Privacy policy

This translation is provided for information only. Only the German version is legally binding: Go to the German version

As of: October 2026

The protection of your personal data is important to us. With this privacy policy we inform you, in accordance with Articles 13 and 14 of the Datenschutz-Grundverordnung (General Data Protection Regulation, GDPR; in German: DSGVO), which data we process when you visit this website and use our services, for which purposes, on which legal basis and for how long.

1. Controller

The controller for data processing on this website within the meaning of Article 4 No. 7 GDPR is:

Stay & Live eGbR
represented by its partners Sven Kauling and Eugenia Kauling-Isaak
Pfaffenberg 1
51674 Wiehl
Phone: 02262 7920
Email: info@waldhotel-wiehl.de

We have not appointed a data protection officer, as there is no legal obligation to do so. If you have questions about data protection, please contact us using the contact details above.

2. Overview: legal bases

We process personal data only where one of the following legal bases permits it:

Article 6(1)(a) GDPR – your consent (e.g. newsletter),
Article 6(1)(b) GDPR – performance of a contract or pre-contractual measures (e.g. booking a tour, answering your enquiry),
Article 6(1)(c) GDPR – compliance with legal obligations (e.g. retention under commercial and tax law),
Article 6(1)(f) GDPR – our legitimate interest in a secure, stable and economical operation of this website.

Information is stored on your device only where this is strictly necessary for a service you have expressly requested (Section 25(2) No. 2 of the Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, German Telecommunications Digital Services Data Protection Act, TDDDG).

3. Hosting

This website is operated on servers in Germany by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur. When you access the website, your IP address is technically processed in order to deliver the requested content to your device. We do not store any server log files; the IP address is not stored after delivery. A data processing agreement pursuant to Article 28 GDPR exists with the hosting provider. The legal basis is Article 6(1)(f) GDPR.

4. Cloudflare

For protection against attacks and for fast, reliable delivery, we use the network of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Your requests to this website are routed via Cloudflare servers. In doing so, Cloudflare processes technically necessary connection data, in particular your IP address, the requested address, date and time, and information about your browser and operating system, in order to detect and repel attacks and abusive access.

The legal basis is our legitimate interest in the security and availability of the website (Article 6(1)(f) GDPR). A data processing agreement exists with Cloudflare. Cloudflare is certified under the EU-US Data Privacy Framework; an adequacy decision of the EU Commission therefore exists for the USA (Article 45 GDPR). In addition, the standard contractual clauses of the EU Commission apply. Further information: https://www.cloudflare.com/privacypolicy/

5. Statistics with Matomo (anonymised, without cookies)

To understand how our website is used and to improve it, we use the open-source software Matomo. Matomo is not operated by third parties but by our service provider INREMA Unternehmensberatung GmbH, Rentmeister-Wilthelm-Weg 16, 33181 Bad Wünnenberg, on its own servers in Germany (data processing pursuant to Article 28 GDPR). The data is not passed on to third parties.

Your IP address is shortened by two bytes before storage (anonymised); it is therefore not possible to attribute it to you personally.
Matomo sets no cookies, does not use your browser’s local storage and creates no device fingerprint.
What is recorded includes, for example, pages viewed, time spent, approximate region, browser and device type, and technical characteristics used to distinguish automated access (bots) from human visits.

The legal basis is our legitimate interest in anonymous audience measurement (Article 6(1)(f) GDPR).

Objection (opt-out): You can object to the recording at any time – via the “Deactivate statistics” link in the footer of every page. Your objection is stored in your browser so that we can respect it on future visits; this storage is technically necessary (Section 25(2) No. 2 TDDDG). If you delete your browser data, the objection must be declared again. You can use the same link to allow statistics again. Because of this data-minimising design, the website does not need a cookie banner.

6. Booking a tour

When you book a tour online, we process the information from the booking form: name, email address, optionally phone number, chosen date, number and type of tickets, your optional note, the chosen language and the confirmation of our booking terms. To protect against misuse, we also store the time of the booking and a hash value of your IP address from which the address cannot be recovered.

You receive an email with a confirmation link (double opt-in) that leads to a page of this website; the booking is binding only once you have clicked it. After confirmation, you receive your admission ticket as a PDF attachment by email. The QR code on the ticket contains only a ticket code, which is checked at the ticket desk on entry. If you would like to change or cancel a booking, please contact us by phone or email. Payment is made on site at the ticket desk.

The legal basis is the performance of the contract or pre-contractual measures (Article 6(1)(b) GDPR). We manage bookings in the customer portal of our service provider INREMA Unternehmensberatung GmbH (servers in Germany, data processing pursuant to Article 28 GDPR).

