Privacy Policy

Protecting your personal data is important to us. Personal data is any information that can be used to identify you directly or indirectly.

This Privacy Policy informs you about what data we collect, process and use, and about your rights under the General Data Protection Regulation (GDPR).

Providing your data: To conclude and perform a contract we need the information marked as mandatory in the order or registration form. Without it we cannot enter into a contract with you. All other information is voluntary.

No automated decision-making: We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

When you visit our website, your browser automatically transmits information to our server, which is temporarily stored in so-called log files. This data includes:

• IP address (anonymised or partial)
• Date and time of access
• Name and URL of the file accessed
• Website from which access originated (referrer)
• Browser type and operating system
• Volume of data transferred

Purpose: To ensure the operation, security and functionality of the website.

Legal basis: Legitimate interests pursuant to Art. 6(1)(f) GDPR.

If you contact us via a contact form or by email, we process the data you enter (e.g. name, email address, subject, message) in order to handle your enquiry.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract or pre-contractual measures) and Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries).

Our website may use cookies and similar technologies where these are technically necessary or where you have previously consented (e.g. session cookies, consent management tools).

You may withdraw your consent at any time. Further information can be found in our Cookie Policy.

We currently use no web analytics and no tracking services. We do not create usage profiles and do not embed third-party analytics services. Should that change, we will update this privacy policy and obtain your consent in advance where required.

Our website is hosted with Cloudflare. The provider is Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA.

To operate our website we use in particular Cloudflare Pages (hosting) and Cloudflare R2 (object storage for images). Data processing takes place on the infrastructure provided by Cloudflare, with content stored in data centres within the European Union insofar as this is technically provided for and configured by us accordingly.

When you access our website, Cloudflare processes technical connection data (e.g. IP address, time of access and browser information) to the extent necessary for the provision, stability and security of the website.

A Data Processing Agreement pursuant to Art. 28 GDPR is in place with Cloudflare.

Because Cloudflare is a company based in the USA, a transfer of personal data to the USA cannot be entirely ruled out. Where such a transfer takes place, it is based on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework and — where required — on the Standard Contractual Clauses adopted by the European Commission pursuant to Art. 46 GDPR.

We operate the host portal and its database on servers of IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, in data centres in Germany. A Data Processing Agreement pursuant to Art. 28 GDPR is in place with IONOS.

We manage the source files of the host websites we create in repositories at GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA. Here too, a transfer of personal data to the USA cannot be entirely ruled out; it is based on the EU-U.S. Data Privacy Framework and — where required — on the Standard Contractual Clauses pursuant to Art. 46 GDPR.

To send emails — both transactional emails (e.g. booking confirmations, notifications) and newsletter and marketing emails — we use Brevo (Brevo SAS, Paris, France) as a processor. A Data Processing Agreement pursuant to Art. 28 GDPR is in place with Brevo. Brevo records technical delivery data when sending. We do not evaluate open or click behaviour and do not create usage profiles from it.

Within our host portal we process personal data that our customers (hosts) enter in order to manage their holiday accommodation (e.g. guest data, bookings and communication data). This processing is carried out exclusively on behalf of the respective host.

In this respect, Better Projects Faster GmbH acts as a processor pursuant to Art. 28 GDPR. Details follow from the data processing agreement concluded between us and the respective host.

The controller for this data is the respective host. Data subjects — in particular guests — should therefore address requests for access, rectification or erasure to the host they are dealing with. We forward any requests that reach us to the responsible host.

Our staff only access data in the host portal if the host has granted access beforehand. Such a support session is time-limited, restricted to read access and logged. The host can revoke it at any time.

Within our company, only those persons who need access to your data in order to fulfil our contractual and legal obligations will receive it.

In addition, service providers (e.g. IT service providers, hosting providers) may act as processors. Data is not passed on to uninvolved third parties unless we are legally obliged to do so.

