How we process your personal data under GDPR
The controller responsible for data processing under GDPR is:
Stacey Real Estate GmbH
Brooktorkai 7, 20457 Hamburg, Germany
Email: booking@stacey.de
Phone: +49 40 696389600
[PLACEHOLDER, replace with vetted generator output.] We process personal data of our users only as necessary to provide a functional website and our content and services. Processing of personal data generally takes place only with the user's consent or where the processing is authorised by legal provisions (Art. 6 (1) GDPR).
To operate our website and booking process, we use the following service providers. The legal basis is, respectively, Art. 6 (1) (b) GDPR (contract performance) or Art. 6 (1) (f) GDPR (legitimate interest).
Provider: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA
Purpose: Website hosting. Processes server logs (IP address, user agent, referrer, timestamp) to ensure operation and security.
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in secure operation)
Provider: Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992
Purpose: Storage of booking data, tenant master data, rent payments. Server location: EU (Frankfurt).
Legal basis: Art. 6 (1) (b) GDPR
Provider: Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA
Purpose: Sending transactional emails (booking confirmations, contracts, payment information, reminders).
Legal basis: Art. 6 (1) (b) GDPR
Provider: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland
Purpose: Processing of membership fee, security payment and monthly rent payments (SEPA direct debit, credit card).
Legal basis: Art. 6 (1) (b) GDPR
Provider: Yousign SAS, 350 rue Saint Sauveur, 14000 Caen, France
Purpose: Legally valid electronic signing of rental contracts.
Legal basis: Art. 6 (1) (b) GDPR
Provider: apaleo GmbH, Rosental 10, 80331 Munich, Germany
Purpose: Management of short stays, reservations, check-in/check-out, billing.
Legal basis: Art. 6 (1) (b) GDPR
Provider: Mapbox Inc., 1714 14th Street NW, Washington, DC 20009, USA
Purpose: Embedding of interactive maps to display our locations.
Legal basis: Art. 6 (1) (f) GDPR
Provider: Functional Software, Inc. dba Sentry, 132 Hawthorne Street, San Francisco, CA 94107, USA
Purpose: Technical monitoring for error resolution. Captures stack traces and browser metadata; no personal form data is stored.
Legal basis: Art. 6 (1) (f) GDPR
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Purpose: Embedding of the 'Montserrat' typeface. Loaded locally via next/font, NO connection to Google servers on page load.
Legal basis: Art. 6 (1) (f) GDPR
Provider: Cybot A/S, Havnegade 39, 1058 Copenhagen, Denmark
Purpose: Display and documentation of cookie consent, automatic blocking of non-essential scripts until consent is granted.
Legal basis: Art. 6 (1) (c) GDPR (legal obligation to obtain consent)
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Purpose: Measurement of website usage (pages viewed, sessions, rough geography) to improve our product. IP-anonymisation enabled. Data shared with Google LLC (USA) under SCC + EU-US Data Privacy Framework. Loaded ONLY after explicit consent.
Legal basis: Art. 6 (1) (a) GDPR (consent)
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Purpose: Measurement of ad campaign effectiveness (conversions) and re-targeting to users who previously visited our site. Data shared with Google LLC (USA) under SCC + EU-US Data Privacy Framework. Loaded ONLY after explicit consent.
Legal basis: Art. 6 (1) (a) GDPR (consent)
When you first visit our website, a cookie banner (Cookiebot) asks you to choose which categories of cookies to accept: Necessary, Preferences, Statistics and Marketing. Necessary cookies are set by default, they are required for the website to function (session, security, consent storage).
Statistics and Marketing cookies (Google Analytics, Google Ads) are only set AFTER you actively consent. If you decline, no tracking scripts are loaded. You can change or withdraw your consent at any time via the 'Cookie settings' link in the footer.
We implement Google Consent Mode v2: while you have not consented, no personal identifiers are transmitted to Google. Upon consent, tracking begins.
You have the right to access, rectify, erase, restrict, and receive your personal data, as well as to object to processing. You may withdraw any consent you have given at any time. To exercise these rights, please contact us at booking@stacey.de.
You also have the right to lodge a complaint with a supervisory authority. For Hamburg: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit.
Personal data is deleted as soon as the purpose of processing ceases. For contract-related data, statutory retention periods of up to 10 years apply under German commercial and tax law.
We reserve the right to update this privacy policy to reflect changes in legal or factual circumstances. Last updated: April 2026.