Privacy Policy

Matteo Gamba, Boxhagener Str. 13, 10245 Berlin, Germany.
Email: impressum@boxi13.de. Full details in the imprint.

This is the direct booking site for an individual Airbnb, not a large company with a data protection officer. For any inquiry, the host will be the person getting in touch with you.

When you book or send a request

We ask for your name, email, phone number, travel dates, guest count, and anything you write in the message field. We need this to hold the dates, answer you, and run the stay. Without it we cannot process your requests, so providing it is a requirement of entering into the contract.

Legal basis: performance of a contract, or steps taken at your request before entering one (Art. 6(1)(b) GDPR).

When you pay

Card details are entered directly into Stripe's payment form and never reach our server — we only ever see the last four digits and the card brand. Stripe stores your card so the stay can be charged at the agreed time, and acts as its own controller for fraud prevention.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

When you use the contact form or ask for a discount code

We use your email address to reply, or to send the code you asked for. Nothing else — we do not run a newsletter and we do not add you to any mailing list.

Legal basis: your request (Art. 6(1)(b) GDPR) or consent (Art. 6(1)(a) GDPR) for the discount code.

Automatically, when you visit

Our server briefly processes your IP address to rate-limit abusive traffic and to guess your country so the phone-number field starts on the right dialling code. The country lookup sends your IP to ipwho.is; nothing else about you is sent with it.

Legal basis: legitimate interest in a working, non-abused site (Art. 6(1)(f) GDPR).

Essential cookies keep booking and the guest house-manual unlock working. These are always active because the site cannot function without them.

Google Analytics runs only if you turn it on in the cookie banner. Nothing analytics-related loads before you agree, and you can change your mind at any time via Cookie settings in the footer — withdrawing is as easy as consenting, and takes effect immediately.

The banner also offers a Marketing category. Nothing on the site uses it today — there are no advertising or remarketing tags at all. It is there so that your answer is already on record, and anything of that kind added later can only run if you have already said yes.

Legal basis: your consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG).

We keep the list of third parties as short as we can. Fonts are served from our own server, so no font provider ever sees your visit.

• Stripe — payments and card storage.
• Resend — sends the booking and contact emails.
• Railway — hosts the site and stores booking records.
• ipwho.is — country lookup from your IP address.
• Google — Analytics, only with your consent; plus the embedded map, which loads from Google when you open a listing page.

Some of these are based outside the EU. Where that is the case, transfers rely on the European Commission's Standard Contractual Clauses or an adequacy decision.

Booking records are kept for up to ten years, because German tax and commercial law requires it (§ 147 AO). Enquiries that never became a booking are deleted once the conversation is clearly over. Your cookie choice is stored in your own browser until you clear it.

You can ask for a copy of your data, have it corrected or deleted, restrict or object to how we use it, and receive it in a portable format. Where we rely on consent, you can withdraw it at any time without affecting what happened before. Just email impressum@boxi13.de — we will respond within a month.

You also have the right to complain to a supervisory authority. Ours is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).

We do not sell your data, we do not share it with advertisers, and we make no automated decisions or profiling about you.