Privacy Policy

Neupitz GmbH

hallo@neupitz.de

+49 33766 594998

1. The essentials at a glance

Who is responsible?

The controller responsible for data processing on this website is Neupitz GmbH, Kohlgarten 1, 15755 Teupitz, represented by Managing Director Stephan Gabler. E-mail: hallo@neupitz.de, telephone: +49 33766 594998.

What data we process

  • When you visit this website, our host processes technically necessary data, such as your IP address and the requested URL. Without this data, the website cannot be delivered.
  • When you send us an inquiry via a form, we process the information you provide there.
  • If you book a stay on our booking page, we process the details from the booking form and the payment data in order to carry out and invoice the booking. Stripe handles the payment.
  • We only use services for analytics (Google Analytics) and marketing (Meta Pixel, lemlist) with your consent. Without your consent, these services will not be loaded.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. You can withdraw your consent at any time via the “Cookie settings” link at the bottom of every page on this website. You also have the right to lodge a complaint with a supervisory authority. Further details can be found in Section 3. If you have any questions about data protection, feel free to contact us at any time at hallo@neupitz.de.

2. Hosting and website delivery

Cloudflare

This website is delivered via Cloudflare Pages. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When you visit the website, Cloudflare processes your IP address, date and time, the requested URL, the previously visited page, and details about your browser and operating system. This is necessary to deliver the website, ensure fast loading times and protect against attacks.

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in the secure and reliable delivery of the website. A data processing agreement is in place with Cloudflare. Cloudflare is certified under the EU-US Data Privacy Framework; transfers to the US are based on the European Commission's adequacy decision and, in addition, on standard contractual clauses. Read more in the Cloudflare Privacy Policy .

Sanity (content, images and files)

We manage texts, images and files for this website, such as our terms and conditions as a PDF, in the Sanity content management system. Your browser loads images and files directly from Sanity's server (cdn.sanity.io). In doing so, your IP address is transmitted to Sanity. The providers are Sanity AS, Oslo, Norway, and Sanity US Inc., USA.

The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in displaying content quickly and reliably. Insofar as data is transferred to the US, this is based on the European Commission's standard contractual clauses. Read more in the Sanity Privacy Policy .

Fonts

The fonts on this website are hosted on our own server. When loading the page, no connection is established to Google Fonts or any other font provider.

Encryption

This website uses TLS encryption. You can recognise an encrypted connection by “https://” in the address bar and the lock icon in your browser. Data you transmit to us, for example via an inquiry form, cannot be read by third parties.

3. General information and mandatory information

Storage duration

Unless a specific retention period is specified in this privacy policy, we retain your data until the purpose for processing no longer applies. If you request erasure or withdraw your consent, we will delete your data unless we are required to retain it for other legal reasons, such as retention periods under tax or commercial law. In that case, we will delete it as soon as those reasons no longer apply.

Legal bases

If you have given consent, we process your data on the basis of Art. 6 (1) (a) GDPR. If consent relates to storing information on your end device or accessing it, for example via cookies, Section 25 (1) TDDDG also applies. If your data is required for a contract or pre-contractual measures, such as preparing a proposal following your inquiry, we process it on the basis of Art. 6 (1) (b) GDPR. Data required to comply with a legal obligation is processed on the basis of Art. 6 (1) (c) GDPR. Processing may also be based on our legitimate interest pursuant to Art. 6 (1) (f) GDPR. The specific legal basis that applies in each case is set out in the sections below.

Recipients and transfers to third countries

We only share personal data if it is necessary for a contract, if we are legally obliged to do so, if we have a legitimate interest, or if you have given your consent. We only use service providers that process data on our behalf on the basis of a data processing agreement. Some of the providers mentioned are based in the US or transfer data there. For companies certified under the EU-US Data Privacy Framework, the European Commission's adequacy decision applies; for others, we base transfers on standard contractual clauses.

Withdrawal of your consent

Many processing activities are only possible with your consent. You can withdraw your consent at any time with future effect, on this website via “Cookie settings” at the bottom of every page. The lawfulness of processing carried out prior to withdrawal remains unaffected.

Right to object (Art. 21 GDPR)

If processing is based on Art. 6 (1) (e) or (f) GDPR, you have the right to object at any time on grounds relating to your particular situation. This also applies to profiling based on these provisions. Following an objection, we will no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims (Art. 21 (1) GDPR).

If we process your data for direct marketing purposes, you have the right to object at any time. This also applies to profiling insofar as it is related to such direct marketing. Following your objection, we will no longer use your data for direct marketing (Art. 21 (2) GDPR).

Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement. The supervisory authority responsible for us is the Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg, Stahnsdorfer Damm 77, 14532 Kleinmachnow.

