Privacy policy

1. Controller

Controller responsible for data processing on this website:

Seventeen Living GmbH
Küferstraße 6, 76530 Baden-Baden
Phone: +49 (0) 7221 9228899
Email: hello@boutique-charme.de

2. General information on data processing

We process our users' personal data only to the extent necessary to provide a functioning website along with our content and services. Processing is based on Art. 6 (1) (a) (consent), (b) (performance of a contract), (c) (legal obligation) or (f) (legitimate interest) GDPR.

3. Hosting and server log files

This website is hosted by Vercel Inc. (San Francisco, USA). When you visit our pages, information is automatically stored in server log files:

• Browser type and version
• Operating system used
• Referrer URL
• IP address (anonymised)
• Date and time of access

The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in the technical provision of the website). The data is generally deleted after 30 days.

Vercel may process data in the USA. An adequacy decision of the EU Commission is in place (EU-US Data Privacy Framework). Further information: Vercel Privacy Policy.

4. Cookies

4.1 Strictly necessary cookies

We use strictly necessary cookies that are required to operate the website (e.g. session cookies, theme preference). These are set on the basis of Art. 6 (1) (f) GDPR. No consent is required for them.

4.2 Analytics and marketing cookies

Cookies for analytics or marketing purposes (e.g. Google Analytics, Google Ads) are only set with your express consent (Art. 6 (1) (a) GDPR). Until you consent, all analytics and marketing services are blocked via Google Consent Mode v2. You can withdraw your consent at any time with effect for the future:

Cookie settings

5. Google services

5.1 Google Fonts

This website uses Google Fonts (Cormorant Garamond, Jost, DM Mono). The fonts are embedded locally via next/font and are not loaded from Google servers. No data is transmitted to Google.

5.2 Google Analytics (with consent)

If you consent via the cookie banner, we use Google Analytics 4 (GA4) provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. GA4 uses cookies and creates pseudonymised usage profiles. IP addresses are anonymised (IP anonymisation). The data is processed on servers within the EU.

You can prevent collection by Google Analytics by declining the cookie banner or by installing the browser plug-in Google Analytics Opt-Out . Legal basis: Art. 6 (1) (a) GDPR.

5.3 Google Ads / conversion tracking (with consent)

With your consent, we use Google Ads conversion tracking. If you reach our website via a Google ad, a conversion cookie is set. This cookie is used to measure the success of our ads. No personal data enabling individual identification is transmitted. Legal basis: Art. 6 (1) (a) GDPR.

5.4 Google Maps

We do not embed Google Maps. Maps are displayed via OpenStreetMap (Leaflet), with tiles loaded from openstreetmap.org. In doing so, your IP address is transmitted to the OpenStreetMap Foundation. Legal basis: Art. 6 (1) (f) GDPR.

6. Booking system and payment processing

6.1 Smoobu (property management)

We use Smoobu GmbH, Berlin, Germany to manage bookings and availability. The booking page also embeds Smoobu's booking tool directly; opening that page transmits your IP address to Smoobu. When you make a booking, the following data is transmitted to Smoobu: name, email address, phone number, booking period, number of guests. Legal basis: Art. 6 (1) (b) GDPR (performance of a contract).

6.2 Stripe (payment processing)

Payments are processed by Stripe Payments Europe Ltd., Dublin, Ireland. When paying, you are redirected to the Stripe checkout page. Card details are processed exclusively by Stripe and never reach our server (PCI-DSS compliant). Stripe processes: name, email, payment data, IP address, device information. Legal basis: Art. 6 (1) (b) GDPR.

Further information: Stripe privacy policy.

7. Contacting us

If you contact us by email, phone or WhatsApp, the data you provide (name, email, message content) is stored in order to process your enquiry. The data is deleted as soon as it is no longer required for that purpose. Legal basis: Art. 6 (1) (b)/(f) GDPR.

7.1 WhatsApp (Meta)

We offer the option of contacting us via WhatsApp (Meta Platforms Ireland Ltd.). If you use it, data is transmitted to Meta and may be processed in the USA. Using WhatsApp is entirely voluntary. Legal basis: Art. 6 (1) (a) GDPR.

8. Booking forms

In the booking form we collect: first name, surname, email address, phone number (optional), message (optional), selected apartment and travel dates. This data is processed in order to perform the accommodation contract. Legal basis: Art. 6 (1) (b) GDPR. The data is deleted once the statutory tax and commercial retention periods (6 and 10 years respectively) have expired.

9. Reviews

On our website we display guest reviews from Google and other platforms. The reviews shown contain the reviewer's name and the review text. This data is publicly available on the respective platforms.

10. Your rights

You have the following rights:

• Access (Art. 15 GDPR) — to the data we process about you
• Rectification (Art. 16 GDPR) — of inaccurate data
• Erasure (Art. 17 GDPR) — of your data
• Restriction (Art. 18 GDPR) — of processing
• Data portability (Art. 20 GDPR)
• Objection (Art. 21 GDPR) — to the processing
• Withdrawal of consent given, with effect for the future
• Complaint to a supervisory authority (Art. 77 GDPR)

The competent supervisory authority is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

11. SSL/TLS encryption

For security reasons, this site uses SSL/TLS encryption. You can recognise an encrypted connection by the padlock symbol in your browser's address bar and by the address beginning with “https://”.

12. Changes to this privacy policy

We reserve the right to amend this privacy policy to reflect changes in the legal situation or changes to the service and to our data processing. The current version published on our website always applies.