Privacy Policy

1. Controller

The controller responsible for the processing of personal data on this website within the meaning of the EU General Data Protection Regulation (GDPR) is:

2. General Information

We take the protection of your personal data very seriously and treat such data confidentially in accordance with statutory data protection provisions (in particular the GDPR, the German Federal Data Protection Act (BDSG) and the German Telecommunications-Telemedia Data Protection Act (TTDSG)) and this Privacy Policy.

As a rule, our website can be used without providing any personal data. Where personal data (such as name, address or email address) is collected on our pages, this is always done on a voluntary basis, wherever possible. This data will not be passed on to third parties without your explicit consent.

We would like to point out that data transmission over the Internet (for example, when communicating by email) may be subject to security vulnerabilities. Complete protection of data against access by third parties is not possible.

3. Automatically collected data (Server log files)

When you access this website, our hosting provider automatically records information that your browser transmits to us in so-called server log files:

• IP address of the accessing device (shortened / anonymised)
• Date and time of the request
• Name and URL of the retrieved file
• Referring website
• Browser used and, where applicable, operating system as well as the name of your access provider

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in the technical operation and security of the website).

Storage period: generally 30 days. This data is not merged with other data sources.

4. Cookies and local storage

Our website does not use tracking or advertising cookies. We only use technically necessary storage mechanisms that are permitted without consent (§ 25 (2) No. 2 TTDSG):

• sessionStorage (age verification): Stores for the current browser session that you have confirmed the age verification. The entry is automatically deleted when you close the browser tab.
• localStorage (consent banner): Stores your choice made in the consent banner (consent or rejection of optional services) so that the banner does not reappear on every page load. Validity: until you manually clear the storage.

You can control or delete these entries at any time via your browser settings.

5. Reservation form

When you send us enquiries via the reservation form, your information (name, phone number, reservation details and any special requests) is stored by us for the purpose of processing your enquiry and for any related follow-up questions.

The transmission is technically processed via the service provider Formspree, Inc., 251 Little Falls Drive, Wilmington, DE 19808, USA. Formspree forwards the form content as an email to our business email address.

Legal basis: Art. 6 (1) (b) GDPR (pre-contractual measures at your request) and Art. 6 (1) (f) GDPR (legitimate interest in efficient reservation handling).

Transfer to third countries: Formspree processes data in the United States. The transfer takes place on the basis of the EU Standard Contractual Clauses and additional safeguards implemented by Formspree (Art. 46 GDPR). Further information: formspree.io/legal/privacy-policy.

Storage period: Form submissions are deleted after your enquiry has been fully processed, at the latest upon expiry of statutory retention periods.

6. Integration of external services

To display individual content, our website integrates services from third parties. Except for hosting and server log files, these are generally only loaded after your active consent or after a deliberate click on the respective element (e.g. play button, map placeholder). Where consent is required, the legal basis is Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TTDSG.

6.1 Vercel (hosting)

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When you access the site, the data referred to in section 3 (server log files) is technically transmitted to Vercel. Legal basis: Art. 6 (1) (f) GDPR. Transfer to the USA is based on the EU Standard Contractual Clauses.

6.2 Vimeo (video embedding)

We embed a cinematic trailer on our site via the Vimeo service operated by Vimeo, LLC, 555 West 18th Street, New York, NY 10011, USA.

The video is embedded in "Do Not Track" mode (dnt=1) and is only loaded after you deliberately click the play button (two-click solution). Before this click, no data is transmitted to Vimeo.

After the click, your IP address, browser information and other technical data are technically transmitted to Vimeo. Vimeo's Privacy Policy: vimeo.com/privacy.

Legal basis: Art. 6 (1) (a) GDPR (consent via deliberate click).

6.3 Google Maps (map)

To display directions, we embed Google Maps from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Parent company: Google LLC, USA.

The map is only loaded after active consent (consent banner or click on the placeholder). Before consent, no data is transmitted to Google.

After consent, your IP address and technical data are transmitted to Google each time the map is loaded; Google may also set cookies. Google's Privacy Policy: policies.google.com/privacy.

Legal basis: Art. 6 (1) (a) GDPR.

6.4 Google Fonts

For a consistent visual presentation we use fonts provided by Google Fonts (provider: Google Ireland Limited, see above). The fonts are loaded from Google servers at page load, which technically entails transmission of your IP address to Google.

Legal basis: Art. 6 (1) (a) GDPR (consent via the consent banner) or Art. 6 (1) (f) GDPR (legitimate interest in consistent visual presentation).

Note: A self-hosted integration of the fonts is planned for a subsequent release.

6.5 Font Awesome (icon library)

To display icons, we load the Font Awesome library via the content delivery network operated by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (cdnjs.cloudflare.com). Your IP address is transmitted to Cloudflare in the process. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in fast and secure delivery).

6.6 Instagram (link)

Our website contains a link to the Night Circus Instagram profile (operator: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland). Only by clicking this link will you be redirected to Instagram. There is no automatic data transfer to Meta merely by loading our site.

7. Your rights

With regard to your personal data, you have the following rights:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to certain types of processing (Art. 21 GDPR)
• Right to withdraw consent (Art. 7 (3) GDPR)

To exercise your rights, please contact us using the details under section 1.

8. Right to complain to a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority. The competent authority for our company is:

9. Withdrawal of consent

Many data processing operations are only possible with your explicit consent. You can withdraw previously given consent at any time with effect for the future. The lawfulness of processing carried out before withdrawal remains unaffected.

10. SSL/TLS encryption

For security reasons, this website uses SSL/TLS encryption. You can recognise an encrypted connection by the fact that the browser's address bar switches from "http://" to "https://" and by the padlock symbol in your browser.

11. Changes to this Privacy Policy

We reserve the right to adapt this Privacy Policy to reflect changes in the law or in our services. The version current at the time of your next visit shall apply.