Last updated: August 2026
1. Controller
Zimmervermietung Nine Rooms
Yannick Üzüm
Am Wald 1
76149 Karlsruhe, Germany
Phone: +49 170 7211123
Email: info@ninerooms.de
2. Legal bases
We process personal data where necessary to provide the website, answer enquiries, handle bookings and stays, comply with legal duties or protect legitimate interests. Main legal bases are Article 6(1)(b), (c), (f) and, where consent is obtained, (a) GDPR.
3. Hosting
This website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. Server logs may include IP address, date and time, requested URL, referrer, browser, operating system and data volume. Processing is based on Article 6(1)(f) GDPR for secure and stable website operation. A data processing agreement is in place.
4. Contact and WhatsApp
When you contact us by email or phone, we process your contact details, message and relevant booking information under Article 6(1)(b) or (f) GDPR. If you voluntarily use WhatsApp, WhatsApp Ireland Limited also processes phone number, profile, message and metadata. Data may be processed outside the EEA. Please do not send identity documents or complete payment data through WhatsApp.
5. Smoobu booking engine
We use Smoobu GmbH, Pappelallee 78/79, 10437 Berlin, for live availability, direct bookings, reservation management and guest communication. The booking engine loads automatically on the home page, establishing a connection to Smoobu before active use. Technical data and, when booking, contact, stay, invoice and payment data may be processed. Booking processing is based on Article 6(1)(b) GDPR; automatic integration is based on Article 6(1)(f) GDPR. Additional device-access requirements under section 25 TDDDG may apply.
6. Google Maps
Google Maps is embedded and loads automatically on the home and contact pages. Provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. IP address, device, browser, location and map interaction data may be processed and associated with a Google account. We rely on Article 6(1)(f) GDPR for user-friendly directions. Data may be processed in the United States or other countries; Google refers to the EU-US Data Privacy Framework and Standard Contractual Clauses.
7. Booking and external platforms
For direct bookings and stays we process name, address, contact details, dates, room category, guest count, price, payment status, invoice data and requests under Article 6(1)(b) GDPR. If you book through Booking.com, Airbnb or another platform, we receive the contract data from that platform. The platform remains responsible for its own processing.
8. Payments and ChargeAutomation
Payments are processed by the provider shown in the booking or pre-check-in flow. We use ChargeAutomation, Inc., 20 John St., Toronto, Ontario M5V 0G5, Canada, for digital pre-check-in, guest data, information relevant to city-tax documentation and, where used, identity checks. Data may include identity, contact, booking, stay, invoice, payment and document data. Legal bases are Article 6(1)(b), (c) and (f) GDPR. Transfers to Canada or technical sub-processors may occur under applicable transfer safeguards.
9. Legal guest registration and retention
Where legally required, we process registration data for foreign guests and information needed for city tax. Electronic accommodation registration data is generally retained for one year after departure and deleted within the following three months. Tax and accounting records are retained for the statutory six-, eight- or ten-year periods depending on the document.
10. Recipients and international transfers
Recipients may include STRATO, Smoobu, ChargeAutomation, payment providers, booking platforms, accounting and tax advisers, IT providers, legal advisers and authorities. Where processing takes place outside the EEA, adequacy decisions, the EU-US Data Privacy Framework, Standard Contractual Clauses and supplementary safeguards may be used.
11. Your rights
Subject to legal requirements, you have rights of access, rectification, erasure, restriction, portability and objection. Consent can be withdrawn for the future. You may complain to a data protection authority, in particular the authority in Baden-Württemberg.
12. Security and updates
We use appropriate technical and organisational safeguards. Nine Rooms does not use solely automated decisions producing legal or similarly significant effects. This policy is updated when services, processing or legal requirements change.