Privacy Policy

General information

This privacy policy explains how personal data is processed when you visit our website, contact us or request a reservation, and within the protected reservation administration area.

1. Data controller

You can use these contact details for privacy questions and to exercise your rights.

2. Hosting and server logs

Our website and our own reservation system are hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin. STRATO processes hosting data on our behalf. We have concluded a data processing agreement.

When you access a page, the connection and request data needed to deliver it is processed. This includes, in particular, the IP address, time, page or file requested, technical response status, volume of data transferred and information sent by the browser about the browser, operating system and, where applicable, the previously visited page. Such technical request data also arises when the reservation configuration is loaded, before you fill in the form.

This processing serves to provide the website, diagnose errors and identify and defend against attacks. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the reliable and secure operation of our website.

According to STRATO’s general information, complete visitor IP addresses are stored for no more than seven days to identify and defend against attacks. This security logging is separate from the statistical analysis described below.

3. Server-side visitor statistics

STRATO’s visitor statistics are active for this website. They include page access counts, accesses grouped as visitors and sessions, and breakdowns by device and client type. STRATO describes these hosting statistics as an analysis of server logs. We can view the results in the protected customer area.

The analysis helps us understand which content is accessed and how we can improve the website’s technology and content. Relevant access data may include pages requested, times, technical browser information, referring pages and IP addresses or identifiers derived from them. The visitors shown in the statistics do not necessarily correspond to individual people.

We do not use these analyses for personalised advertising or combine them with our reservation data. We rely on Article 6(1)(f) GDPR for proportionate analysis of personal access data. Our interest is to assess the use and technical quality of our website. Your right to object is described in section 9.

We do not embed an additional analytics script, tracking pixel or analytics cookie on the public website for these statistics. They are therefore distinct from browser-based advertising and tracking services. Google Analytics, Google Tag Manager and Meta Pixel are not embedded.

4. Contacting us

If you contact us by email or phone, we process the contact details you provide and the content of your enquiry so that we can respond. If the enquiry concerns entering into or performing a contract with you, processing is based on Article 6(1)(b) GDPR. We handle other enquiries on the basis of Article 6(1)(f) GDPR and our interest in responding to incoming requests. Where needed, this also includes communication with a company’s contact persons.

The time needed for processing depends, in particular, on completing your enquiry and resolving subsequent questions. Retaining personal data beyond that requires a specific reason, such as an applicable statutory obligation or an ongoing dispute. Information on emails and backup copies is provided in section 7.

5. Online reservations

Information and purpose

For a reservation enquiry, we process the occasion, date, time, number of guests, first name and contact details provided. Depending on the occasion and your entries, this may also include your last name, company name, requested football match and an optional message.

The occasion, date, time, number of guests, first name and acknowledgement of the privacy information are mandatory. Except for corporate events, at least one contact method is required: an email address or phone number. For corporate events, the last name, company name, email address and phone number are additionally mandatory; for football reservations, the requested match is mandatory. For other occasions, the last name is optional.

The required information is needed to process the particular enquiry; it is not generally required by law. Without it, we cannot process the enquiry. The privacy acknowledgement checkbox is not consent to advertising or tracking.

We use the data to check, organise, process and, where applicable, change or cancel the reservation on the basis of Article 6(1)(b) GDPR. If you act as a contact person for a company, your contact details are processed for business communication on the basis of Article 6(1)(f) GDPR.

Technical process and notifications

While you enter information, the form details are held temporarily in the browser’s working memory. When you submit the completed form, they are sent to our own reservation system and stored in a database within STRATO’s hosting environment. Authorised people at Bose Eck can access them to process the enquiry.

The system also stores the reservation number, a technical identifier to prevent duplicate requests, language, processing status, and creation and processing timestamps. It records whether the enquiry was entered through the public form or the administration area, and documents the version and acknowledgement of the information provided. Organisational notes and a cancellation message may be added during further processing.

Opening hours, time slots, capacity and blocked periods are checked automatically. Every reservation enquiry is reviewed personally and becomes binding only after Bose Eck expressly confirms it. No decision based solely on automated processing with legal or similarly significant effects within the meaning of Article 22 GDPR is made.

If you provide an email address, we send an acknowledgement with the main enquiry details and reservation number. This is not yet a binding reservation confirmation. Bose Eck also receives a notification. Further emails may concern processing or cancellation. If you provide only a phone number, no automatic email is sent to you.

We send reservation messages through STRATO’s SMTP service. STRATO processes the recipient address, subject and content as our data processor; other mail servers involved in delivery also process the data required for that purpose. The system temporarily holds messages and delivery status in a server-side outgoing mail queue. This processing follows the purpose and legal basis of the relevant reservation communication.

