La Casa Bonita Boutique
La Casa Bonita Boutique
1. Privacy Policy at a Glance
General Information
The protection of your personal data is a top priority for us. This privacy policy informs you about the personal data we collect when you use our website www.lacasabonita.boutique and how we process this data, for what purposes, and what rights you have under the General Data Protection Regulation (GDPR)
Personal data is any information that relates to an identified or identifiable natural person.
Data Collection on Our Website
Your personal data is collected when you provide it to us actively. This can be, for example, in the context of a contact or booking inquiry, by e-mail, telephone, or via WhatsApp.
In addition, certain technical information is automatically collected by our IT systems when you visit our website. This may include, in particular, your IP address, browser type and version, the operating system used, the referrer URL, and the date and time of access to the site.
We use analysis, statistics, or similar services on our website only after your prior consent, if legally required.
Purpose of Processing
We process your personal data for the following purposes:
-- to provide our website technically and securely,
-- to process contact and booking inquiries,
-- to prepare and execute accommodation contracts,
-- to communicate with our guests and interested parties,
-- to fulfill legal obligations,
-- to ensure the security and functionality of our website,
-- and, if you have given your consent, to analyze and improve our online offer.
Your Rights
You have the right, at any time, to:
-- information about the personal data stored about you,
-- correction of incorrect or incomplete data,
-- deletion of your personal data,
-- restriction of processing,
-- data portability,
-- objection to certain processing,
-- and to revoke a given consent with effect for the future.
Furthermore, you have the right to complain to a competent data protection supervisory authority about the processing of your personal data.
2. Hosting
This website is hosted by the following provider:
IONOS SE
Elgendorfer Straße 57
56410 Montabaur
Germany
When you visit our website, the hosting provider may process technical data and server log files. This may include your IP address.
The processing is carried out to provide our website in a secure, stable, and technically flawless manner.
The legal basis is Art. 6 (1) lit. f GDPR. Our legitimate interest lies in the secure and reliable provision of our online offer.
If consent is required for certain processing operations, the processing will only be carried out on the basis of your consent.
For more information on data protection at IONOS, please refer to IONOS' data protection declaration.
If necessary, there is a contract for order processing with IONOS in accordance with Art. 28 GDPR.
3. General Information and Mandatory Information
Responsible Entity
The responsible entity within the meaning of the GDPR is:
Halima Taoumi
La Casa Bonita
Am Born 4
59821 Arnsberg
Germany
Phone: +49 (0) 152 01815895
E-mail: info@lacasabonita.boutique
Storage Duration
Unless a more specific storage period is specified in this data protection declaration, we will store personal data only as long as necessary to fulfill the purpose of processing or as long as required by law.
When the purpose of storage ceases to apply or a storage period prescribed by law expires, the personal data will be routinely deleted, unless there is a need for further storage of the data for the conclusion or fulfillment of a contract.
Revocation of Consent
If the data processing is based on your consent, you can revoke this consent at any time with effect for the future.
The lawfulness of the data processing carried out until the revocation remains unaffected by the revocation.
Right to Object
You have the right, for reasons arising from your particular situation, to object at any time to the processing of your personal data based on Art. 6 (1) lit. e or lit. f GDPR.
Right to Lodge a Complaint with the Supervisory Authority
You have the right to complain to a data protection supervisory authority about the processing of your personal data.
The competent supervisory authority for North Rhine-Westphalia is:
Data Protection Commissioner for North Rhine-Westphalia (LDI NRW)
Kavalleriestraße 2–4
40213 Düsseldorf
Germany
Right to Data Portability
You have the right to receive data that we process automatically on the basis of your consent or in fulfillment of a contract, in a common and machine-readable format, or to have it transmitted to another controller, if technically feasible.
Information, Correction, and Deletion
You have the right, at any time, to free information about your stored personal data, its origin and recipients, and the purpose of data processing, as well as a right to correction or deletion of this data, if necessary.
4. SSL and/or TLS Encryption
This website uses SSL and/or TLS encryption for security reasons and to protect the transmission of confidential content.
