Imprint, General Terms and Conditions, and Privacy Policy

Data privacy is a matter of trust, and your trust matters to Interhome. It is therefore important to us that your personal data is protected and that its collection, processing and use in relation to Interhome's services in our app and on our website interhome.co.uk complies with the law. In this Policy, we want to tell you about how we collect and use data, in order to give you an overview of how your personal data will be used.

1. Overview

This privacy policy provides information about the nature and scope of the processing of personal data by Interhome in accordance with the GDPR. Personal data are any pieces of information that relate to an identified or identifiable person, such as name or email address.

As a rule, we only store personal data for as long as is necessary to fulfill the purposes for which we collected the data. Thereafter, we delete the data in accordance with the implemented retention and deletion policy, observing legal retention periods, unless we need to retain the data until the expiry of the statutory limitation period for civil law claims or due to legal storage obligations. In specific individual cases, storage may also occur for a longer period if there is another legal basis under data protection law for the continued processing of the data.

We are obliged to retain personal data based on statutory documentation requirements, including those stipulated in the German Commercial Code (retention of business documents), the German Fiscal Code (accounting and financial reporting), the Money Laundering Act, or other tax law requirements (DAC7). The retention periods stipulated there for documents in separate and protected areas are up to ten years.

2. Name and contact details of the controller and the data protection officer

This privacy policy applies to the data processing carried out by HHD AG (Interhome), Sägereistrasse 20, 8152 Glattbrugg, Switzerland (the controller, hereinafter referred to as “Interhome”), reachable at [email protected], and to the following website and application: www.interhome.de.

The data protection officer of Interhome can be contacted at [email protected] or [email protected].

3. Purposes of data processing, legal bases, and legitimate interests pursued by Interhome or a third party, as well as categories of recipients

3.1 Accessing our website/application

3.1.1 Provision of data, mandatory information

To use our services, it is necessary to provide certain data. The scope of these mandatory details depends on the specific service requested and is either legally required or necessary for potential contract conclusions with us or third parties on the portal. The fields marked with an asterisk (*) or a note indicating they are mandatory must be completed; otherwise, we will not be able to provide the service or offer you have requested.

3.1.2 External hosting

This website and the databases used for data processing are hosted by external service providers (hereinafter “hosting providers”). In the processing activities described below, personal data is transmitted to the hosting providers, stored on their data centers ("servers"), and processed on our behalf. This may particularly involve:

• IP addresses,

• contact requests,

• metadata and communication data about devices used,

• search queries,

• contract data (e.g. bookings, booking requests),

• transaction data,

• names, possibly pseudonymized identification numbers,

• website visits and pages accessed, and

• other data generated via a website.

The use of hosting providers is for the purpose of fulfilling contracts with our potential and existing customers (Art. 6(1)(b) GDPR) and in the interest of a secure, fast, and efficient provision of our online services by a professional provider (Art. 6(1)(f) GDPR).

Our hosting providers will only process data to the extent necessary to fulfill their service obligations and will follow our instructions regarding this data. To ensure GDPR-compliant processing, we have concluded a data processing agreement with our hosting providers. These providers process data either exclusively within the European Economic Area or in third countries under the strict conditions applicable to international data transfers.

3.1.3 Content Delivery Network

This website uses a content delivery network (CDN), which provides protective functions for the website (such as a web application firewall). The data transfer between the browser and the hosted servers flows through the CDN infrastructure and is analyzed there in order to prevent attacks, deliver content, and implement further security measures.

The following data, among others, may be processed in the process:

• the accessed webpage,

• browser type used,

• operating system,

• referrer URL,

• IP address,

• requesting internet service provider.

We process this data on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR. The use of a CDN is in our interest in ensuring the secure use of our online presence and in preventing harmful external attacks. We have concluded a data processing agreement with our CDN provider.

3.1.4 Log files

When our website/application is accessed, the browser on the end device automatically sends information to our server and temporarily stores it in a so-called log file. We have no influence over this process.

