Privacy notice

Controller and scope #

The controller is Xsigns GmbH & Co. KG, Clärenore-Stinnes-Straße 15, 27283 Verden (Aller), Germany. Please address privacy enquiries to info@xsigns.de.

This notice covers the public Vacarema website. It does not cover processing within the management application, such as booking or guest data.

Providing the website #

Accessing the website involves processing technical connection data, including IP address, time, requested address, browser and connection information. This supports delivery, stability and security. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is operating this website securely.

Technical service providers may process data for hosting and operation. Data is retained only as long as necessary for its purpose or to meet statutory obligations.

Privacy preferences #

After your confirmation, we store your privacy preferences in your browser’s local storage under vacarema.privacy-preferences. The entry contains your selection, the preference version and the time it was saved, but no visitor identifier. It lets us respect your decision on subsequent page views.

Your choice is valid for 180 days in this browser and on this domain. We ask again after that period or when the version changes. You can reopen the settings at any time using the “Privacy” button at the bottom right. You can also delete the entry through your browser’s website data settings. No optional services are currently integrated.

Email and contact form #

When you contact us by email, we process your contact details and message to handle your enquiry. The legal basis is Article 6(1)(b) GDPR for contract-related enquiries, otherwise Article 6(1)(f) GDPR based on our interest in answering enquiries. Access is limited to the people handling the enquiry and technical service providers involved.

The displayed contact form does not currently transmit input. Sending is disabled. This website neither stores the entries nor sends them to us. Email contact is available independently.

Correspondence is deleted when handling is complete unless statutory retention obligations or another necessary processing purpose apply.

Google reCAPTCHA #

Google reCAPTCHA helps identify automated access and abusive form submissions. The service is not currently active on this website: neither loading a page nor selecting the existing checkbox loads reCAPTCHA or sends data to Google through that service. Form submission remains disabled.

When activated, reCAPTCHA processes technical information and interaction signals to assess risk. This may involve transmitting connection, browser and device information to Google. When executed, the service sets the _GRECAPTCHA cookie for risk analysis.

Before enabling the service, we intend to obtain prior, voluntary consent directly at the form. The legal bases are Article 6(1)(a) GDPR and Section 25(1) TDDDG for storing information on, or accessing information from, your device. reCAPTCHA is to remain unloaded without that consent. Email contact remains available independently.

Before enabling the service, we will add details of the specific Google contracting entity, processing and retention conditions, possible international transfers and their safeguards, and the technical way to withdraw consent. Withdrawal takes effect for the future and does not affect the lawfulness of processing based on consent before withdrawal.

Fonts, images and external links #

Fonts and images are served directly by this website. No external analytics or advertising trackers are integrated. The public website currently does not set its own analytics cookies.

Following an external link takes you to another provider. Processing on the destination website is governed by that provider’s privacy information.

WhatsApp channel #

Our website links to the Vacarema channel on WhatsApp. Loading this website does not establish a connection to WhatsApp or Meta through that link. The WhatsApp logo is served from our own server; no WhatsApp widget or embedded channel is integrated.

Only when you click the link do you open WhatsApp’s service. Its provider processes data under its own privacy information, for example technical connection data and, where applicable, data about your WhatsApp account and use of the channel. Clicking the link does not automatically make you follow the channel.

Using the channel is voluntary and is not required to use our website or contact us. Details of WhatsApp’s processing are available in the privacy information linked below.

WhatsApp privacy policy (European Region) (opens in a new tab)

Your rights #

Subject to statutory conditions, you have rights of access, rectification, erasure, restriction and data portability. Where processing relies on consent, you may withdraw it for the future.

You may object to processing based on legitimate interests on grounds relating to your particular situation. You may also complain to a data protection supervisory authority, especially where you live, work or suspect an infringement. The authority for Lower Saxony is the Landesbeauftragte für den Datenschutz Niedersachsen.

Use of this information website does not involve automated decision-making producing legal or similarly significant effects on you.

Campaign links and website administration #

When a QR campaign link is opened, we record the time, campaign and link identifiers, and broad categories for browser, operating system, device and known bots. The campaign report does not store IP addresses or the full browser user-agent value. It does not create visitor profiles, count unique people or set analytics cookies. Reports are processed on our server; technical server logs are separate.

After sign-in, the protected administration area uses a technically necessary session cookie lasting eight hours, solely for authentication. Signing out revokes the session.