Privacy Policy

Neupitz GmbH

hallo@neupitz.de

+49 33766 594998

1. The essentials at a glance

Who is responsible?

The controller responsible for data processing on this website is Neupitz GmbH, Kohlgarten 1, 15755 Teupitz, represented by Managing Director Stephan Gabler. E-mail: hallo@neupitz.de, telephone: +49 33766 594998.

What data we process

  • When you visit this website, our host processes technically necessary data, such as your IP address and the requested URL. Without this data, the website cannot be delivered.
  • When you send us an inquiry via a form, we process the information you provide there.
  • When you book a stay via our booking page, we process the details from your booking form and payment information to complete and settle the booking. Payment is processed by Stripe.
  • We track how many people visit our website and where they come from using Umami, a software tool we host ourselves. Umami sets no cookies and does not store IP addresses.
  • We only use services for analytics (Google Analytics, recordings with Umami) and marketing (Meta Pixel, lemlist) with your consent. Without consent, these services are not loaded.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. You can withdraw your consent at any time via the “Cookie settings” link at the bottom of every page on this website. You also have the right to lodge a complaint with a supervisory authority. Further details can be found in Section 3. If you have any questions about data protection, feel free to contact us at any time at hallo@neupitz.de.

2. Hosting and website delivery

Cloudflare

This website is delivered via Cloudflare Pages. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When you visit the website, Cloudflare processes your IP address, date and time, the requested URL, the previously visited page, and details about your browser and operating system. This is necessary to deliver the website, ensure fast loading times and protect against attacks.

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in the secure and reliable delivery of the website. A data processing agreement is in place with Cloudflare. Cloudflare is certified under the EU-US Data Privacy Framework; transfers to the US are based on the European Commission's adequacy decision and, in addition, on standard contractual clauses. Read more in the Cloudflare Privacy Policy .

Sanity (content, images and files)

We manage texts, images and files for this website, such as our terms and conditions as a PDF, in the Sanity content management system. Your browser loads images and files directly from Sanity's server (cdn.sanity.io). In doing so, your IP address is transmitted to Sanity. The providers are Sanity AS, Oslo, Norway, and Sanity US Inc., USA.

The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in displaying content quickly and reliably. Insofar as data is transferred to the US, this is based on the European Commission's standard contractual clauses. Read more in the Sanity Privacy Policy .

Fonts

The fonts on this website are hosted on our own server. When loading the page, no connection is established to Google Fonts or any other font provider.

Encryption

This website uses TLS encryption. You can recognise an encrypted connection by “https://” in the address bar and the lock icon in your browser. Data you transmit to us, for example via an inquiry form, cannot be read by third parties.

3. General information and mandatory information

Storage duration

Unless a specific retention period is specified in this privacy policy, we retain your data until the purpose for processing no longer applies. If you request erasure or withdraw your consent, we will delete your data unless we are required to retain it for other legal reasons, such as retention periods under tax or commercial law. In that case, we will delete it as soon as those reasons no longer apply.

Legal bases

If you have given consent, we process your data on the basis of Art. 6 (1) (a) GDPR. If consent relates to storing information on your end device or accessing it, for example via cookies, Section 25 (1) TDDDG also applies. If your data is required for a contract or pre-contractual measures, such as preparing a proposal following your inquiry, we process it on the basis of Art. 6 (1) (b) GDPR. Data required to comply with a legal obligation is processed on the basis of Art. 6 (1) (c) GDPR. Processing may also be based on our legitimate interest pursuant to Art. 6 (1) (f) GDPR. The specific legal basis that applies in each case is set out in the sections below.

Recipients and transfers to third countries

We only share personal data if it is necessary for a contract, if we are legally obliged to do so, if we have a legitimate interest, or if you have given your consent. We only use service providers that process data on our behalf on the basis of a data processing agreement. Some of the providers mentioned are based in the US or transfer data there. For companies certified under the EU-US Data Privacy Framework, the European Commission's adequacy decision applies; for others, we base transfers on standard contractual clauses.

Withdrawal of your consent

Many processing activities are only possible with your consent. You can withdraw your consent at any time with future effect, on this website via “Cookie settings” at the bottom of every page. The lawfulness of processing carried out prior to withdrawal remains unaffected.

Right to object (Art. 21 GDPR)

If processing is based on Art. 6 (1) (e) or (f) GDPR, you have the right to object at any time on grounds relating to your particular situation. This also applies to profiling based on these provisions. Following an objection, we will no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims (Art. 21 (1) GDPR).

