Astoria Apartments · Lorenz Apartments · Brunnen Apartments
Privacy Notice for Guests
Version: 16 October 2026
1. Controller and Data Protection Officer
1.1
The controller responsible for processing your personal data within the meaning of the General Data Protection Regulation (GDPR) is
Bright Sight GmbH, Virchowstraße 17a, 90409 Nürnberg, Germany, commercial register Amtsgericht Nürnberg HRB 36664 (referred to below as "we"). For data protection enquiries you can reach us at datenschutz@bright-sight.com.
1.2
This notice applies to the properties Astoria Apartments (Weidenkellerstraße 4, 90443 Nürnberg), Lorenz Apartments (Pfannenschmiedsgasse 4, 90402 Nürnberg) and Brunnen Apartments (Brunnengasse 47 and 42, 90402 Nürnberg).
1.3
You can reach our Data Protection Officer, Daniel Schneiderbanger, at datenschutz@bright-sight.com or by post at the address above, marked "Data Protection Officer, personal".
1.4
This notice describes how we process data in connection with a booking and a stay. When you visit our websites, the privacy policy published there applies in addition.
2. Booking and Performance of the Stay
2.1
When you book with us, we process your contact and address details, details of the stay (dates, number of persons and, where relevant for occupancy or price, their age), the services booked and payment details, for business bookings also the company name and billing address, as well as optional details such as your preferred language and special requests.
2.2
The legal basis is Article 6(1)(b) GDPR, because the processing is necessary to perform the contract and to take steps prior to entering into it.
2.3
If you give us further details, for instance preferences regarding the apartment, we process them in order to meet your request (Article 6(1)(b) GDPR). Details about your health, such as an allergy, we process only in order to take them into account during your stay, on the basis of your explicit consent (Article 6(1)(a) and Article 9(2)(a) GDPR), which you may withdraw at any time with effect for the future. We remove such details from the booking at the latest when you depart.
2.4
Mandatory details are marked when you book. Without them we cannot conclude or perform the contract, and without the details listed in section 6 we cannot comply with the statutory registration requirement. All other details are optional.
3. Bookings Through Platforms and Bookings Made by Others
3.1
If you book through a platform such as Booking.com, Airbnb or Expedia, we do not collect your data ourselves but receive it from that platform. What is transmitted is usually your name, the dates of stay, the service booked, the number of persons, the country, an e-mail address (often a forwarding address assigned by the platform) and, depending on the platform, a telephone number.
3.2
We process this data in order to perform the accommodation contract concluded with you. The legal basis is Article 6(1)(b) GDPR; for persons who are not themselves a party to the contract, section 3.4 applies.
3.3
The platforms process data under their own responsibility. Our processing of the booking data transmitted to us and of our communication with you is governed by this notice.
3.4
If someone else books for you, for instance your employer or a travel organiser, we receive from them the details about you, your contact details and your stay that are needed to accommodate you. Where you are not yourself a party to the contract, the legal basis is Article 6(1)(f) GDPR; our legitimate interest is organising and providing the accommodation booked for you. Data required by registration law is processed separately under section 6. If you register further persons, please inform them of this privacy notice.
4. Payment Processing
4.1
We use payment service providers for payments, for storing card details and for refunds.
4.2
We process the method of payment, the amount, the time, the booking reference, the result of the authorisation and card details in tokenised or truncated form. Please do not send us card details by e-mail. If we nevertheless receive card details by a route other than the payment system, we use them only to record the payment concerned and then delete them from our correspondence.
4.3
The legal basis is Article 6(1)(b) GDPR for processing the payment, Article 6(1)(c) GDPR for the statutory retention of accounting records, and Article 6(1)(f) GDPR for protecting against non-payment and for pursuing claims under the accommodation contract.
4.4
The payment service providers process some data under their own responsibility, for instance to meet their own regulatory obligations and to prevent fraud.
5. Arrival, Check-in and Access
5.1
Before your arrival we send arrival information and access details to the contact details you have provided, by e-mail or text message. For this we process your name, contact details, dates of stay and the apartment assigned to you. The legal basis is Article 6(1)(b) GDPR.