The following information is collected and stored automatically without your intervention until it is automatically deleted:

• the IP address of the requesting internet-enabled device,

• the date and time of access,

• the name and URL of the file accessed,

• the website/application from which the access was made (referrer URL),

• the browser used and, if applicable, the operating system of the internet-enabled device as well as the name of the access provider,

• the device used (e.g. desktop or smartphone),

• the language of your browser.

The legal basis for processing the IP address is Article 6(1)(f) GDPR. Our legitimate interest results from the purposes of data collection listed below. We would like to note that the data collected does not allow us to directly infer your identity, nor do we attempt to do so.

The IP address and the other data listed above are used by us for the following purposes:

• to ensure a smooth connection to the website,

• to ensure convenient use of our website/application,

• to analyze system security and stability.

The data is deleted as soon as it is no longer required for the purpose for which it was collected. In the case of data collected to provide the website, this is the case when the respective session has ended. If the data is stored in log files, it is limited to the strictly necessary extent. Data is not stored beyond that. In such cases, the users’ IP addresses are deleted so that assigning them to the accessing user is no longer possible.

3.2 Creating and using a user account for bookings, booking inquiries, vouchers for bookings, and participation in sweepstakes

3.2.1 Creating a user account

If you create a user account with us, we process personal data, specifically:

• when logging in via a social media login account (see below), the email address and the information transmitted from the relevant social media profile (if applicable, name, profile picture, link to the account and top-level domain, gender, and additionally age range, language, country, and other public information),

• when logging in via email, the email address used.

For technical reasons, a user account is also created when the email address is entered during a booking or booking inquiry on our website or when subscribing to our newsletter.

Within the user account, the following data can also be stored:

• First and last name,

• (optional) salutation and gender,

• (optional) date of birth,

• place of residence / address,

• contact details (telephone),

• previous bookings (including travel dates, number of guests, booking number, partner/provider).

In the case of direct bookings, name, address, and booking information are stored under the "Bookings" section of the user account for invoicing and tax calculation purposes, if applicable and necessary.

Additionally, settings regarding language and currency preferences, as well as newsletter consent, can be managed in the user account.

Each time you log in, technical information about the device and browser used, as well as details about your search queries, is stored. This serves to improve the user experience on the website and enhance our overall service offering.

The legal basis for processing the provided data is Article 6(1)(b) and (f) GDPR, based on the contractual relationship for using the website services. Furthermore, our legitimate interest arises from the protection of user identity and the prevention of fraudulent activity pursuant to Article 6(1)(f) GDPR.

We delete collected data in accordance with legal retention and archiving requirements after the termination of the usage agreement with us. You may terminate this agreement and request the deletion of all data stored in your account at any time by sending a message via email, using the contact form, or directly via the account settings in the app, provided there are no conflicting legal obligations.

3.2.2 Bookings and booking inquiries as well as payment processing

For booking inquiries, we collect the following data:

• the requested arrival and departure dates;
  
  

• first and last names; if applicable, also of accompanying guests;
  
  

• email address;
  
  

• (optional) message related to the booking;
  
  

• postal address;
  
  

• telephone number;
  
  

• (optional) selected extras;
  
  

• payment method.
  
  

The collection of the aforementioned data and its transfer to the providers is a pre-contractual measure necessary for concluding a contract (Art. 6(1)(b) GDPR).

Interhome works with property owners and local keyholders (see our General Terms and Conditions for details). When booking an accommodation through the portal, we collect and use the provided personal data to process payments and, where necessary for contract fulfillment, to forward the data to our partners.

In the case of direct bookings, payment processing is carried out by Interhome. In this context, we collect the payment information provided during the booking process and process all required data (name, payment details such as credit card/bank transfer data, billing address, cookie information, or other relevant information) necessary for a secure and valid transaction, fraud detection, risk assessment, or the selected payment method. The reverse applies in the case of cancellations where a full or partial refund is issued — the refund amount is returned to the original payment method.

The legal basis for processing payment data for all processes related to payment handling and asserting claims for contract initiation and fulfillment is Art. 6(1)(b) GDPR. The legal basis for activities related to tax audits and the preparation of annual financial statements is Art. 6(1)(c) GDPR.

