PRIVACY

This English version is provided for convenience. The legally binding version is the German one available at /datenschutz.

We greatly appreciate your interest in our company. Data protection is a particularly high priority for the management of C.A.L. Verwaltung UG (haftungsbeschränkt). The websites of LEIPZIG SUITES can generally be used without providing any personal data. However, if a data subject wishes to use specific services through our website, processing of personal data may become necessary.

1. Data Protection at a Glance

General Information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data with which you can be personally identified. For detailed information on data protection, please refer to the privacy policy listed below this text.

Data Collection on This Website

Who is responsible for data collection?

Data processing on this website is carried out by the website operator. You can find their contact details in the section "Information about the Data Controller" in this privacy policy.

How do we collect your data?

Your data is collected, on the one hand, by you providing it to us — for example via our contact form or by email. Other data is collected automatically or with your consent when you visit the website by our IT systems. This is mainly technical data (e.g. internet browser, operating system, time of page access). Analytics tools are activated only after your explicit consent via the cookie banner.

What rights do you have regarding your data?

You have the right at any time to obtain free information about the origin, recipient and purpose of your stored personal data. You also have the right to request the rectification or erasure of this data. If you have given consent to data processing, you can revoke it at any time with effect for the future. You also have the right, under certain circumstances, to request restriction of the processing of your personal data. Furthermore, you have the right to lodge a complaint with the competent supervisory authority.

2. Hosting

Netlify

This website is hosted by Netlify. The provider is Netlify, Inc., 2325 3rd Street, Suite 296, San Francisco, CA 94107, USA.

When you visit our website, Netlify automatically collects so-called server log files. These contain: IP address, browser type and version, operating system used, referrer URL, hostname of the accessing computer, as well as the date and time of the server request.

Hosting takes place for the purpose of secure, fast and efficient provision of our online offering. The lawful basis is Art. 6(1)(f) GDPR (legitimate interest). Server log files are usually deleted automatically after 30 days.

As Netlify is a US company, data transfers to the USA may occur. Netlify is certified under the EU-US Data Privacy Framework and has concluded the EU Commission's Standard Contractual Clauses. We have signed a data processing agreement (DPA) with Netlify.

Further information can be found in Netlify's privacy policy: Netlify Privacy Policy (netlify.com)

3. General Information and Mandatory Notices

Data Protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations and this privacy policy. We point out that data transmission over the internet may have security gaps. Complete protection of data against access by third parties is not possible.

Information about the Data Controller

The data controller within the meaning of the General Data Protection Regulation, other data protection laws applicable in EU Member States, and other provisions of a data protection nature is:

Any data subject may contact the named contact person directly at any time with questions or suggestions regarding data protection.

Retention Period

Unless a more specific retention period is mentioned within this privacy policy, your personal data will remain with us until the purpose for processing no longer applies. If you assert a legitimate request for erasure or revoke consent, your data will be deleted unless we have other legally permissible grounds for storage (e.g. tax or commercial retention periods of up to 10 years).

General Information on Lawful Bases

If you have consented to data processing, we process your personal data on the basis of Art. 6(1)(a) GDPR. If your data is necessary for the performance of a contract, we process it on the basis of Art. 6(1)(b) GDPR. For compliance with legal obligations, Art. 6(1)(c) GDPR applies. Processing on the basis of our legitimate interest takes place under Art. 6(1)(f) GDPR. Where the storage of cookies or access to information on your terminal device is concerned, § 25 TDDDG applies in addition.

Revocation of Your Consent to Data Processing

Many data processing operations are only possible with your explicit consent. You can revoke consent already given at any time. The lawfulness of data processing carried out up to revocation remains unaffected. To change your cookie settings, click "Cookie Settings" in the footer.

Right to Object to Data Collection in Special Cases (Art. 21 GDPR)

If data processing takes place on the basis of Art. 6(1)(e) or (f) GDPR, you have the right at any time, on grounds arising from your particular situation, to object to the processing of your personal data; this also applies to profiling based on these provisions. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for processing that override your interests, rights and freedoms, or processing serves the establishment, exercise or defence of legal claims (objection under Art. 21(1) GDPR).

