Privacy Policy

As of: 29 October 2026. The German version (Datenschutzerklärung) is the authoritative text.

1. General information

This privacy policy explains what happens to your personal data when you visit our website https://www.khayaa.com. Personal data is any data that can be used to identify you personally. We process your data in strict accordance with the statutory requirements, in particular the General Data Protection Regulation (“GDPR”). It is very important to us that your visit to our website is completely safe.

2. Controller

The controller responsible for the collection and processing of personal data on this website under data protection law is:

• First name, last name: Felix Erhard
• Street, house number: Seracher Str. 71
• Postcode, city: 73732 Esslingen
• Country: Germany
• Email: booking@khayaa.com

3. Hosting (Vercel)

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA (“Vercel”). When you visit the website, Vercel processes technically necessary connection data in server log files, in particular your IP address, the date and time of the request, the page requested, the amount of data transferred, and your browser type and operating system. This processing is necessary to deliver the website and to ensure its security and stability. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the secure and efficient operation of the website).

We have a data processing agreement with Vercel pursuant to Art. 28 GDPR. Because Vercel is based in the USA, personal data may be transferred to a third country. This transfer relies on the European Commission’s adequacy decision (EU-US Data Privacy Framework) or on standard contractual clauses. For more information, see Vercel’s privacy policy: https://vercel.com/legal/privacy-policy.

4. Cookies and local storage

We do not set any cookies ourselves on this website and do not use services for audience measurement or advertising. According to our review, the embedded Smoobu content (see section 5) does not set any cookies either. If you choose a language for the website, we store this choice (“de” or “en”) in your browser’s local storage (localStorage) so that it is kept for your next visit. This information stays on your device, is not transmitted to us, and contains no personal data. It is necessary to display the website as you requested (Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG). You can delete the entry at any time in your browser settings.

5. Availability calendar and booking tool (Smoobu)

To show availability and to enable booking requests, we embed content from the provider Smoobu, which is loaded from its servers (smoobu.com). When this content is loaded, your IP address is transmitted to Smoobu so that the content can be delivered to your browser. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a convenient presentation of availability and booking options).

If you submit a booking request or booking in the booking tool, the data you enter (for example your name, contact details and travel dates) is processed via Smoobu in order to carry out the booking. The legal basis in this case is Art. 6(1)(b) GDPR. We have only limited influence on the processing by Smoobu. For information on how your data is handled, please see Smoobu’s privacy policy at https://www.smoobu.com.

6. Contact form and email (Web3Forms)

If you contact us by email or through the contact form, the data you send, including your contact details, is stored in order to process your request and to be available for any follow-up questions.

Through the contact form we process your name (optional), your email address and your message. To transmit it, we use the service Web3Forms (api.web3forms.com), which receives your input and forwards it to us as an email. Web3Forms acts as a processor and may process the data on servers outside the European Union, in particular in the USA. The transfer to a third country is based on appropriate safeguards pursuant to Art. 44 et seq. GDPR.

The data submitted through the contact form is processed on the basis of your consent under Art. 6(1)(a) GDPR, which you give by submitting the form. If your enquiry aims at concluding a contract, Art. 6(1)(b) GDPR is an additional legal basis. You may withdraw your consent at any time without giving reasons. An informal email to us is sufficient. The lawfulness of the processing carried out before the withdrawal is not affected by it.

The data submitted through the contact form is stored by us until you ask us to delete it, withdraw your consent to its storage, or the purpose for storing it no longer applies. Statutory retention periods remain unaffected.

7. Use and disclosure of data

We assure you that personal data you provide to us, for example by email (such as your name, your address or your email address), will not be sold or otherwise used commercially. Your data is processed solely for the purpose of corresponding with you, handling bookings, and fulfilling the purpose for which you provided the data to us.

Your data is disclosed to third parties only to the service providers named in this privacy policy (hosting, form transmission, booking software), to the extent necessary for the respective service, where we are legally obliged to disclose it, or where you have given us your express consent.

8. Encryption (SSL/TLS)

Our website uses SSL or TLS encryption to ensure the security and protection of the transmission of confidential content. This applies in particular to enquiries you send us through the contact form as a visitor to the website. An encrypted connection is recognisable by the “https://” in your browser’s address bar and the lock symbol in your browser bar.

With SSL or TLS encryption enabled, the data you send to us cannot be read by unauthorised third parties.

9. Storage period

Your personal data that you submit to us through our website is stored only for as long as is necessary to achieve the respective purpose of the processing. In line with commercial and tax retention obligations, however, certain data may be stored for up to 10 years.

10. Your data protection rights

As a data subject, you have the following rights against the controller with regard to your personal data, in accordance with the statutory provisions:

Right to withdraw consent

Many data processing operations are only possible with your express consent. If the processing of your data is based on your consent, you have the right under Art. 7(3) GDPR to withdraw this consent at any time with effect for the future. The lawfulness of the data processing carried out on the basis of your consent until the withdrawal remains unaffected. The storage of data for billing and accounting purposes is not affected by a withdrawal.

Right of access

Under Art. 15 GDPR, you have the right to request confirmation from us as to whether we process personal data concerning you. If we do, you are entitled to information about this data, including the purposes of the processing, the categories of data processed, the recipients or categories of recipients to whom the data has been or will be disclosed, the planned storage period or the criteria for determining it, the existence of a right to rectification, erasure, restriction of processing, objection to the processing, and to lodge a complaint with a supervisory authority, the source of the data if it was not collected from you, the existence of automated decision-making including profiling and, where applicable, meaningful information about the logic involved as well as the significance and envisaged consequences of such processing for you, and your right to be informed of the safeguards under Art. 46 GDPR when your data is transferred to third countries.