By selecting one of the available payment methods (e.g. credit card, invoice), you agree to the use of the respective payment service, the outsourcing of such a service, and the associated transmission and processing of your data. We share payment data with our house bank and use the following payment service providers and payment methods:

• PayPal, a service of PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. Further information about processed personal data can be found at:
  https://www.paypal.com/de/webapps/mpp/ua/privacy-full?locale.x=de_DE
  
  

• Services of Mastercard Europe SA, Chaussée de Tervuren 198A, B-1410 Waterloo, Belgium. Further information is available at:
  https://www.mastercard.de/de-de/datenschutz.html
  
  

• Services of Visa Europe Management Services Limited, German Branch, Neue Mainzer Strasse 66–68, 60311 Frankfurt, Germany. Further information is available at:
  https://www.visa.de/legal/privacy-policy.html
  
  

• In some countries, Interhome uses the services of regional providers. Contact details for these providers, including their data protection officers (if applicable), and additional privacy information can be found on their respective information pages.
  
  

No further transfer of data to third parties takes place unless we are legally obliged to do so or the transfer serves law enforcement purposes.

For certain selected payment methods, a risk assessment is conducted by the payment providers using the entered data before the transaction is processed, in order to prevent fraud or payment defaults. You will also be notified accordingly.

The legal basis for activities related to any risk assessment by the payment provider or the choice of payment method is Art. 6(1)(f) GDPR. Our legitimate interest is based on our business interest in providing direct booking services and in avoiding payment defaults, while protecting your personal data through a data processing agreement with the payment provider.

3.2.3 Use and redemption of an Interhome voucher

When redeeming an Interhome voucher, the following data is collected and processed:

• First and last name;

• postal address;

• email address;

• contact details of authorized third parties;

• booking number;

• (optional) bank details (e.g. IBAN and BIC) — if required.

We process the data exclusively for the handling, reconciliation, and (if applicable) disbursement of the voucher value, provided all redemption requirements under the respective voucher terms are met. The data is stored in accordance with statutory retention periods.

The legal basis is Art. 6(1)(b) GDPR.

3.2.4 Sweepstakes and special offers

In connection with sweepstakes and other promotional campaigns via our website, applications, campaign pages, or social media channels, we store the data of all participants in accordance with the applicable terms and conditions of participation. In the event of a potential win, we may contact participants.

In sweepstakes, the personal data (salutation, name, address, title, telephone numbers, email addresses) of the winners may be transmitted to the respective sweepstake and cooperation partners. This is done on the basis of contractual fulfillment (Art. 6(1)(b) GDPR).

Participation in sweepstakes, including the associated data transmission, is voluntary.

3.3 Data processing for additional services

3.3.1 Insurance brokerage

In the case of a direct booking, an insurance benefit is already included, and additional insurance packages offered can also be selected via a certified partner. Interhome cooperates for the purpose of insurance brokerage with:

Helvetia Swiss Insurance Company Ltd,
Dufourstrasse 40, CH-9001 St. Gallen, Switzerland.

Responsible for this insurance: Europäische Reiseversicherung (referred to as “ERV” in the GTC), a branch of Helvetia Swiss Insurance Company Ltd, based at St. Alban-Anlage 56, P.O. Box, CH-4002 Basel, Switzerland.

We store the data solely for the brokerage and processing of the insurance contract, and only for the duration of the insurer's contractual obligations toward the beneficiaries.

The legal basis is Art. 6(1)(b) GDPR.

Further details regarding data processing by ERV / Helvetia can be found at:
https://www.helvetia.com/de/web/de/ueber-uns/service/datenschutz.html

3.3.2 WeatherPromise

We integrate services provided by WeatherPromise (Germany) GmbH, located at Tieckstraße 2, 10115 Berlin (“WeatherPromise”). WeatherPromise offers the possibility of protecting a trip by automatically generating a personalized weather guarantee for the booked trip, based on weather data from leading and independent global providers.

