Privacy Policy

1. Data controller

Porta Solis
Proprietor: Aleksandra Drežančić
Joachimsthaler Str. 4
91126 Schwabach
Germany

Email: info@portasolis.com. You can also use this address for data protection questions and to exercise your rights.

2. Scope

This privacy policy applies to portasolis.com, including the German, Croatian and English website sections, user and host accounts, accommodation listings, partner areas and digital guest functions.

Porta Solis is responsible for its own platform purposes. Hosts may be independent controllers for their own accommodation services, contract processing and statutory reporting obligations. Where we process guest data on their behalf, the respective agreements apply. This policy supplements the privacy information provided by the responsible host.

We receive data from you and, where applicable, from the host or the person organising a stay for several travellers. Required information is needed for the relevant process; without it, for example, we cannot assign an enquiry or create an account. A required field alone does not imply a legal obligation to provide information. You may omit optional information.

3. Hosting and technical infrastructure

The website, database and configured email delivery are provided through ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany.

When you visit, technically necessary data are processed: IP address, time, page accessed, browser, operating system, where applicable referrer, and status and error information. This serves content delivery, security, stability and troubleshooting. The legal basis is our legitimate interest in secure operation under Article 6(1)(f) GDPR.

Some images are loaded directly from kroatien-ferienhausvermittlung.de and jd-schwabach.de. The server delivering them receives connection data needed for retrieval, particularly the IP address, time and browser information. This serves to display accommodation or partner content on the basis of Article 6(1)(f) GDPR. Unlike a simple link, such an image file may be retrieved as soon as the relevant page section is displayed.

4. Contacting us

When you contact us by form, email or telephone, we process your information, particularly your name, email address, telephone number, topic, message and, where applicable, accommodation or travel information. The purpose is to process and respond to your enquiry.

The legal basis is Article 6(1)(b) GDPR for steps towards a contract or contract performance requested by you, and otherwise Article 6(1)(f) GDPR based on our interest in answering enquiries. Acknowledging this privacy policy is not additional consent to advertising.

5. User and host accounts

For registration, login and account management, we process your name or username, email address, password verification values, user role, profile and, where applicable, business data, assigned accommodation and activities handled in the account. Necessary security and status information is also processed.

This serves to provide agreed account functions under Article 6(1)(b) GDPR and to secure access and prevent misuse under Article 6(1)(f) GDPR. Public contact-person details and non-public contract or account data serve different purposes and are used accordingly.

6. Accommodation listings and uploads

For an accommodation listing, we process accommodation and host data, contact persons, address or location, amenities, prices, contact options, descriptions, images, logos and submitted files. Information intended for publication is visible to visitors to the listing.

The purposes are to review, create, publish and maintain the agreed listing. The legal basis is Article 6(1)(b) GDPR; communication with named contact persons may be based on Article 6(1)(f) GDPR. Please upload only necessary content that you are entitled to use and share.

7. Partner enquiries and partner profiles

For partner enquiries, depending on your entries, we process the company name, contact person, email address, telephone number, website, country, region or city, sector/category, services offered, desired partner package, payment method and other information provided.

This serves to process your enquiry, prepare a quotation, take steps towards a contract and carry out a subsequent partnership. Agreed partner profile data such as company name, services, region, images and contact or website links may be published. An enquiry alone does not result in publication of all form entries.

The legal basis is Article 6(1)(b) GDPR where you are the contracting party, and Article 6(1)(f) GDPR for business communication with contact persons. We process legally required billing and evidential data under Article 6(1)(c) GDPR.

8. Newsletter

If you subscribe to our newsletter, we use your email address and any additional information you provide to send you news, accommodation, travel ideas and offers from Porta Solis. The basis is your consent under Article 6(1)(a) GDPR.

We use MailPoet within our WordPress installation. Emails are sent through the configured SMTP connection at ALL-INKL.COM. After subscribing, you receive a confirmation email; only confirmation completes the double opt-in. Subscription data, the consent field, status and timestamps serve administration and evidential purposes. The time and IP address are also recorded upon confirmation.

Open and click tracking are currently disabled. No tracking cookies are used to measure newsletter performance. Technical delivery and error data may be processed for delivery and troubleshooting; our legitimate interest under Article 6(1)(f) GDPR applies to this.

You may withdraw your consent at any time with future effect, particularly via the unsubscribe link in the newsletter or by emailing us. The lawfulness of processing before withdrawal remains unaffected. We may retain limited evidence for necessary consent records and to honour an unsubscribe request on the basis of Article 6(1)(f) GDPR.