Access, rectification, erasure, restriction and data portability

Within the scope of statutory provisions, you have the right to free information at any time about your stored personal data, its origin and recipients, and the purpose of processing, as well as a right to rectification or erasure. You may request that we restrict processing, for example while we verify the accuracy of your data, or if you need the data for legal claims but we would otherwise delete it. Data that we process automatically based on your consent or for the performance of a contract will be provided to you or a third party in a common, machine-readable format upon request. An e-mail to hallo@neupitz.de is sufficient for all of this.

4. Consent and cookies

Cookies and similar technologies

Cookies are small text files that your browser stores. Similar technologies include local storage or session storage in the browser. We set technically necessary cookies, such as saving your choice in the banner, on the basis of Section 25 (2) No. 2 TDDDG and Art. 6 (1) (f) GDPR. All other cookies are set only with your consent pursuant to Section 25 (1) TDDDG and Art. 6 (1) (a) GDPR. You can delete or block cookies in your browser at any time. Certain parts of the website may then no longer function properly.

Consent banner (Privado)

We obtain your consent via the banner from Privado; the provider is Privado, Inc., San Francisco, USA. The banner is loaded from a Privado server, transmitting your IP address. We store your choice in the “preferences” and “last_consent” cookies in your browser. To document your consent, the banner transmits your choice along with a random identifier and timestamp to Privado.

The legal basis is Art. 6 (1) (c) GDPR, as we are required to demonstrate consent (Art. 7 (1) GDPR), and Section 25 (2) No. 2 TDDDG for the cookies.

In the banner, you can enable two categories individually:

  • Analytics: Google Analytics (Section 5)
  • Marketing: Meta Pixel and lemlist (Section 5)

5. Analytics and marketing (only with consent)

The following services are loaded only after you have given consent in the banner. The legal basis in each case is your consent pursuant to Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG. You can withdraw your consent at any time via “Cookie settings” at the bottom of every page.

Google Analytics

We use Google Analytics 4 to understand how our website is used: which pages are viewed, for how long, how visitors reach us, with what device, and from which approximate region. When you submit an inquiry, we count this as an event without storing the content of your inquiry. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics sets the cookies “_ga” and “_ga_BC6P54PGE4” with a lifespan of up to two years. IP addresses are not stored in Google Analytics 4.

On the booking page we also count when someone selects a room, when the payment form is opened and when a booking is completed, the latter with the total amount. We do not send your name, email address or other details from the form to Google.

Event-level data is deleted after two months, data on individual users after 14 months. Data may be transferred to Google LLC in the US. Google is certified under the EU-US Data Privacy Framework. Read more in the Google Privacy Policy .

Meta Pixel

We use the Meta Pixel to measure the effectiveness of our advertising on Facebook and Instagram and to display adverts there to visitors of our website. When you submit an inquiry, the pixel reports this as an event without the content of your inquiry. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The pixel sets the cookie “_fbp” with a lifespan of three months. If you are logged into Facebook or Instagram, Meta can associate your visit with your account.

We and Meta are jointly responsible for collecting and transmitting the data to Meta (Art. 26 GDPR). The respective duties are set out in a joint controllership agreement . Meta is solely responsible for further processing. Data may be transferred to Meta Platforms, Inc. in the US; Meta is certified under the EU-US Data Privacy Framework. Read more in the Meta Privacy Policy .

lemlist

We use lemlist to identify which companies visit our website and to reach out to them in a targeted way. To do this, your IP address is matched with public company data. The provider is lempire SAS, 128 rue La Boétie, 75008 Paris, France.

6. Inquiries via our forms

When you send us an inquiry via a form, we process the information you provide in order to respond and prepare a quote: name, company, e-mail address, telephone number, number of guests, dates, your message and any other details you share. If you reached our website via a link with campaign parameters (such as “utm_source”), we send these along with the landing page and referrer URL with your inquiry so that we can see how inquiries reach us. Beyond the currently open page, we only retain this information if you have permitted marketing in the banner, and then only for the duration of your visit in your browser's session storage.

The inquiry is routed via the automation service n8n (n8n GmbH, Berlin) into our customer database in Notion (Notion Labs, Inc., San Francisco, USA). Data processing agreements are in place with both providers. Notion is certified under the EU-US Data Privacy Framework.

The legal basis is Art. 6 (1) (b) GDPR, as your inquiry serves to initiate a contract, and otherwise our legitimate interest in processing inquiries (Art. 6 (1) (f) GDPR). We store your details until the inquiry has been dealt with. If a booking is made, we retain the data for as long as required under tax and commercial law.

