Privacy Policy

Privacy notice for guests of be Apart GmbH

(Last updated: August 2026)

1. Data Controller

be Apart GmbH
Owner: Aleksandar Micic
Helgoländer Str. 11
30163 Hannover, Germany
Email: stay@be-apart.eu
Website: www.ba-apartments.de

2. Data Protection Officer

A company data protection officer has not been appointed, as there is no legal obligation to do so under current legislation.

Contact person for data protection enquiries:

Aleksandar Micic, email: stay@be-apart.eu

3. Purposes and Legal Bases of Data Processing

We process personal data of our guests exclusively for the purpose of carrying out and managing bookings, stays and legal obligations.

Processing is based on:

Art. 6(1)(b) GDPR – performance of a contract (booking, check-in, accommodation, billing)
Art. 6(1)(c) GDPR – compliance with a legal obligation (registration law, retention obligations)
Art. 6(1)(f) GDPR – legitimate interest (e.g. security through video surveillance)

We do not use personal data for advertising, newsletters or profiling.

4. Categories of Data Processed

Master data (name, address, date of birth)
Contact data (telephone, email)
Booking and stay data (arrival/departure, apartment category, price, payment method)
Payment and billing data
Registration information pursuant to the German Federal Registration Act (Bundesmeldegesetz)
Video recordings from public areas (see section 8)

5. Sources of Data

We receive data directly from you or via booking platforms (e.g. Booking.com, Expedia, Airbnb) and through our self-check-in kiosk.

6. Recipients / Disclosure to Third Parties

To fulfil our obligations, we use European service providers, for example for:

Booking and property management systems
Payment processing / payment service providers
IT hosting and technical maintenance

All service providers are contractually obligated to comply with data protection requirements in accordance with Art. 28 GDPR. Data is not transferred to third parties outside the EU.

7. Duration of Storage

Booking and billing data: 10 years (tax retention obligation)
Registration forms: 1 year (pursuant to the German Federal Registration Act)
Video recordings: max. 72 hours, followed by automatic deletion unless a security-related evaluation is required
Other data: deleted once no longer required for its intended purpose

8. Video Surveillance

Our public areas (e.g. entrance area, corridors, outdoor areas) are subject to video surveillance.

Purpose: exercising domiciliary rights, protecting guests and property, investigating security incidents.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest).

Storage period: max. 72 hours; in the event of incidents, until the matter has been fully resolved.

9. Hosting

This website is hosted by netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany. The servers are located in a data centre in Nuremberg, Germany, and are subject to European data protection law (GDPR). Further information can be found in netcup's privacy policy.

Each time you access our website, technical connection data is transmitted between your browser and the web server. This includes in particular:

Date and time of the request
Name of the page or file accessed
Access status (successful, error, etc.)
Web browser and operating system used
Full IP address of the requesting device
Volume of data transferred

This data is stored briefly for technical and security reasons. It is not possible for us to attribute this data to individual persons. The data is anonymised or deleted after no more than 30 days.

10. Contact Form

When you send us an enquiry via the contact form on our website, the data you provide in the form (name, email address, message text and any additional details) is stored and processed by us.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries).

The data entered in the contact form remains with us until you request its deletion, revoke your consent to storage or the purpose for data storage no longer applies. Mandatory legal provisions – in particular retention periods – remain unaffected.

11. Use of Cookies

Our website uses only technically necessary cookies that are required for the operation of the website. These cookies do not contain personal data. In addition, we use analytics cookies (Google Analytics) on the basis of your consent – see the following section.

You can restrict or disable the use of cookies in your browser settings at any time.

12. Google Analytics

This website uses Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, on the basis of the consent of website visitors. Google Analytics uses cookies that enable an analysis of your use of our website. The information generated by the cookie about your use of this website is usually transferred to and stored on a Google server in the USA.

IP anonymisation is activated on this website. Your IP address is truncated by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area before being transmitted to the USA.

Legal basis: Art. 6(1)(a) GDPR (consent). You can revoke your consent at any time via our cookie notice. You can also prevent data collection by Google Analytics by installing the browser add-on to deactivate Google Analytics (https://tools.google.com/dlpage/gaoptout).

13. Google Tag Manager

We use Google Tag Manager provided by Google Ireland Limited. Google Tag Manager is a tool that allows us to integrate tracking or statistics tools on our website. Google Tag Manager itself does not collect any personal data. It merely activates the integrated tools, provided you have consented to their use.

14. CookieYes – Cookie Consent Management

This website uses CookieYes, a cookie consent service provided by CookieYes Limited, 3 Warren Yard Warren Park, Wolverton Mill, Milton Keynes, MK12 5NW, United Kingdom.

CookieYes stores your cookie consent decisions (acceptance or rejection) in a cookie so that they do not need to be requested again on your next visit. The cookie set by CookieYes does not contain personal data in the strict sense, but only information about your consent decision.

Legal basis: Art. 6(1)(c) GDPR (legal obligation to document consent pursuant to the GDPR). The consent cookie is typically stored for 365 days.

15. Your Rights as a Data Subject

Under the GDPR, you have the following rights:

Right of access to personal data processed by us (Art. 15 GDPR)
Right to rectification of inaccurate data (Art. 16 GDPR)
Right to erasure of your data (Art. 17 GDPR)
Right to restriction of processing (Art. 18 GDPR)
Right to data portability (Art. 20 GDPR)
Right to object to processing (Art. 21 GDPR)
Right to withdraw consent with effect for the future (Art. 7(3) GDPR)

To exercise your rights, please contact:

be Apart GmbH – Aleksandar Micic
Helgoländer Str. 11, 30163 Hannover
Email: stay@be-apart.eu

16. Right to Lodge a Complaint

You also have the right to lodge a complaint with the competent data protection supervisory authority. The supervisory authority responsible for Lower Saxony is:

Die Landesbeauftragte für den Datenschutz Niedersachsen
(State Commissioner for Data Protection of Lower Saxony)
Prinzenstraße 5, 30159 Hannover, Germany
Phone: +49 511 120 4500
www.lfd.niedersachsen.de

17. Mandatory Information under the German Federal Registration Act (BMG)

Pursuant to § 29 BMG, we are required to collect certain data from all arriving guests (name, date of birth, nationality, address, arrival/departure, ID number). This data is processed exclusively for registration purposes and deleted after one year.

18. Changes to This Privacy Notice

We reserve the right to amend this privacy notice if required by legal or operational changes. The current version is available on our website at www.ba-apartments.de/en/privacy-policy and can be viewed on the premises.

Note: This privacy policy applies to all guests – regardless of whether the booking was made directly, via OTAs or through the self-check-in kiosk.