9. Accommodation, service and other enquiries

For an enquiry, we process in particular names, contact details, selected accommodation or service, stay dates, number of people, message and processing status. We use these data to assign and process the requested enquiry and, where necessary, pass them to the responsible host, landlord or provider.

The legal basis is Article 6(1)(b) GDPR for requested pre-contractual or contractual measures, and otherwise Article 6(1)(f) GDPR for appropriate communication and forwarding of your enquiry. On an external booking website, the respective provider carries out the processing.

10. Digital guest guides and guest access

Digital guest guides bring together information about the accommodation and stay, such as arrival, check-in, Wi-Fi, property information, contacts and recommendations. Depending on the modules booked and enabled, service requests, the guest shop, orders and problem reports are available.

Personal guest links and technical access identifiers associate authorised access with the relevant stay. Please do not share personal links with unauthorised persons. Processing serves to provide the agreed guest service under Article 6(1)(b) GDPR and to protect access under Article 6(1)(f) GDPR; the host's role is described in section 2.

11. Service requests, guest shop and problem reports

When these functions are used, we process accommodation and stay information, contact and assignment data, selected services or items, quantities, prices, requested dates, messages, and processing and payment status. Problem reports may contain descriptions and uploaded photographs.

Where necessary, the information is passed to the responsible host or service provider for processing, coordination, delivery and billing. The basis is Article 6(1)(b) GDPR; Article 6(1)(f) GDPR additionally applies when clarifying damage and safeguarding specific claims.

Please do not submit unnecessary sensitive data, copies of identity documents or images of uninvolved persons through free text or photographs.

12. Push notifications

The supplementary guest app is currently designated as an integration version and has not yet received general production acceptance. An optional web push function is available in the public demo. An ordinary website visit does not activate a push subscription.

If you explicitly activate this function and grant browser permission, Porta Solis uses its own service worker and web push via the infrastructure of the respective browser or operating system. Google, Mozilla and Apple are technically connected. No additional push marketing service is used.

The push endpoint address, technical encryption and authentication identifiers, language, validity and association with accommodation and guest or host access are stored; personal guest access may also include the stay association. The subscription is generally valid for 30 days. Data are stored securely and used to deliver a notification to the respective push service. That service also processes technical connection data. Push notifications contain a general update message and a link to the relevant activity.

The basis is your consent under Article 6(1)(a) GDPR and, where required, section 25(1) of the German TDDDG. You can withdraw push consent using the provided disable function or browser settings. Activities remain accessible through the normal app functions.

13. Stay data and pre-check-in

Depending on the stay, we process name, date and place of birth, nationality, address, contact details, document type and number, issuing country, where applicable validity details, and association with the stay. Information about fellow travellers may be provided by the organiser or host.

This serves to prepare and carry out the stay and to prepare required reporting data by the host. The host's legal basis depends on the respective accommodation contract and specifically applicable reporting duties, particularly Article 6(1)(b) or (c) GDPR. Not every technically available field is legally required for every stay.

Pre-check-in does not request scans or photographs of identity documents. Porta Solis currently does not automatically transmit these data to eVisitor. Internal preparation does not replace official reporting by the host. Traveller and document data are stored in encrypted form and made available only to authorised persons.

14. Contracts, confirmations and payment information

For contract and booking documents, we process contracting parties and their contact or address details, accommodation, stay, services, prices, security deposit, terms, contract confirmations, signature and time evidence, and saved PDF versions and version information. Payment information includes, for example, the selected payment method, invoice details and recorded payment statuses.

The purposes are to prepare, perform, bill and document the respective contract. Legal bases are Article 6(1)(b) GDPR, point (c) for statutory retention obligations and point (f) for safeguarding specific claims. The respective host's information also applies to host contracts.

Porta Solis does not itself process full credit card details in the current system. A recorded payment status is not an automatic confirmation from a payment provider. If you open an offered external payment link, the respective provider processes data there. Recipients of emailed contract PDFs receive their own document copy.

15. Cookies and local storage

Technically necessary cookies or access and session information are used for requested logins, protected areas, security and sessions. A protected contract session may require its own session cookie. Favourites store selected accommodation identifiers locally in the browser. The page language is determined by the respective address.

