Privacy

1. Controller and contact

Martin Höfler, Bio-Ferienhof Höfler
Glotzing 2, 94107 Untergriesbach, Germany
Email: info@ferienhof-hoefler.de
Phone: +49 8592 8607

You can also use these contact details for any privacy-related questions.

2. Website hosting and Cloudflare Pages

We provide our website through Cloudflare Pages, a service of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. When you visit a page, Cloudflare processes technical connection data, including your IP address, the requested address, date and time, browser and device information and, where applicable, referrer information.

This processing delivers our pages, helps diagnose technical faults and protects against abuse and attacks. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is a securely and reliably accessible website. The data necessary to establish a connection is required to display a page.

Data may be processed outside the EU and EEA, including in the United States. Cloudflare describes the EU-US Data Privacy Framework and standard contractual clauses among its transfer mechanisms. Information about processing, retention and safeguards is available in Cloudflare's privacy policy and Cloudflare's data processing terms.

3. Contact and enquiries

If you email or call us, we process the contact details and information you provide. These may include your name, email address, telephone number, preferred accommodation and travel dates. We use them to respond to you and help arrange your stay.

Article 6(1)(b) GDPR applies to enquiries about a booking or an existing stay. For other enquiries, the basis is Article 6(1)(f) GDPR and our legitimate interest in responding to your message. You choose what to share; we need a way to reply and enough information to handle your request.

There is no contact form submitting data from this website. Email links open your email application. A draft enquiry prepared from the calendar is sent only when you send it yourself from that application.

4. Availability calendar

When you open the availability calendar, your browser loads the calendar widget as JavaScript from belegungskalender.api.eberl-online.net. The occupancy plan is provided by DREAMWAY TRAVEL GmbH, Kirchplatz 6, 87509 Immenstadt, Germany. Data is retrieved from the occupancy service to provide its functions. This establishes a connection between your browser and the service's servers; your IP address in particular is transmitted. We have no control over this data transfer.

The widget loads only when the calendar area is displayed. The retrieval provides an engaging presentation of our online services and makes it easier to check an availability enquiry. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is to provide the occupancy overview. The calendar is not linked to your consent for statistics or external reviews. Further information is available in the DREAMWAY TRAVEL privacy information.

5. External booking

The booking button takes you away from our website to the external booking service at tbooking.toubiz.de. It is presented as Holidu Smart Destination. We do not embed a booking form or booking widget on our pages.

Your browser connects to the booking site when you open the link. You enter your reservation details there. Any accommodation or travel dates selected on our website are not passed on automatically; you make your selection again on the booking site.

We process the booking and contact details supplied to us to prepare and perform your accommodation contract under Article 6(1)(b) GDPR. Statutory documentation and retention duties are based on Article 6(1)(c) GDPR. Your cookie choices here do not apply on the external booking site. Further provider information: Holidu privacy policy.

6. Saving your privacy choices

We store your choices about statistics and external reviews, together with the time of your decision, in our own cookie “hoefler_consent_v1”. It lasts for 180 days from saving and does not contain an advertising-profile visitor identifier assigned by us.

This storage is necessary to apply your choices. Storage and access are based on section 25(2)(2) TDDDG. The associated processing is based on Article 6(1)(f) GDPR and our legitimate interest in reliably respecting your decision.

Open or change cookie choices

7. Matomo and Google Search Console

We use Matomo for a reduced basic count and, only after your consent, for enhanced statistics. The script is loaded from https://matomo.cyblinge.de. Without consent it sends a generic page view without page path, page title, referrer information in the analytics record, active device detection or analytics cookies. Technical connection data, including the IP address and browser identifier, is transmitted; according to the operator, the Matomo instance is configured to anonymize the IP address before storage.

The legal basis for cookieless basic counting is Article 6(1)(f) GDPR; our legitimate interest is knowing the aggregate number of page views. After consent, we additionally process exact page paths and titles, referrer and browser features, and allow analytics cookies. The legal basis for this enhanced analytics is your consent under Article 6(1)(a) GDPR and, where cookies or device access are involved, section 25(1) TDDDG. You may withdraw consent for the future at any time in Cookie settings; Matomo then returns to basic counting.

There is currently no Google Search Console HTML verification tag on this website. Such a tag would verify website ownership, not track visits.

We do not use Google Analytics or remotely loaded Google Fonts.

8. External reviews with TrustYou

We obtain current review summaries from TrustYou GmbH, Schmellerstraße 9, 80337 München, Germany. Automatic embedding via api.trustyou.com occurs only after you consent to “External reviews with TrustYou” and the review section approaches the visible area.

TrustYou then receives the connection data needed to supply the content, including your IP address and technical browser information. We suppress the referrer for this embed. Depending on the service and your browser settings, the provider may store or access information on your device. Embedding is based on your consent under Article 6(1)(a) GDPR and, where device storage or access takes place, section 25(1) TDDDG.