If we process your data for direct marketing purposes, you have the right to object at any time. This also applies to profiling insofar as it is related to such direct marketing. Following your objection, we will no longer use your data for direct marketing (Art. 21 (2) GDPR).

Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement. The supervisory authority responsible for us is the Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg, Stahnsdorfer Damm 77, 14532 Kleinmachnow.

Access, rectification, erasure, restriction and data portability

Within the scope of statutory provisions, you have the right to free information at any time about your stored personal data, its origin and recipients, and the purpose of processing, as well as a right to rectification or erasure. You may request that we restrict processing, for example while we verify the accuracy of your data, or if you need the data for legal claims but we would otherwise delete it. Data that we process automatically based on your consent or for the performance of a contract will be provided to you or a third party in a common, machine-readable format upon request. An e-mail to hallo@neupitz.de is sufficient for all of this.

4. Consent and cookies

Cookies and similar technologies

Cookies are small text files that your browser stores. Similar technologies include local storage or session storage in the browser. We set technically necessary cookies, such as saving your choice in the banner, on the basis of Section 25 (2) No. 2 TDDDG and Art. 6 (1) (f) GDPR. All other cookies are set only with your consent pursuant to Section 25 (1) TDDDG and Art. 6 (1) (a) GDPR. You can delete or block cookies in your browser at any time. Certain parts of the website may then no longer function properly.

Consent banner (Privado)

We obtain your consent via the banner from Privado; the provider is Privado, Inc., San Francisco, USA. The banner is loaded from a Privado server, transmitting your IP address. We store your choice in the “preferences” and “last_consent” cookies in your browser. To document your consent, the banner transmits your choice along with a random identifier and timestamp to Privado.

The legal basis is Art. 6 (1) (c) GDPR, as we are required to demonstrate consent (Art. 7 (1) GDPR), and Section 25 (2) No. 2 TDDDG for the cookies.

In the banner, you can enable two categories individually:

  • Analytics: Google Analytics and recordings with Umami (Section 5)
  • Marketing: Meta Pixel and lemlist (Section 5)

5. Analytics and marketing

Audience measurement with Umami

To understand how many people visit our website, where they come from, and which pages they view, we use Umami. Umami is open-source software that we host ourselves; the data is not sent to any analytics provider. Umami sets no cookies and stores nothing on your device. It records the page visited, the referring page, campaign parameters in the address (such as 'utm_source'), browser, operating system, device type, screen size, language, and approximate country and region derived from the IP address. We also track events such as submitting an enquiry or the steps of a booking including the amount, without your form entries. Your IP address is not stored. To count a visit across multiple pages as a single visit, Umami creates an identifier from the IP address, browser user-agent, and a random value that changes each month, from which the IP address cannot be recalculated.

The legal basis is our legitimate interest in measuring the reach of our website in a privacy-friendly manner and improving it (Art. 6(1)(f) GDPR). You can object at any time (Section 3) or disable tracking for your browser yourself by opening www.neupitz.de/nicht-zaehlen in your browser. We store the data for two years, after which we delete it.

Umami runs on servers operated by Railway Corporation, 548 Market St PMB 68956, San Francisco, California 94104, USA, in a data centre in Amsterdam (Netherlands). We have concluded a data processing agreement with Railway. Data may be transferred to Railway in the US; Railway is certified under the EU-US Data Privacy Framework. For more details, see the Railway privacy policy .

Recordings with Umami (only with consent)

If you consent to analytics in the banner, Umami also records how you interact with the page: mouse movements, clicks, scrolling, and page changes, for a maximum of 15 minutes. Any information entered into form fields is obfuscated directly in your browser and never transmitted. These recordings help us identify usability issues, for example in the booking form, and generate overviews of click and scroll behaviour (heatmaps). Recordings are deleted after 30 days. Operation and servers are as described above. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG.

Services that only load with consent

The following services are loaded only after you have given consent in the banner. The legal basis in each case is your consent pursuant to Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG. You can withdraw your consent at any time via “Cookie settings” at the bottom of every page.

Google Analytics

We use Google Analytics 4 to understand how our website is used: which pages are viewed, for how long, how visitors reach us, with what device, and from which approximate region. When you submit an inquiry, we count this as an event without storing the content of your inquiry. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics sets the cookies “_ga” and “_ga_BC6P54PGE4” with a lifespan of up to two years. IP addresses are not stored in Google Analytics 4.