6. Abuse prevention and administration

Limiting abusive requests

To protect the form and login, the system limits certain requests within defined time windows. It uses a secret key to derive a verification value from the IP address and stores it with a request counter and timestamps. For login attempts, the email address entered may also be included in this value. The value is a pseudonymous identifier; these counters do not contain the IP address in plain text.

Processing is based on Article 6(1)(f) GDPR and our interest in protecting the functions against abuse and unauthorised access. Counters for windows that began more than 48 hours earlier are removed during the next technical cleanup. Cleanup is triggered by requests to the reservation interface and runs at most once daily.

Administrator accounts and logs

The protected administration area processes login email addresses, protected password verification values, permissions, login timestamps and information about failed login attempts. Access is provided only to authorised people.

Administrative actions are logged with their time, action, record identifier, any status information and a verification value derived from the IP address. A separate technical error log may contain messages relating to the application and email delivery. These logs support traceability, error diagnosis and protection against unauthorised interference on the basis of Article 6(1)(f) GDPR.

Administrative log entries are removed after 30 days during the next technical cleanup. The application’s own error log retains the last 14 UTC calendar days; older entries are removed during the next daily cleanup run of the reservation interface. These periods apply to our application and are separate from the hosting provider’s logs.

Technical session cookie

The session cookie bose_eck_reservations_admin is set only after a successful administrator login. It contains a technical session identifier and is used for authentication and securing administrative actions. It is used only for the reservation interface, is transmitted over HTTPS and cannot be read by JavaScript (Secure, HttpOnly, SameSite=Strict).

The cookie has no fixed expiry date in the browser. Browser session restoration may preserve it after a window is closed. Independently of that, server-side login authorisation expires after one hour of inactivity or after eight hours at the latest. Logging out ends the session.

This session cookie is not newly set on public pages, in the public reservation form or simply by opening the login page. Storage that is strictly necessary for the expressly requested login is based on section 25(2), point 2 TDDDG; processing personal data for security is based on Article 6(1)(f) GDPR.

7. Retention and deletion

Reservation data and outgoing mail queue

Once 90 days have passed since the end of the reserved time slot, the system clears direct name and contact details, company, requested match, free text, internal notes and the cancellation message. Cleanup takes place on a subsequent request to the reservation interface, at most once per UTC calendar day. It is not an independently scheduled process that runs without website requests.

Associated messages in the outgoing mail queue are removed at the same time. Successfully sent queue entries are removed during the next cleanup once more than 14 days have passed since sending. Personal information newly entered into older, previously cleaned records is cleaned again.

Some reservation identifiers, dates and times, guest numbers and status details remain. Where other information can link them to a person, they remain personal data. Removing names and contact details therefore does not guarantee complete anonymity.

Correspondence and backups

Cleaning the reservation database and outgoing mail queue does not remove messages from the email inboxes actually used. Retention of correspondence depends on whether the enquiry and related questions have been finally resolved or whether a message is still needed for a specific statutory retention purpose or an existing legal dispute. Statutory obligations may justify processing under Article 6(1)(c) GDPR; necessary establishment, exercise or defence of legal claims may be based on Article 6(1)(f) GDPR.

Deletion from active data must also be distinguished from existing backups. STRATO creates daily backups of the webspace; according to the provider’s description, backups from the last 14 days are available. Cleaning the running application does not simultaneously remove data from an earlier backup. These backups enable recovery after data loss or technical faults, based on Article 6(1)(f) GDPR and our interest in reliable recovery of operations.

A restoration may bring back earlier data. Deletions already due must therefore be applied again; restoring data does not restart the retention period. These webspace backups are separate from copies in email inboxes or independent mail backups. You can request deletion or restriction of your data using the contact details above.

8. Public pages and external links

We do not use advertising or tracking cookies on public pages. The application does not persist reservation entries in Local Storage, Session Storage or a browser database. Technical state held in working memory and browser navigation supports the form and page changes. The normal browser cache may store static files temporarily. These functions are not used to build advertising profiles. Server-side visitor statistics are described in section 3.

Images, logos, fonts, stylesheets and application scripts are served from our own webspace. Maps, social media posts and external video players are not automatically embedded.

Links to Google Maps, Facebook and Instagram are ordinary external links. Opening one takes you to the respective provider’s service, where its privacy information applies. Our locally hosted icons do not themselves load content from those providers.

9. Your rights

Subject to the applicable legal conditions, you have rights to access, rectification, erasure, restriction of processing and data portability. You can use the contact details above to exercise them.

Right to object: Where we process data under Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. We will then continue processing only if overriding compelling legitimate grounds or the establishment, exercise or defence of legal claims justify it.

If processing is based on your consent, you may withdraw it for the future. The lawfulness of previous processing is unaffected. Acknowledging the privacy information in the reservation form is not consent to advertising or tracking.

You also have the right to complain to a data protection supervisory authority. In particular, you can contact the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin. Information and complaint options are available at datenschutz-berlin.de.