Privacy policy

1. Controller

TIMANA GmbH
Knorrestraße 5
20099 Hamburg
Germany
Managing director: Tim Kertscher
Email: hello@timana-collection.com
Phone: +49 15679 020 600

We have not appointed a data protection officer, as there is no legal obligation to do so. For any privacy question, simply contact us at the address above.

2. In short

• This website sets no cookies and uses no analytics or tracking tools.
• Fonts and images are served from our own server; no content is loaded from Google or other third parties.
• There are no embedded maps, videos or social media plugins.
• We only process data when you open the site (technically necessary), contact us, join the TIMANA Club or book.

3. Hosting and server log files

The website is hosted by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (Cloudflare Pages) and delivered through its network. When you open a page, Cloudflare processes technically necessary data: IP address, date and time, requested URL, amount of data transferred, referrer, browser and operating system. This serves the secure and fast delivery of the site and protection against attacks.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a secure, working website). We have a data processing agreement with Cloudflare. Cloudflare is certified under the EU-US Data Privacy Framework; EU standard contractual clauses apply in addition. Log data is kept only briefly and is not combined with other data.

4. Contact by email or phone

When you write to us or call us, we process your details (e.g. name, email address, phone number, content of your request) to answer you. The legal basis is Art. 6(1)(b) GDPR where it concerns a booking or stay, otherwise Art. 6(1)(f) GDPR. We delete the data once your request is settled, unless statutory retention periods apply.

5. TIMANA Club

When you join the TIMANA Club, we process your first name, your email address and the language of the page. The form is passed by a function on our hosting (Cloudflare) directly to our email service and is not stored there.

We send emails with Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France). Brevo processes the data on our behalf on servers in the EU; we have a data processing agreement with Brevo.

We use double opt-in: you become a member and receive your Club code only after clicking the link in the confirmation email. To prove your consent we store the time of sign-up and confirmation and the IP address used. Ticking the box for general news is a separate, voluntary consent.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time via the unsubscribe link in every email or by writing to hello@timana-collection.com. We then delete your data; we keep proof of the earlier consent for up to three years (Art. 6(1)(f) GDPR) so we can demonstrate it if needed.

6. Booking

When you click "Check availability" or "Book", you move to our booking page timana.holidayfuture.com, run for us by Hostaway, Inc. (USA) as a processor. There we process the data needed for the booking, payment and stay, e.g. name, address, email, phone, travel dates, number of guests and payment details. Payment is handled by the payment provider shown there, whose own privacy policy also applies.

The legal basis is Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR where we are legally obliged, e.g. guest registration in accommodation (§§ 29, 30 BMG), the Hamburg culture and tourism tax, and retention under commercial and tax law (up to ten years). Where data is transferred to the USA, this is based on EU standard contractual clauses (Art. 46 GDPR).

If you book via Airbnb, Booking.com or another platform, that platform is responsible for the booking there and its privacy policy applies. We receive the details needed for your stay from it.

7. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw consent with effect for the future (Art. 7(3)). A message to hello@timana-collection.com is enough.

Right to object (Art. 21 GDPR): where we process data on the basis of legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation.

You can also lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information (Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit), Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany.

8. Encryption

The website is delivered only over an encrypted connection (HTTPS/TLS).

9. Changes

We update this policy when the website or the law changes. The version published here applies.