Right to rectification

Under Art. 16 GDPR, you have the right at any time to request that we correct inaccurate personal data concerning you and/or complete your incomplete data.

Right to erasure

Under Art. 17 GDPR, you have the right to request the erasure of your personal data if one of the following grounds applies:

1. Your personal data is no longer necessary for the purposes for which it was collected or otherwise processed.
2. You withdraw your consent on which the processing under Art. 6(1)(a) or Art. 9(2)(a) GDPR was based, and there is no other legal basis for the processing.
3. You object to the processing under Art. 21(1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing under Art. 21(2) GDPR.
4. Your personal data has been processed unlawfully.
5. We are obliged to erase the personal data to comply with a legal obligation under Union law or the law of the Member State to which we are subject.
6. The personal data was collected in relation to the offer of information society services under Art. 8(1) GDPR.

This right may be restricted where the processing is necessary:

1. for compliance with a legal obligation that requires processing under Union or Member State law to which we are subject, or for the performance of a task carried out in the public interest or in the exercise of official authority;
2. for compliance with a legal obligation that requires processing under Union or Member State law to which we are subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in us;
3. for reasons of public interest in the area of public health in accordance with Art. 9(2)(h) and (i) and Art. 9(3) GDPR;
4. for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Art. 89(1) GDPR, in so far as the right referred to is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
5. for the establishment, exercise or defence of legal claims.

If we have made your personal data public and are obliged to erase it under the preceding provisions, we will, taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to inform the controllers processing the data that you, as the data subject, have requested the erasure of any links to, or copy or replication of, that personal data.

Right to restriction of processing

Under Art. 18 GDPR, you have the right to request the restriction of processing (blocking) of your personal data. To exercise this right, you can contact us at any time. You will find our contact details in the legal notice (Impressum). A restriction of processing can be requested in the following cases:

1. If you contest the accuracy of your personal data stored by us, we usually need time to verify this. For the duration of the verification, you have the right to request the restriction of the processing of your personal data.
2. If the processing of your personal data was or is unlawful, you can request the restriction of data processing instead of erasure.
3. If we no longer need your personal data but you need it for the establishment, exercise or defence of legal claims, you have the right to request the restriction of the processing of your personal data instead of erasure.
4. If you have objected under Art. 21(1) GDPR, a balancing of your interests and ours must be carried out. As long as it has not been determined whose interests prevail, you have the right to request the restriction of the processing of your personal data.

After the processing of your personal data has been restricted, it may generally only be processed with your consent. Exceptions apply to certain cases defined by law, such as the establishment, exercise or defence of legal claims or the protection of public interests.

Right to notification

If you exercise your right to rectification, erasure or restriction of the processing of your personal data, we are obliged under Art. 19 GDPR to notify all recipients to whom the data has been disclosed. This does not apply if notification proves impossible or involves disproportionate effort. At your request, we will inform you of the recipients of your data.

Protection against automated decisions (profiling)

Under Art. 22 GDPR, you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

This does not apply if the decision

1. is necessary for entering into, or the performance of, a contract between you and us,
2. is authorised by Union or Member State law to which the controller is subject and which lays down suitable measures to safeguard your rights, freedoms and legitimate interests, or
3. is based on your explicit consent.

However, the decisions referred to in (a) to (c) must not be based on special categories of personal data within the meaning of Art. 9(1) GDPR, unless Art. 9(2)(a) or (g) applies and suitable measures to safeguard your rights, freedoms and legitimate interests are in place.

In the cases referred to in (a) and (c), we take reasonable measures to safeguard your rights, freedoms and legitimate interests. This includes at least the right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision.

Right to data portability

Where your personal data is processed on the basis of your consent under Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR, or on a contract under Art. 6(1)(b) GDPR, and the processing is carried out by automated means, you have the right under Art. 20 GDPR to receive the data you provided to us in a structured, commonly used and machine-readable format and to transmit it to another controller or to have it transmitted by us to another controller, where technically feasible.

Right to object

If we process your personal data on the basis of a balancing of interests under Art. 6(1)(f) GDPR, you have the right to object to this processing at any time on grounds relating to your particular situation; this also applies to profiling based on that provision. The applicable legal basis for each processing operation can be found in this privacy policy. If you object, we will no longer process the personal data concerned, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims (objection under Art. 21(1) GDPR).

Where your personal data is processed for direct marketing purposes, you have the right to object at any time to this processing; this also applies to profiling to the extent that it is related to such direct marketing. If you object, your personal data will no longer be used for direct marketing purposes (objection under Art. 21(2) GDPR).

In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.

Right to lodge a complaint with the competent supervisory authority (Art. 77 GDPR)

In the event of infringements of the GDPR, data subjects have the right to lodge a complaint with a competent supervisory authority. The complaint can be lodged in particular in the Member State of the data subject’s habitual residence or place of work, or of the place of the alleged infringement. The right to lodge a complaint under this provision exists without prejudice to any other administrative or judicial remedies.

Our competent supervisory authority is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Postfach 10 29 32
70025 Stuttgart
or: Lautenschlagerstraße 20, 70173 Stuttgart
Telephone: +49 711 615541-0
Email: poststelle@lfdi.bwl.de
Internet: https://www.baden-wuerttemberg.datenschutz.de

11. Validity and amendments to this privacy policy

This privacy policy applies in the version dated 29 October 2026. We reserve the right to amend it where necessary and in compliance with the applicable data protection laws. This may be necessary, for example, to meet new legal requirements or to reflect changes to our website or new services offered through our website. The current version of the privacy policy available at the time of your visit to our website is binding.

If this privacy policy is amended, we will publish the changes on this page in order to inform you fully about which personal data we collect, how we process it and under what conditions we may disclose it.