Privacy policy

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:
Kevin Deobald, Pension Mariposa Weimar, Obere Schlossgasse 3, 99423 Weimar
Telephone: +49 3643 7737060 · E-mail: mail@mariposa-weimar.de

2. Accessing the website

When you access the website, the web server processes technically necessary information (IP address, date and time, page accessed, amount of data transferred, browser and operating system) in server log files. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and stable operation of the website. The transmission is encrypted using TLS.

Fonts and all other components of the website are delivered from our own server. No analytics or advertising services are used and no content is loaded from third-party providers.

3. Cookies and consent

We only use technically necessary cookies: a session cookie so that forms (contact, login to the guest portal) work securely – it is deleted when you close your browser or when the session expires – and the cookie “einwilligung”, which stores your selection in the cookie notice for six months (content: version, selected categories, time; no identifier for recognising you). The legal basis is Section 25(2) no. 2 TDDDG and Art. 6(1)(f) GDPR.

We do not currently embed content from other providers (for example maps or videos). Should we do so in future, we will only load it after you have given your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR); until then, a placeholder will be shown in its place.

You can change or withdraw your selection at any time via the “Cookie settings” link at the bottom of every page.

4. Contact form and e-mail

If you write to us, we process the information you provide (name, e-mail address, telephone number, message) in order to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR (pre-contractual enquiry) or Art. 6(1)(f) GDPR. The data are deleted once they are no longer required for processing your enquiry and no statutory retention obligations apply.

5. Online booking

For bookings, we forward you together with your travel dates (arrival and departure) to our booking system RoomRaccoon (RoomRaccoon B.V., the Netherlands). There you enter your details for the booking; RoomRaccoon’s privacy notice also applies. The legal basis is Art. 6(1)(b) GDPR.

For your stay, we process your contact details and address, the period of travel, the number of guests and the information you provide about your stay. The legal basis is Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR (legal obligations, such as the registration requirement under the German Federal Registration Act and retention for tax purposes). We retain invoicing data for up to ten years in accordance with the retention periods under commercial and tax law.

6. Online payment

If you pay online with us, for example when purchasing a gift voucher, we use the following payment services.

If you pay online by card or direct debit, the payment is processed via Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland). You enter your payment details directly with Stripe; we only receive confirmation of the payment and the information required for accounting. The legal basis is Art. 6(1)(b) GDPR. Stripe’s privacy notice also applies: stripe.com/de/privacy.

If you pay with PayPal, the payment is processed via PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg). For this purpose, we transmit to PayPal the amount, the booking or order number and a brief description of the service; you enter your login and payment details directly with PayPal. We only receive confirmation of the payment and the information required for accounting. The legal basis is Art. 6(1)(b) GDPR. PayPal’s privacy notice also applies: paypal.com/de/legalhub/paypal/privacy-full.

7. Culture promotion levy

For the culture promotion levy (Kulturförderabgabe) of the City of Weimar, we are obliged to record the number of guests and overnight stays subject to the levy and to declare them to the city (Art. 6(1)(c) GDPR).

8. Your rights

You have the right of access, rectification, erasure, restriction of processing and data portability, as well as the right to object to processing based on Art. 6(1)(f) GDPR. You may also lodge a complaint with a data protection supervisory authority, for example the Thuringian State Commissioner for Data Protection and Freedom of Information (Thüringer Landesbeauftragter für den Datenschutz und die Informationsfreiheit).