Privacy Policy

We are delighted that you are interested in the Heinshof. Here you can find out which personal data we process when you visit our website, book with us, contact us or stay with us on the farm, for what purposes this is done and what rights you have.

1. Controller

Heinshof GbR, represented by its partners Linda Naeve and Patrick Haht, Im Sahrendorf 13, 21272 Egestorf, Germany, telephone +49 4175 808 4618, email info@heinshof.com.

For questions about data protection, you can reach us at info@heinshof.com.

2. Website

2.1 Hosting and server log files. Our website is operated on servers of Hetzner Online GmbH in Germany. When you access it, the server automatically stores the date and time, IP address, page accessed, browser and operating system, and the previously visited page. We need this data to provide the website securely and reliably (Art. 6(1)(f) GDPR). The log files are deleted after 14 days at the latest unless they are needed to investigate a security incident.

2.2 Cookies and consent. We use technically necessary cookies without consent (Section 25(2) TDDDG). We only load all other cookies and services (statistics, marketing, external media) once you have given your consent in the cookie banner (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). We use Borlabs Cookie for the banner; it stores your selection in a cookie. You can change or withdraw your selection at any time:

2.3 Google Tag Manager, Google Analytics 4 and Google Ads. With your consent, we use Google Tag Manager, through which Google Analytics 4 (audience measurement) and Google Ads conversion tracking are loaded. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Usage data (e.g. pages accessed, time spent, device data, shortened IP address) is processed and also transferred to Google LLC in the USA. Google is certified under the EU-US Data Privacy Framework. The legal basis is your consent (Art. 6(1)(a) GDPR).

2.4 Forms, enquiries and communication. For contact forms, enquiries, quotes, emails and the chat on our website, we use the communication platform of a service provider based in Ireland whose parent company is based in the USA. The data is also stored on servers in the USA; the service provider is certified under the EU-US Data Privacy Framework, and a data processing agreement with standard contractual clauses is also in place. Your enquiries and bookings are processed to prepare and perform the contract (Art. 6(1)(b) GDPR). We only set this service provider’s tracking cookies with your consent (Art. 6(1)(a) GDPR); the cookie banner shows you the details.

2.5 AI chat assistant. On the website and partly by email, our AI-based assistant “Claudea” answers questions automatically on the basis of our information. She is not a human but an AI system; for booking, payment and complaint matters, she hands over to our team. Your input is processed and stored via the communication platform under section 2.4 (Art. 6(1)(b) or (f) GDPR). Please do not enter any sensitive data. Only our team makes binding commitments.

2.6 Spam protection (reCAPTCHA). We protect forms with Google reCAPTCHA (Google Ireland Limited). reCAPTCHA uses characteristics such as IP address and mouse movements to check whether a human is filling in the form. We only load reCAPTCHA after your consent in the cookie banner (Art. 6(1)(a) GDPR); without consent, the form may be blocked. You can then reach us by email or telephone.

2.7 Maps and videos. We only load maps from Google Maps and videos from YouTube (both Google Ireland Limited) once you activate them or have given your consent in the cookie banner (Art. 6(1)(a) GDPR). Your IP address and usage data are transferred to Google, including to the USA.

2.8 Social networks. We only link to Facebook, Instagram and YouTube. When you click, you switch to the respective provider; no data is transferred beforehand.

3. Booking, contract and stay

3.1 Purposes and legal bases. For enquiries, quotes, bookings, payments and the performance of your stay, your riding lessons, events and purchases, we process your name, address, email, telephone number, booking and payment data (Art. 6(1)(b) GDPR). For riding lessons, we also collect date of birth, weight, riding level and information from the health declaration in order to select horse, equipment and lessons safely. We only process health information with your explicit consent (Art. 9(2)(a) GDPR).

3.2 Service providers. For this purpose, we use carefully selected service providers as processors:

• booking, customer and invoicing system (Swoppen/hoteldesk, Germany)
• online booking for the riding school, customer accounts, packages and vouchers (SimplyBook.me)
• email, calendar and documents (Microsoft 365, Microsoft Ireland Operations Ltd.)
• financial accounting (Diamant Software, Germany) and tax advisors
• own servers for automations (Hostinger, Lithuania) and encrypted backups (Hetzner, Germany)
• key safes (igloohome)
• payment services (PayPal, SumUp/Zettle, our bank)
• telephone system with answering machine (Placetel)
• reading handwritten consumption slips with the help of artificial intelligence (Anthropic, USA)

Where data is transferred to countries outside the EU, this is done on the basis of an adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses.

3.3 Registration form. For guests from abroad, we are obliged under the German Federal Registration Act to collect a registration form and keep it for one year (Art. 6(1)(c) GDPR).

3.4 Key safes. The keys to the holiday apartments are kept in electronic key safes. The safes log when and with which access code they are opened. We use these logs to track access and investigate misuse (Art. 6(1)(b) and (f) GDPR) and delete them after 90 days.

3.5 Consumption slips. In the farm shop and farm café “Chick-Inn”, you note what you take on a slip. We read the slips with the help of artificial intelligence and charge them to your booking (Art. 6(1)(b) GDPR).

4. Communication

4.1 Email, telephone, WhatsApp. When you contact us, we process your details in order to respond to your enquiry (Art. 6(1)(b) or (f) GDPR). Messages on the answering machine are forwarded to our mailbox as audio files. If you write to us via WhatsApp Business, WhatsApp Ireland Limited (Meta) also processes your data under its own terms; only use WhatsApp if you agree to this.

4.2 Information about your booking. In connection with your booking, we send you emails, e.g. confirmation, payment reminders, arrival and departure information and your access code (Art. 6(1)(b) GDPR).

4.3 Offers and newsletter. If you have booked or bought from us, we send you offers for similar services of our own by email (Section 7(3) UWG, Art. 6(1)(f) GDPR). We only send information about events and news by newsletter or WhatsApp with your consent (Art. 6(1)(a) GDPR). You can object or withdraw your consent at any time, for example via the unsubscribe link in every email or a short message to us.

4.4 Reviews. After your stay, we ask you by email for a review, e.g. on Google. You can ignore the request or let us know that you do not wish to receive any further requests.

5. Video surveillance

Parts of our farm premises are under video surveillance to protect horses, guests and property and to investigate criminal offences (Art. 6(1)(f) GDPR). The monitored areas are marked with signs. The recordings are stored on a recording device on site, are not passed on to third parties and are automatically overwritten after 7 days unless they are needed to investigate an incident. Apartments and sanitary areas are not monitored.

6. Storage period

We delete your data as soon as it is no longer required for the purpose. We retain contract and invoice data for up to eight or ten years due to commercial and tax law obligations (Section 147 AO, Section 257 HGB). We store customer data for offers until you object, but no longer than three years after your last contact with us.

7. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw consent given with effect for the future (Art. 7(3)).

Right to object: If we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21(1)). You can object to processing for direct marketing at any time without giving reasons (Art. 21(2)).

You also have the right to lodge a complaint with a data protection supervisory authority, for example the State Commissioner for Data Protection of Lower Saxony, Prinzenstraße 5, 30159 Hannover, Germany.

8. Obligation to provide data

For a booking, we need the data marked as mandatory; without it, we cannot conclude a contract. There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

As of: 29 September 2026