Privacy Policy

1. Responsible Party

The party responsible for data processing on this platform is:

TRIMOSA Apartments & Homes eGbR
Feldkirchener Str. 18a
85622 Weißenfeld
E-Mail: mail@trimosa.de

The responsible party is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data.

2. General Information and Legal Basis

We process personal data in accordance with the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). The legal bases for processing depend on the purpose: fulfilment of a contract or pre-contractual measures (Art. 6 para. 1 lit. b GDPR), compliance with legal obligations (Art. 6 para. 1 lit. c GDPR), your consent (Art. 6 para. 1 lit. a GDPR), and our legitimate interests in secure and proper operation of the platform (Art. 6 para. 1 lit. f GDPR).

Data transmission on the Internet (e.g. when communicating by email) may have security vulnerabilities. Complete protection of data against access by third parties is not possible. This website uses TLS encryption to protect transmission (recognisable by "https://" and the lock symbol in the browser).

3. Hosting and Provision (Vercel)

This platform is hosted with Vercel Inc. (USA). When the website is accessed, technically necessary data (including IP address, date and time of access, page accessed, browser type and operating system) is processed in server log files to ensure page delivery and guarantee technical security. The legal basis is Art. 6 para. 1 lit. f GDPR. Data is transferred to the USA; this is based on the EU Commission's Standard Contractual Clauses.

To improve our services, we also use Vercel Web Analytics, a privacy-friendly reach measurement tool. No cookies are set, no cross-device profiles are created and no IP addresses are stored permanently; the evaluation is carried out anonymously (e.g. page views, country of origin, device type). The legal basis is Article 6 (1) lit. f GDPR (legitimate interest in statistical evaluation of usage without interference in privacy).

4. Database, Login and Storage (Supabase)

For user accounts, login, database and file storage (e.g. profile and object photos), we use Supabase (Supabase Inc., USA). Data is stored in a data centre within the European Union (Frankfurt region, Germany). The legal basis is contract fulfilment (Art. 6 para. 1 lit. b GDPR) and our legitimate interest in secure operation (Art. 6 para. 1 lit. f GDPR).

For login, technically necessary cookies are set to maintain your session (see section "Cookies").

5. Registration and User Account

During registration, we collect the data required for account administration and booking processing: name or company name, address, telephone number, email address, chosen display name, and – for businesses – the VAT ID. For users with host functionality, we may additionally process billing and bank details (including IBAN, BIC) insofar as this is necessary for payouts and invoicing. The legal basis is Article 6(1)(b) GDPR.

6. Booking Processing and Channel Manager (Smoobu)

To manage availability, prices and reservations, as well as to synchronise with connected booking channels, we use the channel manager Smoobu (Smoobu GmbH, Berlin, Germany). During a booking, the data required for the reservation (including name, contact details, check-in and check-out dates, number of guests) is transmitted to Smoobu and – if an accommodation is also offered via external booking portals – is reconciled with these channels to prevent double bookings. The legal basis is contract performance (Article 6(1)(b) GDPR).

To provide access to the accommodation, we use electronic door locks from Nuki Home Solutions GmbH (Graz, Austria). To provide a personal access code for your stay, we only transmit the validity period of the code and an internal booking reference to Nuki – no guest name or contact details. The legal basis is contract performance (Article 6 (1) lit. b GDPR).

7. Payment Processing (Stripe)

Payments are processed via the payment service provider Stripe (Stripe Payments Europe, Ltd., Ireland; potentially with involvement of Stripe, Inc., USA). To process a payment, the required payment and order data (including name, amount, payment method details) is transmitted directly to Stripe and processed there. We do not ourselves receive or store complete credit card data. The legal basis is contract performance (Article 6(1)(b) GDPR). Transmission to the USA may occur, which is based on the EU Commission's Standard Contractual Clauses. Further information: stripe.com/de/privacy.

8. Email Dispatch (Resend)

For the dispatch of transactional emails (such as booking confirmations), we use the service Resend (USA). This involves processing the recipient's email address and the content data necessary for dispatch. The legal basis is contract performance (Article 6(1)(b) GDPR) or our legitimate interest in reliable communication (Article 6(1)(f) GDPR). Transmission to the USA is based on the EU Commission's Standard Contractual Clauses.

9. Map Display (CARTO, OpenStreetMap, Google Maps)

To display the location of accommodations, we use map services. Our maps use map tiles from CARTO (CartoDB Inc., USA) based on OpenStreetMap data; alternatively, tiles can be loaded via the tile service of the OpenStreetMap Foundation (United Kingdom). On detail pages, a map embedded via Google Maps (Google Ireland Limited, Ireland) may additionally be displayed. When loading maps, your IP address is transmitted to the respective provider, which is technically necessary to deliver the map. The legal basis is our legitimate interest in an attractive location display (Article 6 (1) lit. f GDPR).

10. Embedded Cycle Tours (Komoot)

On our regional pages, we offer selected cycling routes from the Komoot service (komoot GmbH, Friedrich-Ebert-Straße 28, 14469 Potsdam, Germany) for inspiration. These contents are integrated in a privacy-friendly manner as a so-called two-click solution: When you access the page, only a local placeholder is initially displayed and there is no connection to Komoot. Only when you actively click on "Load Tour" is the interactive tour map from komoot.com loaded; your IP address is transmitted to Komoot and Komoot can set its own cookies. The legal basis is your consent through clicking (Art. 6 para. 1 lit. a GDPR). Further information can be found in Komoot's privacy policy.

