Book Call +49 2262 7920

Home · Privacy policy

Privacy policy

Only the German version is legally binding.

As of: October 2026

The protection of your personal data is important to us. With this privacy policy we inform you, in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR), which data we process when you visit this website, for what purposes, on what legal basis and for how long.

1. Controller

The controller for data processing on this website within the meaning of Art. 4 (7) GDPR is:

Stay & Live eGbR
represented by the partners Sven Kauling and Eugenia Kauling-Isaak
Pfaffenberg 1
51674 Wiehl, Germany
Phone: +49 2262 7920
E-mail: [email protected]

We have not appointed a data protection officer, as there is no legal obligation to do so. If you have questions about data protection, please use the contact details above.

2. Overview: legal bases

We only process personal data insofar as one of the following legal bases permits it:

  • Art. 6 (1) (b) GDPR – performance of a contract or pre-contractual measures (e.g. answering your enquiry),
  • Art. 6 (1) (c) GDPR – compliance with legal obligations (e.g. commercial and tax retention),
  • Art. 6 (1) (f) GDPR – our legitimate interest in the secure, stable and economical operation of this website.

Information is only stored on your device insofar as it is strictly necessary for the service you have expressly requested (§ 25 (2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG).

3. Hosting and server logs

This website is operated on servers in Germany (host: IONOS SE, Elgendorfer Straße 57, 56410 Montabaur). When you open the website, your IP address is processed technically in order to deliver the requested content to your device. We do not store server log files; the IP address is not stored after delivery. A data processing agreement under Art. 28 GDPR exists with the host. The legal basis is Art. 6 (1) (f) GDPR.

4. Cloudflare

To protect against attacks and for fast, reliable delivery we use the network of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Your requests to this website are routed through Cloudflare servers. Cloudflare processes technically necessary connection data, in particular your IP address, the requested address, date and time, and information about browser and operating system, in order to detect and repel attacks and abusive access.

The legal basis is our legitimate interest in the security and availability of the website (Art. 6 (1) (f) GDPR). A data processing agreement exists with Cloudflare. Cloudflare is certified under the EU-US Data Privacy Framework; an adequacy decision of the EU Commission therefore exists for the USA (Art. 45 GDPR). The EU Commission’s standard contractual clauses also apply. Further information: https://www.cloudflare.com/privacypolicy/

5. Statistics with Matomo (anonymised, no cookies)

To understand how our website is used and to improve it, we use the open-source software Matomo. Matomo is not run by a third party but by our service provider INREMA Unternehmensberatung GmbH, Rentmeister-Wilthelm-Weg 16, 33181 Bad Wünnenberg, Germany, on its own servers in Germany (matomo.inrema.de; data processing agreement under Art. 28 GDPR). The data is not passed on to third parties.

  • Your IP address is shortened by two bytes before it is stored (anonymised); it can therefore not be linked to you.
  • Matomo sets no cookies and does no device fingerprinting.
  • What is recorded includes pages viewed, time spent, approximate region, browser and device type, and technical characteristics used to tell automated access (bots) from human visits.

The legal basis is our legitimate interest in anonymous audience measurement (Art. 6 (1) (f) GDPR).

Objection (opt-out): You can object to the recording at any time with the “Disable statistics” button in the footer of every page. Your objection is stored in your browser (name “statistik-aus”) so that we can respect it on future visits; this storage is technically necessary (§ 25 (2) no. 2 TDDDG). If you delete your browser data, you have to object again. The same button lets you allow statistics again. Because of this data-saving design the website needs no cookie banner.

6. Contact by e-mail or telephone

This website contains no forms. If you contact us by e-mail or telephone, we process your details (name, e-mail address or telephone number, your message) in order to handle your enquiry. Clicking a call or e-mail link opens the respective application on your device; the connection is only made through your own action.

The legal basis is Art. 6 (1) (b) GDPR insofar as your enquiry relates to a contract or pre-contractual measures, and otherwise our legitimate interest in answering enquiries (Art. 6 (1) (f) GDPR). We delete your details as soon as your enquiry has been finally handled and no statutory retention obligations apply; business correspondence is kept for up to ten years (§ 147 German Fiscal Code, § 257 German Commercial Code).

7. Cookies and storage in the browser

This website sets no cookies. Only if you confirm or close the language suggestion on the German home page does your browser store a small entry (name “wh-sprache”, value: the language chosen) in local storage, so that the suggestion does not appear again; likewise it stores your objection to statistics (name “statistik-aus”, see section 5). This entry is strictly necessary for the language setting you requested (§ 25 (2) no. 2 TDDDG), is not transmitted to us and can be deleted at any time in your browser settings. A cookie banner is therefore not necessary.

8. Fonts and external links

All fonts are hosted locally on our server; no connection to font providers is made when you open the website. Links to external offers (e.g. “Directions” in Google Maps or to the stalactite cave) are ordinary links: only when you click such a link do you leave our website, and the privacy policy of the respective provider applies. No map is embedded.

9. Room booking via Mews

For direct room bookings we use the booking widget of Mews Systems B.V., Amsterdam (Netherlands). The booking widget is only loaded when you click “Book” or “Book a room”; before that there is no connection to Mews. With the click, a script is retrieved from app.mews.com and your IP address is transmitted to Mews. Without JavaScript the button opens the Mews booking page in a new tab. The legal basis is the performance of pre-contractual measures at your request (Art. 6 (1) (b) GDPR).

The details you enter in the booking widget go directly to Mews and are processed there to handle your booking (Art. 6 (1) (b) GDPR). We receive the booking to perform the contract. The privacy notices of Mews also apply.

10. Your rights

You have the right to

  • request access to the data we process (Art. 15 GDPR),
  • request the rectification of inaccurate data (Art. 16 GDPR),
  • request the erasure of your data (Art. 17 GDPR),
  • request the restriction of processing (Art. 18 GDPR),
  • receive your data in a common, machine-readable format (data portability, Art. 20 GDPR),
  • withdraw consent at any time (Art. 7 (3) GDPR); the lawfulness of processing carried out until the withdrawal remains unaffected.

Right to object (Art. 21 GDPR): If we process your data on the basis of our legitimate interest (Art. 6 (1) (f) GDPR), you may object at any time on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

To exercise your rights, a message to [email protected] or to the address in section 1 is sufficient.

Right to lodge a complaint: You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Kavalleriestraße 2–4, 40213 Düsseldorf, https://www.ldi.nrw.de

11. No automated decision-making

Automated decision-making including profiling (Art. 22 GDPR) does not take place. Providing data is not required when you visit this website.

12. Data security

This website is delivered exclusively in encrypted form via HTTPS (TLS). We take appropriate technical and organisational measures to protect your data against loss, manipulation and unauthorised access.

13. Changes to this privacy policy

We adapt this privacy policy when our website, our offers or the legal situation change. The version published on this page at the time applies.