GDPR

Data Protection and Your Personal Rights

Privacy Policy

Pursuant to GDPR and § 25 TDDDG

1. Controller

My Holiday Reisecenter GbR
Obertorstraße 6, 89537 Giengen an der Brenz, Germany
Tel: +49 7322 956779 | Email: leylek@my-reisecenter.de
Authorised Partners: Ayfer Leylek, Cumali Leylek

2. Data Collected and Collection Method

The following personal data is collected online via our online platform:

  • Identity data: First name, last name, date of birth, nationality, ID/passport number (at booking)
  • Contact data: Email address, phone number, postal address
  • Booking data: Selected property, check-in/out dates, number of guests, payment information
  • Account data: Username, password (encrypted), account creation date
  • Technical data: IP address, browser type, operating system, pages visited (server logs)
  • Analytics data: Anonymous/pseudonymous usage statistics via Google Analytics (only with your consent)

3. Purposes of Processing

  • Initiation and performance of the brokerage and rental agreement
  • Payment processing
  • Customer account management
  • Compliance with legal obligations (tax, accounting)
  • Customer communication and support
  • Website security and technical operation
  • With your consent: usage analytics (Google Analytics), marketing communications
  • Compliance with local registration obligations in the destination country (guest registration under Turkish law)

4. Legal Basis (Art. 6 GDPR)

  • Contract performance (Art. 6(1)(b)): Booking and payment data
  • Legal obligation (Art. 6(1)(c)): Tax and accounting records
  • Legitimate interest (Art. 6(1)(f)): Server logs, IT security
  • Consent (Art. 6(1)(a)): Google Analytics, Google Ads, marketing communications

Cookies: Non-essential cookies require your consent pursuant to § 25 TDDDG in conjunction with Art. 6(1)(a) GDPR. Technically necessary cookies are set on the basis of Art. 6(1)(f) GDPR.

5. Recipients of Personal Data

  • Property owners/landlords: Data required to complete the booking is transmitted to the respective property owners or landlords, who may be located in Turkey or other countries. For transfers to third countries without an adequacy decision, this is done on the basis of Art. 6(1)(b) GDPR (contract performance).
  • Turkish authorities (Kimlik Bildirimi Sistemi – KBS): Under Turkish law (residence registration), we are required to transmit guest identity data (name, passport number, nationality) to the Turkish Kimlik Bildirimi Sistemi (KBS). Legal basis: Art. 6(1)(c) GDPR (legal obligation).
  • Payment service providers: Stripe, PayPal (for payment processing)
  • Local service providers: To provide booked additional services (e.g. transfer companies, cleaning services), necessary contact data is passed on to the relevant local partners.
  • Hosting (Strato AG): STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin. Server logs (including IP addresses) are processed on Strato servers with each page visit. A data processing agreement pursuant to Art. 28 GDPR is in place with Strato.
  • Google LLC (USA): Google Analytics 4 and Google Ads – only with your consent; transfer based on the EU-US Data Privacy Framework (DPF)
  • Authorities: as required by law

Your data is never sold or rented to third parties for advertising purposes.

6. Retention Periods

  • Booking and contract data: 10 years (commercial/tax law)
  • Customer account data: until account deletion + 3 years
  • Server logs: 7 days
  • Google Analytics: 14 months
  • Marketing communications: until withdrawal of consent

7. Your Rights (Art. 15–21 GDPR)

  • Access (Art. 15): What data we hold about you
  • Rectification (Art. 16): Correction of inaccurate data
  • Erasure (Art. 17): Deletion of your data where no retention obligation applies
  • Restriction (Art. 18): Restriction of processing
  • Data portability (Art. 20): Your data in machine-readable format
  • Objection (Art. 21): Against processing based on legitimate interests
  • Withdrawal: Consents may be withdrawn at any time with future effect

Please send requests to: leylek@my-reisecenter.de

Right to lodge a complaint: You may contact the supervisory authority:
Landesbeauftragter für den Datenschutz Baden-Württemberg, Königstraße 10a, 70173 Stuttgart, Germany

8. Google Analytics 4 and Google Ads

We use Google Analytics 4 (GA4) and Google Ads Conversion Tracking, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Only with your consent: GA4 is activated only after your consent in the cookie banner (§ 25 TDDDG). No analytics data is collected before consent.

IP anonymisation: IP addresses of EU/EEA users are truncated before transmission to Google servers and are not stored.

Data transfer to the USA: Google LLC is a US company. Any transfer of personal data to the USA is based on the EU-US Data Privacy Framework (DPF), for which the EU Commission issued an adequacy decision on 10 July 2023. Google is DPF-certified.

Retention period in GA4: 14 months.

Further information: Google Privacy Policy | Google Analytics Opt-Out

9. Cookies

For detailed information on the cookies we use, please see our Cookie Policy. Consent and privacy information are handled separately both technically and in content.

10. Dispute Resolution (§ 36 VSBG)

We are neither obligated nor willing to participate in dispute resolution proceedings before a consumer arbitration board (§ 36 VSBG).

Last updated: 2026 | My Holiday Reisecenter GbR