Privacy

October 2026. Carried forward from the dretzel.de privacy notice (April 2022 version) for this website, the request form and booking desk.

Controller

Schloss Dretzel Park & Events
Proprietor: Petra Gloria von Ostau
Straße der Freundschaft 8
39307 Gladau OT Dretzel
Genthin, Sachsen-Anhalt
Contact: Philipp von Ostau
+49 151 28908578
events@schlossdretzel.de
Tax number: 103/299/13878

No data protection officer is appointed. The duty in GDPR Art. 37 does not apply to this business. Privacy requests go to the address above.

Hosting and server logs

The site is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, on a server in Germany. A visit technically processes the address requested, time, volume transferred, referrer, browser, operating system and IP address. The purpose is operation, stability and defence against attacks. Legal basis: GDPR Art. 6(1)(f). Logfile IP addresses are deleted after 7 days at the latest, unless needed to investigate an attack. A processing contract under Art. 28 is in place with the host.

Cookies and local storage

This public site sets no analytics, advertising or social-media cookies. The private booking desk sets a session cookie so a login can be kept. It is strictly necessary and falls under TDDDG § 25(2). It is deleted on logout or when the session ends. No consent under § 25(1) is required.

Request and booking

The form processes salutation, name, email, phone, address, requested dates, occasion, spaces, guest count, beds, breakfast and the message. The purpose is to check availability, send an offer and, if you confirm, carry out the booking including the invoice. Legal basis: GDPR Art. 6(1)(b), including steps before a contract. Unconfirmed requests are deleted once dealt with, and at the latest after 24 months, unless a longer claim is open. Confirmed bookings and invoices are kept under German bookkeeping rules, usually 10 years.

Email and calendar

Replies to requests are sent by email. If the house connects a dedicated mailbox or a dedicated booking calendar, subject, message and dates are processed there, and only for these bookings. Legal basis: GDPR Art. 6(1)(b). A private calendar with unrelated entries is not read.

Recipients

Recipients are the host, and where needed the tax adviser and tax authority, plus a payment provider if a transfer runs through one. Catering or technical partners receive your data only if you contact them yourself. There is no sharing for advertising.

Third countries

Hosting and booking data stay in the EU. Links to Facebook, Instagram or Airbnb open only when you choose them. The provider’s rules then apply. The former EU-US Privacy Shield is not used. Any transfer to a third country would rely on an adequacy decision or standard contractual clauses under GDPR Art. 44 and following.

Social networks

The footer holds links to Facebook and Instagram only. There are no plugins, no like buttons and no tracking. Data reaches Meta only if you open the link.

Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20) and to object to processing based on Art. 6(1)(f) (Art. 21). Consent can be withdrawn at any time with effect for the future. There is no automated decision-making, including profiling, under Art. 22.

Complaints go to the Saxony-Anhalt data protection commissioner, Leiterstraße 9, 39104 Magdeburg, poststelle@lfd.sachsen-anhalt.de.