1. Overview
Protecting your personal data is important to us. In this privacy policy we inform you, in accordance with Art. 13 and 14 of the General Data Protection Regulation (GDPR), which personal data we process when you use our booking platform HalalReservation, for which purposes and on which legal basis, and which rights you have.
The key points at a glance:
- We mainly process your data to arrange and handle hotel bookings and to provide your customer account.
- We do not use any analytics, tracking or advertising cookies and do not create user profiles.
- External content (maps) is only loaded if you have given your consent.
- We never receive your card details – they go directly to our payment service provider Stripe.
- Halal-related special requests are voluntary and are only passed on to the hotel with your explicit consent.
2. Controller
The controller within the meaning of Art. 4(7) GDPR is:
[FIRMENNAME] [RECHTSFORM]
[ANSCHRIFT – STRASSE UND HAUSNUMMER]
[PLZ] [ORT]
Germany
Phone: [TELEFON]
Email: [E-MAIL]
For data protection enquiries please contact [DATENSCHUTZ-E-MAIL]. Further details can be found in our legal notice.
3. Data protection officer
You can reach our data protection officer at: [DATENSCHUTZBEAUFTRAGTER – falls bestellt], email: [DATENSCHUTZ-E-MAIL].
4. Hosting and server log files
Our website and servers are operated by [HOSTER], [HOSTER-ANSCHRIFT]. The host processes data solely on our behalf and on our instructions under a data processing agreement (Art. 28 GDPR).
Each time you access our website, the server automatically processes information transmitted by your browser (server log files):
- IP address of the requesting device
- date and time of access
- requested page or file, amount of data transferred and HTTP status code
- referrer URL (previously visited page)
- browser type and version, operating system
This processing serves to deliver the website, to ensure system security (e.g. defending against attacks and misuse) and to analyse errors. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and stable operation of the platform. Log files are deleted after [14] days unless they are needed for longer to investigate a specific security incident. All data is transmitted in encrypted form (TLS).
6. Registration and customer account
You can create a customer account on our platform. If you book without an existing account, we automatically create a customer account with your booking details so that you can view, manage and cancel your booking; you will receive an email to activate it.
- Data processed: title, first and last name, email address, password (stored only as a cryptographic hash), optionally phone number and further profile details, time of registration and login, activation and password reset tokens, favourites.
- Purpose: providing the customer account, login, managing your bookings, favourites, reviews and messages.
- Legal basis: Art. 6(1)(b) GDPR (user agreement).
- Retention: until your account is deleted, which you may request at any time. Data that we must retain for commercial or tax law reasons is restricted until these periods expire and deleted afterwards.
Deleting your account: you can delete your customer account yourself at any time under “My profile”. We then anonymise your profile data (name, email address, phone number), remove your favourites and sign you out on all devices. Booking records, including the guest details they contain, are kept for the statutory retention periods (Section 257 HGB, Section 147 AO); they are restricted and deleted once these periods expire. If you have upcoming bookings, the account can only be deleted after they have been cancelled or completed. Hotel partner accounts are deleted on request via our support.
7. Hotel bookings
When you book a hotel via HalalReservation, we process the data required to arrange and carry out your booking:
- title, first and last name, email address, phone number
- nationality and address (for bookings of partner hotels whose providers require this information)
- booking data: hotel, room type, rate and cancellation conditions, arrival and departure dates, number of guests, price components, booking reference, booking status and cancellations
- payment information: amount, currency, payment status, payment method and Stripe transaction and refund references (no full card details)
- voluntary special requests and comments
The purposes are arranging the booking, passing it on to the hotel or our partner, processing the payment, sending the booking confirmation, customer service and handling cancellations and refunds. The legal basis is Art. 6(1)(b) GDPR (performance of a contract and pre-contractual measures) and Art. 6(1)(c) GDPR (statutory retention obligations).
Halal-related special requests (special categories of data)
When booking, you can voluntarily specify special requests, e.g. removal of alcoholic drinks from the minibar, provision of a prayer mat or marking of the prayer direction (qibla). Such information may allow conclusions to be drawn about your religious beliefs and may therefore constitute special categories of personal data within the meaning of Art. 9(1) GDPR.