7. Booking a stay

What data we process when you book

When you book a stay on our booking page, we process:

  • dates, chosen rooms and occupancy,
  • first name, last name and email address,
  • your phone number, if you give it,
  • your planned arrival time,
  • your answer to "How did you hear about us?" and, if you choose "Other", your own answer,
  • if you like, a short sentence about yourself and a comment, for example about a dog or people travelling with you,
  • your acceptance of the terms and the house rules,
  • the language you book in,
  • after payment, your billing address and, if you enter one, a company name, the payment identifiers at Stripe, the amount and the time of payment.

If you came to our site via a link with campaign parameters (such as "utm_source"), we store these together with the landing page and the page you came from with your booking. Beyond the page currently open, your browser only remembers these details if you allowed marketing in the banner (see section 6).

Only we read the sentence about yourself, so that we know who is coming. We do not show it to other guests. If you tell us something about your health on your own initiative, we only use it to take it into account during your stay and delete it together with the comment.

We cannot accept the booking without your name, email address and arrival time. The question "How did you hear about us?" is also required, because it is the only reliable way for us to see how guests find us. All other details are optional.

We do not ask for nationality or details of people travelling with you when you book. Guests without German citizenship fill in a registration form on arrival, as required by the German Federal Registration Act (section 29 (2) BMG). We keep the form for one year after departure and destroy it within the following three months (section 30 (4) BMG). On request, we must show it to the registration authority or the police.

Purpose and legal bases

We need your details to create the booking, hold the rooms for you, process the payment, send you the confirmation and invoice, and prepare your stay. The legal basis is the performance of the contract and of pre-contractual measures (Art. 6 (1) (b) GDPR). We keep invoices and booking records because commercial and tax law require it (Art. 6 (1) (c) GDPR in conjunction with section 147 AO and section 257 HGB); the same applies to the registration form (sections 29, 30 BMG).

We also use your arrival time, your answer to "How did you hear about us?" and the campaign parameters to plan our operations and to understand how guests find us. This is our legitimate interest (Art. 6 (1) (f) GDPR). We process the optional sentence about yourself and your comment because you give them to us so that we can prepare your stay better (Art. 6 (1) (b) and (f) GDPR).

Emails about new dates

If you have booked with us, we occasionally write to the email address from your booking when there are new workation dates. We tell you this in the booking form and again in each of these emails. You can object at any time, for example with a short email to hallo@neupitz.de, without incurring any costs other than the transmission costs at basic rates. The legal basis is our legitimate interest in direct marketing for our own similar offers (Art. 6 (1) (f) GDPR in conjunction with section 7 (3) UWG). You only receive our newsletter if you sign up for it yourself.

Storage in your browser

So that your selection and details are not lost if you reload the page or briefly switch to another page, the booking page keeps them in your browser's session storage: dates, rooms, your details in the form and, once you continue to payment, the identifier of the payment session. This data stays on your device, applies only to this browser window and is deleted when you close it or the booking is completed. We do not store your acceptance of the terms and house rules there. This storage is strictly necessary for the booking you requested (section 25 (2) no. 2 TDDDG).

Protection against automated bookings (Cloudflare Turnstile)

Before the payment starts, Cloudflare Turnstile checks invisibly whether a human is booking. The provider is Cloudflare, Inc. (see section 2). For this, Turnstile evaluates technical characteristics of your browser, including your IP address, your browser identifier (user agent) and characteristics of the encrypted connection. According to Cloudflare, it uses this data only to tell humans from bots, not to identify you or show you advertising. Cloudflare acts on our behalf for this check; to improve Turnstile itself, Cloudflare processes the data as an independent controller. More in the Turnstile privacy notice .

The legal basis is our legitimate interest in protecting the booking page against abuse and fake bookings (Art. 6 (1) (f) GDPR). Where information in your browser is accessed, this is strictly necessary for the booking you requested (section 25 (2) no. 2 TDDDG). For the same reason, our booking system limits how many requests may come from one IP address. For this, it keeps the IP address in memory for at most 10 minutes and does not write it anywhere.

Payment via Stripe

Stripe handles the payment. The provider is Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. Stripe's payment form is only loaded when you reach the payment step on the booking page. In the payment form you enter your billing address, a company name if you like, and your payment details directly with Stripe. We do not see your full card details. After payment, Stripe sends us your name, billing address, company name, email address, amount, payment method and the payment identifiers.

Stripe processes your data partly on our behalf and partly as an independent controller, for example to prevent fraud and to meet its legal obligations as a payment service provider, such as anti-money-laundering rules. To do so, Stripe also collects technical data about your device and browser when the payment form loads and sets cookies, such as "__stripe_mid" (one year) and "__stripe_sid" (30 minutes). Data may be transferred to Stripe, Inc. in the USA; Stripe is certified under the EU-US Data Privacy Framework. More in Stripe's privacy policy .

