Legal, Terms of Service and Privacy Policy

Thank you for your interest in booking a holiday home from Interhome. We appreciate your confidence in our company. Please find below our terms and conditions in print-ready PDF format.

Conditions

Data privacy is a matter of trust, and your trust matters to Interhome. It is therefore important to us that your personal data is protected and that its collection, processing and use in relation to Interhome's services in our app and on our website interhome.com complies with the law. In this Policy, we want to tell you about how we collect and use data, in order to give you an overview of how your personal data will be used.

1. Overview

This privacy policy provides information about the nature and scope of the processing of personal data by Interhome in accordance with the GDPR. Personal data are any pieces of information that relate to an identified or identifiable person, such as name or email address.

As a rule, we only store personal data for as long as is necessary to fulfill the purposes for which we collected the data. Thereafter, we delete the data in accordance with the implemented retention and deletion policy, observing legal retention periods, unless we need to retain the data until the expiry of the statutory limitation period for civil law claims or due to legal storage obligations. In specific individual cases, storage may also occur for a longer period if there is another legal basis under data protection law for the continued processing of the data.

We are obliged to retain personal data based on statutory documentation requirements, including those stipulated in the German Commercial Code (retention of business documents), the German Fiscal Code (accounting and financial reporting), the Money Laundering Act, or other tax law requirements (DAC7). The retention periods stipulated there for documents in separate and protected areas are up to ten years.

2. Name and contact details of the controller and the data protection officer

This privacy policy applies to the data processing carried out by HHD AG (Interhome), Sägereistrasse 20, 8152 Glattbrugg, Switzerland (the controller, hereinafter referred to as “Interhome”), reachable at [email protected], and to the following website and application: www.interhome.de.

The data protection officer of Interhome can be contacted at [email protected] or [email protected].

3. Purposes of data processing, legal bases, and legitimate interests pursued by Interhome or a third party, as well as categories of recipients

3.1 Accessing our website/application

3.1.1 Provision of data, mandatory information

To use our services, it is necessary to provide certain data. The scope of these mandatory details depends on the specific service requested and is either legally required or necessary for potential contract conclusions with us or third parties on the portal. The fields marked with an asterisk (*) or a note indicating they are mandatory must be completed; otherwise, we will not be able to provide the service or offer you have requested.

3.1.2 External hosting

This website and the databases used for data processing are hosted by external service providers (hereinafter “hosting providers”). In the processing activities described below, personal data is transmitted to the hosting providers, stored on their data centers ("servers"), and processed on our behalf. This may particularly involve:

• IP addresses,

• contact requests,

• metadata and communication data about devices used,

• search queries,

• contract data (e.g. bookings, booking requests),

• transaction data,

• names, possibly pseudonymized identification numbers,

• website visits and pages accessed, and

• other data generated via a website.

The use of hosting providers is for the purpose of fulfilling contracts with our potential and existing customers (Art. 6(1)(b) GDPR) and in the interest of a secure, fast, and efficient provision of our online services by a professional provider (Art. 6(1)(f) GDPR).

Our hosting providers will only process data to the extent necessary to fulfill their service obligations and will follow our instructions regarding this data. To ensure GDPR-compliant processing, we have concluded a data processing agreement with our hosting providers. These providers process data either exclusively within the European Economic Area or in third countries under the strict conditions applicable to international data transfers.

3.1.3 Content Delivery Network

This website uses a content delivery network (CDN), which provides protective functions for the website (such as a web application firewall). The data transfer between the browser and the hosted servers flows through the CDN infrastructure and is analyzed there in order to prevent attacks, deliver content, and implement further security measures.

The following data, among others, may be processed in the process:

• the accessed webpage,

• browser type used,

• operating system,

• referrer URL,

• IP address,

• requesting internet service provider.

We process this data on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR. The use of a CDN is in our interest in ensuring the secure use of our online presence and in preventing harmful external attacks. We have concluded a data processing agreement with our CDN provider.

3.1.4 Log files

When our website/application is accessed, the browser on the end device automatically sends information to our server and temporarily stores it in a so-called log file. We have no influence over this process.

The following information is collected and stored automatically without your intervention until it is automatically deleted:

• the IP address of the requesting internet-enabled device,

• the date and time of access,

• the name and URL of the file accessed,

• the website/application from which the access was made (referrer URL),

• the browser used and, if applicable, the operating system of the internet-enabled device as well as the name of the access provider,

• the device used (e.g. desktop or smartphone),

• the language of your browser.

The legal basis for processing the IP address is Article 6(1)(f) GDPR. Our legitimate interest results from the purposes of data collection listed below. We would like to note that the data collected does not allow us to directly infer your identity, nor do we attempt to do so.

The IP address and the other data listed above are used by us for the following purposes:

• to ensure a smooth connection to the website,

• to ensure convenient use of our website/application,

• to analyze system security and stability.

The data is deleted as soon as it is no longer required for the purpose for which it was collected. In the case of data collected to provide the website, this is the case when the respective session has ended. If the data is stored in log files, it is limited to the strictly necessary extent. Data is not stored beyond that. In such cases, the users’ IP addresses are deleted so that assigning them to the accessing user is no longer possible.

3.2 Creating and using a user account for bookings, booking inquiries, vouchers for bookings, and participation in sweepstakes

3.2.1 Creating a user account

If you create a user account with us, we process personal data, specifically:

• when logging in via a social media login account (see below), the email address and the information transmitted from the relevant social media profile (if applicable, name, profile picture, link to the account and top-level domain, gender, and additionally age range, language, country, and other public information),

• when logging in via email, the email address used.

For technical reasons, a user account is also created when the email address is entered during a booking or booking inquiry on our website or when subscribing to our newsletter.

Within the user account, the following data can also be stored:

• First and last name,

• (optional) salutation and gender,

• (optional) date of birth,

• place of residence / address,

• contact details (telephone),

• previous bookings (including travel dates, number of guests, booking number, partner/provider).

In the case of direct bookings, name, address, and booking information are stored under the "Bookings" section of the user account for invoicing and tax calculation purposes, if applicable and necessary.

Additionally, settings regarding language and currency preferences, as well as newsletter consent, can be managed in the user account.

Each time you log in, technical information about the device and browser used, as well as details about your search queries, is stored. This serves to improve the user experience on the website and enhance our overall service offering.

The legal basis for processing the provided data is Article 6(1)(b) and (f) GDPR, based on the contractual relationship for using the website services. Furthermore, our legitimate interest arises from the protection of user identity and the prevention of fraudulent activity pursuant to Article 6(1)(f) GDPR.

We delete collected data in accordance with legal retention and archiving requirements after the termination of the usage agreement with us. You may terminate this agreement and request the deletion of all data stored in your account at any time by sending a message via email, using the contact form, or directly via the account settings in the app, provided there are no conflicting legal obligations.

3.2.2 Bookings and booking inquiries as well as payment processing

For booking inquiries, we collect the following data:

• the requested arrival and departure dates;
  
  

• first and last names; if applicable, also of accompanying guests;
  
  

• email address;
  
  

• (optional) message related to the booking;
  
  

• postal address;
  
  

• telephone number;
  
  

• (optional) selected extras;
  
  

• payment method.
  
  

The collection of the aforementioned data and its transfer to the providers is a pre-contractual measure necessary for concluding a contract (Art. 6(1)(b) GDPR).

Interhome works with property owners and local keyholders (see our General Terms and Conditions for details). When booking an accommodation through the portal, we collect and use the provided personal data to process payments and, where necessary for contract fulfillment, to forward the data to our partners.

In the case of direct bookings, payment processing is carried out by Interhome. In this context, we collect the payment information provided during the booking process and process all required data (name, payment details such as credit card/bank transfer data, billing address, cookie information, or other relevant information) necessary for a secure and valid transaction, fraud detection, risk assessment, or the selected payment method. The reverse applies in the case of cancellations where a full or partial refund is issued — the refund amount is returned to the original payment method.

The legal basis for processing payment data for all processes related to payment handling and asserting claims for contract initiation and fulfillment is Art. 6(1)(b) GDPR. The legal basis for activities related to tax audits and the preparation of annual financial statements is Art. 6(1)(c) GDPR.