11. Display of guest reviews from external platforms

On our accommodation pages, we display guest reviews that guests have publicly published on booking platforms (Airbnb, Booking.com, FeWo-direkt/Vrbo) and on Google. We take the information publicly available there (first name or displayed name, profile picture if applicable, review text, star rating and date) into our database and present them bundled with source information. We obtain Google reviews via Google's official interface (Places API); reviews from other platforms are read from publicly accessible pages by our technical service provider Apify Technologies s.r.o. (Prague, Czech Republic, EU). The legal basis is our legitimate interest in transparently presenting the quality of our accommodation based on reviews already publicly available (Art. 6 para. 1 lit. f GDPR). As a reviewer, you can object to the display of your review on our page at any time (Art. 21 GDPR) – an informal message to mail@trimosa.de is sufficient; we will remove the review immediately.

12. AI-supported processing of messages and texts

To reliably support guests from different countries, we use AI assistance. With this, we automatically translate incoming and outgoing messages (so you can write in your language and we reply in your language), create response suggestions for our team, summarise published guest reviews, derive improvement measures for our accommodations from them and extract the required information from booking or invoice emails sent to us. The content of your messages and emails to us, your name or display name and information about your booking (accommodation, period, number of people) are processed.

The service provider is Anthropic PBC (San Francisco, USA), which processes the content as a processor according to our instructions; according to the provider's information, content transmitted via the programming interface used is not used to train AI models. For data transmission to third countries, see section 18. The legal basis is the performance of the accommodation contract including communication with you (Article 6 (1) lit. b GDPR) as well as our legitimate interest in clear, fast support and quality assurance of our accommodations (Article 6 (1) lit. f GDPR).

Simple messages (for example thanks, questions about WiFi, check-in times, parking or amenities, or notification of your arrival time) are answered partly automatically by our system: The AI formulates the answer exclusively on the basis of information about your accommodation and booking, a second AI model checks it, and our team is notified before sending and can change or stop the answer within 15 minutes. Decisions with legal effect for you – such as regarding prices, cancellations, refunds, booking changes or complaints – are always made by a human; an automated decision within the meaning of Art. 22 GDPR does not take place. Automatically sent service messages are otherwise based on templates written by us. You can object to the processing pursuant to Art. 21 GDPR; an informal message to mail@trimosa.de is sufficient – we will then support you without AI assistance.

13. Telephone AI assistant

When you call our service number, the call is answered by an AI-supported assistant. At the beginning of the call, this explicitly points out that it is a digital assistant. Your phone number (if transmitted – we use it exclusively to assign your request to your booking), the content of the call and a text version (transcript) and summary created from it are processed. If you ask for a message to be left for the team, we store this message together with your name and your request.

For telephony and voice processing we use Twilio Inc. (USA) and ElevenLabs Inc. (USA); the evaluation of the call afterwards (summary, assignment to booking) is carried out via Anthropic PBC (USA). These providers process the data exclusively as processors according to our instructions; for data transmission to third countries see section 18. The legal basis for existing bookings is the performance of the accommodation contract (Article 6 (1) lit. b GDPR), otherwise our legitimate interest in telephone availability around the clock (Article 6 (1) lit. f GDPR).

We use conversation logs to process your enquiry and improve the response quality of our assistant; technical insights are derived from the logs (e.g. how to answer frequently asked questions) – access codes and personal information are not included in this evaluation. Automated decision-making with legal effect or profiling does not take place. If you prefer not to speak with an AI, you can reach us at any time by email at mail@trimosa.de or you can request a callback from a team member during the conversation. You can object to the processing under Art. 21 GDPR and request deletion of the conversation log.

14. Cookies

We use exclusively technically necessary cookies that are required for logging in and maintaining your session. These cookies do not require consent; the legal basis is § 25 para. 2 TTDSG in conjunction with Art. 6 para. 1 lit. f or lit. b GDPR. We do not use analytics, tracking or marketing cookies.

15. Protection against misuse (rate-limiting)

To protect against automated misuse (e.g. mass registration or booking attempts), we temporarily store a counter value in connection with your IP address or user ID for certain requests. This data is used only to prevent misuse and is deleted regularly. The legal basis is our legitimate interest in the security of the platform (Art. 6 para. 1 lit. f GDPR).

16. Storage duration

We store personal data only as long as it is necessary for the stated purposes or as required by legal retention periods (in particular commercial and tax law periods of up to ten years). After that, the data is deleted.

17. Your rights

Within the scope of legal provisions, you have at any time the right to free information about your stored personal data (Art. 15 GDPR), to rectification (Art. 16 GDPR), to erasure (Art. 17 GDPR), to restriction of processing (Art. 18 GDPR), to data portability (Art. 20 GDPR) and a right to object to processing (Art. 21 GDPR). You can withdraw any consent given at any time with effect for the future. You can contact us at any time for this purpose as well as for any other questions mail@trimosa.de apply.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement.

18. Data transfer to third countries

Some of the services used (including Vercel, Stripe, Resend, Google, CARTO, Anthropic, Twilio, ElevenLabs) may transfer personal data to countries outside the EU/EEA – particularly to the USA. In these countries, there may not be a level of data protection comparable to the EU. Insofar as such a transfer takes place, it is based on appropriate safeguards, in particular the standard contractual clauses of the EU Commission.