You can recognize an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in the browser line.
Due to the encryption, data transmitted via this website cannot be read by third parties.
5. Data Collection on This Website
Cookies
Our website uses cookies and similar technologies.
Cookies are small data sets that can be stored on your device. They can be used to ensure the technical functionality of the website or to provide specific functions.
Technically necessary cookies and similar technologies may be used if they are absolutely necessary for the provision of a service expressly requested by you.
For all other cookies or access to information on your device, we will obtain your consent beforehand, if required by law.
The legal basis for storing or accessing information on your device is § 25 TDDSG. For the subsequent processing of personal data, the respective legal basis according to Art. 6 GDPR is decisive.
A consent given can be revoked at any time with effect for the future.
Cookie Consent Management
A consent mechanism may be used on our website, which allows you to decide whether certain optional services and technologies can be used.
Your selection will be documented so that we can prove that consent has been given or not.
The processing of consent information is carried out to fulfill our data protection obligations.
The legal basis for this is Art. 6 (1) lit. c GDPR.
Server Log Files
The hosting provider of this website automatically collects and stores information in server log files, which your browser automatically transmits to us.
This information may include:
-- browser type and version,
-- operating system used,
-- referrer URL,
-- hostname of the accessing computer,
-- time of the server request,
-- IP address.
The processing is carried out to ensure a secure and technically flawless provision of our website.
The legal basis is Art. 6 (1) lit. f GDPR.
6. Contact Form
If you contact us using the contact form, we will process the data you enter into the form, including your contact information and the content of your message.
The processing is carried out for the handling of your inquiry and for the case of follow-up questions.
If your inquiry is related to the preparation or execution of a contract, the legal basis is Art. 6 (1) lit. b GDPR.
In other cases, the processing is based on our legitimate interest in an efficient handling of inquiries according to Art. 6 (1) lit. f GDPR or, if required, on the basis of your consent according to Art. 6 (1) lit. a GDPR.
The data will be deleted as soon as your inquiry has been conclusively processed and no legal obligations to store the data oppose deletion.
7. Contact via E-mail or Telephone
If you contact us by e-mail or telephone, your personal data will be processed for the purpose of handling your inquiry.
This may include:
-- name,
-- e-mail address,
-- telephone number, if provided,
-- content of your inquiry,
-- as well as further data that you voluntarily transmit to us.
The legal basis depends on the purpose of the contact and corresponds to Art. 6 (1) lit. b, lit. f, or, if required, lit. a GDPR.
8. Contact via WhatsApp
There may be a link to WhatsApp on our website.
If you click on this link, you will be redirected to WhatsApp. The provider is:
WhatsApp Ireland Limited
Merrion Road
Dublin 4
D04 X2K5
Ireland
If you contact us via WhatsApp, your telephone number and the content of your message may be processed.
The use of WhatsApp is voluntary.
For more information on data protection at WhatsApp, please refer to the data protection declaration of the provider.
9. Google Tag Manager
If Google Tag Manager is used on this website, it is used for the management and technical integration of other website services.
The provider is:
Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland
Google Tag Manager can process technical information, including the IP address. If services are integrated via Google Tag Manager that require consent, they will only be activated after the corresponding consent has been given.
If consent is required, the processing is carried out on the basis of Art. 6 (1) lit. a GDPR and § 25 TDDSG.
10. Google Analytics
If Google Analytics is used on this website, we use the service to analyze the use of our website.
The provider is:
Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland
Google Analytics can collect information about the use of our website, such as page views, duration of stay, technical information about the device and browser used, and other usage data.
Google may also transfer personal data to countries outside the European Union, particularly to the USA.
Google uses suitable data protection mechanisms for certain data transfers. This may include the standard contractual clauses of the European Commission and the EU-US Data Privacy Framework.
Google Analytics is only used if the required consent is available.
The legal basis is Art. 6 (1) lit. a GDPR in conjunction with § 25 TDDSG.
The consent can be revoked at any time with effect for the future.