Storage period: Unconfirmed bookings are discarded once the hold period has expired. We store confirmed bookings for handling your visit; information relevant to our accounting is retained within the statutory retention obligations (Section 147 of the Abgabenordnung, German Fiscal Code, AO; Section 257 of the Handelsgesetzbuch, German Commercial Code, HGB) for up to ten years (Article 6(1)(c) GDPR). Contact data that is no longer needed beyond this (name, email address, phone number, note) is deleted or anonymised no later than 180 days after the date of the tour.

If you subscribe to our newsletter – via the newsletter form or via the optional checkbox when booking – we process your email address, optionally your first name, your chosen interests and your language in order to inform you about news, events and offers of the Wiehl dripstone cave.

Double opt-in: After signing up, you receive an email with a confirmation link. We add you to the mailing list only after your confirmation.
Proof: To be able to prove your consent (Article 7(1) GDPR), we store the wording of the consent, the times of sign-up and confirmation, a hash value of your IP address, the browser identifier and the page on which you signed up.
Unsubscribing: You can unsubscribe from the newsletter at any time. An unsubscribe link is contained in every email; alternatively, a message to info@waldhotel-wiehl.de is sufficient.

The legal basis is your consent (Article 6(1)(a) GDPR), which you can withdraw at any time with effect for the future. We manage the subscriptions in the INREMA customer portal (see section 6). We store your data until you unsubscribe; after that, we retain the proof of consent for up to three years in order to be able to defend against claims (Article 6(1)(f) GDPR).

8. Contact form and contact by email or phone

If you contact us via the contact form, by email or by phone, we process your details (name, email address, optionally phone number and subject, your message) in order to handle your enquiry. To protect against automated mass requests, we briefly store a hash value of your IP address from which the address cannot be recovered, in order to limit the number of requests; it is no longer used after one hour at the latest and is deleted regularly. Enquiries via the contact form are managed in the INREMA customer portal (see section 6).

The legal basis is Article 6(1)(b) GDPR where your enquiry relates to a contract or pre-contractual measures, and otherwise our legitimate interest in answering enquiries (Article 6(1)(f) GDPR). We delete your details as soon as your enquiry has been finally dealt with and no statutory retention obligations stand in the way; business correspondence is retained for up to ten years (Section 147 AO, Section 257 HGB).

9. Sending emails

We send confirmation, booking and newsletter emails via the mail server of our service provider INREMA (servers in Germany, data processing pursuant to Article 28 GDPR). Transmission is encrypted (TLS).

10. Storage in the browser (local storage)

Without your express request, this website stores nothing on your device. Some functions you use place small entries in your browser’s local storage: the language in which you started a booking (so that the confirmation page appears in your language), the tour time selected on the home page (for the duration of the session), your decision on the notice about another language version, your selection in the packing list and your objection to statistics. These entries do not leave your device and are strictly necessary for the respective function (Section 25(2) No. 2 TDDDG). You can delete them at any time via your browser settings.

11. Fonts, maps and external links

All fonts are embedded locally on our server; no connection to font providers is established when the website is accessed. The directions map is an image stored on our server. Links to external offerings (e.g. “Route in Google Maps” or to the Waldhotel) are ordinary links: you leave our website only when you click such a link, and the privacy policy of the respective provider applies.

12. Your rights

You have the right

to request access to the data we process (Article 15 GDPR),
to request the rectification of inaccurate data (Article 16 GDPR),
to request the erasure of your data (Article 17 GDPR),
to request the restriction of processing (Article 18 GDPR),
to receive your data in a commonly used, machine-readable format (data portability, Article 20 GDPR),
to withdraw consent at any time (Article 7(3) GDPR); the lawfulness of processing carried out until the withdrawal remains unaffected.

Right to object (Article 21 GDPR): Where we process your data on the basis of our legitimate interest (Article 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

To exercise your rights, a message to info@waldhotel-wiehl.de or to the address in section 1 is sufficient.

Right to lodge a complaint: You have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR). The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia), Kavalleriestraße 2–4, 40213 Düsseldorf, https://www.ldi.nrw.de

13. Obligation to provide data, no automated decision-making

The information in the booking form is required for the booking; without it, we cannot accept the booking. However, you can also visit a tour directly at the ticket desk without an online booking. All other information is voluntary. Automated decision-making including profiling (Article 22 GDPR) does not take place.

14. Data security

This website is delivered exclusively in encrypted form via HTTPS (TLS). We take appropriate technical and organisational measures to protect your data against loss, manipulation and unauthorised access.

15. Changes to this privacy policy

We adapt this privacy policy when our website, our offerings or the legal situation change. The version currently published on this page applies.