Right to Lodge a Complaint with the Competent Supervisory Authority

In the event of breaches of the GDPR, you have the right to lodge a complaint with a supervisory authority. The competent supervisory authority for Saxony is:

Right to Data Portability

You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party in a common, machine-readable format.

Information, Rectification and Erasure

Within the framework of applicable statutory provisions, you have the right at any time to free information about your stored personal data, its origin and recipients, and the purpose of data processing, and where applicable a right to rectification or erasure of this data.

SSL / TLS Encryption

For security reasons and to protect the transmission of confidential content, this site uses SSL / TLS encryption. You can recognise an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser bar.

4. Data Collection on This Website

Cookies

Our website uses cookies. Cookies are small data packets that your browser stores on your device. We distinguish between:

• Essential cookies: Technically necessary for the operation of the website (e.g. cookie consent storage). Lawful basis: Art. 6(1)(f) GDPR (legitimate interest).
• Analytics cookies (Google Analytics): Set only with your explicit consent. Lawful basis: Art. 6(1)(a) GDPR, § 25(1) TDDDG.
• Marketing cookies: Set only with your explicit consent. Lawful basis: Art. 6(1)(a) GDPR, § 25(1) TDDDG.

As part of analytics and marketing cookies, we use the following cookies, subject to your consent:

You can revoke your consent at any time with effect for the future. To do so, click "Cookie Settings" in the footer. You can also configure your browser to inform you about the setting of cookies and to allow cookies only on a case-by-case basis.

Contact Form

If you send us inquiries via the contact form, your details from the inquiry form, including the contact data you provide there (name, email address, message, telephone if applicable), will be stored by us for the purpose of processing the inquiry and in case of follow-up questions. We will not pass on this data without your consent.

Processing takes place on the basis of Art. 6(1)(b) GDPR if your inquiry is related to the performance of a contract, otherwise on the basis of our legitimate interest (Art. 6(1)(f) GDPR). The data remains with us until you request deletion or the purpose for data storage no longer applies. Statutory retention periods remain unaffected.

Inquiry by Email or Telephone

If you contact us by email or telephone, your inquiry, including all personal data arising from it (name, inquiry), will be stored and processed by us for the purpose of handling your matter. The lawful basis is Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest). The data is deleted after the matter has been completely processed, unless there is a statutory retention obligation.

Newsletter

If you wish to receive our newsletter, we require your email address as well as information that allows us to verify that you are the owner of the email address provided and that you agree to receive the newsletter (double opt-in).

Processing takes place on the basis of your consent (Art. 6(1)(a) GDPR). You can revoke this consent at any time by clicking the unsubscribe link in the newsletter or by sending us an informal message. The lawfulness of data processing operations already carried out remains unaffected by the revocation.

The data you provide for the purpose of receiving the newsletter will be stored by us or by the newsletter service provider until you unsubscribe from the newsletter and will be deleted after unsubscription. Data stored with us for other purposes remains unaffected.

Mews Booking System

For booking apartments, we use the Mews booking system from Mews Systems B.V., Westerpark 2, 1014 BT Amsterdam, Netherlands. When you click the booking button on our website, you will be redirected to the Mews booking platform (app.mews.com).

During the booking process, Mews processes the data you provide (name, address, payment details, email, telephone) to handle your booking. Data processing is carried out on the basis of Art. 6(1)(b) GDPR (performance of contract). We are jointly responsible with Mews for booking processing. You can find Mews's privacy policy at: Mews Privacy Policy (mews.com)

5. Analytics Tools and Advertising

Google Tag Manager

This website uses Google Tag Manager (GTM, container ID GTM-WS9WD5QW). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Tag Manager is a tag management system that allows us to centrally manage tracking and analytics tools (e.g. Google Analytics 4, Google Ads).

Google Tag Manager itself does not set cookies and does not collect personal data. It only controls the firing of other tags configured by us. These are activated only after your consent via the cookie banner (Google Consent Mode v2: default state "denied" until granted). When the Tag Manager script is delivered, your IP address is transmitted to Google but is not used for tracking purposes.