For explicitly used app functions, the service worker stores static app files locally. This cache does not store guest data, photographs or business activities. When push is enabled, the browser also manages the technical push subscription. Push is used only after separate activation; see section 12.

Where storage or access is strictly necessary for an explicitly requested function, section 25(2)(2) TDDDG applies. Any further use requiring consent is subject to consent. Further data processing depends on the respective contractual, consent or security purpose. You can delete or block local data and cookies in your browser; this may restrict functionality.

16. Independent Analytics

We use Independent Analytics for local audience measurement. In particular, pages visited, times and visit sequences, referring pages, browser, operating system and device categories, and approximate geographical location are stored.

The IP address and browser identifier are used to create a pseudonymous visitor identifier; the IP address also serves approximate geographical assignment. It is not stored in plain text in the analytics database. The additional value (salt) used for this changes daily. Logged-in users are not recorded.

The retention period is set to 90 days . Analytics data remain on our hosting and are not transmitted to external analytics servers for analysis. Independent Analytics uses neither tracking cookies nor local storage for this. The legal basis is our legitimate interest in data-minimising audience and usage analysis under Article 6(1)(f) GDPR.

17. External links, partner and affiliate offers

Our website contains links to hosts, partners, travel and booking providers and optional external communication channels. An ordinary external link leads to the third-party website only when clicked. There, the provider processes connection data and any link parameters passed according to its own privacy information. This differs from directly embedded images under section 3.

Porta Solis may receive a commission for qualifying transactions through affiliate links. Link parameters may identify the offer and referring channel.

If you use a WhatsApp link, you voluntarily access the service of WhatsApp Ireland Limited. Depending on the link, a prepared enquiry text may be passed. Alternatively, you can contact us by form or email. Please do not transmit unnecessary document data or sensitive traveller data via external communication links.

18. Data recipients

Where necessary for the relevant purpose and legally permitted, data are received by authorised employees, hosting, IT and email providers, responsible hosts/landlords and partners or service providers. When push is activated, the respective browser push service is also involved.

Further recipients may include accounting, tax and legal advisers and authorities where legally required. Accommodation and partner profile data agreed for publication are accessible to website visitors. Other hosts do not gain access to your non-public activities merely by registering.

19. Processing outside the EU/EEA

Hosting and configured email delivery take place at ALL-INKL.COM in Germany. Local analytics processing also takes place there.

Voluntary use of WhatsApp, external travel, booking or payment websites and optional browser push infrastructure may involve additional processing outside the EU/EEA. The service actually selected and its infrastructure are decisive. Independent processing by external providers is governed by their privacy information.

Where we ourselves transfer personal data to third countries, the requirements of Articles 44 et seq. GDPR must be observed. Information about the recipients and safeguards applicable to a specific transfer of our own can be requested at info@portasolis.com .

20. Retention period

We store data for as long as required for the relevant purpose, contract processing, statutory retention obligations, security or the establishment or defence of claims. They are then deleted or anonymised unless overriding retention reasons apply. Relevant factors include, for example, the duration of the account or service relationship and completion of the relevant activity.

Local analytics data are set to 90 days. Contact form copies are generally deleted 180 days after documented completion of processing; necessary separate retention of business records remains unaffected. Newsletter delivery status data are set to one month; unconfirmed newsletter subscriptions are generally scheduled for cleanup after 30 days. Account data in user administration must be distinguished from these.

Traveller and document data from pre-check-in are generally scheduled for deletion 24 hours after departure. In a timely documented unresolved reporting or correction case, the period may be extended to a maximum of seven days after departure. Technical deletion records are retained for up to 30 days. These periods do not apply generally to separate contracts, invoices or service activities.

Backups are overwritten or removed according to internal deletion and rotation rules.

21. Data subject rights

Subject to the statutory conditions, you have the right of access and a copy of your data (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20).

Objection: You may object to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation. You may object to direct marketing at any time without giving reasons (Article 21 GDPR).

You may withdraw consent at any time with future effect. The lawfulness of earlier processing remains unaffected. Contact: info@portasolis.com. Reasonable additional information may be required for secure identification. Please do not send an identity document copy unless requested.

22. Right to complain

You may lodge a complaint with a data protection supervisory authority, particularly in your habitual place of residence, workplace or the place of the alleged infringement.

For private businesses in Bavaria: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany. Information about complaints to BayLDA.

23. Changes to this privacy policy

We update this privacy policy when functions, services used or legal requirements change.

Last updated: September 2026