Privacy Policy
This policy describes what happens to the information you send us through this website.
Controller
LEGAL COMPANY NAME, ADDRESS, München. Contact: concierge@munichkey.com.
What we collect from the enquiry form
Name, email address, phone number and, where you provide them, country, travel dates, group size, the services you are interested in, an indicative budget and any free text you write. Nothing else is collected, and no field is required beyond name, email and phone.
Legal basis: Art. 6(1)(b) GDPR — steps taken at your request prior to entering into a contract.
Server logs
Our hosting provider records the usual technical data — IP address, timestamp, requested page, browser and referrer — for security and abuse prevention. Legal basis: Art. 6(1)(f) GDPR. Your IP address is also used, in memory only, to limit repeated form submissions.
Processors
Supabase — database hosting for enquiries. Region: SUPABASE REGION, e.g. eu-central-1. Data processing agreement: DPA REFERENCE.
Resend — delivery of the notification email that reaches us when you submit an enquiry. Data processing agreement: DPA REFERENCE.
HOSTING PROVIDER, e.g. Vercel — website hosting and delivery.
Where a processor is based outside the EU, transfers are covered by the EU Standard Contractual Clauses. CONFIRM PER PROVIDER
Fonts and third-party content
Typefaces are served from our own servers. This site makes no requests to Google Fonts or any other font CDN, so no data is transmitted to those providers when you visit.
Cookies and analytics
This site sets no cookies and loads no analytics scripts. If web analytics are introduced, they will load only after you have actively consented, and this section will be updated first.
The WhatsApp buttons are ordinary links. Nothing is transmitted to WhatsApp until you tap one and send a message, at which point WhatsApp’s own privacy policy applies to that conversation.
Retention
Enquiries that do not lead to a booking are deleted after RETENTION PERIOD, e.g. 12 months. Where a contract results, statutory commercial and tax retention periods of six and ten years apply (§ 257 HGB, § 147 AO).
Your rights
You may request access, rectification, erasure, restriction of processing and data portability, and you may object to processing based on legitimate interests. Write to concierge@munichkey.com and we will answer within one month.
You may also complain to a supervisory authority — for Munich, the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA).
Review status
DRAFT — must be reviewed by a German data-protection lawyer before launch, and updated whenever a processor is added