By selecting one of the available payment methods (e.g. credit card, invoice), you agree to the use of the respective payment service, the outsourcing of such a service, and the associated transmission and processing of your data. We share payment data with our house bank and use the following payment service providers and payment methods:

• PayPal, a service of PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. Further information about processed personal data can be found at:
  https://www.paypal.com/de/webapps/mpp/ua/privacy-full?locale.x=de_DE
  
  

• Services of Mastercard Europe SA, Chaussée de Tervuren 198A, B-1410 Waterloo, Belgium. Further information is available at:
  https://www.mastercard.de/de-de/datenschutz.html
  
  

• Services of Visa Europe Management Services Limited, German Branch, Neue Mainzer Strasse 66–68, 60311 Frankfurt, Germany. Further information is available at:
  https://www.visa.de/legal/privacy-policy.html
  
  

• In some countries, Interhome uses the services of regional providers. Contact details for these providers, including their data protection officers (if applicable), and additional privacy information can be found on their respective information pages.
  
  

No further transfer of data to third parties takes place unless we are legally obliged to do so or the transfer serves law enforcement purposes.

For certain selected payment methods, a risk assessment is conducted by the payment providers using the entered data before the transaction is processed, in order to prevent fraud or payment defaults. You will also be notified accordingly.

The legal basis for activities related to any risk assessment by the payment provider or the choice of payment method is Art. 6(1)(f) GDPR. Our legitimate interest is based on our business interest in providing direct booking services and in avoiding payment defaults, while protecting your personal data through a data processing agreement with the payment provider.

3.2.3 Use and redemption of an Interhome voucher

When redeeming an Interhome voucher, the following data is collected and processed:

• First and last name;

• postal address;

• email address;

• contact details of authorized third parties;

• booking number;

• (optional) bank details (e.g. IBAN and BIC) — if required.

We process the data exclusively for the handling, reconciliation, and (if applicable) disbursement of the voucher value, provided all redemption requirements under the respective voucher terms are met. The data is stored in accordance with statutory retention periods.

The legal basis is Art. 6(1)(b) GDPR.

3.2.4 Sweepstakes and special offers

In connection with sweepstakes and other promotional campaigns via our website, applications, campaign pages, or social media channels, we store the data of all participants in accordance with the applicable terms and conditions of participation. In the event of a potential win, we may contact participants.

In sweepstakes, the personal data (salutation, name, address, title, telephone numbers, email addresses) of the winners may be transmitted to the respective sweepstake and cooperation partners. This is done on the basis of contractual fulfillment (Art. 6(1)(b) GDPR).

Participation in sweepstakes, including the associated data transmission, is voluntary.

3.3 Data processing for additional services

3.3.1 Insurance brokerage

In the case of a direct booking, an insurance benefit is already included, and additional insurance packages offered can also be selected via a certified partner. Interhome cooperates for the purpose of insurance brokerage with:

Helvetia Swiss Insurance Company Ltd,
Dufourstrasse 40, CH-9001 St. Gallen, Switzerland.

Responsible for this insurance: Europäische Reiseversicherung (referred to as “ERV” in the GTC), a branch of Helvetia Swiss Insurance Company Ltd, based at St. Alban-Anlage 56, P.O. Box, CH-4002 Basel, Switzerland.

We store the data solely for the brokerage and processing of the insurance contract, and only for the duration of the insurer's contractual obligations toward the beneficiaries.

The legal basis is Art. 6(1)(b) GDPR.

Further details regarding data processing by ERV / Helvetia can be found at:
https://www.helvetia.com/de/web/de/ueber-uns/service/datenschutz.html

3.3.2 WeatherPromise

We integrate services provided by WeatherPromise (Germany) GmbH, located at Tieckstraße 2, 10115 Berlin (“WeatherPromise”). WeatherPromise offers the possibility of protecting a trip by automatically generating a personalized weather guarantee for the booked trip, based on weather data from leading and independent global providers.

WeatherPromise and Interhome act as independent controllers when processing data for the purpose of contract initiation. Interhome is responsible for processing data related to brokerage and, if applicable, payment processing. WeatherPromise is responsible for the execution of the offered insurance service.

Further information can be found in the WeatherPromise privacy policy:
https://www.weatherpromise.com/de/privacy/

3.4 Social logins (login via Facebook, Apple, or Google) and email communication

In addition to the option of creating a user account via email, social media logins offer a service that allows you to log in to our portal and websites using your social media login profile.

The use of this data serves the purpose of identification, setting up the user account, and checking the entered data for plausibility. The connection can be removed at any time in the settings of your social media profile. Of the transmitted data, we use and store the following information until it is automatically deleted after the contract for using our portal is terminated:

• the email address used on the social media channel,

• the profile name (first and last name),

• the profile and background image used,

• age range (e.g. over 18, over 21),

• a link to the social media account,

• gender,

• the top-level domain of the logged-in account,

• the time zone of the account,

• if applicable, the top-level domain of the logged-in Google account,

• if applicable, the user domain maintained by the channel (hosted domain, HD).

The legal basis for using this data is Art. 6(1)(b) GDPR. The use serves to fulfill our contractual obligations arising from our Terms of Use (Art. 6(1)(b) GDPR). If you have expressly given consent to the social media platform, the legal basis is Art. 6(1)(a) GDPR, and your personal data will be transmitted to us as part of registration. If providers are based outside the EU, it cannot be ruled out that the data will also be transferred to the United States as part of an international data transfer.

3.4.1 Facebook Connect

This service is provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Facebook,” “Meta”). When logging in via Facebook Connect, a direct connection to Facebook's servers (1601 South California Avenue, Palo Alto, CA 94304, USA) is established. Facebook becomes aware that the login credentials are being used on Interhome.

The purpose and scope of data collection and the further processing and use of the data by Meta, as well as related rights and privacy settings, can be found in Facebook’s privacy policy:
https://www.facebook.com/privacy/policy

3.4.2 Sign in with Google

When logging in via Google by selecting “Sign in with Google,” a direct connection to the servers of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”) is established. Google is informed that these login credentials were used with Interhome. We do not receive Google account information.

Google will inform you whether and which data from your Google account will be made available to us. For registration and use of Google, Google's terms and privacy policies apply:

https://policies.google.com/privacy

https://business.safety.google/privacy/

3.4.3 Apple Sign-in

When logging in via Apple Sign-in, a direct connection to the servers of Apple Distribution International Limited, Hollyhill Industrial Estate, Hollyhill, Cork, Ireland (“Apple”) is established. Apple becomes aware that the login credentials are being used.

Depending on the settings in your Apple profile, certain data may be hidden, and Apple may send us an email address generated by Apple.

Further information about Apple’s data processing can be found here:
https://www.apple.com/legal/privacy/data/en/sign-in-with-apple/

3.4.4 Email service

We use the SendGrid service from Twilio / SendGrid, Inc., 1801 California Street, Suite 500, Denver, Colorado 80202, USA ("SendGrid") to send relevant emails (e.g. booking and inquiry confirmations, notifications). For this purpose, your email address and your name (to personalize the email) are processed.

A data processing agreement exists with Twilio / SendGrid under the conditions applicable to international data transfers.

The legal basis for this processing is contract execution under Art. 6(1)(b) GDPR.

Further information can be found in the privacy policy of SendGrid:

https://sendgrid.com/policies/privacy

3.5 Data processing for advertising purposes

To send promotional messages via email, push notifications (if applicable), surveys, review requests, feedback, and other company-related information (“newsletters”), we use the provider Braze, Inc., 330 West 34th Street, 18th Floor, New York, NY 10001, USA (“Braze”).

Additionally, data on the use of these notifications (such as open rates, click rates, or display duration) is collected and stored.

For the purpose of sending emails, the following data is processed:

• Email address,

• Device data related to the device used (primarily for push notifications via app, if applicable),

• Name (for personalizing the email),

• and, for the creation of groups and related campaigns, transactional data regarding bookings and booking inquiries.

The legal basis for sending newsletters is your consent pursuant to Art. 6(1)(a) GDPR.

The legal basis for evaluating and analyzing the newsletter is Art. 6(1)(f) GDPR, as we have a legitimate interest in improving and tailoring our service offerings. We have entered into a data processing agreement with the service provider and comply with the requirements for international data transfers.

