1. Controller
rest2rent Event GmbH · Stresemannstraße 375, Haus 9 · 22761 Hamburg Represented by the managing director Leonidas Paschalis Phone: +49 40 767 573 47 · Email: info@rest2rent.de
2. Principles
This website sets no tracking or advertising cookies and includes no third-party tracking. For reach measurement we use a self-hosted, cookieless analytics tool (see section "Reach measurement"). Fonts are served locally from our own server. In the customer portal we set exclusively a technically necessary login cookie (see section "Customer portal"). We process personal data only to the extent required to operate the website and to handle your enquiries.
3. Hosting and server log files
The website is hosted by Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) on servers located in Germany; a data processing agreement (Art. 28 GDPR) is in place with the provider. When you visit the website, technically necessary data (IP address, date/time, page accessed, browser type) is processed in server log files. The legal basis is Art. 6(1)(f) GDPR (secure and stable operation). Log files are deleted after no more than 14 days.
4. Contact and event enquiries
If you use our enquiry form or contact us by email or phone, we process the data you provide (e.g. name, contact details, event details, optional budget) to handle your enquiry and prepare a quote. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR. The data is stored in our booking system and deleted once it is no longer required for its purpose and no statutory retention obligations (in particular 6/8/10 years under the German Commercial Code (HGB) and Fiscal Code (AO)) apply.
After you submit the enquiry form, you automatically receive a confirmation of receipt at the email address you provided, with a summary of your details and a reference number. It is sent via Microsoft 365 (see section 7). To prevent misuse, we send no more than three confirmations per email address within 24 hours; to fend off automated requests, your IP address is evaluated briefly in memory and not stored. The legal basis is Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR for misuse protection (legitimate interest in a secure enquiry channel).
5. Customer portal (login cookie)
For customers with an ongoing booking we provide an online portal (access via a personal login link). Upon login we set a technically necessary login cookie ("r2r_portal") that keeps you signed in for up to 14 days. The cookie contains only a random session identifier, serves solely for authentication and is not used for tracking or advertising. Its storage is exempt from consent under Section 25(2) no. 2 TDDDG, as it is strictly necessary for the service you have expressly requested. The legal basis for the associated processing is Art. 6(1)(b) GDPR (performance of a contract). Upon logout or expiry, the session becomes invalid.
6. Debt management and collection
In the event of payment default, we process the necessary contract and payment data (name, address, invoice and claim data, payment history) to enforce outstanding claims, in particular for payment reminders and dunning notices. The legal bases are Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(f) GDPR (legitimate interest in enforcing our claims). If payment is not made despite a reminder, we may transfer this data to a registered debt collection agency or a law firm commissioned with enforcement, and where necessary to courts (Art. 6(1)(f) GDPR). The data is deleted once the claim has been settled and no statutory retention obligations (6/8/10 years under HGB/AO) apply.
7. Email communication (Microsoft 365)
We use Microsoft 365 (Microsoft Ireland Operations Ltd.) for email and calendaring. A data processing agreement including the EU Standard Contractual Clauses is in place with Microsoft; Microsoft is also certified under the EU–U.S. Data Privacy Framework.
8. Reach measurement (Umami)
To analyse website usage statistically, we use Umami — a self-hosted, cookieless analytics tool running on our own server at Hetzner Online GmbH in Germany. No cookies are set and no information is stored on or read from your device; consent under Section 25 TDDDG is therefore not required. Umami does not store IP addresses and does not create cross-device profiles. Only aggregated data that cannot be traced back to you is collected (e.g. pages viewed, referrer, approximate country-level origin, browser and device type). No data is shared with third parties. The legal basis is our legitimate interest in privacy-friendly reach measurement (Art. 6(1)(f) GDPR).
9. Directions map (Google Maps)
On our contact page we embed a directions map from the Google Maps service, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, so that you can see our location and plan your journey. The map is only loaded once you actively click "Load map" (two-click solution). Only then is a connection to Google's servers established; your IP address and technical browser data are transmitted to Google, and Google may use cookies or similar technologies. No data flows before you click. The legal basis is your consent given by clicking (Art. 6(1)(a) GDPR, Section 25(1) TDDDG); you can use the page at any time without loading the map. Data may be transferred to Google LLC in the USA; Google is certified under the EU-U.S. Data Privacy Framework (adequacy decision of the EU Commission, Art. 45 GDPR). Google privacy notice: https://policies.google.com/privacy.
10. 360° tour (werft6)
On our website you can start a virtual 360° tour. It is provided by an external provider (space.werft6.com, werft6). The tour is only loaded once you actively click "Load 360° tour" (two-click solution). Only then is a connection to the provider's servers established and your IP address transmitted to them. The legal basis is your consent given by clicking (Art. 6(1)(a) GDPR). No data is transmitted to werft6 before you click.
11. External links
Our website links to external services (e.g. Google Maps for route planning, our Google review profile). When you follow these links, the privacy policies of the respective providers apply.
12. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing based on Art. 6(1)(f) GDPR (Art. 21). You may withdraw any consent you have given at any time with effect for the future. To do so, please contact info@rest2rent.de.
13. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI), Ludwig-Erhard-Str. 22, 20459 Hamburg.
Last updated: September 2026