On the booking page, we also track when a room is selected, when the payment field is opened, and when a booking is completed, including the total amount upon completion. We do not transmit your name, email address, or other form details to Google.

Event-level data is deleted after two months, data on individual users after 14 months. Data may be transferred to Google LLC in the US. Google is certified under the EU-US Data Privacy Framework. Read more in the Google Privacy Policy .

Meta Pixel

We use the Meta Pixel to measure the effectiveness of our advertising on Facebook and Instagram and to display adverts there to visitors of our website. When you submit an inquiry, the pixel reports this as an event without the content of your inquiry. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The pixel sets the cookie “_fbp” with a lifespan of three months. If you are logged into Facebook or Instagram, Meta can associate your visit with your account.

We and Meta are jointly responsible for collecting and transmitting the data to Meta (Art. 26 GDPR). The respective duties are set out in a joint controllership agreement . Meta is solely responsible for further processing. Data may be transferred to Meta Platforms, Inc. in the US; Meta is certified under the EU-US Data Privacy Framework. Read more in the Meta Privacy Policy .

lemlist

We use lemlist to identify which companies visit our website and to reach out to them in a targeted way. To do this, your IP address is matched with public company data. The provider is lempire SAS, 128 rue La Boétie, 75008 Paris, France.

6. Inquiries via our forms

When you send us an inquiry via a form, we process the information you provide in order to respond and prepare a quote: name, company, e-mail address, telephone number, number of guests, dates, your message and any other details you share. If you reached our website via a link with campaign parameters (such as “utm_source”), we send these along with the landing page and referrer URL with your inquiry so that we can see how inquiries reach us. Beyond the currently open page, we only retain this information if you have permitted marketing in the banner, and then only for the duration of your visit in your browser's session storage.

The enquiry is sent to our own booking system, which runs on servers in the Netherlands operated by Railway Corporation, USA. The booking system creates the enquiry in our customer database in Notion (Notion Labs, Inc., San Francisco, USA) and uses the e-mail service Resend (Resend, Inc., USA) to send a message to our team and a confirmation of receipt to you. If a technical error occurs, the booking system reports it to the service Sentry (Functional Software, Inc., USA); in individual cases the report may contain your e-mail address. Data processing agreements are in place with all of these providers. Notion is certified under the EU-US Data Privacy Framework; insofar as data may be transferred to the US by the other providers, this is based on the European Commission's standard contractual clauses.

Before the enquiry is sent, Cloudflare Turnstile invisibly checks whether a human is sending it. The provider is Cloudflare, Inc. (see section 2). The Cloudflare script only loads when you send the enquiry. For this check, Turnstile evaluates technical characteristics of your browser, including your IP address, your browser identifier (user agent) and characteristics of the encrypted connection. According to Cloudflare, this data is only used to distinguish humans from bots. Cloudflare performs this check on our behalf; to improve Turnstile itself, Cloudflare processes the data under its own responsibility. Read more in the Turnstile privacy addendum . The legal basis is our legitimate interest in protecting the form from misuse (Art. 6 (1) (f) GDPR). Insofar as information in your browser is accessed, this is strictly necessary for the enquiry you request (Section 25 (2) No. 2 TDDDG). For the same reason, our booking system limits how many enquiries may come from one IP address. To do so, it keeps the IP address in memory for no more than 10 minutes and does not store it anywhere.

The legal basis is Art. 6 (1) (b) GDPR, as your inquiry serves to initiate a contract, and otherwise our legitimate interest in processing inquiries (Art. 6 (1) (f) GDPR). We store your details until the inquiry has been dealt with. If a booking is made, we retain the data for as long as required under tax and commercial law.

7. Booking a stay

What data we process during booking

When you book a stay via our booking page, we process:

  • Dates, selected rooms, and occupancy,
  • First name, last name, and email address,
  • Optionally, your phone number,
  • Your planned arrival time,
  • Your answer to 'How did you hear about us?' and, if you select 'Other', your custom note,
  • Optionally, a short note about yourself and any comments, such as regarding a dog or accompanying guests,
  • Your confirmation of the Terms and Conditions and house rules,
  • The language in which you book,
  • After payment, your billing address and, if provided, company name, Stripe payment identifiers, the amount, and the time of payment.

If you arrived at our website via a link containing campaign parameters (such as 'utm_source'), we store these details along with the landing page and referrer page with your booking. Beyond the currently opened page, your browser only retains these details if you have accepted marketing in the banner (see Section 6).

