Privacy Policy

1. Controller

Lion Property GmbH Bachstraße 32 33161 Hövelhof, Germany

Commercial register: Amtsgericht Paderborn (Local Court), HRB 18555 Managing director: Nuri Aslan Email: info@lionstay.de Phone: 0179 2120576

Lion Property GmbH operates holiday apartments in Paderborn under the „Lion Stay“ brand, as well as the website lionstay.de with a digital guestbook and online check-in. A data protection officer is not legally required and has not been appointed.

2. Overview: which data we process

• Booking data (name, contact details, travel dates, price) — from your booking via a portal or directly with us
• Registration data under the Bundesmeldegesetz (Federal Registration Act) via online check-in; for foreign guests additionally a photo of the identity document
• Communication data (messages via booking portals and email)
• Invoice and payment data
• Technical access data when you visit our website

We use no tracking, no analytics tools and no advertising cookies. No data is passed on to third parties or sold for advertising purposes.

3. Website and digital guestbook

When you access our pages, our server processes technically necessary data (IP address, date/time, page requested, browser type) in server logs. The legal basis is Art. 6(1)(f) GDPR (Art. 6 Abs. 1 lit. f DSGVO — legitimate interest in secure, stable operation). The logs are deleted automatically on a regular basis.

Hosting takes place on our own server at IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany (processing on our behalf under Art. 28 GDPR). Processing takes place exclusively on servers in Germany.

Our pages embed no external services (no Google Fonts, no map services, no social media plugins). Only technically necessary cookies or local browser data are used (e.g. a session cookie for the operator login, the language setting). You reach your guestbook via a personal access link — without an account and without consent-requiring cookies. A cookie banner is therefore not necessary.

4. Booking and contract handling

If you book via a portal (Booking.com B.V., Amsterdam; Airbnb Ireland UC, Dublin; Vrbo/FeWo-direkt), we receive from there the data required to process your stay (name, travel period, price, contact details where applicable). Each portal is independently responsible for its own processing; its privacy notices apply. For direct bookings we collect this data ourselves.

To manage bookings we use the channel manager Smoobu GmbH (Berlin) as a processor. To organise access we generate stay-specific access codes for electronic door locks; the codes are valid only for the duration of your stay.

Legal basis: Art. 6(1)(b) GDPR (Art. 6 Abs. 1 lit. b DSGVO — performance of a contract).

5. Online check-in and registration form

As an accommodation provider we are obliged under §§ 29, 30 Bundesmeldegesetz (BMG — Federal Registration Act) to collect a registration form on the day of arrival (including name, address, date of birth, nationality and, for foreign guests, the number of the identity document). We collect this information conveniently in advance via the online check-in in your guestbook.

Legal basis: Art. 6(1)(c) GDPR (Art. 6 Abs. 1 lit. c DSGVO — legal obligation). Retention period: the registration data is deleted automatically once the statutory retention period expires (at the latest twelve months after departure).

In addition, we report the statutory accommodation tax („Bettensteuer“ — bed tax) to the City of Paderborn; no guest data beyond what is necessary is transmitted for this purpose.

6. ID photo for foreign guests

For guests without a German registered address we are obliged under § 30(2) and (4) BMG to verify identity on the basis of the identity document. For this purpose, foreign guests upload a photo of their ID card or passport during online check-in.

• The photo serves exclusively the statutory registration and verification obligation.
• It is visible only to the host — not in the guestbook, not in exports, not to third parties.
• Metadata (e.g. GPS location in the photo) is removed automatically on upload.
• The photo is deleted automatically twelve months after departure.

Legal basis: Art. 6(1)(c) GDPR in conjunction with § 30 BMG.

7. Communication and guest service

Messages you send us via the booking portal or by email to info@lionstay.de are processed to answer your enquiry and to look after your stay (Art. 6(1)(b) GDPR).

In order to look after returning guests well, we may store short service notes about your stay (e.g. room preferences). The legal basis is Art. 6(1)(f) GDPR (legitimate interest in good guest service). These notes and the email correspondence are deleted automatically twelve months after your last departure, provided no new booking exists and no statutory retention obligation applies.

For sending emails we use the service Brevo (Sendinblue GmbH, Berlin) as a processor.

8. Invoices and payment data

Invoice and booking data are subject to commercial and tax retention obligations (§ 147 AO — German Fiscal Code, § 257 HGB — German Commercial Code) and are stored for the statutory period (eight or ten years respectively). Payments are handled via the relevant booking portal or by bank transfer to our business account; we do not store credit card data.

If you request an invoice in the online check-in, we process the billing address and invoice email address you provide in order to issue the invoice and send it to you (Art. 6(1)(b) GDPR), and we store them for the statutory retention periods (§ 147 AO — German Fiscal Code, § 14b UStG — German VAT Act). This invoice data is not deleted together with the registration data.

Legal basis: Art. 6(1)(c) GDPR.

9. AI-assisted handling of enquiries

For fast handling we use AI services for incoming email enquiries and when drafting replies (Anthropic, USA, on the basis of a data processing agreement and certification under the EU-U.S. Data Privacy Framework; transfer pursuant to Art. 46 GDPR).

Important in this respect:

• There is no automated decision-making within the meaning of Art. 22 GDPR. Every reply is reviewed and approved by a human before it is sent.
• The services receive only the content required for handling; under the agreements this content is not used to train AI models.
• ID photos and registration data are not transmitted to AI services.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in efficient handling of enquiries). You may object to this processing at any time (see section 11); your enquiry will then be handled entirely manually.

10. Retention periods (overview)

11. Your rights

You have the following rights regarding your personal data:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)

To exercise these rights, simply contact info@lionstay.de. You also have the right to lodge a complaint with a data protection supervisory authority; the authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW — State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia), Kavalleriestraße 2–4, 40213 Düsseldorf, www.ldi.nrw.de.

Providing the registration data is required by law; without it we may not carry out the accommodation. All other information is voluntary.

12. Data security

All pages are delivered exclusively over an encrypted connection (TLS/HTTPS). Access to guest data is restricted to the host and protected against unauthorised access; sensitive data such as ID photos are additionally excluded from the guestbook and from exports. We protect our systems with regular backups and keep them technically up to date.

13. Changes

We adapt this privacy policy when our processing or the legal situation changes. The version published on this page at the time applies.