We only process this information if you provide it voluntarily, and solely to pass your request on to the booked hotel or our partner. The legal basis is your explicit consent (Art. 9(2)(a) in conjunction with Art. 6(1)(a) GDPR), which you give by selecting the respective option. This information is not required for the booking. You can withdraw your consent at any time with effect for the future, e.g. by email to [DATENSCHUTZ-E-MAIL]; we will then delete the information and inform the hotel where this is still possible. Please do not enter any further sensitive information (e.g. about your health) in the free-text field unless it is necessary for your stay.
Retention
We retain booking, payment and invoice data in accordance with commercial and tax law retention obligations (§ 257 HGB, § 147 AO) for six, eight or ten years depending on the type of document. The period begins at the end of the calendar year in which the document was created. We delete special requests at the latest together with the other booking data, or earlier if you withdraw your consent.
8. Recipients: hotels, partners and service providers
Booked hotel
To carry out your stay, we transmit the booking data (name, contact details, dates of stay, number of guests and any special requests) to the booked hotel. The hotel processes this data as an independent controller; its own privacy notice also applies. The legal basis is Art. 6(1)(b) GDPR and, for special requests, Art. 9(2)(a) GDPR. If the hotel is located outside the EU/EEA, the transfer is necessary for the performance of the contract you requested (Art. 49(1)(b) GDPR).
TBO Holidays (partner hotels)
Part of our hotel offering is sourced from the hotel wholesaler TBO Tek Limited (TBO Holidays), [VERTRAGSPARTNER UND ANSCHRIFT TBO – LT. VERTRAG BESTÄTIGEN] (“TBO”). If you book such a partner hotel, we transmit the data required for the booking – in particular name, nationality, address, contact details, dates of stay and any special requests – to TBO, which forwards the booking to the hotel. The legal basis is Art. 6(1)(b) GDPR.
TBO also processes data in countries outside the EU (India, United Arab Emirates) for which there is no adequacy decision of the EU Commission. The transfer is based on EU standard contractual clauses (Art. 46(2)(c) GDPR) [VERTRAGLICHE GARANTIEN MIT TBO BESTÄTIGEN] and, where necessary for the performance of your booking, on Art. 49(1)(b) GDPR. You can request a copy of the safeguards from us.
Payment processing with Stripe
We process payments via Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland (“Stripe”). You enter your card or payment details directly into a payment form provided by Stripe; they are transmitted directly to Stripe. We do not receive full card details, only information on the amount, payment status, payment method (e.g. card type and last four digits) and a transaction reference.
For this purpose, the Stripe library (Stripe.js) is loaded from Stripe’s servers on the checkout page only. Stripe also processes technical data (e.g. IP address, device and browser information) for fraud prevention and may set its own cookies required for the payment. Stripe acts as an independent controller for payment processing and for compliance with its own legal obligations (e.g. anti-money laundering).
The legal basis is Art. 6(1)(b) GDPR (payment processing) and Art. 6(1)(f) GDPR (fraud prevention); loading Stripe.js on the checkout page is strictly necessary for the payment you requested (§ 25(2) no. 2 TDDDG). Stripe may transfer data to Stripe, Inc. in the USA. Stripe, Inc. is certified under the EU-US Data Privacy Framework, for which an adequacy decision of the EU Commission exists (Art. 45 GDPR); in addition, Stripe uses EU standard contractual clauses. More information: stripe.com/privacy.
Sending emails
We send transactional emails – e.g. booking confirmations, cancellation confirmations, account activation, password resets and notifications about new messages – via [E-MAIL-DIENSTLEISTER]. The provider processes your email address, your name and the content of the email on our behalf (Art. 28 GDPR). The legal basis is Art. 6(1)(b) GDPR. We do not send newsletters or advertising emails.
Other recipients
Beyond this, we only disclose personal data if we are legally obliged to do so (e.g. to authorities or courts), if this is necessary to establish, exercise or defend legal claims, or to tax advisors and auditors within the scope of statutory obligations (Art. 6(1)(c) or (f) GDPR). We use hosting, IT and email service providers as processors. We do not sell your data.
9. Reviews
As a registered user you can review hotels. Reviews are displayed publicly on the hotel page together with your first name, the initial of your last name (e.g. “Aisha K.”) and the date. If a review is linked to a booking made via HalalReservation, we mark it as “verified”. The reviewed hotel can respond to reviews.
The legal basis is Art. 6(1)(b) GDPR (use of the review function). Reviews remain published until you have them deleted or your account is deleted.