More information can be found in Braze’s privacy policy:
https://www.braze.com/company/legal/privacy

3.5.1 Newsletter delivery

On our website, we offer the opportunity to sign up for our newsletter. To ensure that no errors occur during the input of the email address, we use the so-called double opt-in procedure. After entering your email address into the registration field, we will send a confirmation link to that address. Your email address will only be added to our mailing list once the confirmation link has been clicked.

You may revoke your consent at any time with effect for the future. This can be done by clicking the unsubscribe link at the end of the newsletter, changing the settings in your user account, or sending a message to the controller by email or through the contact form. The legality of any data processing that occurred prior to the revocation remains unaffected.

3.5.2 Product recommendations

After completing a booking or submitting a booking inquiry, and having collected your email address for the purpose of initiating or performing a contract, we may use this email address for the purpose of maintaining our customer relationship by sending direct advertising for similar goods or services (“product recommendations”).

These product recommendations are sent regardless of whether you have subscribed to a newsletter. Our intention is to provide you with relevant information about our services based on your previous transactions and searches.

If you no longer wish to receive product recommendations from us, you can let us know at any time. Our contact details are listed in Section 2. Naturally, each email also contains an unsubscribe link.

3.5.3 Interest-based advertising

We categorize user profiles based on information from completed search queries so that we only send information that is likely to be of interest. Based on this information, we tailor our newsletter content and promotional emails.

The goal is to provide interest-based advertising that is aligned with actual user needs and to avoid sending irrelevant content.

The legal basis for the above-mentioned processing is Art. 6(1)(f) GDPR. The processing of existing customer data for advertising purposes is considered a legitimate interest.

3.5.4 Disclosure to third parties

To display interest-based advertising—and provided that you have given your consent—we may share email addresses in hashed (pseudonymized) form with social media platforms (such as Google and Facebook). We have signed corresponding data protection agreements with both Google and Facebook.

The legal basis for sharing hashed email addresses with social media platform operators is Art. 6(1)(a) GDPR. This consent may be withdrawn at any time with effect for the future, using the contact methods mentioned above.

3.5.5 Review requests for accommodations, satisfaction surveys

When you book via Interhome, we send a follow-up email after your departure that includes a link allowing you to submit a review of the vacation rental you booked.

The review, which includes a 1-to-5 rating scale (with 5 being the best possible score) and an optional written comment, may be published on our website alongside the relevant accommodation listin

4. “Cookies” and other tracking technologies – General information

On our websites and applications, we use cookies, pixels, web beacons, or similar technologies on the basis of Art. 6(1)(a), (b), and (f) GDPR.

Cookies are small files that are automatically created by the browser and stored on the device when our website is visited or our application is used. Pixels and web beacons are small graphics and code fragments that serve to measure activities on our website. Hereinafter, we refer to pixels, web beacons, and similar technologies collectively as “cookies.”

Cookies do not cause any damage to your device, nor do they contain viruses, Trojans, or other malware. The cookie stores information that arises in connection with the specific device used. However, this does not mean that we gain direct knowledge of your identity.

When our website or application is accessed, a notice appears regarding our use of cookies.

Some cookies help us provide users with the best possible and functional service and ensure a secure experience on our website and in our application (“functional cookies”). Functional cookies are technically necessary and essential for the uninterrupted and risk-minimized operation of our services, as they ensure security, user experience, and settings (e.g. for making a booking, creating a user account, storing preferred searches).

As they are essential for the operation and functionality of our website and application, the processing of data through functional cookies is based on Art. 6(1)(f) GDPR and, for the performance of our usage contracts (Terms of Use), on Art. 6(1)(b) GDPR.

We use so-called session cookies to recognize that you have already visited specific pages on our website or logged into your user account. These are automatically deleted when you leave our website.

In addition, we also use temporary cookies for the purpose of fulfilling our usage contracts. These are stored on your device for a specified period. If you revisit our website to use our services, the cookie automatically recognizes that you have previously visited and what entries and settings you made, so we can provide our services accordingly.

If you have a user account and are logged in or activate the “stay logged in” function, the information stored in cookies will also be saved to your user account.

We also use analytical cookies, based on Art. 6(1)(a) GDPR, to statistically evaluate the use of our website and optimize our offering, as well as marketing cookies to show you personalized information and tailored content. These cookies are only set after you have given your express consent.

Consent can be revoked at any time. The legality of the data processing performed based on the consent prior to its withdrawal remains unaffected. You may revoke your consent at any time by adjusting your cookie settings.

You can also configure your browser to prevent cookies from being stored on your device or to notify you whenever a new cookie is being set. However, disabling cookies entirely may result in some parts of our website or app not functioning properly.

The storage period of cookies depends on their purpose and therefore varies. In all cases, cookies are automatically deleted after a specified period.

You can find more detailed information about the analytical and marketing cookies we use in the sections below.

4.1 Analytical cookies and tools

For the purpose of demand-oriented design and ongoing optimization of our websites and app, we use cookies and tools that allow us to analyze the usage of our website and app, provided you have given your consent in accordance with Art. 6(1)(a) GDPR.

4.1.1 Google Analytics

We use Google Analytics, a web analytics service provided by Google. In this process, pseudonymized user profiles are created and cookies are used. The information generated by the cookie about your use of the website, such as:

• browser type/version,
  
  

• operating system used,
  
  

• referrer URL (the previously visited page),
  
  

• hostname of the accessing computer (IP address),
  
  

• time of the server request,
  
  

is transmitted to a Google server in the USA and stored there. Google complies with the privacy standards of the EU-U.S. Data Privacy Framework of the U.S. Department of Commerce.

We have also concluded a data processing agreement with Google for the use of Google Analytics. Under this agreement, Google assures us that the data will be processed in accordance with the GDPR and that the rights of data subjects will be protected.

The information is used to evaluate the use of the website, compile reports on website activity, and provide other services related to website and internet usage for purposes of market research and the tailored design of our website. This information may also be transferred to third parties where required by law or where such third parties process the data on our behalf.

Under no circumstances will the IP address be merged with other Google data. The IP addresses are anonymized so that identification is not possible (this is known as IP masking).

You can prevent cookies from being installed by adjusting the settings in your browser software. However, we would like to point out that in this case, not all features of our website may be fully functional.

You can also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address), and the processing of this data by Google, by downloading and installing the following browser add-on:
https://tools.google.com/dlpage/gaoptout?hl=de

As an alternative to the browser add-on, especially for mobile browsers, you can prevent Google Analytics from collecting your data by clicking a specific opt-out link. This will set an opt-out cookie that prevents future data collection when visiting this website. The opt-out cookie applies only to this browser, only for our website, and is stored on your device. If you delete the cookie in this browser, you must set the opt-out cookie again.

Further information on data protection in connection with Google Analytics can be found at:
https://support.google.com/analytics/answer/6004245?hl=de
https://business.safety.google/privacy/

4.1.2 Google Tag Manager

We use Google Tag Manager, a service from Google that allows website tags to be managed via an interface. Only tags are implemented; no cookies are set and no personal data is collected. The Tag Manager triggers other tags that may collect data, but Google Tag Manager does not access this data.

If deactivation is carried out at the domain or cookie level, it will remain in effect for all tracking tags implemented with Google Tag Manager.

For more information, see Google’s usage policy for Tag Manager:
https://www.google.com/intl/de/tagmanager/use-policy.html

4.1.3 New Relic

To monitor the availability and performance of our servers, we use the web analytics service New Relic, provided by New Relic Inc., 188 Spear Street, Suite 1200, San Francisco, CA 94105, USA.

Using pseudonymized usage data, technical performance metrics (such as response and load times) are measured and analyzed to improve our server performance.

Further information can be found in New Relic’s privacy policy:
https://newrelic.com/privacy/

4.1.4 Snowplow

We use the open-source web analytics service Snowplow, provided by Snowplow Analytics Limited, 32–38 Scrutton Street, London EC2A 4RQ, United Kingdom. Cookies are used for this purpose. The information generated by the cookie about your use of the website includes:

• browser type/version,

• operating system used,

• referrer URL (the previously visited page),

• hostname of the accessing computer (IP address),

• time of the server request,

• search queries and filter settings,

• clicks on the website.

This data is transmitted to and stored on a server operated by Interhome in Frankfurt, Germany.

The information is used to evaluate the use of the website, compile reports on website activity, and provide other services related to website and internet usage for market research and tailored design purposes.

