’s name in our non-public Google calendar to manage occupancy; Google processes this data as the provider of the calendar service. The legal basis is the performance of pre-contractual steps and of the rental contract (Art. 6 (1)(b) GDPR). To prevent misuse, we store the IP address for no more than one hour in order to limit the number of requests and code attempts (point f).

Payment by bank transfer: You receive the bank details with the payment request. Your bank and our bank process the payment data to carry out the transfer.

Payment by PayPal: If you choose PayPal, a link in the payment request takes you to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. PayPal’s privacy statement, available on paypal.com, applies there. We receive your name, email address and the payment confirmation from PayPal (Art. 6 (1)(b) GDPR).

Booking platforms: If you book via platforms such as Booking.com or Airbnb, their privacy policies also apply; we receive the data required for the booking from them.

6. Guestbook

You can leave an entry in our guestbook. For this we store the name you give, optionally your town and email address, the text of your entry, a star rating and the time. We do not store your IP address. Every entry is checked by us before publication. After our approval, the name, town, text and rating are published on the website; we also show short excerpts on the home page under “What our guests say”. Your email address is not published.

The legal basis is your consent (Art. 6 (1)(a) GDPR), which you give by submitting the entry. You can withdraw it at any time by email to kontakt@stohrerhof.de; we will then delete your entry. The guestbook runs with the plugin Gwolle Guestbook on our own server.

7. Google Maps, external links and social networks

Google Maps: On the home and contact pages you can display a map from Google Maps (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland). The map only loads once you click “Show map” and have given your consent. Your browser then transmits, among other things, your IP address to Google; a transfer to the USA is possible. Google is certified under the EU-US Data Privacy Framework. The legal basis is your consent (Section 25 (1) TDDDG, Art. 6 (1)(a) GDPR), which you can withdraw at any time via “Cookie settings”. More information: policies.google.com/privacy.

External links: Our pages link to partners, webcams, videos and places to visit. Only when you click such a link do you leave our website; the privacy policies of the target pages apply there.

Social networks: We link to our profiles on Facebook, Instagram and TikTok. No plugins from these networks are embedded; no data is transferred to them when you visit our website. Only clicking the link takes you to the respective network, where its privacy policy applies.

8. Storage period

We store personal data only for as long as necessary for the respective purpose. We retain records of bookings and payments because of legal obligations: invoices and accounting records for 8 years (Section 147 of the German Fiscal Code, AO; Section 14b of the German VAT Act, UStG), commercial and business letters for 6 years (Section 257 of the German Commercial Code, HGB). We delete non-binding enquiries that do not lead to a booking after 12 months at the latest.

9. Your rights

You have the right at any time to:

access the data stored about you (Art. 15 GDPR),
have inaccurate data corrected (Art. 16),
erasure (Art. 17) and restriction of processing (Art. 18),
data portability (Art. 20),
withdraw consent with effect for the future (Art. 7 (3)),
object to processing based on legitimate interests (Art. 21).

Simply write to kontakt@stohrerhof.de.

Right to lodge a complaint: You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

10. Changes

We adapt this privacy policy when our website or the legal situation changes. The version published here applies.

Version: 21 October 2026