If you pay with Apple Pay or Google Pay, the privacy terms of Apple or Google also apply; they act as independent controllers.

The legal basis is the performance of the contract (Art. 6 (1) (b) GDPR) and our legitimate interest in secure payment processing without fraud (Art. 6 (1) (f) GDPR). Stripe's cookies are strictly necessary for the payment (section 25 (2) no. 2 TDDDG).

Our booking system

We create your booking in our own booking system. There our team sees the booking, assigns rooms and plans cleaning and heating. The booking system runs at Railway Corporation, USA, on servers in the Netherlands. The database is operated by Supabase, Inc., USA, on servers in Ireland. We have data processing agreements with both providers. Where data may be transferred to the USA, this is based on the European Commission's standard contractual clauses.

We also briefly inform our team about each new booking by email and in our internal chat Slack, with booking number, name, dates, rooms, arrival time and amount. The provider of Slack is Slack Technologies Limited, Dublin, Ireland; data may be transferred to Slack Technologies, LLC in the USA. So that the team can plan arrivals, your booking with name, rooms, arrival time and your comment also appears in our team's internal calendar. The legal basis is the performance of the contract (Art. 6 (1) (b) GDPR).

If a technical error occurs in the booking system, it reports it to the Sentry service (Functional Software, Inc., USA) so that we can fix it. The report contains the booking number and the error message. We do not send contact or payment data; in individual cases, however, an error message may contain an email address, for example if an email could not be delivered. We have data processing agreements with Sentry and Slack; transfers to the USA are based on the European Commission's standard contractual clauses. The legal basis is our legitimate interest in error-free operation (Art. 6 (1) (f) GDPR).

Invoice (sevdesk)

We create the invoice for your stay with the accounting software sevdesk. The provider is sevdesk GmbH, Offenburg, Germany. For this, our booking system sends your name or company name, your billing address and email address, and the booked services and amounts to sevdesk. We have a data processing agreement with sevdesk. The legal basis is the performance of the contract (Art. 6 (1) (b) GDPR) and our obligation to issue and keep invoices (Art. 6 (1) (c) GDPR).

Booking emails (Resend)

We send the booking confirmation with the invoice via the email service Resend, as well as the message about your booking to our team. The provider is Resend, Inc., USA. Resend processes your email address and the content of the message on our behalf and stores the data in the USA. We have a data processing agreement with Resend; the transfer to the USA is based on the European Commission's standard contractual clauses. The legal basis is the performance of the contract (Art. 6 (1) (b) GDPR).

Storage period

We keep invoices and all documents belonging to an invoice for eight years, and business letters such as your booking confirmation and our booking emails for six years (section 147 (1) and (3) AO, section 257 (1) and (4) HGB). These periods start at the end of the year in which the document was created. Your booking with dates and rooms is stored for the same time.

We only need your phone number, your comment and the sentence about yourself for your stay. We delete them six months after your departure, in the booking system and in the notification to our team. After six months, we keep your arrival time and your answer to "How did you hear about us?" only without your name, for our statistics.

We use your name and email address for emails about new dates until you object.

If someone stops the booking before paying, or the payment is not completed within 30 minutes, the booking is cancelled. We then delete the details from the form after 30 days; we only keep the fact that a booking was abandoned, without name or contact details.

8. Newsletter

We send our newsletter using Brevo. The provider is Sendinblue SAS (Brevo), 106 boulevard Haussmann, 75008 Paris, France. Subscription takes place via a Brevo page linked from our website. To send the newsletter, we require your e-mail address. After signing up, you will receive an e-mail asking you to confirm your subscription. Brevo stores the timestamp and IP address of your sign-up and confirmation as proof and can measure whether newsletters are opened and links are clicked.

The legal basis is your consent (Art. 6 (1) (a) GDPR). You can unsubscribe at any time via the link at the bottom of each newsletter. We retain your data until you unsubscribe. Afterwards, your e-mail address may remain on a suppression list so that you no longer receive newsletters. Read more in the Brevo Privacy Policy .

9. External content and links

Google Maps

On our contact page, you can display a map from Google Maps. The map loads only when you click “Load external content”. Your IP address and other technical data are then transmitted to Google, and Google may set cookies. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google LLC in the US; Google is certified under the EU-US Data Privacy Framework.

The legal basis is your consent by clicking (Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG). Read more in the Google Privacy Policy .

Links to social networks

We link to our profiles on Instagram, LinkedIn and Facebook using simple links only. When you visit our website, no data is transferred to these networks. The privacy policies of the respective networks only apply once you click a link.

10. Last updated

Last updated: November 2026.