Privacy policy

1. Controller

Controller within the meaning of the GDPR and other national data protection laws as well as other data protection regulations:

UnicHomes GmbH
Frankfurter Straße 7
36043 Fulda
Email: info@oh-key.de

2. Access data / server log files

Visiting the website involves processing connection data needed to provide the service. This includes your IP address, access time, requested page, browser, operating system and, where available, referring page. We use these data to deliver the website, diagnose errors and prevent misuse. The legal basis is Art. 6(1)(f) GDPR, reflecting our legitimate interest in secure, reliable operation. Retention depends on the operational and security purpose. Data relating to a specific security incident may be needed until the incident is resolved and, where applicable, for legal claims.

3. Cookies and similar technologies

Storing information on your device is subject to section 25 TDDDG. Strictly necessary storage relies on section 25(2) no. 2 TDDDG. We save your cookie choice in local browser storage so it is respected on subsequent visits. It remains there until you change it or delete your browser data.

We use analytics technologies only with your consent (section 25(1) TDDDG and Art. 6(1)(a) GDPR). You can change or withdraw your choice at any time using “Cookie settings” in the footer and selecting “Necessary only”. The website and booking entry remain available without analytics consent.

4. Google Analytics 4 (only with consent)

With your consent, we use Google Analytics 4 provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It records page views, interactions with booking links, and browser and device information using pseudonymous identifiers. We use the reports to improve content and usability. The legal basis is Art. 6(1)(a) GDPR. The Google Analytics script is not loaded before you consent.

Google states that Google Analytics 4 does not log or store IP addresses. Approximate location information may nevertheless be derived from the connection. This does not automatically anonymise other usage data. Your consent is used for statistics; it does not enable advertising storage or advertising personalisation.

Withdrawal through “Cookie settings” takes effect for the future and does not affect the lawfulness of earlier processing. Selecting “Necessary only” disables analytics. You may also delete analytics cookies through your browser settings at any time. Pseudonymous usage data are retained only as long as needed for the analytics purpose, then deleted or aggregated.

Google LLC in the USA may participate in processing. Transfers outside the European Economic Area are possible. Such transfers are subject to Art. 44 et seq. GDPR, particularly an applicable adequacy decision or appropriate safeguards such as EU Standard Contractual Clauses. You can contact us for information about the safeguards used.

5. Booking flow via my.oh-key.de

When you click a booking button you are forwarded to my.oh-key.de . Booking and guest services are provided through the platform of likeMagic AG, Dübendorf, Switzerland. Your selected dates, guest count and property are passed to the offer search. Contact, booking and, where applicable, payment data you enter later are processed to arrange and provide your stay (Art. 6(1)(b) GDPR). Payment providers involved in your selected payment method receive the data needed to process payment. Further information is available during the booking and payment process.

6. Apaleo (property management system)

We use Apaleo as our property management system to manage availability, reservations and stays. Website availability queries pass through our server and use your selected dates and property. Guest and reservation data needed to perform the booking contract are processed under Art. 6(1)(b) GDPR. Data required for statutory record-keeping and accounting obligations are processed under Art. 6(1)(c) GDPR.

7. Your rights

Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction and data portability (Art. 15–20 GDPR). You may withdraw consent at any time for the future. You may object to processing based on legitimate interests on grounds relating to your particular situation (Art. 21 GDPR). To exercise these rights, use the contact details above.

You may lodge a complaint with a supervisory authority, particularly where you live, work or believe an infringement occurred. Our competent authority is the Hessian Commissioner for Data Protection and Freedom of Information.

8. Hosting

We use Vercel to host and deliver the website. The hosting service processes connection data necessary to provide and secure it, on the basis of Art. 6(1)(f) GDPR. Providers outside the European Economic Area may participate in processing; transfers are subject to Art. 44 et seq. GDPR. Processing on our behalf is governed by Art. 28 GDPR.

9. Contact and statutory obligations

If you contact us by email or phone, we process your contact details and enquiry to respond. Booking-related enquiries rely on Art. 6(1)(b) GDPR; other enquiries rely on Art. 6(1)(f) GDPR and our interest in responding. Statutory obligations such as accounting, tax retention and the tourism contribution rely on Art. 6(1)(c) GDPR. Required information may be disclosed to competent authorities. Without the data required for a booking, we cannot perform the contract.

10. Retention and external links

We delete personal data when their purpose ends unless statutory retention obligations or legitimate grounds for establishing, exercising or defending legal claims require further retention. In particular, commercial and tax retention rules apply to booking and accounting records. Linked sites such as Google Maps and booking platforms process data under their own privacy notices when you visit them. Fonts and apartment images are delivered through this website.