5.2
Access is provided through an electronic locking system with time-limited access rights. The system processes the assignment of the access right to an apartment and a period, as well as opening events with the time and the access medium used. These entries can be linked to a stay through the booking data. We analyse opening events only on a specific occasion, to resolve a fault or to investigate a specific incident; no ongoing analysis takes place. The legal basis is Article 6(1)(b) GDPR for the access right and Article 6(1)(f) GDPR for logging and analysis on a specific occasion; our legitimate interest is the security of our properties and the investigation of incidents.
5.3
You complete check-in yourself, either before arrival or on site. In doing so you add your details and can separately consent to receiving advertising by e-mail. That consent is optional and can be withdrawn at any time; we keep a record of it as evidence (Article 7(1) GDPR). The legal basis for check-in is Article 6(1)(b) GDPR; registration data is covered by section 6; the legal basis for the advertising consent is Article 6(1)(a) GDPR.
5.4
The check-in form is protected against automated access by Google reCAPTCHA (provider: Google Ireland Limited). This transmits technical details about your device and your use of the form to Google, including to the United States (section 12). The legal basis is Article 6(1)(f) GDPR; our legitimate interest is protecting the form against automated attacks and abusive entries.
6. Registration Requirement Under the German Federal Registration Act
6.1
The special registration requirement for accommodation providers under Sections 29 and 30 of the German Federal Registration Act (Bundesmeldegesetz) applies to guests who do not hold German nationality. For German nationals it was abolished with effect from 1 January 2025.
6.2
For guests subject to the requirement we process the details prescribed by law: the date of arrival and of expected departure, family name and first names, date of birth, nationalities, address, the serial number of the passport or passport substitute, and the signature or its legally permitted electronic substitute; for accompanying persons, their number and nationalities. The statutory simplifications for families and travel groups apply. You provide these details yourself during check-in. We do not make a copy of your identity document.
6.3
The legal basis is Article 6(1)(c) GDPR in conjunction with the provisions named above. Providing this data is required by law.
6.4
Only authorised persons have access to registration data. We make it available to the competent authorities in accordance with the statutory provisions.
7. Communication During and After Your Stay
7.1
We process your correspondence with us, whether by e-mail, through a booking platform, by telephone or by message, in order to deal with your request. The legal basis is Article 6(1)(b) GDPR for enquiries relating to a contract or prior to one, and otherwise Article 6(1)(f) GDPR, based on our legitimate interest in answering enquiries and keeping a record of the matter.
7.2
If we ask you for a review by e-mail after your stay, we do so only with your consent or under the conditions of Section 7(3) of the German Act Against Unfair Competition (UWG), on the basis of Article 6(1)(f) GDPR; our legitimate interest is improving what we offer. You may object to this at any time, at no cost other than the transmission costs at base rates.
7.3
For further advertising by e-mail, such as a newsletter, we process your data only with your consent under Article 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future, for example using the unsubscribe link in every message.
8. Invoices, Accounting and Tax
8.1
We issue invoices and process the data they contain in our accounting. We use service providers for this; our tax advisors are responsible for their own processing.
8.2
The legal basis is Article 6(1)(b) GDPR for billing the service and Article 6(1)(c) GDPR in conjunction with the retention obligations under commercial and tax law (Section 147 of the German Fiscal Code, Section 257 of the German Commercial Code).
9. Video Surveillance
9.1
Video surveillance is in operation in entrance areas, stairwells and corridors of our properties where indicated by signs on site. The entrances to apartments may also be captured. The apartments themselves are not monitored.
9.2
The purpose is to protect people and property and to prevent and investigate criminal offences and damage to property. The legal basis is Article 6(1)(f) GDPR; our legitimate interest lies in these purposes.
9.3
Recordings are automatically deleted after 48 hours. A recording is kept for longer only where it is needed in an individual case to investigate a specific incident or to establish, exercise or defend legal claims. In that case the relevant sequence is secured separately and deleted as soon as the purpose no longer applies.
9.4
Only authorised persons have access to the recordings. They are disclosed only to law enforcement authorities and, where necessary to pursue legal claims, to insurers, lawyers and courts.
10. Wi-Fi
10.1
We provide Wi-Fi at our properties. Technical connection data is processed in doing so, in particular the device identifier (MAC address) and the time and duration of the connection.
