1) Controller
The controller is Revard Digital 030 GmbH, c/o betahaus GmbH, Rudi-Dutschke-Str. 23, 10969 Berlin, Germany. Managing director: Robert Nagel. Telephone: +49 30 60989327. Email: info@rd030.de.
Data protection enquiries: info@rd030.de
2) Hosting and server log files
This website is delivered via the platform of Lovable (Lovable Labs, Stockholm, Sweden) and its infrastructure service providers. Technically necessary data are processed by them as processors. Processing outside Germany, including outside the European Economic Area, cannot be ruled out; where this occurs, it is based on adequacy decisions or standard contractual clauses.
The RD030 platform itself is developed and operated in Germany and is not part of this website.
Page requests may involve processing the URL visited, time, browser, operating system, referrer, transferred data volume and IP address in server logs. The purposes are operation, stability and abuse detection; the legal basis is Article 6(1)(f) GDPR. Server log files are kept only as long as necessary for these purposes. Security-related data may remain necessary until a specific incident has been resolved.
3) Contact forms and access requests
Depending on the form, we process your name, company, email address, number of hotels, message and optional telephone number. The purposes are handling your request, recording interest in access and providing the associated confirmation. Contract-related requests rely on Article 6(1)(b) GDPR; other requests and technical administration rely on Article 6(1)(f) GDPR. The mandatory checkbox acknowledges processing to handle the request; it is not advertising consent.
Initially, only the email address provided receives a confirmation link (double opt-in). The link is valid for 24 hours and can be used once. Only after explicit confirmation is the request saved as confirmed and forwarded to Robert Nagel at Revard Digital 030 GmbH; the requester then receives an acknowledgement. These emails are sent via Mailgun Technologies (EU region) as processor. Form contents are not shared with advertising platforms.
Permitted confirmed and unconfirmed requests are stored with restricted access: form contents, time, form type, language, confirmation status and campaign information (source). Confirmation tokens are stored only as hashes. For abuse prevention, the IP address is hashed with a secret addition; raw IP addresses are not stored in the request table. An invisible check field, a three-second minimum, input validation, duplicate detection and time-based sending limits help prevent abuse. The legal basis is Article 6(1)(f) GDPR. Technical counters expire within 24 hours and are cleared on the next permitted form call.
Requests are deleted after 12 months at the latest, unless statutory retention obligations apply.
4) Campaign information (UTM parameters and click identifiers)
If the requested address contains utm_source, utm_medium, utm_campaign, utm_content, utm_term, gclid, fbclid or msclkid, we take these values with a form request and show them as the source in the internal notification. The purpose is attributing the request to a campaign; the legal basis is Article 6(1)(f) GDPR. Only with marketing consent do we keep the values of the first page view in sessionStorage for the browser session; without consent they are sent only from the current address together with the form. On our campaign pages we additionally send the entry page (path without parameters), the referring page (address without parameters) and the language; with consent these values are also kept in sessionStorage for the browser session.
5) Cookies, tracking and consent management
Necessary: When you choose DE or EN manually, we store this choice in our own cookie rd030_language for 12 months (localStorage as fallback). Your cookie decision is stored in our own cookie rd030_consent for 12 months with time, notice version and choice per category. The legal basis is Section 25(2) no. 2 TDDDG and Article 6(1)(c) and (f) GDPR.
On your first visit a banner offers the equivalent options “Accept all”, “Necessary only” and “Settings”. Only necessary storage is preselected. No analytics or marketing scripts load before your consent; Google Consent Mode v2 starts with denied signals for ad_storage, ad_user_data, ad_personalization and analytics_storage.
Statistics: With consent we load Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Processed data are pages viewed, events such as call-to-action clicks, opened FAQs, scroll depth, language switches and submitted forms, device and browser details, truncated IP address and cookie identifiers. The legal basis is Article 6(1)(a) GDPR and Section 25(1) TDDDG.
Marketing: With consent we load Google Ads conversion tracking (Google Ireland Limited) and the Meta Pixel (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland). We measure page views, opened modules and successfully submitted requests with a random event ID. With marketing consent a request may additionally be reported server-side through the Meta Conversions API; the email address is sent only as a SHA-256 hash together with IP address, browser identifier and Meta cookie identifiers. Hashing is not anonymisation. The legal basis is Article 6(1)(a) GDPR and Section 25(1) TDDDG. For the Meta Pixel we are joint controllers with Meta (Article 26 GDPR). The Meta Pixel loads only after your marketing consent. You can withdraw consent at any time with effect for the future via “Cookie settings” in the footer; after that we send no further data to Meta.
International transfers: Google and Meta may transfer data to the USA, based on the EU-US Data Privacy Framework where the providers are certified, and on standard contractual clauses.
Retention: Google Analytics cookies up to 14 months, Google Ads cookies up to 90 days, Meta cookies up to 90 days.
Withdrawal: You can change or withdraw your consent at any time via “Cookie settings” in the footer. Withdrawal takes effect immediately, including in other open tabs; processing before withdrawal remains lawful. Events blocked earlier are not sent afterwards.
6) International transfers
Where data are processed outside the EEA, for example by Google, Meta or infrastructure service providers, we rely on the EU-US Data Privacy Framework where the provider is certified, and on standard contractual clauses.
7) Data security
This website uses TLS encryption for transmission. Access to request data is limited to necessary personnel. Inputs are validated and form abuse is hindered by an invisible check field and time-limited sending restrictions. Complete security of every electronic transmission cannot be guaranteed.
8) Your rights and right to object
Subject to the legal requirements, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction (Article 18), notification (Article 19) and data portability (Article 20). Consent can be withdrawn at any time with future effect under Article 7(3). Under Article 21, you may object to processing based on legitimate interests on grounds relating to your particular situation. You may object to direct marketing at any time. Contact: info@rd030.de.
Under Article 77 GDPR, you can complain to a data protection supervisory authority, particularly the Berlin Commissioner for Data Protection and Freedom of Information. Information and contact: https://www.datenschutz-berlin.de/.
9) Changes to this policy
We update this policy when services, processing purposes or legal requirements change. Any necessary new consent will be obtained before the processing concerned begins.
Updated: 26 October 2026