4.1.5 TrackJS

We use the services of TrackJS LLC. TrackJS enables the analysis of technical errors in JavaScript, allowing us to check and improve the quality of our website and app.

Further information can be found in TrackJS’s privacy policy:
https://trackjs.com/privacy/

4.1.6 Matomo

We also use the open-source web analytics service Matomo (formerly Piwik), provided by InnoCraft Ltd., 150 Willis St, 6011 Wellington, New Zealand (“Matomo”). Cookies are used, which allow an analysis of the use of our website.

Pseudonymized usage profiles may be created and evaluated from this data. The information generated by the cookie, such as the browser used and the pseudonymized IP address, is processed on our own servers.

The information generated in the pseudonymized user profile is not used to personally identify anyone and is not merged with personal data.

Further information on Matomo’s privacy policy can be found at:
https://matomo.org/privacy-policy/

There you can also object to website tracking using the “opt-out” function.

4.2 Marketing cookies

The following marketing and targeting measures we use are based on your consent pursuant to Article 6(1)(a) GDPR.

Targeting serves the purpose of personalized advertising. The marketing and targeting measures we use are intended to ensure that the advertisements shown on your device are based on your personal interests.

4.2.1 DoubleClick

We use Google’s DoubleClick technology. This collects and evaluates information to optimize advertising content. Cookies are used for this purpose, which may record information such as which of our products you were interested in. This enables us to show personalized offers on third-party websites based on your previous behavior.

Data collection and evaluation take place exclusively in pseudonymized form. We do not merge this with any personal data. Cookies are automatically deleted after 30 days.

You can manage your ad settings via Google’s Ads Settings Manager:
https://adssettings.google.com/authenticated?hl=de
Further details:
https://www.google.com/policies/technologies/ads/
https://business.safety.google/privacy/

4.2.2 Google Ads (Conversion + Enhanced Conversions)

We use Google Ads and its conversion tracking feature to measure the success of our ads and optimize interactions. When you click on a Google ad, a cookie is set for 30 days, which allows us to determine if you returned to our offer page.

Each Google Ads customer receives a different cookie. If you are signed into a Google service, your visit can be associated with your account.

We also use Enhanced Conversions: hashed user data (e.g. email address, customer IDs) is shared with Google after a transaction to match it with existing Google accounts. We receive aggregated reports.

Legal basis: your consent under Art. 6(1)(a) GDPR; our legitimate interests in analytics, measuring reach, and optimizing advertising.

More info:
https://services.google.com/sitestats/de.html
https://business.safety.google/privacy/

4.2.3 Google Dynamic Remarketing

We use Google Dynamic Remarketing in combination with Google Ads and DoubleClick. It allows interest-based, cross-device advertising. If you gave consent to Google, your browsing behavior is linked to your Google account so you can be shown the same ads on multiple devices.

Google Analytics temporarily links authenticated Google user IDs with our Analytics data.

You can opt out of cross-device advertising here:
https://www.google.com/settings/ads/onweb/
Privacy info:
https://www.google.com/policies/technologies/ads/

4.2.4 Google AdSense

We use Google AdSense to show ads on our website. These may be interest-based. AdSense uses web beacons and cookies. Data (including your IP address) is transferred to Google servers in the USA.

Third-party providers may also receive data:
https://support.google.com/dfp_sb/answer/94149

Disable interest-based ads via:
http://www.google.de/ads/preferences

Privacy info:
https://www.google.com/policies/technologies/ads/

4.2.5 Google AdMob

We use Google AdMob to show ads in the Interhome app. It uses the Apple Advertising Identifier (Apple Ad-ID) to assign users to segments for targeted advertising. The Ad-ID is a pseudonym.

You can prevent this via iOS settings under “Privacy > Advertising” by enabling “Limit Ad Tracking” or resetting the Ad-ID.

4.2.6 AppsFlyer

Our app uses AppsFlyer Ltd., 14 Maskit St., Herzliya, Israel. It collects:

• IP address,
  
  

• device ID (including ad ID),
  
  

• (de-)installation data,
  
  

• HTTP headers (e.g. country, language, OS, app version),
  
  

• device and browser behavior.
  
  

Used for ad performance and fraud prevention.

Opt-out & privacy:
https://www.appsflyer.com/legal/privacy-policy

4.2.7 Criteo

We use Criteo SA, 32 Rue Blanche, 75009 Paris, France. Data is collected via pixels, which may include your IP address, referrer URL, browser, and cookies.

Criteo analyzes browsing behavior to show personalized ads. Data is pseudonymized and not used to identify you personally.

More info + opt-out:
https://www.criteo.com/de/privacy/
https://www.criteo.com/de/privacy/criteo-works-with-the-following-platforms/

4.2.8 Microsoft Advertising

We use Microsoft Advertising (Microsoft Corporation, USA). When you click on one of our ads, a cookie is set and a tag tracks time on site, page visits, and referral ad.

Data is stored in the US for up to 180 days.

More info:
https://help.ads.microsoft.com/#apex/3/de/53056/2
https://privacy.microsoft.com/de-de/privacystatement

4.2.9 Taboola

We use Taboola Inc., 28 West 23rd St., New York, USA. Taboola sets cookies to evaluate which content you use and recommends content accordingly.

Data is pseudonymized.
Opt-out:
https://www.taboola.com/privacy-policy

4.2.10 Facebook Custom Audiences

We use Facebook Custom Audiences. A JavaScript pixel collects non-personal data (e.g. IP address, browser, referrer). Facebook compares this data with its cookie to determine if the user is part of a target group.

You can opt out here:
https://www.facebook.com/ads/website_custom_audiences

Privacy info:
https://www.facebook.com/privacy/explanation

4.2.11 RTB House

We use RTB House S.A., Złota 61/101, Warsaw, Poland, for retargeting. Cookies track which content you viewed and display related recommendations on other websites.

More info:
https://www.rtbhouse.com/privacy/

4.2.12 Clicktripz

We use Clicktripz, 1112 Ocean Drive, CA 90266 Manhattan Beach, USA, to process user travel preferences and behavior for displaying travel offers.

Privacy info:
http://www.clicktripz.com/privacy_policy.php

4.2.13 Ad Up

We use Ad Up (Axel Springer Teaser Ad GmbH) for conversion tracking and ad performance. Cookies are used. Data is anonymized or pseudonymized.

Opt-out:
https://www.adup-tech.com/datenschutz/

5. Affiliate services

We use affiliate networks where publishers earn a commission if they refer users via affiliate links.

No tracking is performed on our website directly — cookies are set after redirection. We work with:

• Performance Horizon Group Ltd
  Privacy policy:
  http://performancehorizon.de/docs/Datenschutzrichtlinie.pdf
  
  

• CJ Affiliate (Commission Junction LLC)
  http://de.conversantmedia.eu/legal/datenschutzerklaerung
  
  

• TradeTracker Deutschland GmbH
  https://tradetracker.com/privacy-policy/
  
  

• AWIN AG
  https://www.awin.com/de/rechtliches/privacy-policy-DACH
  
  

AdCell / Firstlead GmbH
https://www.adcell.de/datenschutz

6. Online presence on social networks

We operate online profiles on platforms like Facebook and Instagram (Meta). These platforms may provide us with aggregated usage statistics, such as demographics and engagement data.

We use this data to improve our content. The legal basis is:

• Art. 6(1)(b) GDPR: to interact with customers and interested parties,

• Art. 6(1)(f) GDPR: our legitimate interest in effective communication and public presence.

Meta may use this data for its own purposes beyond our control.

Privacy info:
https://www.facebook.com/privacy/polic

7. Use of third-party plugins

7.1 Google Maps

Used for displaying interactive maps. IP addresses are transmitted to Google servers in the US.

Legal basis: Art. 6(1)(f) GDPR
Terms:https://www.google.com/intl/de_de/help/terms_maps.html
Privacy:https://policies.google.com/privacy

7.2 Google Fonts

Used to display fonts. Fonts are requested from Google servers in the USA.

Legal basis: Art. 6(1)(f) GDPR
More info:
https://policies.google.com/privacy
https://business.safety.google/

7.3 Use of Artificial Intelligence (AI)

We use modern AI technologies, including OpenAI, Google Vertex AI, and others, for:

• internal process optimization,
  
  

• enhanced user functions (e.g. chatbots),
  
  

• content support (e.g. summaries, code generation).
  
