Privacy Policy
Last updated: October 2026
This Privacy Policy informs you, in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR), about which personal data we process when you use the bookingbyoffer platform (website bookingbyoffer.com and related apps). It also explains for what purposes and on what legal basis this happens, to whom we disclose data, and what rights you have. Personal data means any information relating to an identified or identifiable person. This English version is a translation for your convenience; the German version is legally binding.
1. Controller
bookingbyoffer GmbH Urbanstraße 27 10967 Berlin Germany Represented by: William Fischer (Managing Director) Email: info@bookingbyoffer.com Phone: +49 170 4070175 For all questions about data protection and to exercise your rights, contact us at info@bookingbyoffer.com.
2. What data we process
2.1 Account and profile data Name, email address, password (only as a hash), optionally phone number, address, profile picture and description, preferred language and currency, settings (e.g. for notifications), whether you are enabled as a host and whether you rent out privately or as a business, and your registration date. 2.2 Listing data (hosts) Address and map position of the accommodation, photos, description, amenities, rooms and beds, house rules, check-in and check-out times, cancellation policy, internal base price and cleaning fee, availability and blocked days. If you connect an external calendar, we store its link and the booked periods read from it. If you save a listing as a draft, we store the details entered and the photos uploaded until you publish or delete the draft. 2.3 Identity and payout data (hosts) To enable payouts, we collect your full legal name, date of birth, nationality, legal form (individual or company) and, where applicable, company name and registration number. We also collect your tax identification number (optional) and your IBAN. We pass the full IBAN directly to Stripe and keep only its last four digits. If Stripe additionally requires an identity document or a photo match (selfie), you upload these directly to Stripe in an embedded form. We do not receive or store these documents. From Stripe we only receive the verification status and any outstanding requirements. 2.4 Offer, negotiation and booking data Requested accommodation, travel dates, number of guests, offers and counter-offers with their messages, negotiation history, deadlines, booking status, change and cancellation requests with reasons, refunds, and the cancellation policy in force at the time of booking. 2.5 Payment data Stripe customer and payment references, payment and payout status, amounts, service fee and payout amount. Card details and other full payment instrument data exist only at Stripe; they are not stored on our systems. To allow an agreed extension to be charged, your payment method may be stored with Stripe for the respective booking. 2.6 Communication data Messages you exchange with other users via the platform, your enquiries to us, and the emails and push notifications we send you about your bookings. 2.7 Reviews Reviews of accommodation, hosts and guests (stars and comment) and ratings of negotiations (response speed and fairness). 2.8 Technical data When you access the platform, our hosting provider and database process technically necessary data. This includes IP address, date and time, URL requested, browser and operating system, and error messages. We also process login tokens and, in the app, a push token of your device if you have allowed notifications. 2.9 Data from other sources From Stripe we receive information about the status of identity verification and payments. Through calendar sync we receive booked periods from other booking platforms. From other users we receive, for example, reviews about you or reports of violations.
3. Purposes and legal bases
We only process your data where a legal basis exists. Providing the platform and your account, displaying listings, search, negotiation, booking, payment, payout, refunds, cancellation, changes to stays, and communication between guest and host Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Email and push notifications about offers, bookings and messages Legal basis: performance of a contract (Art. 6(1)(b) GDPR). You can switch off email notifications in your profile, and push notifications in the app or your device settings. We only send marketing emails with your consent (Art. 6(1)(a) GDPR). Identity verification of hosts and payouts via Stripe Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and Stripe's legal obligations as a payment service provider, e.g. to prevent money laundering. Reporting to tax authorities and retention under commercial and tax law Legal basis: legal obligation (Art. 6(1)(c) GDPR in conjunction with the German Platform Tax Transparency Act (PStTG), section 147 of the German Fiscal Code (AO) and section 257 of the German Commercial Code (HGB)). Machine translation of listings, messages and reviews into your language, displaying accommodation on maps and converting addresses into coordinates Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and our legitimate interest in an understandable and user-friendly platform (Art. 6(1)(f) GDPR). Non-binding price suggestion when submitting an offer We calculate it from the prices of previously accepted bookings for the same accommodation. Other users do not see any data of individual bookings. Legal basis: legitimate interest in functioning price negotiation (Art. 6(1)(f) GDPR). Security, fraud and abuse prevention, handling reports, enforcing our Terms, error analysis and further development of the platform Legal basis: legitimate interest in the secure and stable operation of the platform and in protecting our users (Art. 6(1)(f) GDPR). Establishing, exercising or defending legal claims Legal basis: legitimate interest (Art. 6(1)(f) GDPR). You must provide the information required for registration, a booking or a payout so that we can perform the contract. Without it you cannot use the respective feature. All other information (e.g. profile picture, profile description) is voluntary. We do not make solely automated decisions within the meaning of Art. 22 GDPR and do not carry out profiling for advertising purposes. Only the deadlines defined in our Terms run automatically, e.g. an offer expiring without a reply.