WeatherPromise and Interhome act as independent controllers when processing data for the purpose of contract initiation. Interhome is responsible for processing data related to brokerage and, if applicable, payment processing. WeatherPromise is responsible for the execution of the offered insurance service.

Further information can be found in the WeatherPromise privacy policy:
https://www.weatherpromise.com/de/privacy/

3.4 Social logins (login via Facebook, Apple, or Google) and email communication

In addition to the option of creating a user account via email, social media logins offer a service that allows you to log in to our portal and websites using your social media login profile.

The use of this data serves the purpose of identification, setting up the user account, and checking the entered data for plausibility. The connection can be removed at any time in the settings of your social media profile. Of the transmitted data, we use and store the following information until it is automatically deleted after the contract for using our portal is terminated:

• the email address used on the social media channel,

• the profile name (first and last name),

• the profile and background image used,

• age range (e.g. over 18, over 21),

• a link to the social media account,

• gender,

• the top-level domain of the logged-in account,

• the time zone of the account,

• if applicable, the top-level domain of the logged-in Google account,

• if applicable, the user domain maintained by the channel (hosted domain, HD).

The legal basis for using this data is Art. 6(1)(b) GDPR. The use serves to fulfill our contractual obligations arising from our Terms of Use (Art. 6(1)(b) GDPR). If you have expressly given consent to the social media platform, the legal basis is Art. 6(1)(a) GDPR, and your personal data will be transmitted to us as part of registration. If providers are based outside the EU, it cannot be ruled out that the data will also be transferred to the United States as part of an international data transfer.

3.4.1 Facebook Connect

This service is provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Facebook,” “Meta”). When logging in via Facebook Connect, a direct connection to Facebook's servers (1601 South California Avenue, Palo Alto, CA 94304, USA) is established. Facebook becomes aware that the login credentials are being used on Interhome.

The purpose and scope of data collection and the further processing and use of the data by Meta, as well as related rights and privacy settings, can be found in Facebook’s privacy policy:
https://www.facebook.com/privacy/policy

3.4.2 Sign in with Google

When logging in via Google by selecting “Sign in with Google,” a direct connection to the servers of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”) is established. Google is informed that these login credentials were used with Interhome. We do not receive Google account information.

Google will inform you whether and which data from your Google account will be made available to us. For registration and use of Google, Google's terms and privacy policies apply:

https://policies.google.com/privacy

https://business.safety.google/privacy/

3.4.3 Apple Sign-in

When logging in via Apple Sign-in, a direct connection to the servers of Apple Distribution International Limited, Hollyhill Industrial Estate, Hollyhill, Cork, Ireland (“Apple”) is established. Apple becomes aware that the login credentials are being used.

Depending on the settings in your Apple profile, certain data may be hidden, and Apple may send us an email address generated by Apple.

Further information about Apple’s data processing can be found here:
https://www.apple.com/legal/privacy/data/en/sign-in-with-apple/

3.4.4 Email service

We use the SendGrid service from Twilio / SendGrid, Inc., 1801 California Street, Suite 500, Denver, Colorado 80202, USA ("SendGrid") to send relevant emails (e.g. booking and inquiry confirmations, notifications). For this purpose, your email address and your name (to personalize the email) are processed.

A data processing agreement exists with Twilio / SendGrid under the conditions applicable to international data transfers.

The legal basis for this processing is contract execution under Art. 6(1)(b) GDPR.

Further information can be found in the privacy policy of SendGrid:

https://sendgrid.com/policies/privacy

3.5 Data processing for advertising purposes

To send promotional messages via email, push notifications (if applicable), surveys, review requests, feedback, and other company-related information (“newsletters”), we use the provider Braze, Inc., 330 West 34th Street, 18th Floor, New York, NY 10001, USA (“Braze”).

Additionally, data on the use of these notifications (such as open rates, click rates, or display duration) is collected and stored.

For the purpose of sending emails, the following data is processed:

• Email address,

• Device data related to the device used (primarily for push notifications via app, if applicable),

• Name (for personalizing the email),

• and, for the creation of groups and related campaigns, transactional data regarding bookings and booking inquiries.