  

Personal data is only processed if absolutely necessary and never used to train models. Transfers to the U.S. are based on SCCs or the EU-U.S. DPF.

Legal basis: Art. 6(1)(f) GDPR.

8. Corporate Group

Interhome is a company of the HomeToGo Group, HomeToGo GmbH, Pappelallee 78/79, 10439 Berlin, Germany. We occasionally transfer personal data to affiliated companies within the HomeToGo Group. The HomeToGo Group includes all current and future companies that are directly or indirectly controlled by HomeToGo GmbH (“HomeToGo”) or are under common control with HomeToGo.

The transfer of data within the corporate group takes place for the following purposes:

a) Provision of our services and our other platforms
b) Provision of services within the scope of customer service
c) Sending advertising with consent or if otherwise permitted by applicable law
d) Analysis, optimization, and improvement of our website and application
e) Detection and investigation of fraud and illegal activities
f) Compliance (observance and adherence to legal obligations)

The legal basis for data sharing within the HomeToGo Group is Article 6(1)(a), (b), and (f) GDPR.

Specifically, the legal basis for purposes a) and b) is Article 6(1)(b) GDPR. The sharing of data enables us to fulfill our contractual obligations arising from our Terms of Use.

The legal basis for purpose c) is the explicit consent granted by you (Article 6(1)(a) GDPR), which you may withdraw at any time. Alternatively, it is our legitimate interest in conducting marketing for existing customers (Article 6(1)(f) GDPR). The lawfulness of the processing carried out prior to revocation remains unaffected.

For purposes d), e), and f), our legitimate interest arises from the improvement of our services, the protection of identity, and the prevention of fraudulent activities (Article 6(1)(f) GDPR).

9. Customer service inquiries via email, contact form, voicemail, and chat, as well as surveys and satisfaction analyses (feedback)

9.1

You can send us inquiries via email or the contact form on our website by providing your name, email address, and phone number (and, in the case of cancellations, also the booking number). Use of the contact form is voluntary; the processing of this data is carried out for the performance of our contractual service obligations (Art. 6(1)(b) GDPR).

Before responding to inquiries, we may require further information to verify identity, in order to protect personal data, if identification is not otherwise possible.

The inquiries and the information entered are transferred to our ticketing system. We use the services of Salesforce.com, Inc., Salesforce Tower, 415 Mission Street, San Francisco, CA 94105, USA (“Salesforce”) for this purpose. If you do not wish your data to be processed by Salesforce, you can contact our customer service directly at [email protected].

Further information can be found in Salesforce’s privacy policy:
https://www.salesforce.com/company/privacy/

9.2 Live Chat and Chatbot

We also offer a live chat for electronic communication.

When starting the live chat, a functional cookie is set in the browser and the following data is collected:

• First and last name

• Email address

• Browser type/version

• IP address

• Operating system used

• URL of the previously visited website

During the chat, you may also provide additional personal information, depending on the nature of your inquiry.

We process and store this data to enable and ensure the quality of the live chat functionality. The legal basis is Art. 6(1)(f) GDPR. The chat history is deleted no later than 12 months after the interaction.

Before you are connected with a human support agent, basic questions may be asked by the chatbot via a chat form and answered automatically using FAQs. These data are stored as part of the support ticket, as described above.

9.3 Feedback

We offer various options for submitting feedback, suggestions, or criticism regarding our website, products, or services. This can be done via dedicated feedback forms (e.g., pop-ups), by email, or through other input fields on our website.

Among other tools, we use the services of zenloop GmbH, part of SaaS.group, Attilastraße 18, 12529 Schönefeld, and headquartered at Pappelallee 78/79, 10437 Berlin. Zenloop allows us to collect and analyze user feedback through various channels.

Zenloop collects the following information:

• IP address

• Device and browser data

• The website from which the feedback tool was accessed

We have concluded a data processing agreement with Zenloop.

The purpose of processing the data you submit is to evaluate and use your feedback to improve our services and the quality of our offerings.

Depending on the feedback method, we may process the following data:

• Feedback content

• Contact information (email address and, where applicable, name) — if needed to respond or better categorize the feedback

• Technical data (e.g., date and time of submission, IP address) — to prevent misuse and ensure traceability

The legal basis for processing personal data for feedback handling is our legitimate interest (Art. 6(1)(f) GDPR), which lies in continuously improving our service quality and user experience. The processing serves internal analysis and optimization and typically does not override the rights and freedoms of data subjects, since the feedback is provided voluntarily.

Even without a separate and active declaration of consent (e.g., checkbox), submitting feedback via interactive web forms is voluntary and shall be considered consent once submitted. In this case, the explicit legal basis is Art. 6(1)(a) GDPR. You may withdraw this consent at any time with future effect.

10. Data transfers to third countries

As outlined in this privacy policy, we use systems and software from service providers who are either based outside the European Union or the European Economic Area (i.e., in so-called third countries such as the USA), or where it cannot be ruled out that data may be transferred from the EU to a third country.

In some cases, an adequacy decision by the European Commission exists for the respective country, confirming an adequate level of data protection (e.g. Canada, the USA under the EU-U.S. Data Privacy Framework).

In other cases, the level of data protection may not be equivalent to that in the EU. Where no adequacy decision exists (Art. 45 GDPR), we implement appropriate safeguards, such as the EU Standard Contractual Clauses (SCCs), as well as other contractual measures (where required), to ensure an adequate level of data protection for such transfers.

Where this is not possible, we rely on the exceptions outlined in Art. 49 GDPR, particularly your explicit consent.

If a data transfer to a third country is planned or cannot be ruled out and no adequacy decision or safeguards exist, it is possible — and there is a risk — that authorities in the third country (e.g. intelligence services) may access, collect, and analyze the transferred data. Additionally, enforcement of your rights may not be guaranteed. You are also informed of this when providing consent via the cookie banner.

11. Rights of the data subject

Requests to exercise your rights, along with our responses, are stored for documentation purposes for up to three years, and, in individual cases, for a longer period if required for the assertion, exercise, or defense of legal claims. Legal basis: Art. 6(1)(f) GDPR, based on our interest in defending against possible civil claims under Art. 82 GDPR, avoiding fines under Art. 83 GDPR, and fulfilling our accountability obligations under Art. 5(2) GDPR.

11.1 Overview

In addition to the right to withdraw any previously given consent, you are entitled — if the legal requirements are met — to the following rights under Articles 12–22 GDPR, particularly:

• Right of access to personal data stored by us (Art. 15 GDPR)

• Right to rectification of inaccurate or incomplete data (Art. 16 GDPR)

• Right to erasure of stored data (Art. 17 GDPR)

• Right to restriction of data processing (Art. 18 GDPR)

We also confirm that we do not carry out automated decision-making as defined in Art. 22 GDPR that would have legal effects on the data subject.

11.2 Right to object

Under the conditions of Art. 21(1) GDPR, you have the right to object to data processing on grounds relating to your particular situation.

This general right to object applies to all data processing activities described in this privacy policy that are based on Art. 6(1)(f) GDPR. Unlike the special right to object to direct marketing, we are only obligated to comply with this general objection if you provide compelling legitimate grounds (e.g., potential risk to life or health).

11.3 Supervisory authority

You may also contact the supervisory authority responsible for Interhome:

Federal Data Protection and Information Commissioner (EDÖB)
Feldeggweg 1, CH-3003 Bern, Switzerland
Phone: +41 58 462 43 95
Online contact form: www.edoeb.admin.ch

12. Changes to this Privacy Policy

We may occasionally update this privacy policy, for example, when we adapt our website/applications or services, or when legal, technical, or regulatory requirements change.

The current version is always available on our website and applies to all data processing activities from the time of publication.

Version – Effective from November 2025

3.7.2. Google Tag Manager

We use the Google Tag Manager. This Google service allows website tags to be managed through an interface. Only tags are implemented, i.e. no cookies are set and no personal data is collected. The Tag Manager triggers other tags that may themselves collect data. Google Tag Manager does not access this data. If deactivation has been done at the domain or cookie level, it will apply to all tracking tags implemented with Google Tag Manager. More information can be found in the Google Tag Manager use policy: https://www.google.com/intl/de/tagmanager/use-policy.html.