10.2
The purpose is to provide and operate the network, to detect and resolve faults and to prevent misuse. The legal basis is Article 6(1)(b) GDPR for providing the network and Article 6(1)(f) GDPR for its operation and security.
11. Recipients of Your Data
11.1
We disclose data to the following categories of recipient:
a)
Service providers processing on our behalf (Article 28 GDPR), for instance for booking and distribution, communication, payment, access, IT and hosting.
b)
Payment service providers and credit institutions, for the processing of payments.
c)
Tax advisors and auditors, within the scope of their statutory duties.
d)
Public authorities, where we are legally obliged or entitled to provide information, in particular under the registration requirement.
e)
Lawyers, courts, insurers and debt collection providers, where this is necessary to establish or defend legal claims.
f)
Booking platforms, where the booking was made through them and communication runs through their system.
11.2
This notice names the categories of recipient. On request we will tell you the specific companies behind them (Article 15(1)(c) GDPR).
12. Processing Outside the European Union
12.1
Some service providers are based outside the European Economic Area or use sub-processors there, in particular in the United States.
12.2
We base such transfers on an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework for certified recipients, or on the European Commission's standard contractual clauses (Article 46(2)(c) GDPR). You can obtain a copy of the relevant safeguards on request.
13. Retention Periods
13.1
We store personal data only for as long as it is needed for the relevant purpose or as long as we are legally required to retain it. After that it is deleted or anonymised. The following periods apply:
| Data | Period |
|---|---|
| Booking and stay data, as far as needed to secure claims | 3 years from the end of the year in which the stay ended |
| Invoices and other accounting vouchers | 8 years (Section 147 AO, Section 257 HGB) |
| Business correspondence subject to statutory retention | 6 years (Section 147 AO, Section 257 HGB) |
| Accounting books and annual financial statements | 10 years (Section 147 AO, Section 257 HGB) |
| Registration forms | 1 year from the day of departure, then destroyed within 3 months (Section 30(4) BMG) |
| Health-related details | until departure |
| Video recordings | 48 hours, then automatically deleted |
| Other guest correspondence | 3 years from receipt or dispatch of the message |
| Consent to advertising | until withdrawn; the record of consent and withdrawal for 3 years thereafter |
13.2
Unless the table states otherwise, each period starts at the end of the calendar year designated by law. To secure claims after the contract has ended (standard limitation period under Sections 195 and 199 of the German Civil Code) we keep only the data needed for that; the legal basis is Article 6(1)(f) GDPR, based on our legitimate interest in pursuing and defending claims. Where data is subject to a longer statutory retention obligation, it is blocked for all other purposes and held solely to meet that obligation.
14. Your Rights
14.1
You have the right of access to the data we hold about you (Article 15 GDPR), to have inaccurate data corrected (Article 16 GDPR), to erasure (Article 17 GDPR), to restriction of processing (Article 18 GDPR) and to data portability (Article 20 GDPR).
14.2
Right to object: You have the right, on grounds relating to your particular situation, to object at any time to processing that we base on Article 6(1)(f) GDPR (Article 21(1) GDPR). We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or unless the processing serves to establish, exercise or defend legal claims.
14.3
Objection to direct marketing: You may object at any time, without giving reasons, to the processing of your data for direct marketing purposes (Article 21(2) GDPR). We will then no longer use your data for that purpose.
14.4
Where you have consented to processing, you may withdraw your consent at any time with effect for the future (Article 7(3) GDPR). This does not affect the lawfulness of processing carried out before the withdrawal.
14.5
A message to the contact details given in section 1 is sufficient to exercise your rights. We respond within the statutory time limits, as a rule within one month. Where there are reasonable doubts about your identity, we may request additional information to confirm it.
15. Right to Lodge a Complaint
15.1
Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR), in particular in the Member State of your residence, place of work or the place of the alleged infringement.
15.2
The authority responsible for us is the Bavarian Data Protection Authority, Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, Germany.
16. No Automated Decision-Making, and Changes to This Notice
16.1
Automated decision-making, including profiling, within the meaning of Article 22 GDPR does not take place.
16.2
If we intend to process your data for a purpose other than the one for which it was collected, we will inform you of that new purpose, together with the further information required by law, before that processing begins. Otherwise we update this notice when our processing or the legal requirements change. The version available on our websites applies. The current version date is shown above.