Draft – obtain legal review before publication. Actual hosting locations, subprocessors, contracts and retention periods must be checked against the services used.
1) Controller
The controller is Revard Digital 030 GmbH, c/o betahaus GmbH, Rudi-Dutschke-Str 23, 10969 Berlin, Germany. Managing director: Robert Nagel. Telephone: +49 30 60989327. Email: info@revard.de.
2) Hosting and server log files
The intended configuration provides for hosting in Germany. The website’s actual hosting provider and its subprocessors must be identified before publication and their locations verified; information about the RD030 platform’s hosting does not automatically describe this website’s hosting. Hosting providers receive technically necessary data as processors under Article 28 GDPR where agreed accordingly.
Page requests may involve processing the URL visited, time, browser, operating system, referrer, transferred data volume and IP address in server logs. The purposes are operation, stability and abuse detection; the legal basis is Article 6(1)(f) GDPR. The specific log retention period must be agreed with the hosting provider before publication. Security-related data may remain necessary until a specific incident has been resolved.
3) Contact forms and access requests
Depending on the form, we process your name, company, email address, number of hotels, message and optional telephone number. The purposes are handling your request, recording interest in access and providing the associated confirmation. Contract-related requests rely on Article 6(1)(b) GDPR; other requests and technical administration rely on Article 6(1)(f) GDPR. The mandatory checkbox acknowledges processing to handle the request; it is not advertising consent.
Initially, only the email address provided receives a confirmation link (double opt-in). The link is valid for 24 hours and can be used once. Only after explicit confirmation is the request saved as confirmed and forwarded to Robert Nagel at Revard Digital 030 GmbH; the requester then receives an acknowledgement. When the daily notification limit is reached, additional confirmed requests are saved but not emailed to Robert. These emails use Mailgun Technologies (EU region); the precise contracting entity, subprocessors and data processing agreement must be checked before publication. Form contents are not shared with advertising platforms.
Permitted confirmed and unconfirmed requests are stored with restricted access: form contents, time, form type, language, confirmation status and optional campaign information only with separate consent. Confirmation tokens are stored only as hashes. For abuse prevention, the IP address is hashed with a secret addition; raw IP addresses are not stored in the request table. An invisible check field, a three-second minimum, input validation, duplicate detection and time-based sending limits help prevent abuse. The legal basis is Article 6(1)(f) GDPR. Technical counters expire within 24 hours and are cleared on the next permitted form call.
Request data can be deleted after 12 months through a restricted deletion function; the operator must perform this deletion practice regularly. Earlier deletion after completion or a valid deletion request remains possible unless statutory retention duties apply. A regular deletion practice for email inboxes must also be established before publication.
4) Optional campaign information
Advertising pages may read UTM parameters and gclid/fbclid from the requested URL. These identifiers are transmitted with the request to Revard Digital 030 GmbH through Mailgun EU only with separate, voluntary advertising consent. The purpose is attributing the request to a campaign; the legal basis is Article 6(1)(a) GDPR. Consent is not required to submit a request. Time, notice version, displayed notice and choice are documented in the request email as evidence; the region remains unresolved. No identifiers are currently sent to Google or Meta.
You may withdraw consent by unchecking the box before submission or later by contacting info@revard.de. The lawfulness of earlier processing is unaffected. Optional advertising processing stops upon withdrawal; evidence of the earlier choice and withdrawal may be retained where necessary for documentation. Campaign information is not retained longer than needed for the stated purpose; the precise period must be set before publication.
5) Language preference, cookies, tracking and prepared services
When you manually select DE or EN, we store only that choice in the first-party cookie rd030_language for 12 months (365 days), with a localStorage fallback. This non-tracking preference lets us remember your requested language; it contains no advertising identifier and is not shared with advertising services. Its legal basis is Article 6(1)(f) GDPR and, for the expressly requested preference, section 25(2)(2) of the German Telecommunications Digital Services Data Protection Act. You can change the choice at any time using the language switcher or delete it in your browser. Without a saved choice, only the root URL selects a language using your browser’s language settings or the Accept-Language header. Direct language-specific pages remain accessible regardless of preference.
No analytics, tracking or marketing scripts are loaded. No advertising consent banner is currently displayed. Technical preparation for consent and success events remains disabled. Cloudflare Turnstile is prepared as an additional bot check but is disabled; no Turnstile scripts load or data is transmitted to Cloudflare without activation. Before activation, the provider, data processed, legal basis and any international transfers require further review.
Google Ads, Meta Pixel and Analytics are not activated. Before later activation, the specific provider, data, recipients, purposes, retention periods and any international transfer safeguards must be added. In regions requiring consent, these services remain blocked until a decision. Analytics and advertising require separate choices; refusal must be as easy as acceptance. Preparation compatible with Google Consent Mode v2 starts with denied signals for advertising storage, advertising user data, personalisation and analytics storage. It does not currently transmit data.
A future consent mechanism must record time, notice version, purposes, recipients and choices as evidence. Any later change or withdrawal through cookie settings must take effect immediately, including in other open tabs. Previously blocked events must not be transmitted retrospectively.
6) International transfers
A service’s EU region does not automatically exclude access from third countries, for example by support staff or subprocessors. Actual recipients and possible third-country access for hosting and Mailgun must be checked before publication. Transfers outside the EEA require an appropriate basis under Articles 44 et seq. GDPR, such as an applicable adequacy decision or standard contractual clauses with supplementary measures. No unverified guarantee of protection is offered here.
7) Data security
This website uses TLS encryption for transmission. Access to request data is limited to necessary personnel. Inputs are validated and form abuse is hindered by an invisible check field and time-limited sending restrictions. Complete security of every electronic transmission cannot be guaranteed.
8) Your rights and right to object
Subject to the legal requirements, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction (Article 18), notification (Article 19) and data portability (Article 20). Consent can be withdrawn at any time with future effect under Article 7(3). Under Article 21, you may object to processing based on legitimate interests on grounds relating to your particular situation. You may object to direct marketing at any time. Contact: info@revard.de.
Under Article 77 GDPR, you can complain to a data protection supervisory authority, particularly the Berlin Commissioner for Data Protection and Freedom of Information. Information and contact: https://www.datenschutz-berlin.de/.
9) Changes to this policy
We update this policy when services, processing purposes or legal requirements change. Technical preparation does not activate a service. Any necessary new consent will be obtained before the processing concerned begins.
Updated: 26 October 2026