To send transactional as well as newsletter and marketing emails, we pass your email address to our email service provider Brevo (Brevo SAS, Paris, France), who acts as a processor in this respect on the basis of a data processing agreement pursuant to Art. 28 GDPR. Brevo records technical delivery data when sending. We do not evaluate open or click behaviour and do not create usage profiles from it.

We retain personal data only for as long as is necessary for the purposes for which it is processed, or for as long as statutory retention obligations exist.

Server log files: We delete them as soon as they are no longer needed to analyse faults and security incidents. In the event of a specific security incident we keep the affected log files until it has been resolved.

Customer account and contract data: For the term of the contract. After it ends your data is available for export for 30 days; we then delete it unless a statutory retention obligation applies.

Change history for landlord data: We retain these change logs for 12 months from the time of the respective change; after that we delete them automatically. In the event of a specific security incident or legal dispute, we may suspend deletion; any such suspension is documented with its occasion, scope, duration and the person who ordered it. This rule applies to landlord data for which we are ourselves the controller (account, contract, communication with us). For data that landlords record in the portal about their guests, the landlord remains the controller; there we process only on their behalf (see Section 8).

Invoices and booking records: 8 years (§ 147 AO, § 257 HGB).

Contracts and business correspondence: 6 years (§ 257 HGB). For orders, the rule under “Orders” applies.

Enquiries from prospects: 3 years after the last contact if no contract is concluded.

Trial account: Deleted or anonymised with the next daily clean-up run after the trial ends, usually within 24 hours (see section 11).

Order requests before confirmation: Until you confirm your order, we store your entries from the order form only as an order request. We keep them at most until the nightly clean-up run on the day after the most recently sent link has expired, and then delete them automatically. The link is valid for 24 hours by default; the period is configurable. If you request the link again, the period starts again. An unconfirmed request does not create an order. If you confirm, we delete your email address and your entries from the request at once. Only a technical record without your entries remains (identifier, language, timestamps, reference to the order). The nightly run also deletes this record after the link period has expired.

Order confirmation proof: When you confirm your order, we store the time of the confirmation together with your email address. We also store your IP address as a hash value, not in plain text. The legal basis is our legitimate interest in proving that the contract was concluded and in defending against legal claims (Art. 6(1)(f) GDPR). If there is a link to a customer account (we create a customer from your order), we keep the proof while the contract runs. After that we keep it for a further 3 years, counted from the end of the calendar year in which the contract ends (limitation period, § 195 BGB). If there is no link to a customer account, we keep the proof for 3 years from the confirmation.

Orders: If there is a link to a customer account, we store order data (e.g. name, address, email address, selected package, time of the order) while the contract runs. After that we store it for 10 years from the end of the calendar year in which the contract ends. If there is no link to a customer account, we store the order data for 10 years from the end of the calendar year in which we received the order. We set the period of 10 years ourselves. It is longer than the statutory minimum periods (§ 257 HGB, § 147 AO). Legal bases: Art. 6(1)(c) GDPR for the statutory obligations and Art. 6(1)(f) GDPR for the longer period.

Newsletter and marketing emails: Data that we process on the basis of your consent for sending newsletter and marketing emails is retained until you withdraw your consent. After a withdrawal, we retain your email address as well as the timestamps of the consent and the withdrawal for a further three years as proof of the consent originally given (Art. 7(1) GDPR). The legal basis for this retention is our legitimate interest in defending against legal claims pursuant to Art. 6(1)(f) GDPR.

You can try our service free of charge and without obligation for 14 days. As part of the "Try for free" workflow, we process the data you provide in order to set up access to the host portal and a demo website for you.

Data collected:

• Host's email address (for login and communication)
• Name
• Technical data on the use of the trial access (e.g. IP address, timestamps)

Data you may optionally enter: In addition, during the trial you can enter further data into the host portal (e.g. address, property descriptions, photos). Entering this data is voluntary and not required to use the trial access. This data is processed solely to provide the trial features.

Purpose: Provision of free trial access to the host portal and demo website.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures). In addition, when starting the trial you may consent to receiving marketing emails (Art. 6(1)(a) GDPR, see section 13). That consent is voluntary and not required for the trial access.

