Privacy policy

SALT Consulting, Esther Penelope Sieper, Kurt-Schumacher-Str. 3, 57271 Hilchenbach, Germany. Phone +49 152 25714194, email penelope@consulting-salt.com.

This policy explains which personal data is processed on this website and for our services, for what purpose, on which legal basis and for how long. For data protection questions, contact us at the email address above.

• No analytics or tracking tools and no advertising cookies.
• No cookies and no browser storage set by this website.
• No external fonts: fonts are loaded from our own server.
• Our emails to clients load no external fonts either; they use the fonts available on your device.
• No embedded third-party content such as maps, videos or social media plugins.

Links to other providers (for example to a payment page) are plain links: data only reaches that provider once you open the link. Their privacy policy applies there.

The website is delivered through Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). When you visit, Cloudflare processes technically necessary data: your IP address, the requested address, time, browser and device details. This is needed to deliver the pages and to protect them against attacks and abuse.

The legal basis is our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). Cloudflare also processes data in the USA; Cloudflare is certified under the EU-U.S. Data Privacy Framework and names the EU standard contractual clauses as an additional basis.

Our own application writes no form content, names or email addresses to logs, at most technical identifiers such as a reference number.

If you use the contact form, we process what you enter: name and email address (required), optionally property/project, website, location, topic, dates and your message. We use it to answer your enquiry and, where relevant, to prepare a proposal.

The legal basis is Art. 6(1)(b) GDPR where your enquiry aims at a contract, otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).

The website does not store the message. It is sent as an email through the email service Brevo to our mailbox, which is hosted on Microsoft 365 (Microsoft Ireland Operations Ltd., Ireland). The same applies when you email us directly.

To protect against spam we use a field invisible to people, a minimum time for filling in the form and a check of where the request comes from. No third-party services or captchas are used for this.

We delete enquiries once they are dealt with and no contract results. Correspondence relating to contracts is kept as long as commercial and tax law requires (usually six years for business letters, § 147 AO, § 257 HGB).

If you subscribe to the newsletter, we process your email address to send it to you. You are only subscribed with your explicit consent (Art. 6(1)(a) GDPR) and by double opt-in: you receive an email and are only subscribed once you confirm the link in it. Subscription and confirmation are logged so we can prove consent.

Sending and managing the subscriber list is done through Brevo. You can withdraw consent at any time via the unsubscribe link in every email or by emailing us. This does not affect the lawfulness of processing before withdrawal. After unsubscribing, your address is no longer used for the newsletter.

For payment we forward you to a payment page hosted by Stripe. There you enter your email address, billing address, payment details, optionally a VAT ID, as well as your hotel's name and your name as contact person. Payment details such as card numbers are processed only by Stripe; we do not receive them.

From Stripe we receive what we need for the order: hotel name, contact person, email address, billing name, amounts, payment status and Stripe identifiers. We store them as an order in our database at Cloudflare, together with your confirmation of the business booking and the accepted version of our terms with its time, and email you (via Brevo) the link to the questionnaire.

The legal bases are performing the contract (Art. 6(1)(b) GDPR) and statutory retention obligations (Art. 6(1)(c) GDPR). Accounting records are generally kept for eight years under § 147 AO and § 257 HGB.

Stripe (Stripe Technology Company Limited and Stripe Payments Europe Limited, Ireland) also processes payment data under its own responsibility, for example for fraud prevention and its own legal obligations. Data may be transferred to Stripe, LLC in the USA; Stripe relies on the EU-U.S. Data Privacy Framework. Details: stripe.com/privacy.

Through your personal link you fill in the questionnaire: details on your hotel, website, platform profiles, test booking (booking link, dates, cancellation terms), your concerns and, where applicable, the texts of your pre-arrival email templates. We do not need real guest data; please do not enter any.

The answers are stored in our database at Cloudflare and sent to us by email; you receive a confirmation of receipt (both via Brevo). We use them only to carry out the Online Audit (Art. 6(1)(b) GDPR). The personal link contains no customer data; only an irreversible check value is stored.

We only pass data to service providers we use for the purposes described, and to bodies entitled to it by law (for example tax authorities or our tax adviser).

• Cloudflare (hosting, database): USA, EU-U.S. Data Privacy Framework.
• Brevo (email sending, newsletter): provider based in the EU.
• Microsoft 365 (our mailbox): Microsoft Ireland Operations Ltd., Ireland.

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)). Just write to us at the address above.

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.

Providing your data is voluntary. Without the details marked as required, however, we cannot answer an enquiry or carry out an order. No automated decision-making takes place.