3.7.3. New Relic

To perform accessibility and performance monitoring for our servers, we use the "New Relic" web analytics service provided by New Relic Inc., 188 Spear Street, Suite 1200, San Francisco, CA 94105, USA. Using pseudonymized usage data, technical performance data (e.g., response and load times) is measured and analyzed to improve our server performance. Further details and information can be found in the New Relic Privacy Policy at https://newrelic.com/privacy/.

3.7.4. Snowplow

We use the Snowplow open source web analytics service provided by Snowplow Analytics Limited, 32-38 Scrutton Street, London, EC2A 4RQ, United Kingdom. Cookies are used as part of this. The information generated by the cookie about your use of this website, e.g.

• browser type/version
• operating system used
• Referrer URL (the previously visited page)
• hostname of the accessing computer (IP address)
• time of server request
• search queries and filter settings
• clicks on the website

is transmitted to a HomeToGo server in Frankfurt and stored there.

The information is used to evaluate the use of the website, to compile reports on the activity on the website, and to provide other services related to the use of the website and internet usage for the purposes of market research and to customize the design in line with the needs of users.

3.7.5. Adjust

In our app, we use the analytics service of Adjust GmbH, Saarbrücker Str. 37A, 10405 Berlin, Germany. The analytics service is implemented in our app via a development environment (SDK - Software Developer Kit). The information generated by the development environment, e.g.

• hashed (anonymized) IP address
• mobile identifiers such as the Advertising ID for iOS (IDFA) or the Google Advertising ID
• installation and initial opening of an app on your mobile device
• your interaction within an app (e.g., in-app purchases, registration)
• viewed and clicked ads

is collected and used by Adjust GmbH to evaluate the use of the app, to compile performance reports on app activity, and to provide other services related to the use of the app for purposes of market research and customization of the app. Under no circumstances will the collected data be combined with other data that Adjust obtains via other apps.

You can find more information about Adjust's Privacy Policy here: https://www.adjust.com/privacy-policy/. You can object to tracking by Adjust at any time within the "Opt-out" section of Adjust's Privacy Policy. To do this, you must select the device for which you do not want Adjust to perform tracking and specify your Device Identifier. Behavior tracking from apps that use Adjust will then be immediately removed on your device.

3.7.6. TrackJS

We use the services of TrackJS LLC. TrackJS allows us to analyze technical errors in JavaScript, so that we can check and improve the quality of our website and app. More information can be found in TrackJS Privacy Policy: https://trackjs.com/privacy/.

3.7.7. Videobeat

We use the Videobeat analytics software by Videobeat Networks GmbH, Rathausstr. 4, 20095 Hamburg, Germany, for the analysis of television and online marketing activities. Traffic on our website is monitored via a tracking pixel.

Pixels, also known as tracking pixels, are small 1x1-pixel GIF files that can be hidden e.g. in graphics or in e-mails when visiting a website. Pixels do not damage your device and do not contain viruses, Trojans or other malware.

Through the pixel, IP addresses already collected anonymously are stored together with other data (e.g., operating system or device) in a database. Neither we, nor Videobeat can use that data to identify a concrete person . The information in the database is for the purpose of analysis and evaluation for the production of media plans.

Videobeat's Privacy Policy can be found here: https://www.videobeat.net/us/data-privacy-policy/. You can object to the collection of your data by Videobeat at any time by clicking here: https://pa.videobeat.net/index.php?module=CoreAdminHome&action=optOut&language=en.

3.7.8. Matomo

Additionally, we use the Matomo (formerly Piwik) open source web analytics service provided by InnoCraft Ltd., 150 Willis St, 6011 Wellington, New Zealand (“Matomo”). For this, cookies are used to enable analysis of the use of our website. From this data, pseudonymized user profiles can be created and analyzed. The information generated by the cookie, such as your browser and pseudonymized IP address, is processed on our servers. The information generated by the cookie in the pseudonymous user profile is not used to personally identify you and is not combined with your personal data.

More information on data protection when using Matomo can be found here: https://matomo.org/privacy-policy/. There you can object to website tracking via “Opt-out“.

3.8. Targeting

The targeting measures listed below and used by us are implemented on the basis of Article 6 (1) (f) GDPR. Targeting is used to perform targeted advertising. Through the targeting measures we use, we want to make sure that advertisements which are geared to your interests are displayed on your devices.

3.8.1. DoubleClick

On our website, information used for the optimization of advertisements is collected and evaluated using cookies (see section 3.6.). To do this, we use Google's targeting technologies (DoubleClick). These technologies enable us to provide you with customized, interest-based advertising. The cookies used provide e.g. information regarding which of our products you are interested in. Based on this information, we can also display services on third-party websites that are specifically oriented towards your interests you have shown through your previous user behavior. The collection and evaluation of your user behavior takes place exclusively in a pseudonymized manner and does not enable us to identify you. In particular, the information is not combined with personally identifiable information about you.

The cookie is automatically deleted after 30 days.

You can also set preferences for the display of interest-based advertising through the Google Ads Settings Manager (https://adssettings.google.com/authenticated?hl).

For more information and the privacy policy regarding advertising and Google, please refer to Google's Privacy Policy and Terms of Service (https://policies.google.com/technologies/ads?hl, https://business.safety.google/privacy/).

3.8.2. Google AdWords

HomeToGo uses Google's AdWords service, which uses conversion tracking to measure the effectiveness of individual ads, offers and features. For this, a cookie is set as soon as you click on a Google ad. This cookie does not personally identify you, but rather makes it possible to determine whether you return to the page with the specific offer during the 30-day period in which the cookie is valid.

Each AdWords advertiser receives a different cookie. As a result, cookies cannot be tracked via the website of AdWords advertisers. The information obtained using the conversion cookie is used to generate conversion statistics for AdWords advertisers who have opted for conversion tracking. We track the total number of users who have clicked on an ad and were redirected to the website with a conversion-tracking tag.

You can permanently prevent the storage of the Google conversion cookie by setting your browser software accordingly. Google's Privacy Policy on conversion tracking can be found here: https://services.google.com/sitestats/en.html, https://business.safety.google/privacy/.

3.8.3. Google Dynamic Remarketing

We use the features of Google Dynamic Remarketing with the cross-device features of Google AdWords and Google DoubleClick.

This feature allows us to link the advertising audiences created with Google Dynamic Remarketing to the cross-device features of Google AdWords and Google DoubleClick. In this way, interest-based, personalized advertising messages that have been customized for you based on your past usage and browsing behavior on a device (e.g. smartphone) may also be displayed on another device you use (e.g., tablet or PC).

If you have given the appropriate consent to Google, Google will link your web and app browsing history with your Google Account for this purpose. That way, the same personalized advertising messages can appear on any device you use to sign in to your Google Account.

To support this feature, Google Analytics collects Google-authenticated IDs of users who are temporarily linked to our Google Analytics data to define and create audiences for cross-device ad promotion.

You can permanently opt out of cross-device remarketing/targeting by turning off personalized advertising in your Google Account. To do so, follow this link: https://adssettings.google.com/authenticated?hl.

For more information, as well as the provisions regarding data privacy, please see the Google Privacy Policy at https://policies.google.com/technologies/ads?hl, https://business.safety.google/privacy/.

3.8.4. Google AdSense

On our website, we use Google AdSense for displaying advertisements. In this way we can show you advertisements that may be of interest to you. These advertisements can be recognized by the reference "Google Ads". To do this, Google uses web beacons and cookies (see section 3.6.). The information generated by cookies and web beacons about the use of the website (including your IP address) and delivery of advertising formats is transmitted to a Google server in the US and stored there. Google may share this information with third parties.

We have enabled third-party Google AdSense ads. The data may be transferred to third parties (named at https://support.google.com/dfp_sb/answer/94149).

You can prevent Google AdSense from installing cookies by disabling interest-based ads on Google via the link https://adssettings.google.com/authenticated?hl.

For more information, as well as the provisions regarding data privacy, please see the Google Privacy Policy at https://policies.google.com/technologies/ads?hl, https://business.safety.google/privacy/.

3.8.5. Google AdMob

We use Google AdMob to display ads in the HomeToGo app. Google uses the Apple "Advertising Identifier" (hereafter “Apple Ad-ID”) for advertising control in the app. A pseudonymized user profile is created under the Apple Ad-ID so that the user can be matched to different advertising segments on the Apple advertising platform in order to be able to display interest-based advertising.