10. Messages between guests and hotels
You can exchange messages with hotels via our platform, e.g. about questions relating to your booking. We store the content of the messages, sender, recipient and time in order to enable communication and to be able to trace it in the event of queries or disputes. The legal basis is Art. 6(1)(b) GDPR. Messages are stored for as long as your customer account exists, unless statutory retention obligations apply.
11. Hotel partners and hotelier accounts
If you create a partner account as a hotelier or hotel representative, register a hotel or claim a listing, we process your contact details (name, email address, phone number, position), information about the company and the property (e.g. name, address, amenities, halal features, rooms, prices, availability, images) and, where applicable, proof of your authorisation.
The purposes are verification and activation, presenting the hotel on the platform, managing bookings, messages and reviews, and invoicing. The legal basis is Art. 6(1)(b) GDPR; if you act on behalf of a company, Art. 6(1)(f) GDPR (legitimate interest in communicating with our contractual partner). We store the data for the duration of the partnership and thereafter in accordance with statutory retention periods.
12. Contacting us
If you contact us by email, phone or via a contact form, we process your details (e.g. name, email address, booking reference, request) in order to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to a contract or booking, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). We delete the data once your enquiry has been fully dealt with and no statutory retention obligations apply.
13. Map service (OpenStreetMap)
In the hotel search and on hotel pages we display interactive maps on request. The map tiles are provided by the OpenStreetMap Foundation (St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom) via its servers (tile.openstreetmap.org); the map data comes from OpenStreetMap (© OpenStreetMap contributors).
Maps are only loaded after you have consented to “External media” in the cookie settings or clicked “Load map”. Only then does your browser connect to the servers of the OpenStreetMap Foundation and transmit your IP address and technical information (e.g. browser type, requested map section, referrer).
The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time with effect for the future via the “Cookie settings” in the footer of the website. The European Commission has adopted an adequacy decision for the United Kingdom (Art. 45 GDPR). Privacy policy of the OpenStreetMap Foundation: osmfoundation.org/wiki/Privacy_Policy.
14. Fonts and icons
Fonts and icon libraries are hosted locally on our server. No connections to third-party servers (e.g. Google Fonts or content delivery networks) are established for this purpose when you visit our website.
15. No analytics, tracking or advertising services
We do not use any web analytics, tracking or advertising services, do not embed social media plugins and do not create user profiles.
16. No automated decision-making
We do not carry out automated decision-making, including profiling, within the meaning of Art. 22 GDPR. Stripe carries out its own automated risk assessments of payments for fraud prevention; details can be found in Stripe’s privacy policy.
17. Obligation to provide data
You are under no statutory or contractual obligation to provide us with personal data. However, for registration and bookings we need the information marked as mandatory; without it we cannot create an account or make a booking. Special requests are always voluntary.
18. Retention periods at a glance
- Server log files: [14] days
- Customer account, favourites and messages: until the account is deleted
- Booking, payment and invoice data: six, eight or ten years (§ 257 HGB, § 147 AO)
- Halal-related special requests: until you withdraw your consent, at the latest together with the booking data
- Reviews: until deleted by you or until your account is deleted
- Enquiries: until fully dealt with, unless retention obligations apply
- Privacy settings and language cookie: up to 12 months in your browser
19. Your rights
Subject to the statutory requirements, you have the following rights:
- access to your stored data (Art. 15 GDPR)
- rectification of inaccurate data (Art. 16 GDPR)
- erasure of your data (Art. 17 GDPR)
- restriction of processing (Art. 18 GDPR)
- data portability (Art. 20 GDPR)
- objection to processing (Art. 21 GDPR, see below)
- withdrawal of consent with effect for the future (Art. 7(3) GDPR); the lawfulness of processing carried out before the withdrawal remains unaffected
To exercise your rights, an informal message to [DATENSCHUTZ-E-MAIL] is sufficient.
20. Right to object under Art. 21 GDPR
21. Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The supervisory authority responsible for us is: [ZUSTÄNDIGE AUFSICHTSBEHÖRDE].
22. Data security
We transmit data in encrypted form (TLS) and take technical and organisational measures to protect your data against loss, manipulation and unauthorised access. Passwords are stored only as hashes; login cookies cannot be read by scripts.
23. Changes to this privacy policy
We will update this privacy policy if our data processing or the legal situation changes. The version published on this page applies; the date of the last update is shown at the top of the page.
Note: These legal texts are drafts and must be reviewed by a lawyer before go-live.