11. Google Fonts
The fonts used on this website are integrated locally on our web server.
When you access our website, no connection is established to the Google Font servers to load the fonts.
Through the local integration, no personal data is transmitted to Google in this context.
12. Google reCAPTCHA
If Google reCAPTCHA is used on our website, it serves to protect our forms from abusive automated use and spam.
The provider is:
Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland
reCAPTCHA can process technical information about the website visitor, including the IP address.
If consent is required, reCAPTCHA will only be activated after the corresponding consent has been given.
The processing is then based on Art. 6 (1) lit. a GDPR and § 25 TDDSG.
13. Booking System CalendarApp
We use the booking system CalendarApp to display availability and process booking inquiries.
The provider is:
Tool Loft UG (limited liability)
Bessemerstraße 24–26
12103 Berlin
Germany
CalendarApp allows the display of availability and the transmission of booking inquiries.
When using the booking system, the following data may be processed:
-- name,
-- e-mail address,
-- telephone number, if provided,
-- desired stay period,
-- number of guests,
-- further information that you voluntarily transmit in the context of a booking inquiry.
In addition, technical data such as IP address, browser information, and access time may be processed.
The processing is carried out for the handling of your booking inquiry and for the preparation and execution of an accommodation contract.
The legal basis is Art. 6 (1) lit. b GDPR.
If CalendarApp processes personal data on our behalf, the processing is based on an agreement on order processing according to Art. 28 GDPR.
According to the provider, the data of CalendarApp is processed on servers in Germany and transmitted encrypted via SSL.
For more information on data protection at CalendarApp, please refer to the provider's information.
14. Booking and Accommodation
If you book an apartment with us, we will process the personal data required for the preparation and execution of the accommodation contract.
This may include:
-- first and last name,
-- address,
-- contact information,
-- arrival and departure dates,
-- number of accompanying persons,
-- required booking information,
-- payment and billing data.
The processing is based on Art. 6 (1) lit. b GDPR.
If statutory retention obligations exist, the processing is also based on Art. 6 (1) lit. c GDPR.
The data will be deleted as soon as it is no longer necessary for the stated purposes and no statutory retention obligations oppose deletion.
15. Statutory Reporting Obligations for Accommodation
As the operator of an accommodation establishment, we are obliged to comply with the statutory provisions of the Federal Registration Act.
For foreign guests, there is a special reporting obligation according to § 29 BMG. The data required for this purpose will be collected and processed on the basis of the statutory obligations.
The legally required data may include:
-- surname,
-- first name,
-- date of birth,
-- nationality,
-- address,
-- arrival and expected departure date,
-- number of foreign accompanying persons and their nationality,
-- as well as the serial number of the recognized and valid passport or replacement passport.
The legal requirements result from §§ 29 and 30 BMG.
The registration forms or electronically collected registration data will be stored according to the legal requirements and then deleted or destroyed.
16. Intermediary and Booking Platforms
If bookings are made through external intermediary or booking platforms, we may receive the personal data required for the execution of the booking from the respective platform.
Generally, the respective platform operator is responsible for the processing of your personal data.
For more information on data processing by the respective platform, please refer to the platform's data protection declaration.
17. Social Media
There may be links to our profiles on social networks, particularly Instagram and LinkedIn, on our website.
These links are simple links. A connection to the respective social network is only established when you click on the corresponding link.
For the subsequent processing of personal data by the respective social network, the respective provider is responsible.
18. Data Security
We take appropriate technical and organizational measures to protect your personal data against loss, destruction, manipulation, unauthorized access, or other unauthorized processing.
Our security measures are regularly reviewed and adapted in line with technological development and organizational possibilities.
19. Currency and Changes to This Data Protection Declaration
This data protection declaration has the status of September 2026.
The further development of our website, our offers, or changes in legal or official requirements may make it necessary to adapt this data protection declaration.
The current version will be published on this website.
La Casa Bonita
Halima Taoumi
Am Born 4
59821 Arnsberg
Status: September 2026