The Apple Ad-ID is a pseudonym that prevents personal plain data from being disclosed to Google. The Apple Ad-ID is transmitted to a Google server in the US and stored there.

You can prevent the use of the Apple Ad-ID by clicking on "No Ad-Tracking" under "Privacy/Advertising" in your system settings. Alternatively, you can also click “Reset Ad ID” to generate a new, randomly chosen Apple Ad ID and thus prevent a profile from being generated.
https://business.safety.google/privacy/

3.8.6. Criteo

Pixel technologies (see section 3.7.5.) from Criteo SA, 32 Rue Blanche, 75009 Paris, France ("Criteo") collect and store data for marketing and optimization purposes. Together with Criteo, we determine the purposes and means of processing and are therefore jointly responsible for processing.

The pixels send your IP address, the Referrer URL of the visited website, the time when the pixel was viewed, the browser used and previously set cookie information to a web server. This data can be used to create usage profiles under a pseudonym.

Criteo's pixel technologies allow us to evaluate our advertising campaigns and advertising content. Using an algorithm, Criteo analyzes surfing behavior and can then display targeted product recommendations as personalized advertising banners on other websites (“publishers”). You can find more information about Criteo's technology in Criteo's Privacy Policy (https://www.criteo.com/privacy/).

Using Criteo will load additional pixels from contractual partners with whom Criteo works. An overview of all publishers and networks that load pixels can be found at https://www.criteo.com/privacy/criteo-works-with-the-following-platforms/. The data collected with Criteo technology will not be used to determine the personal identity of the website visitor unless agreed to separately by the data subject. Any use of data other than that described above or transfer to third parties is excluded.

Most browsers accept pixels automatically. You can use the appropriate tools or browser add-ons to prevent the use of pixels on our website (for example, by using the "AdBlock" add-on for the Firefox browser).

You can also object to the pseudonymous analysis of your surfing behavior by us at any time. For instructions on disabling Criteo's service, please visit the following Criteo link: https://www.criteo.com/privacy/.

Please note that if you opt out of displaying personalized ads from Criteo and other affiliates, you will still receive advertisements, however these will be less tailored to your interests/browsing habits.

3.8.7. Bing Ads

We use Bing Universal Event Tracking (UET) from Microsoft Bing Ads. This is a service of Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA ("Microsoft"). This allows us to track user activity on our website when users reach our website through advertisements from Bing Ads.

If you reach our website via a Bing Ads advertisement, a cookie will be placed on your computer (see section 3.6.). A Bing UET tag is integrated into our website. This is a code that is used to store data about the use of the website in connection with the cookie. Among others, this includes the time spent on the website, which areas of the website were accessed, and what ads brought users to the website. Information about your identity is not collected.

This information is transmitted to Microsoft servers in the US and stored there for a maximum of 180 days.

More information on Bing Ads' analytical services can be found on Bing Ads website (https://help.bingads.microsoft.com/#apex/3/en/53056/2). For more information about Microsoft's privacy practice, please see Microsoft's Privacy Policy (https://privacy.microsoft.com/en-us/privacystatement).

3.8.8. Outbrain

On our website, we use technology from the service provider Outbrain Inc., 39 West 13th Street, New York, NY 10011, USA (Outbrain, Outbrain Widgets, Outbrain Pixel). This technology enables us to use pixels (see section 3.7.5.) and cookies (see section 3.6.) to offer further content that may also be of interest to you within our website or on third-party websites ("retargeting"). The recommendations integrated by Outbrain are determined on the basis of your previously read content. The content is technically controlled and delivered by Outbrain automatically.

Display takes place on a pseudonymous basis. When selecting appropriate content, the cookie uses information about the source of the device, the type of browser and your IP address, which is fully anonymized by removing the last octet.

More information about Outbrain's Privacy Policy can be found here: https://www.outbrain.com/legal/privacy#privacy-policy. You may opt-out of Outbrain's use of tracking to display interest-based recommendations via the “Opt out” field within Outbrain's Privacy Policy. Please note that you must separately set the opt-out in each device you use to access our website. After objecting, you will continue to be offered interesting additional content, however this will no longer be based on your previous usage behavior on our websites.

3.8.9. Taboola

Our website uses technologies from Taboola Inc., 28 West 23rd St., New York, NY 10010, USA ("Taboola"). Taboola uses cookies (see section 3.6.) that determine which content you use and which of our pages you visit (conversion tracking). The cookie enables us to create pseudonymous usage profiles by collecting device-related data as well as log data, and enables us to recommend content that matches your personal interests. This permits us to individually customize our offerings for you. These usage profiles cannot be used to establish your identity.

You can find more information about Taboola and the ability to disable the Taboola cookie here: https://www.taboola.com/privacy-policy.

3.8.10. Facebook Custom Audiences

In addition, we also use Facebook Custom Audiences. Facebook Custom Audiences is a Facebook marketing service. It allows us to display personalized and interest-based advertising on Facebook to certain groups of pseudonymized visitors to our website who also use Facebook.

A Facebook Custom Audience pixel is integrated into our website. This is a JavaScript code used to store non-personal information about your use of the site. This includes your IP address, the browser you are using, and the source and destination pages. This information is transmitted to Facebook servers in the United States. There, an automatic check is performed to see if you have saved a Facebook cookie. The Facebook cookie automatically determines whether you belong to the relevant target group for us. If you belong to the target group, we will show you relevant ads on Facebook. You will not be personally identified by us or by Facebook as part of this process.

You may object to the use of the Custom Audiences service on the Facebook website (https://www.facebook.com/ads/website_custom_audiences). After logging in to your Facebook account, you will be taken to the settings for Facebook ads.

For more information on privacy on Facebook, see Facebook's Privacy Policy (https://www.facebook.com/privacy/explanation).

3.8.11. RTB House

On our website, we use technology from RTB House S.A., 61/101 Złota Street, 00-819 Warsaw, Poland. This technology enables us to use pixels (see section 3.7.5.) and cookies (see section 3.6.) to offer further content that may also be of interest to you within our website or on third-party websites ("retargeting"). Cookies are used as part of this process. The recommendations integrated by RTB House are determined on the basis of your previously read content. The content is technically controlled and delivered by RTB House automatically. Display takes place on a pseudonymous basis.

The information generated by the cookie about your use of this website, such as browser type/version, operating system used, Referrer URL (the previously visited page), time of server request is transmitted to RTB House's server and stored there.

You can find more information on RTB House's Privacy Policy here: https://www.rtbhouse.com/privacy/. You may object to RTB House's tracking to display interest-based advertising at any time via the opt-out box within RTB House's Privacy Policy. Please note that you must separately set the opt-out cookie in each device you use to access our website. After objecting, you will continue to be offered interesting additional content, however this will no longer be based on your previous usage behavior on our websites.

3.8.13. Intent Media

On our website, we use technologies of Intent Media Inc., 2 Riding House St, London W1W 7FA, United Kingdom. Intent Media uses cookies (see section 3.6.) and web beacons to collect IP addresses, browser type, referrer URL, time of access and number of clicks with the purpose of targeting and placement of advertisements on our website. You can find further information on the technology here: https://intentmedia.com/privacy-policy/.

Information on your use of our website collected via cookie is transmitted to Intent Media servers, stored there and analyzed to personalize advertising on the website and other websites you visit.

You can object to Intent Media's tracking by displaying interest-based recommendations at any time by clicking this link: http://intentmedia.com/opt-out/.

3.8.14. Clicktripz

On our website, we also use services by Clicktripz, 1112 Ocean Drive, CA 90266 Manhattan Beach, USA. Clicktripz collects and processes user's travel criteria and shopping behavior through the use of cookies (see section 3.6.) and other means to provide relevant offers from partnering travel websites.

You can find more information in Clicktripz's Privacy Policy: http://www.clicktripz.com/privacy_policy.php.

3.8.15. Ad Up

Technology from Ad Up, a service provider of Axel Springer Teaser Ad GmbH, Axel-Springer-Str. 65, 10969 Berlin, Germany, is also integrated on our website. Ad Up uses cookies for conversion tracking, the evaluation of the effectiveness of advertisements and keywords. By collecting anonymized and/or pseudonymous data, Ad Up can display advertisements according to your interests for a certain period of time.