The legal basis for sending newsletters is your consent pursuant to Art. 6(1)(a) GDPR.

The legal basis for evaluating and analyzing the newsletter is Art. 6(1)(f) GDPR, as we have a legitimate interest in improving and tailoring our service offerings. We have entered into a data processing agreement with the service provider and comply with the requirements for international data transfers.

More information can be found in Braze’s privacy policy:
https://www.braze.com/company/legal/privacy

3.5.1 Newsletter delivery

On our website, we offer the opportunity to sign up for our newsletter. To ensure that no errors occur during the input of the email address, we use the so-called double opt-in procedure. After entering your email address into the registration field, we will send a confirmation link to that address. Your email address will only be added to our mailing list once the confirmation link has been clicked.

You may revoke your consent at any time with effect for the future. This can be done by clicking the unsubscribe link at the end of the newsletter, changing the settings in your user account, or sending a message to the controller by email or through the contact form. The legality of any data processing that occurred prior to the revocation remains unaffected.

3.5.2 Product recommendations

After completing a booking or submitting a booking inquiry, and having collected your email address for the purpose of initiating or performing a contract, we may use this email address for the purpose of maintaining our customer relationship by sending direct advertising for similar goods or services (“product recommendations”).

These product recommendations are sent regardless of whether you have subscribed to a newsletter. Our intention is to provide you with relevant information about our services based on your previous transactions and searches.

If you no longer wish to receive product recommendations from us, you can let us know at any time. Our contact details are listed in Section 2. Naturally, each email also contains an unsubscribe link.

3.5.3 Interest-based advertising

We categorize user profiles based on information from completed search queries so that we only send information that is likely to be of interest. Based on this information, we tailor our newsletter content and promotional emails.

The goal is to provide interest-based advertising that is aligned with actual user needs and to avoid sending irrelevant content.

The legal basis for the above-mentioned processing is Art. 6(1)(f) GDPR. The processing of existing customer data for advertising purposes is considered a legitimate interest.

3.5.4 Disclosure to third parties

To display interest-based advertising—and provided that you have given your consent—we may share email addresses in hashed (pseudonymized) form with social media platforms (such as Google and Facebook). We have signed corresponding data protection agreements with both Google and Facebook.

The legal basis for sharing hashed email addresses with social media platform operators is Art. 6(1)(a) GDPR. This consent may be withdrawn at any time with effect for the future, using the contact methods mentioned above.

3.5.5 Review requests for accommodations, satisfaction surveys

When you book via Interhome, we send a follow-up email after your departure that includes a link allowing you to submit a review of the vacation rental you booked.

The review, which includes a 1-to-5 rating scale (with 5 being the best possible score) and an optional written comment, may be published on our website alongside the relevant accommodation listin

4. “Cookies” and other tracking technologies – General information

On our websites and applications, we use cookies, pixels, web beacons, or similar technologies on the basis of Art. 6(1)(a), (b), and (f) GDPR.

Cookies are small files that are automatically created by the browser and stored on the device when our website is visited or our application is used. Pixels and web beacons are small graphics and code fragments that serve to measure activities on our website. Hereinafter, we refer to pixels, web beacons, and similar technologies collectively as “cookies.”

Cookies do not cause any damage to your device, nor do they contain viruses, Trojans, or other malware. The cookie stores information that arises in connection with the specific device used. However, this does not mean that we gain direct knowledge of your identity.

When our website or application is accessed, a notice appears regarding our use of cookies.

Some cookies help us provide users with the best possible and functional service and ensure a secure experience on our website and in our application (“functional cookies”). Functional cookies are technically necessary and essential for the uninterrupted and risk-minimized operation of our services, as they ensure security, user experience, and settings (e.g. for making a booking, creating a user account, storing preferred searches).

As they are essential for the operation and functionality of our website and application, the processing of data through functional cookies is based on Art. 6(1)(f) GDPR and, for the performance of our usage contracts (Terms of Use), on Art. 6(1)(b) GDPR.

We use so-called session cookies to recognize that you have already visited specific pages on our website or logged into your user account. These are automatically deleted when you leave our website.