4. What other users can see
Publicly visible, even without logging in, and possibly findable via search engines: - your profile: name, profile picture, profile description, date of registration, reviews and negotiation ratings received; - for hosts, also whether you rent out privately or as a business (a legally required notice), and your listings, including photos, description, location and map position of the accommodation, and calendar availability (without information about who booked). Visible only to the other party in a negotiation or booking: - your offers, messages and booking details (dates, number of guests, price); - for hosts, the guest's name and profile picture. Please only share in messages the data that is necessary for the booking.
5. Recipients and service providers
We only disclose your data where this is necessary for the purposes described, where you have consented, or where we are legally obliged to. We do not sell personal data. Processors (Art. 28 GDPR) The following service providers work on our behalf and according to our instructions: Supabase Inc., USA – database, login and file storage (e.g. photos). The data is stored in a data centre in the EU. Vercel Inc., USA – website hosting, server functions and content delivery. Resend Inc., USA – sending emails. DeepL SE, Cologne, Germany – machine translation of listings, messages and reviews. Only the respective text is transmitted. Your name or contact details are not sent. Expo (650 Industries, Inc.), USA – delivering push notifications to the app. The notifications are delivered to your device via Apple or Google services. Payments: Stripe Payments, payouts and identity verification of hosts are handled by Stripe Payments Europe, Limited (Dublin, Ireland), together with affiliates such as Stripe, Inc. (USA). Stripe processes some data under its own responsibility, in particular to meet its own legal obligations (e.g. anti-money-laundering) and to detect fraud. On pages with payment or verification forms, Stripe loads its own code and sets cookies for fraud detection. More information: stripe.com/privacy. Maps: OpenStreetMap For maps and for converting addresses into coordinates, we use services of the OpenStreetMap Foundation (United Kingdom). We load the Leaflet library from the unpkg service. For this, your browser retrieves map tiles and program files directly from these servers. In the process, your IP address and the map area displayed or the address entered are transmitted. The legal basis is our legitimate interest in displaying accommodation on a map (Art. 6(1)(f) GDPR). More information: osmfoundation.org/wiki/Privacy_Policy. Other users We only share data with other users as described in section 4. Authorities and courts We disclose data to authorities and courts where we are legally obliged to do so. This includes, for example, the annual reporting of host data and income to the German Federal Central Tax Office under the PStTG. Reported data include in particular name, address, date of birth, tax ID, bank details, address of the accommodation and income. We also disclose data on the basis of enforceable official or court orders and where this is necessary to avert a serious danger. Where permitted, we inform you of such requests. Advisers and corporate transactions We share data with tax advisers, lawyers and auditors, who are bound by statutory confidentiality. In the event of a restructuring, merger or sale of the company, data may pass to the acquirer. We would inform you of this in advance.
6. Transfers to third countries
Some of our service providers are based in, or access data from, the USA or the United Kingdom. For transfers to the USA, we rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework, where the respective provider is certified under it. Otherwise we use the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). For the United Kingdom, an adequacy decision of the European Commission applies. You can obtain a copy of the safeguards on request at info@bookingbyoffer.com.