More information can be found in Ad Up's Privacy Policy here: https://www.adup-tech.com/en/privacy. You can deactivate Ad Up in your browser by clicking the button “activate opt-out cookie” there.

3.8.16 BingAds Services

On our website, we use BingAds Services by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland, for displaying advertisements. In this way we can show you advertisements that may be of interest to you. These advertisements can be recognized by the note “Ads by Microsoft” or a similar reference. Microsoft uses web beacons and cookies (see section 3.6). The information generated by cookies and web beacons about the use of the website (including you IP address and device ID) and delivery of advertising formats is transmitted to a Microsoft server in Ireland and the US and stored there.

For more information, as well as the provisions regarding data privacy, please see the Microsoft Privacy Policy at https://privacy.microsoft.com/en-us/privacystatement. There it is explained how you can object to the interest-based advertising via opt-out.

3.8.17. Other third parties

Besides, we also engage a third party partner for the purpose of identifying users and delivering to them interest-based content and advertisements. We may share information about you with our providers such as a non-human-readable form of your email or other identifier to ensure the security of your information. Our providers also may collect information directly from your device, such as your IP address, device ID, and information about your browser or operating system. They may combine our personal and non-personal information about you with information from other sources, and may place or recognize a unique cookie on your browser.

You can opt-out of these partners' services in the following manner:

To opt-out of BouncePilot's services, please go to http://www.bouncepilot.com/opt-out/ . To opt out of LiveRamp's services, please go to https://liveramp.com/opt_out/. To opt-out of third party cookies, please go to http://optout.aboutads.info/?c=2#!/. To opt-out of the use of your mobile device ID for targeted advertising, please see https://youradchoices.com/appchoices.

3.8.18. Option to object/opt-out

You can prevent the targeting technologies we described by activating the appropriate cookie setting in your browser (see also section 3.6.). In addition, you have the option of deactivating preference-based advertising with the help of the preference manager available here: http://www.youronlinechoices.com/uk/your-ad-choices.

3.9. Third party websites

HomeToGo cooperates with providers (see in-detail our Terms of Service where our providers are referred to as “Providers” in section 1 (1)). Once you are redirected to a provider's website, the terms of the respective provider apply.

Neither providers, nor intermediaries of the provider's offers (affiliate) drop cookies or use other tracking-codes on our website. Cookies or tracking-codes are used after the redirection, upon which HomeToGo has no influence. The following affiliate services are used:

• Performance advertising network by AWIN AG, Eichhornstr. 3, 10785 Berlin, Germany. You can find AWIN's Privacy Policy here: https://www.awin.com/gb/legal/privacy-policy-gb.
• Performance Horizon Group Ltd, West One, Forth Banks, Newcastle upon Tyne NE1 3PA, United Kingdom. You can find Performance Horizon's Privacy Policy here: https://performancehorizon.com/privacy-policy.
• CJ Affiliate, Commission Junction LLC, 530 East Montecito St., Santa Barbara, CA 93103, USA. You can find CJ's Privacy Policy here: https://www.conversantmedia.com/legal/privacy.

4. Third party services and plugins

4.1. Google Maps

We use Google Maps API for displaying interactive maps directly on our website and to enable the simplified use of map functionality. Your IP address is transmitted and stored on one of Google's servers in the US for the usage of Google Maps functionality (see section 3.7.1 regarding the US Privacy Shield). Legal basis is Article 6 (1) (f) GDPR. 

Please see the Terms of Service for Google Maps here: https://www.google.com/intl/en/help/terms_maps.html. You can find further information on data privacy in Google's Privacy Policy here: https://policies.google.com/privacy.

4.2. Google Fonts

On our website we use fonts (“Google Fonts”) provided by Google. For this your browser loads the required font into your browser cache when our website is opened. This is necessary so that the browser can display a visually improved version of our texts. If your browser does not support this feature, a default font will be used by your computer for display. The integration of these fonts is completed by a server call, usually a Google server in the USA. This will communicate to the server that you have visited this website.

When the page is accessed, cookies are not sent by users to the Google Fonts API. Data transferred in connection with the pageview is sent to resource-specific domains such as fonts.googleapis.com or fonts.gstatic.com. You will not be associated with any information collected or used in connection with the parallel use of authenticated Google services, such as Gmail. You can set your browser so that the fonts from Google servers are not loaded.

HomeToGo uses Google fonts to ensure an appealing presentation of its services. The legal basis is Article 6 (1) (f) GDPR.

Further information can be found in Google's Privacy Policy (https://policies.google.com/privacy).

5. Group

HomeToGo is a company of the HomeToGo Group. We may share your personal data with our associated companies within the HomeToGo Group on an occasional basis. The HomeToGo Group includes all (current and future) entities that are directly or indirectly controlled by HomeToGo GmbH (“HomeToGo”) or are under common control of HomeToGo. The transfer of data within the HomeToGo Group takes place for the following purposes:

a)     Provision of our intermediary services and of our portal

b)     Provision of customer support services

c)     Sending advertising with your consent or if permitted by applicable law

d)     Analysis, optimization and improvement of our website and app

e)     Identification and investigation of fraud and illegal activities

f)      Compliance with laws and regulations

The legal basis for the transfer of data within the HomeToGo Group is Article 6 (1) (a), (b) and (f) GDPR.

In detail, the legal basis for the purposes a) and b) is Article 6 (1) (b) GDPR. Sharing this data enables us to fulfill our contractual obligations arising from our Terms of Service.

The legal basis for purpose c) is your explicit consent (Article 6 (1) (a) GDPR) that you may revoke any time, or our legitimate interest to do marketing for existing customers (Article 6 (1) (f) GDPR). The lawfulness of the data processing already carried out remains unaffected by the revocation.

For purposes d), e) and f), our legitimate interest derives from the improvement of our services as well as the protection of your identity and the prevention of fraudulent activities (Article 6 (1) (f) GDPR).

6. Contact form and chat

We provide you with a contact form which you can use to ask us questions by entering your name and your email address. The use of the contact form is voluntary, and your data is processed in order to fulfill our contractual service obligations (Article 6 (1) (b) GDPR).

The questions and the information you enter will be transferred to our ticket system. To this end, we make use of the support services of Desk.com, 1 Market Street, San Francisco, CA 94105, USA. If you do not wish to have your data processed by Desk.com, please contact our Customer Support team through this contact form.

Moreover, we offer a live chat integration for which we use the services of Salesforce.com, Inc. located at Salesforce Tower, 415 Mission Street, San Francisco, CA 94105, USA, and with whom we have entered into a data processing agreement.

When you start the chat, in addition to a functional cookie being installed in your browser, the following data is collected:

- your first and last name

- your email address

- your browser type/version

- IP address

- operating system used

- URL of the website previously visited

During the chat session, you may provide other personal information depending on your request.

We will process and retain your data to enable and ensure the live chat function quality. The legal basis for this is Article 6(1)(f) of the GDPR. The chat history will be deleted, at the latest, within 12 months.

You can learn more about Salesforce's Privacy Policy here: (https://www.salesforce.com/company/privacy/).

7. Your rights

7.1. Overview

In addition to the right to revoke the consent you have granted to us, you are entitled to the following further rights if the relevant legal requirements apply:

• Right of access to information about your personal data stored with us pursuant to Article 15 GDPR
• Right of rectification of inaccurate personal data and right to have incomplete personal data completed pursuant to Article 16 GDPR
• Right to erasure of your personal data stored by us pursuant to Article 17 GDPR
• Right to restriction of processing of your data pursuant to Article 18 GDPR
• Right to data portability pursuant to Article 20 GDPR

7.2. Right to object

Under the conditions of Article 21 (1) GDPR, data processing can be objected to on grounds relating to the particular situation of the data subject.

The above general right of objection applies to all processing purposes described in this Privacy Policy which are based on Article 6 (1) (f) GDPR. Unlike the special right of objection to data processing for advertising purposes, under the GDPR we are only obliged to implement such a general objection if you give us reasons of overriding importance for this (for example, possible danger to life or health). In addition, you may also contact the supervisory authority responsible for HomeToGo, the Berlin Commissioner for Data Protection and Freedom of Information, Friedrichstr. 219, 10969 Berlin, Germany, Phone: +49 (0) 30 13889-0, Fax: +49 (0) 30 2155050, Email: [email protected].

Version 2 – As of October 1st, 2019