The note about yourself is only read by us so we know who is visiting. We do not share it with other guests. If you voluntarily provide health-related information, we only use it to accommodate your stay and delete it alongside the comment.

Without a name, email address, and arrival time, we cannot accept your booking. The question 'How did you hear about us?' is also mandatory, as this is the only reliable way for us to see how guests find us. All other information is optional.

We do not request nationality or details of accompanying guests during booking. Guests without German citizenship complete a registration form upon arrival, as required by the German Federal Registration Act (Section 29(2) BMG). We retain the registration form for one year from departure and destroy it within three months thereafter (Section 30(4) BMG). Upon request, we are required to present it to the registration authority or the police.

Purpose and legal bases

We require your details to create the booking, reserve the rooms for you, process payment, send your confirmation and invoice, and prepare your stay. The legal basis is contract performance and pre-contractual measures (Art. 6(1)(b) GDPR). We retain invoices and accounting records as required by commercial and tax law (Art. 6(1)(c) GDPR in conjunction with Section 147 AO and Section 257 HGB); the same applies to the registration form (Sections 29, 30 BMG).

We also use your arrival time, the answer to 'How did you hear about us?', and campaign parameters to plan our operations and understand how guests find us. This constitutes our legitimate interest (Art. 6(1)(f) GDPR). We process the optional note about yourself and your comment because you provide them to help us prepare your stay (Art. 6(1)(b) and (f) GDPR).

Emails about new dates

If you have booked with us, we may occasionally email you at the address from your booking when new Workation dates become available. We inform you of this in the booking form and in each of these emails. You can object at any time, for example with a brief email to hallo@neupitz.de, incurring no costs other than transmission costs at basic rates. The legal basis is our legitimate interest in direct marketing for our own similar offerings (Art. 6(1)(f) GDPR in conjunction with Section 7(3) UWG). You will only receive our newsletter if you subscribe to it yourself.

Storage in your browser

To ensure your selections and details are not lost if you reload the page or navigate away briefly, the booking page stores them in your browser's session storage: dates, rooms, form entries, and, once you proceed to checkout, the payment session identifier. This data remains on your device, applies only to this browser tab or window, and is deleted when you close it or complete the booking. We do not store your agreement to the Terms and Conditions or house rules there. This storage is strictly necessary for the booking process you requested (Section 25(2) No. 2 TDDDG).

Protection against automated bookings (Cloudflare Turnstile)

Before payment starts, Cloudflare Turnstile performs an invisible check to determine whether a human is booking. The provider is Cloudflare, Inc. (see Section 2). Turnstile evaluates technical characteristics of your browser, including your IP address, browser identifier (user-agent), and characteristics of the encrypted connection. Cloudflare states that it uses this data solely to distinguish humans from bots, not to identify you or serve advertising. Cloudflare conducts this check on our behalf; to improve Turnstile itself, Cloudflare processes the data under its own responsibility. For more details, see the Turnstile privacy notice .

The legal basis is our legitimate interest in protecting the booking page from abuse and fraudulent bookings (Art. 6(1)(f) GDPR). Insofar as information in your browser is accessed, this is strictly necessary for the booking you requested (Section 25(2) No. 2 TDDDG). For the same reason, our booking system limits the number of requests permitted from a single IP address. For this purpose, it retains the IP address in memory for a maximum of 10 minutes and does not store it anywhere permanently.

Payment via Stripe

Payment is processed by Stripe. The provider is Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. Stripe's checkout form only loads when you proceed to payment on the booking page. In the checkout form, you enter your billing address, optional company name, and payment details directly with Stripe. We never see your full card details. After payment, Stripe transmits your name, billing address, company name, email address, amount, payment method, and payment identifiers to us.

Stripe processes your data partly on our behalf and partly under its own responsibility, such as to prevent fraud and fulfil legal obligations as a payment provider, for instance anti-money laundering regulations. To this end, Stripe also collects technical data about your device and browser when the checkout form loads, and sets cookies such as '__stripe_mid' (one year) and '__stripe_sid' (30 minutes). Data may be transferred to Stripe, Inc. in the US; Stripe is certified under the EU-US Data Privacy Framework. For more details, see the Stripe privacy policy .

If you pay using Apple Pay or Google Pay, the privacy policies of Apple or Google additionally apply, as they act under their own responsibility.