End of the trial: After the trial period ends, all accesses are deactivated. You can no longer log in to the host portal, and the demo website is taken offline.

Automatic deletion or anonymisation: Shortly after the 14-day trial expires, the personal data collected during the trial — including apartment master data — is deleted or anonymised. Clean-up runs automatically with the next daily clean-up job after the trial ends, usually within 24 hours; there is no additional grace or waiting period. Personal content (e.g. name, email address, property data, photos) is irreversibly removed or anonymised. Anonymous, non-personal statistical data (e.g. trial start and end and the status of the trial access) may be retained for internal statistics and analysis; this data no longer allows any conclusions about your identity and is therefore considered deleted within the meaning of Art. 17 GDPR.

Note: If you take out a paid subscription, you create a new account and receive a new host portal and a new website. Trial data is not carried over.

Purpose: If you have consented, we send you newsletter and marketing emails with news about our product, tips on renting out holiday apartments, and offers. Recipients are prospects who have consented and subscribers to our newsletter.

Consent and double opt-in: For newsletter sign-ups via our website we use the double opt-in procedure: after you sign up, we send you a confirmation email, and only once you click the confirmation link it contains do we add you to the mailing list and send you marketing emails. Prospects who try our service for free instead give their consent via a checkbox when starting the free trial; this consent takes effect immediately. In either case, you can withdraw your consent at any time using the methods described below.

Legal basis: Your consent pursuant to Art. 6(1)(a) GDPR.

Email service provider: To send newsletter and marketing emails, we use Brevo (Brevo SAS, Paris, France) as a processor pursuant to Art. 28 GDPR. Brevo records technical delivery data when sending. We do not evaluate open or click behaviour and do not create usage profiles from it.

Withdrawal: You can withdraw your consent at any time with effect for the future (Art. 7(3) GDPR) — either via the unsubscribe link at the end of every marketing email or by email to [email protected]. After withdrawal, you will not receive any further marketing emails. The lawfulness of processing carried out up to the withdrawal remains unaffected.

Data collected: In the order form we collect: customer type (private individual or business), selected package, for businesses company name and VAT ID, salutation, first and last name, address (street, postcode, city, country), email address and, if applicable, phone number. We also store the language of the page and your declarations on the Terms and Conditions, privacy policy and data processing agreement, for private individuals also on the right of withdrawal, each with the time and the version of the text. For private individuals we store your express consent that we begin performing the contract before the withdrawal period expires. For businesses we store your confirmation that you are acting as a business operator. In addition we store the order number, the time of the order, the processing status and the times at which we sent the emails. Mandatory fields are marked in the form (see section 1).

Confirmation link (double opt-in): Submitting the form does not yet create an order. We first store your entries only as an order request and send you an email with a confirmation link. Only when you open the link in the email and click “Confirm now” on our page is the contract concluded and your order created. You then receive your order confirmation by email. If you do not confirm, no order is created, and we delete your entries (see section 9).

Purpose and legal basis: We process the data to receive your order and to perform the contract (Art. 6(1)(b) GDPR). We store the proof of your confirmation on the basis of Art. 6(1)(f) GDPR. Section 9 describes how long we keep the order data.

Sending email: We send the confirmation email and your order confirmation through our email service provider Brevo (see sections 5 and 7).

Abuse protection: We limit the number of requests per IP address. For this, our server holds the IP address briefly in memory. We do not store it in the database for this. If an error occurs when you submit the form, confirm your order or request the link again, your IP address may appear in full in a server log. The deletion rule for server log files in section 9 applies to this log. The legal basis is our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR).

Draft in your browser: While you fill in the form, your browser stores your entries locally on your device (Local Storage), so that they are kept when you open the confirmation link in a new tab. We do not receive this data before you submit the form. We do not store consent checkboxes there. If you confirm your order in the same browser, the draft is deleted there automatically. If you confirm in another browser or on another device, it stays in the first browser until you delete your browser data. Details are in our Cookie Policy.