You can withdraw consent in Cookie settings; the embedded reviews are then removed. Withdrawal does not undo data already transmitted. If you choose to open an explicitly external review link instead, you visit the provider directly, independently of your consent to embedding.

Further details and privacy contact: TrustYou privacy policy, dataprotection@trustyou.com.

9. Maps, local destinations and terms PDF

Google Maps, restaurants and local destinations are external links; we do not embed these providers' maps. Our full accommodation terms are a PDF hosted on cdn.tomas-travel.com. The document is not automatically loaded into our pages.

When you open one of these links, the destination provider receives technical connection data such as your IP address and browser information. Its privacy information applies there. Our cookie settings do not control those external websites.

10. Recipients and retention

Recipients of website data are the technical services described above, according to the function you use or the optional embed you consent to. Disclosure may also be necessary to meet legal obligations or establish, exercise or defend legal claims. We do not sell your personal data.

We retain contact and booking data for as long as needed to handle your enquiry, fulfil your stay or resolve outstanding claims. Where statutory retention duties apply, storage continues for the required period and use is restricted to that purpose. We then delete the data unless another lawful reason for retention remains.

Technical log retention is governed by the need for operation, fault analysis and investigation of misuse. Retention by external services also depends on the particular processing activity and provider information. The cookie we set to remember your choices has a fixed duration of 180 days.

11. Your rights

Subject to the applicable legal conditions, you have the following rights:

• Access to your personal data and information about its processing (Article 15 GDPR).
• Rectification of inaccurate and completion of incomplete data (Article 16 GDPR).
• Erasure of your data or restriction of processing (Articles 17 and 18 GDPR).
• Receipt and portability of data you provided where processing is automated and based on consent or contract (Article 20 GDPR).

To exercise your rights, contact us at the address above. Where necessary, we may ask for information to identify you securely.

Objecting to legitimate-interest processing

Where we process data under Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Article 21 GDPR). We will stop this processing unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or processing is necessary for legal claims. You may object to processing for direct marketing at any time without giving reasons.

Withdrawing consent

You may withdraw consent at any time for the future. Use Cookie settings for optional website services or contact us. Withdrawal does not affect the lawfulness of processing before withdrawal. You can use our accommodation information and external booking links without consenting to statistics or reviews.

Complaining to a supervisory authority

Under Article 77 GDPR you can complain to a data protection supervisory authority, particularly where you live or work or where the alleged infringement occurred. The authority for private businesses in Bavaria is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany. Submit a complaint to BayLDA.

12. Automated decisions

On our website we do not make solely automated decisions that produce legal or similarly significant effects for you. We do not carry out profiling for such decisions here.

13. Optional farm assistant

Our farm assistant is an AI chat for questions about the published information of Bio-Ferienhof Höfler. CYBLINGE provides the technical service through hello.cyblinge.de, using a dedicated knowledge area for our farm. The chat configuration is retrieved only when you open the chat; a session starts with your first text message or first transcription of a voice recording, whichever occurs first. Technical connection data, such as your IP address and browser information, is also processed.

When you send a message, we process its text, temporary session data and the corresponding answers. For safety checks, searching the farm information and generating a reply, your question and relevant excerpts of public farm information are sent by our server to the model provider DeepInfra, Inc., USA. Processing in the United States is possible. Please see DeepInfra's privacy policy. Do not share passwords, payment details, health information or other sensitive data.

Optional voice input starts only when you click the microphone and grant your browser microphone permission. A recording lasts no more than 60 seconds. After recording ends, the audio file is transmitted via CYBLINGE to DeepInfra, Inc., USA, for transcription. We do not use the browser's additional live speech recognition. The recognised text appears in the input field, where you can edit or delete it. It is only sent as a chat question when you submit it yourself. You can always type your question instead, without allowing microphone access.

Our chat server processes the audio file temporarily in memory; it is not stored permanently. DeepInfra's retention practices are governed by its privacy information.

The processing answers your voluntary enquiry and protects the chat against abuse. Article 6(1)(b) GDPR applies to pre-contractual enquiries about a stay; Article 6(1)(f) GDPR applies to general farm information and technical safeguards. Our legitimate interest is a helpful and secure information service. You can also contact us by phone or email and use all website information without the chat.

The chat does not set a chat cookie or save a permanent conversation history in your browser. The session token remains in the open page's memory. Chat text is held temporarily on the server with a lifetime of 30 minutes; sessions end after 30 minutes of inactivity and no later than 24 hours. Reloading does not restore a previous conversation. “Delete chat” removes temporary chat data and associated chat feedback. Technical session and blocking records without chat text remain until the session expires and are then removed by a regular cleanup process.

Answer ratings are optional and are removed after 30 days by the regular cleanup process. Your question is included in a rating only if you explicitly enable the corresponding option. Complete conversations are not automatically transferred to knowledge management. External providers' retention practices are also governed by their own information.

The assistant can make mistakes and does not confirm current prices or availability. It cannot make bookings, cancellations, payments or send messages to us. The analytics and review choices in the cookie dialogue do not control this chat, which you open yourself.