The legal basis is contract performance (Art. 6(1)(b) GDPR) and our legitimate interest in secure payment processing without fraud (Art. 6(1)(f) GDPR). Stripe cookies are strictly necessary for the payment process (Section 25(2) No. 2 TDDDG).

Our booking system

We create your booking in our own booking system. There, our team views the booking, allocates rooms, and plans cleaning and heating. The booking system runs on Railway Corporation, USA, on servers in the Netherlands. The database is operated by Supabase, Inc., USA, on servers in Ireland. Data processing agreements are in place with both providers. Insofar as data may be transferred to the US, this is based on the EU Commission's standard contractual clauses.

For every new booking, we also notify our team briefly by email and in our internal chat Slack, including booking reference, name, dates, rooms, arrival time, and amount. Slack is provided by Slack Technologies Limited, Dublin, Ireland; data may be transferred to Slack Technologies, LLC in the US. To help the team organise arrivals, your booking with name, rooms, arrival time, and comments also appears in our team's internal calendar. The legal basis is contract performance (Art. 6(1)(b) GDPR).

If a technical error occurs in the booking system, it is reported to Sentry (Functional Software, Inc., USA) so that we can resolve it. The report contains the booking reference and the error message. We do not include contact or payment details; however, an error message may in individual cases contain an email address, for instance if an email could not be delivered. Data processing agreements are in place with Sentry and Slack; transfers to the US are based on the EU Commission's standard contractual clauses. The legal basis is our legitimate interest in error-free operations (Art. 6(1)(f) GDPR).

Invoicing (sevdesk)

We issue the invoice for your stay using the accounting software sevdesk. The provider is sevdesk GmbH, Offenburg. For this purpose, our booking system transmits your name or company name, billing address, email address, booked services, and amounts to sevdesk. A data processing agreement is in place with sevdesk. The legal basis is contract performance (Art. 6(1)(b) GDPR) and our obligation to issue and retain invoices (Art. 6(1)(c) GDPR).

Booking emails (Resend)

We send the booking confirmation with your invoice via the email service Resend, as well as the booking notification to our team. The provider is Resend, Inc., USA. Resend processes your email address and message contents on our behalf and stores the data in the US. A data processing agreement is in place with Resend; transfers to the US are based on the EU Commission's standard contractual clauses. The legal basis is contract performance (Art. 6(1)(b) GDPR).

Retention period

We retain invoices and all associated accounting records for eight years, and business correspondence such as your booking confirmation and booking-related emails for six years (Section 147(1) and (3) AO, Section 257(1) and (4) HGB). These retention periods start at the end of the calendar year in which the document was created. Your booking details, including dates and rooms, remain stored with us for the same period.

We only require your phone number, comments, and personal note for your stay. We delete them six months after your departure, both in the booking system and in the notification sent to our team. After six months, we retain your arrival time and answer to 'How did you hear about us?' only in anonymised form without your name, for statistical purposes.

We use your name and email address for updates about new dates until you opt out.

If a booking is cancelled before payment or if the payment session expires after 30 minutes, the booking is cancelled. We delete the form entries after 30 days, retaining only the record that a booking was abandoned, without any names or contact details.

8. Newsletter

We send our newsletter using Brevo. The provider is Sendinblue SAS (Brevo), 106 boulevard Haussmann, 75008 Paris, France. Subscription takes place via a Brevo page linked from our website. To send the newsletter, we require your e-mail address. After signing up, you will receive an e-mail asking you to confirm your subscription. Brevo stores the timestamp and IP address of your sign-up and confirmation as proof and can measure whether newsletters are opened and links are clicked.

The legal basis is your consent (Art. 6 (1) (a) GDPR). You can unsubscribe at any time via the link at the bottom of each newsletter. We retain your data until you unsubscribe. Afterwards, your e-mail address may remain on a suppression list so that you no longer receive newsletters. Read more in the Brevo Privacy Policy .

9. External content and links

Google Maps

On our contact page, you can display a map from Google Maps. The map loads only when you click “Load external content”. Your IP address and other technical data are then transmitted to Google, and Google may set cookies. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google LLC in the US; Google is certified under the EU-US Data Privacy Framework.

The legal basis is your consent by clicking (Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG). Read more in the Google Privacy Policy .

Links to social networks

We link to our profiles on Instagram, LinkedIn and Facebook using simple links only. When you visit our website, no data is transferred to these networks. The privacy policies of the respective networks only apply once you click a link.

10. Last updated

Last updated: November 2026.