Privacy

1. Controller

PERCEL GmbH
Mikroforum Ring 1
55234 Wendelsheim
Germany

Telephone: +49 6734 241 99 10
Email: kontakt@percel.de

2. Accessing the website

When this website is requested, the server processes connection data required for technical delivery. This includes the IP address, date and time, requested file, data volume, referring page, browser, operating system and access status.

Processing is necessary to deliver the site, maintain stability and security and identify faults. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of the website.

According to the hosting provider, IP addresses in access and error logs are anonymised after 24 hours and the logs are deleted after no more than seven days. Individual log data is retained for longer only where necessary to investigate a specific security incident or comply with a legal duty.

3. Hosting and recipients

The website is hosted by Alfahosting GmbH, Edmund-von-Lippmann-Straße 13–15, 06112 Halle (Saale), Germany. Alfahosting processes the data required for operation, delivery, form handling and technical protection on our behalf under an Article 28 GDPR data-processing agreement.

Within PERCEL GmbH, personal data is available only to people responsible for handling enquiries and operating the website. Where required for delivery and storage of messages, data is also received by the hosting and email service providers we use, acting either as processors or as independently responsible transmission services. No other disclosure takes place unless required by law or necessary to perform a contract.

See Alfahosting's privacy information.

4. Contact and enquiry form

If you contact us by form, email or telephone, we process the details you provide in order to answer your enquiry. The form requires your name, email address and number of travellers. You must also provide either preferred dates or state that your dates are flexible. The number of children and the message text are voluntary. We cannot process an enquiry without the required information.

Processing is based on Article 6(1)(b) GDPR for pre-contractual measures. General expressions of interest or communications without a specific contractual context are processed under Article 6(1)(f) GDPR and our legitimate interest in orderly correspondence. Form details are sent to us by email and an automated acknowledgement is sent to the address provided.

Enquiries that do not lead to a contract are deleted after final handling as soon as they are no longer required for follow-up questions or to document that handling. The standard maximum period is six months. If a contract is formed, data relevant to the contract and accounting is retained for the applicable statutory periods and then deleted.

5. Essential sessions and guest area

The current website uses no analytics, marketing or profiling service and sets no non-essential cookies.

When the enquiry form is opened, a technically necessary identifier valid only for the browser session is stored. It protects the form against abusive submissions and is removed when the browser is closed.

The protected guest area uses a separate essential session identifier. It is used for login, maintains protected access during use and is restricted to the /gast/ area. Access expires after twelve hours of inactivity or on logout, while the session cookie itself lasts only until the browser is closed. The guest area currently creates no user profiles and permanently stores no personal travel details.

Access to the device is based on section 25(2)(2) of the German Telecommunications and Digital Services Data Protection Act. Subsequent processing is based on Article 6(1)(b) GDPR where information is provided to confirmed guests and additionally on Article 6(1)(f) GDPR. Our legitimate interest is secure, access-controlled operation.

6. Abuse prevention

To protect the enquiry form, non-reversible check values are created from the IP address, email address and essential parts of the enquiry. They are used only to limit automated or repeated submissions. The associated timestamps are used for checks lasting between 15 and 60 minutes. On subsequent form submissions, files are deleted once they are more than 24 hours old.

For guest-area login attempts, a non-reversible check value is also created from the IP address. Failed attempts are considered for 15 minutes to limit repeated attempts. They are deleted after a successful login or after the check period on the next access. In addition, subsequent login attempts remove files once they are more than 24 hours old.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is protecting the website, enquiry channel and guest area against automated abuse and unauthorised access. These checks do not result in automated decisions with legal or similarly significant effects and are not used for profiling or advertising.

7. External links and social networks

The site links to Instagram and Facebook. No connection is made to these platforms until you follow a link. Their own privacy rules then apply and data may be processed outside the European Union.

The relevant provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. See Meta's privacy policy.

8. Your rights

Subject to the statutory requirements, you may request access, correction, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests and withdraw consent for the future.

You may also lodge a complaint with a supervisory authority. The competent authority is the Rhineland-Palatinate Commissioner for Data Protection and Freedom of Information, Postfach 30 40, 55020 Mainz, Germany, www.datenschutz.rlp.de.

9. Security and updates

The website is delivered using encrypted HTTPS. We use appropriate technical and organisational measures to protect personal data. This notice will be updated when features, service providers or legal requirements change.