How we process your personal data under GDPR
The controller responsible for data processing under GDPR is:
Stacey Real Estate GmbH
Brooktorkai 7, 20457 Hamburg, Germany
Email: booking@stacey.de
Phone: +49 40 696389600
We process personal data of our users only as necessary to provide a functional website and our content and services. Processing of personal data generally takes place only with the user's consent or where the processing is authorised by legal provisions (Art. 6 (1) GDPR).
When a booking is started, we store the details entered during the booking process, beginning with the name and email address, followed by the further booking data. The legal basis is Art. 6 (1) (b) GDPR (pre-contractual measures taken at the user's request): the stored details allow an interrupted booking to be resumed and allow us to contact the user about their booking. If the booking is not completed, this data is deleted or anonymised in accordance with section 6.
To operate our website and booking process, we use the following service providers. The legal basis is, respectively, Art. 6 (1) (b) GDPR (contract performance) or Art. 6 (1) (f) GDPR (legitimate interest).
Provider: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA
Purpose: Website hosting. Processes server logs (IP address, user agent, referrer, timestamp) to ensure operation and security.
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in secure operation)
Provider: Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992
Purpose: Storage of booking data, tenant master data, rent payments. Server location: EU (Frankfurt).
Legal basis: Art. 6 (1) (b) GDPR
Provider: Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA
Purpose: Sending transactional emails (booking confirmations, contracts, payment information, reminders). To verify that our emails arrive and to detect delivery problems, they contain a tracking pixel that reports the delivery and the first opening of a message (timestamp) to Resend. You can prevent this by blocking the loading of remote images in your email client; the emails remain fully readable.
Legal basis: Art. 6 (1) (b) GDPR; for the open measurement Art. 6 (1) (f) GDPR (legitimate interest in the reliable delivery of our messages)
Provider: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland
Purpose: Processing of the one-time booking fee and of the security payment (credit card, SEPA direct debit and other payment methods); for existing tenancies also of monthly rent payments by SEPA direct debit.
Legal basis: Art. 6 (1) (b) GDPR
Provider: Yousign SAS, 350 rue Saint Sauveur, 14000 Caen, France
Purpose: Legally valid electronic signing of rental contracts.
Legal basis: Art. 6 (1) (b) GDPR
Provider: apaleo GmbH, Rosental 10, 80331 Munich, Germany
Purpose: Management of short stays, reservations, check-in/check-out, billing.
Legal basis: Art. 6 (1) (b) GDPR
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Purpose: Handling of our email correspondence (e.g. booking@stacey.de) and storage of tenancy-related documents in Google Drive. Transfers to Google LLC (USA) are safeguarded by EU Standard Contractual Clauses and the EU-US Data Privacy Framework.
Legal basis: Art. 6 (1) (b) GDPR (correspondence and documents relating to a booking or tenancy), Art. 6 (1) (f) GDPR (efficient handling of enquiries)
Provider: Enable Banking Oy, Otakaari 5, 02150 Espoo, Finland
Purpose: Retrieval of the statements of our own bank account via the PSD2 account information interface to match incoming rent and booking payments. This processes the transaction details visible on our statements (payer name, IBAN, amount, payment reference). Enable Banking is an account information service provider supervised by the Finnish Financial Supervisory Authority; processing takes place in the EU.
Legal basis: Art. 6 (1) (b) GDPR (allocation of your payments), Art. 6 (1) (f) GDPR (orderly accounting)
Provider: Slack Technologies Limited, Salesforce Tower, 60 R801, North Dock, Dublin, Ireland
Purpose: Internal notifications to our team about operational events (e.g. new bookings, payment or check-in issues); these can contain guest names and booking details. No guest communication takes place via Slack. Transfers to the USA are safeguarded by EU Standard Contractual Clauses and the EU-US Data Privacy Framework (Salesforce).
Legal basis: Art. 6 (1) (f) GDPR (internal coordination of our operations)
Provider: Anthropic, PBC, 500 Howard Street, San Francisco, CA 94105, USA
Purpose: AI-assisted pre-sorting of incoming email to our booking inbox (labelling by topic and urgency) and support of internal operational analyses. Content is processed via Anthropic's commercial API under a data processing agreement and is not used to train AI models. Replies to guests are always written or approved by our staff; no automated decision-making within the meaning of Art. 22 GDPR takes place. Transfers are safeguarded by EU Standard Contractual Clauses.
Legal basis: Art. 6 (1) (f) GDPR (efficient handling of booking enquiries)
Provider: Mapbox Inc., 1714 14th Street NW, Washington, DC 20009, USA
Purpose: Embedding of interactive maps to display our locations.
Legal basis: Art. 6 (1) (f) GDPR
Provider: Functional Software, Inc. dba Sentry, 132 Hawthorne Street, San Francisco, CA 94107, USA
Purpose: Technical monitoring for error resolution. Captures stack traces and browser metadata; no personal form data is stored.
Legal basis: Art. 6 (1) (f) GDPR
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Purpose: Embedding of the 'Montserrat' typeface. Loaded locally via next/font, NO connection to Google servers on page load.
Legal basis: Art. 6 (1) (f) GDPR
Provider: Cybot A/S, Havnegade 39, 1058 Copenhagen, Denmark
Purpose: Display and documentation of cookie consent, automatic blocking of non-essential scripts until consent is granted.
Legal basis: Art. 6 (1) (c) GDPR (legal obligation to obtain consent)
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Purpose: Measurement of website usage (pages viewed, sessions, rough geography) to improve our product. IP-anonymisation enabled. Data shared with Google LLC (USA) under SCC + EU-US Data Privacy Framework. Loaded ONLY after explicit consent.
Legal basis: Art. 6 (1) (a) GDPR (consent)
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Purpose: Measurement of ad campaign effectiveness (conversions) and re-targeting to users who previously visited our site. Data shared with Google LLC (USA) under SCC + EU-US Data Privacy Framework. Loaded ONLY after explicit consent.
Legal basis: Art. 6 (1) (a) GDPR (consent)
When you first visit our website, a cookie banner (Cookiebot) asks you to choose which categories of cookies to accept: Necessary, Preferences, Statistics and Marketing. Necessary cookies are set by default, they are required for the website to function (session, security, consent storage).
Statistics and Marketing cookies (Google Analytics, Google Ads) are only set AFTER you actively consent. If you decline, no tracking scripts are loaded. You can change or withdraw your consent at any time via the 'Cookie settings' link in the footer.
We implement Google Consent Mode v2: while you have not consented, no personal identifiers are transmitted to Google. Upon consent, tracking begins.
You have the right to access, rectify, erase, restrict, and receive your personal data, as well as to object to processing. You may withdraw any consent you have given at any time. To exercise these rights, please contact us at booking@stacey.de.
You also have the right to lodge a complaint with a supervisory authority. For Hamburg: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit.
Personal data is deleted as soon as the purpose of processing ceases. For contract-related data, statutory retention periods of up to 10 years apply under German commercial and tax law. Data from booking enquiries that were not completed is anonymised at the latest 12 months after the enquiry is closed; anonymised records serve statistical purposes only and no longer contain personal data.
We reserve the right to update this privacy policy to reflect changes in legal or factual circumstances. Last updated: August 2026.