The lawful basis for using Google Tag Manager is Art. 6(1)(f) GDPR (legitimate interest in efficient and secure management of tracking tools). The tools loaded by the Tag Manager are themselves activated only on the basis of your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

Google Tag Manager privacy policy: https://policies.google.com/privacy

Google Analytics 4

This website uses Google Analytics 4 (GA4, measurement ID G-72FWFXSTZ5). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Integration takes place via Google Tag Manager.

Google Analytics enables us to analyse the behaviour of website visitors. We thereby receive various usage data such as page views, time on page, operating systems used and origin of users. Google Analytics uses technologies that allow recognition of the user (e.g. cookies or device fingerprinting). Information collected by Google is generally transferred to a Google server in the USA and stored there.

Google Analytics is activated only after your explicit consent. The lawful basis is Art. 6(1)(a) GDPR and § 25(1) TDDDG. Consent can be revoked at any time (cookie settings in the footer).

Cross-domain tracking: When you switch from our website to the Mews booking platform (app.mews.com) via a booking button, your Google Analytics client ID is passed to the Mews domain via a URL parameter (_gl) — exclusively after consent to analytics has been given. This allows us to analyse the booking journey as a connected session. No personal data is transmitted directly to Mews; the client ID is a random, pseudonymous identifier.

We use the following privacy-friendly configurations: IP anonymisation, automated masking of URL parameters that may contain personal data (function ads_data_redaction) as well as a default consent state of "denied" in line with Google Consent Mode v2 until explicit approval is given.

Data transfer to the USA is based on the EU Commission's Standard Contractual Clauses. Google is certified under the EU-US Data Privacy Framework. We have signed a data processing agreement with Google.

Google privacy policy: https://policies.google.com/privacy

Google Ads (Conversion Tracking)

This website uses the conversion tracking tag from Google Ads (account ID AW-16840525555). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. With the help of Google Ads conversion tracking, Google and we can recognise that a person has interacted with certain ads and was redirected to a correspondingly tagged page (e.g. booking confirmation).

Conversion tracking is activated only after your consent. The lawful basis is Art. 6(1)(a) GDPR and § 25(1) TDDDG. We use the privacy-friendly function ads_data_redaction, through which personal data in URL parameters is automatically removed.

6. Plugins and Tools

Google Fonts (Self-Hosted)

This site uses Google Fonts for the consistent display of typefaces. The Google Fonts (Inter) are installed locally on our server. No connection to Google servers takes place. Further information: Google Fonts FAQ (developers.google.com)

Google Material Symbols (External Embedding)

This website embeds Google Material Symbols icons via an external link from Google servers. Your IP address is thereby transmitted to Google. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Lawful basis: Art. 6(1)(f) GDPR (legitimate interest in consistent presentation). We recommend hosting this resource locally in the future to avoid data transfers to Google.

7. Data Processing Agreements

We have concluded data processing agreements (DPA) under Art. 28 GDPR with the following processors:

• Netlify, Inc. (hosting) — San Francisco, USA
• Google Ireland Limited (Google Tag Manager, Google Analytics 4 and Google Ads — tracking only after consent has been given) — Dublin, Ireland
• Mews Systems B.V. (booking system) — Amsterdam, Netherlands

8. Your Rights as a Data Subject

Under the GDPR, you have the following rights:

• Access (Art. 15 GDPR): You may request information about the personal data stored by us.
• Rectification (Art. 16 GDPR): You may request the correction of inaccurate or completion of incomplete data.
• Erasure (Art. 17 GDPR): You may request the erasure of your personal data, provided no statutory retention obligations stand in the way.
• Restriction of processing (Art. 18 GDPR): You may request the restriction of the processing of your data.
• Data portability (Art. 20 GDPR): You may request the release of your data in a machine-readable format.
• Objection (Art. 21 GDPR): You may object to the processing of your data, where it is based on Art. 6(1)(e) or (f) GDPR.
• Withdrawal of consent (Art. 7(3) GDPR): You may revoke consent given at any time with effect for the future.

To exercise your rights, please contact: booking@leipzig-suites.com

Status: March 2026 — Version 1.0