7. Retention
We store personal data only for as long as is necessary for the respective purpose or as long as statutory retention obligations apply. Account and profile data: until your account is deleted. Listings: until deleted by the host or until the account is deleted. Listing drafts: until published or deleted by the host, at the latest until the account is deleted. Messages and negotiations: until the account is deleted, unless they belong to a booking relevant for accounting. Booking, payment and accounting data: in line with the periods under commercial and tax law. We keep accounting vouchers for 8 years and books and annual financial statements for 10 years (section 147 AO, section 257 HGB). Each period begins at the end of the calendar year. Data collected for reporting under the PStTG: 10 years after the end of the respective reporting period. Reviews: for as long as the reviewed listing or profile exists. Reviews you have written about others may continue to be displayed without your name after your account is deleted. Technical logs: in line with our service providers' retention periods, usually a few days to weeks. If deletion is not yet possible due to statutory retention obligations, we restrict the data from any other use. Data we need to resolve a legal dispute is kept until it is concluded. Backups are overwritten after a short delay.
8. Cookies and storage on your device
We do not use cookies or similar technologies for analytics, audience measurement or advertising. We only store or read information on your device that is strictly necessary for the service you requested (section 25(2) no. 2 of the German TDDDG). No consent is required for this. Local storage of your browser or the app: - login token, so that you stay logged in; - your selected language and currency; - whether you are currently using the guest or host view; - a cache of texts already translated, so they do not need to be translated again. Cookies: - Stripe cookies, only on pages with payment or verification forms, for fraud detection and secure payment processing (see section 5). You can delete stored data in your browser at any time. In that case you will need to log in again.
9. Your rights
You have the following rights against us. To exercise them, simply email info@bookingbyoffer.com. You can also view and change much of your data directly in your profile. We respond within one month. Access (Art. 15 GDPR): whether and which data we process about you, and a copy of that data. Rectification (Art. 16 GDPR): you can ask us to correct inaccurate data and complete incomplete data. Erasure (Art. 17 GDPR): you can ask us to delete your data, provided no statutory retention obligation applies and we do not need it to complete open bookings or to defend legal claims. Restriction of processing (Art. 18 GDPR): e.g. while the accuracy of your data is being checked. Data portability (Art. 20 GDPR): you receive the data you provided in a structured, commonly used and machine-readable format. Withdrawal of consent (Art. 7(3) GDPR): you can withdraw consent at any time with effect for the future. This does not affect the lawfulness of processing carried out before the withdrawal. Right to object (Art. 21 GDPR) Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims. You may object to the processing of your data for direct marketing at any time without giving reasons.
10. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your residence, place of work or the alleged infringement. The authority responsible for us is: Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information) Alt-Moabit 59-61 10555 Berlin, Germany Phone: +49 30 13889-0 Email: mailbox@datenschutz-berlin.de Website: www.datenschutz-berlin.de You are also welcome to contact us first with your concern.
11. Data security
We protect your data against loss, misuse and unauthorised access through technical and organisational measures. These include: - encrypted transmission (HTTPS/TLS); - storing passwords only as hashes; - access restrictions in the database; - login checks on all protected server functions; - no storage of full payment or identity document data on our systems. We review these measures regularly. However, nobody can guarantee absolute security when data is transmitted over the internet.
12. Minors
The platform is intended exclusively for people aged 18 and over. We do not knowingly collect data from minors. If we learn that an account has been created by a minor, we will delete it. We only process data about children travelling along (e.g. the number of guests) insofar as the booking adult provides it for the booking.
13. Data about other people
If you give us data about other people, e.g. fellow travellers, you must be entitled to do so. Please inform them about this Privacy Policy.
14. Changes to this Privacy Policy
We update this Privacy Policy when our platform or the legal situation changes. You can always find the current version at bookingbyoffer.com/datenschutz; the date of the last change is shown at the top. We will inform registered users of material changes by email at least 30 days in advance.