MAGONI+ · INFORMATION
Privacy policy
Updated: 9 October 2026.
1. Controller
Marcus Kirsch, owner of kirschrot
Siedlung 12, 14669 Ketzin/Havel
Email: marcus.kirsch@kirschrot.de
MAGONI+ is a brand of kirschrot.
2. Website and hosting
The website is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. Technical access data, such as IP address, page requested, time, browser and operating system details, are processed to provide and secure the website. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is a secure, functioning website.
According to its published hosting documentation, IONOS retains access log files for a maximum of eight weeks and anonymises the IP addresses in them. This period applies to hosting access logs, not booking records or emails.
3. Contact and communication
When you contact us, we process the contact details and messages you provide to handle your enquiry. For contract-related enquiries, the legal basis is Article 6(1)(b) GDPR; for other enquiries, it is our legitimate interest in handling them under Article 6(1)(f) GDPR.
We use IONOS Mail Basic 5 for email communication and also send booking-related messages through Smoobu. Email addresses, messages and, where applicable, attachments are processed.
4. Direct booking, booking management and Guest Guide with Smoobu
We use Smoobu GmbH, Pappelallee 78/79, 10437 Berlin, Germany, for reservations, availability, booking communication and the digital Guest Guide. Data processed include names, contact details, travel dates, guest numbers, booking identifiers, booking and payment status, and booking-related messages. Required fields are marked in the booking form. The legal basis is Article 6(1)(b) GDPR for arranging and performing the accommodation contract and Article 6(1)(c) GDPR for statutory documentation duties.
Under its contractual terms, Smoobu processes guest data as a processor. Smoobu uses subprocessors, whose processing may take place outside the European Economic Area. According to its published provider list, Smoobu uses adequacy decisions, including the EU-US Data Privacy Framework for certified US recipients, or European Commission Standard Contractual Clauses, depending on the recipient. The current list is linked below.
The booking engine only loads when you open it. The embedded providers then receive technical connection data such as IP address and browser information. Necessary access to your device falls under section 25(2) TDDDG; additional access requiring consent needs separate consent.
We analyse aggregated booking numbers, revenue and cancellations to plan our rental offering. The legal basis is our legitimate interest in business planning under Article 6(1)(f) GDPR.
Further information: Smoobu privacy policy, Contractual terms, Data processing agreement (Annex A), Subprocessors.
4a. Technical performance analytics in the Smoobu booking window
When you open the booking window, Smoobu uses Cloudflare Web Analytics from Cloudflare, Inc. within it. According to Smoobu, this monitors the booking window’s technical performance, load management and security. Data processed include page response times, browser type, operating system and HTTP header metadata. Smoobu states that no tracking cookies or persistent user identifiers are used and that users are not tracked across different websites.
According to the provider, IP addresses are briefly processed within Cloudflare’s network for routing connections and assessing security, then anonymised. Smoobu states that technical performance logs are generally retained for up to 30 days. This is not a general deletion period for booking records or all data held by Cloudflare.
Smoobu describes itself as an independent controller for this security and performance monitoring and cites legitimate interests under Article 6(1)(f) GDPR. According to its information, processing takes place within Cloudflare’s global network, so transfers outside the European Economic Area are possible. Smoobu states that Standard Contractual Clauses safeguard international transfers.
This provider-operated performance analytics is separate from our optional Matomo analytics. According to Smoobu, it cannot be disabled separately within the booking window or controlled through our “Analytics settings”. Choosing “Without analytics” prevents our Matomo measurement, but not this processing after you open the booking window. Further information is available in Smoobu’s privacy policy and Cloudflare’s privacy policy.
5. Payments with PayPal
PayPal is available for the direct booking process currently configured. The provider is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. PayPal processes the payment and transaction details needed for payment under its own privacy policy. We use amounts, payment status and transaction information to allocate and process your booking under Article 6(1)(b) GDPR and meet statutory obligations under Article 6(1)(c) GDPR.
6. Digital access with Nuki
We use electronic locks and Nuki Web from Nuki Home Solutions GmbH, Münzgrabenstraße 92/4, 8010 Graz, Austria, in connection with Smoobu to provide access to the property. Booking and authorisation data are processed to create time-limited access permissions. Nuki Web processes data in the cloud. The legal basis for providing access is Article 6(1)(b) GDPR.
Access permissions are limited to the agreed stay. Where access logs are recorded, they may include the time, locking action and permission used. Processing to secure access is based on our legitimate interest under Article 6(1)(f) GDPR. Device logs are overwritten by newer entries once the device-specific storage limit is reached.
7. Fonts and cookies
Fonts are loaded locally from our hosting. No connection to an external font provider is established.
Strictly necessary storage on and access to your device falls under section 25(2) TDDDG. Personal data are processed according to the respective purpose, particularly providing the website or carrying out your booking. The embedded booking engine is described in section 4.
7a. Optional website analytics with Matomo
With your consent, we use Matomo on our own IONOS hosting to measure page views, the selected website language, booking clicks and the opening of the booking engine. Data processed include pages viewed, time, shortened IP address, technical browser and device details, and the referring website at domain level. URL parameters other than the website language are excluded from analytics.
Analytics starts only after your active consent. The legal basis is Article 6(1)(a) GDPR and, for device access requiring consent, section 25(1) TDDDG. Matomo uses no analytics cookies; IP addresses are shortened by two bytes before storage. We use no user account identifiers, heatmaps or session recordings. Analytics data remain on our hosting and are not sent to Matomo as a provider.
Your choice is saved in your browser’s local storage for six months so that you do not need to choose again on every page. This storage is used solely to manage your privacy choice (section 25(2) TDDDG). You can withdraw or give consent at any time through “Analytics settings” in the footer. The website and booking remain available without consent. An enabled Do Not Track preference is respected.
Opening the booking engine does not prove that a booking has been completed or paid for. Data entered into Smoobu booking forms are not collected in Matomo.
Matomo raw data older than 90 days are automatically deleted during the weekly deletion run. Aggregated statistics reports remain available to evaluate our offering.
8. Retention
We retain personal data for as long as needed for the relevant purpose. Enquiries are deleted after they have been resolved, unless retention duties or further requirements to safeguard legal claims apply.
Statutory retention periods apply to tax-related documents: in particular, eight years for invoices and other accounting vouchers, six years for business correspondence, and ten years for books and tax records. Periods generally start at the end of the relevant calendar year; statutory extensions remain unaffected. The legal basis is Article 6(1)(c) GDPR.
Technical access data and entry data are retained according to their operational and security purposes; tax retention periods do not apply to them as a blanket rule. The duration of access permissions and the storage limits of device logs are described in section 6.
9. Your rights
Subject to the legal requirements, you have rights of access, rectification, erasure, restriction of processing and data portability. You may withdraw consent at any time with effect for the future; processing before withdrawal remains lawful. Consent is voluntary. You may object to processing based on legitimate interests for reasons relating to your particular situation. For rights requests, please contact the controller named above.
You may lodge a complaint with a data protection supervisory authority, particularly where you normally live or work, or where the alleged infringement occurred. For our registered location in Brandenburg, the competent authority is the Brandenburg Commissioner for Data Protection and Access to Information: www.lda.brandenburg.de.
We need the required booking details to perform the contract. Without them, we may be unable to process your booking. Our described booking process does not involve solely automated decision-making within the meaning of Article 22 GDPR.