In addition, we also use temporary cookies for the purpose of fulfilling our usage contracts. These are stored on your device for a specified period. If you revisit our website to use our services, the cookie automatically recognizes that you have previously visited and what entries and settings you made, so we can provide our services accordingly.

If you have a user account and are logged in or activate the “stay logged in” function, the information stored in cookies will also be saved to your user account.

We also use analytical cookies, based on Art. 6(1)(a) GDPR, to statistically evaluate the use of our website and optimize our offering, as well as marketing cookies to show you personalized information and tailored content. These cookies are only set after you have given your express consent.

Consent can be revoked at any time. The legality of the data processing performed based on the consent prior to its withdrawal remains unaffected. You may revoke your consent at any time by adjusting your cookie settings.

You can also configure your browser to prevent cookies from being stored on your device or to notify you whenever a new cookie is being set. However, disabling cookies entirely may result in some parts of our website or app not functioning properly.

The storage period of cookies depends on their purpose and therefore varies. In all cases, cookies are automatically deleted after a specified period.

You can find more detailed information about the analytical and marketing cookies we use in the sections below.

4.1 Analytical cookies and tools

For the purpose of demand-oriented design and ongoing optimization of our websites and app, we use cookies and tools that allow us to analyze the usage of our website and app, provided you have given your consent in accordance with Art. 6(1)(a) GDPR.

4.1.1 Google Analytics

We use Google Analytics, a web analytics service provided by Google. In this process, pseudonymized user profiles are created and cookies are used. The information generated by the cookie about your use of the website, such as:

• browser type/version,
  
  

• operating system used,
  
  

• referrer URL (the previously visited page),
  
  

• hostname of the accessing computer (IP address),
  
  

• time of the server request,
  
  

is transmitted to a Google server in the USA and stored there. Google complies with the privacy standards of the EU-U.S. Data Privacy Framework of the U.S. Department of Commerce.

We have also concluded a data processing agreement with Google for the use of Google Analytics. Under this agreement, Google assures us that the data will be processed in accordance with the GDPR and that the rights of data subjects will be protected.

The information is used to evaluate the use of the website, compile reports on website activity, and provide other services related to website and internet usage for purposes of market research and the tailored design of our website. This information may also be transferred to third parties where required by law or where such third parties process the data on our behalf.

Under no circumstances will the IP address be merged with other Google data. The IP addresses are anonymized so that identification is not possible (this is known as IP masking).

You can prevent cookies from being installed by adjusting the settings in your browser software. However, we would like to point out that in this case, not all features of our website may be fully functional.

You can also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address), and the processing of this data by Google, by downloading and installing the following browser add-on:
https://tools.google.com/dlpage/gaoptout?hl=de

As an alternative to the browser add-on, especially for mobile browsers, you can prevent Google Analytics from collecting your data by clicking a specific opt-out link. This will set an opt-out cookie that prevents future data collection when visiting this website. The opt-out cookie applies only to this browser, only for our website, and is stored on your device. If you delete the cookie in this browser, you must set the opt-out cookie again.

Further information on data protection in connection with Google Analytics can be found at:
https://support.google.com/analytics/answer/6004245?hl=de
https://business.safety.google/privacy/

4.1.2 Google Tag Manager

We use Google Tag Manager, a service from Google that allows website tags to be managed via an interface. Only tags are implemented; no cookies are set and no personal data is collected. The Tag Manager triggers other tags that may collect data, but Google Tag Manager does not access this data.

If deactivation is carried out at the domain or cookie level, it will remain in effect for all tracking tags implemented with Google Tag Manager.

For more information, see Google’s usage policy for Tag Manager:
https://www.google.com/intl/de/tagmanager/use-policy.html

4.1.3 New Relic

To monitor the availability and performance of our servers, we use the web analytics service New Relic, provided by New Relic Inc., 188 Spear Street, Suite 1200, San Francisco, CA 94105, USA.

Using pseudonymized usage data, technical performance metrics (such as response and load times) are measured and analyzed to improve our server performance.

Further information can be found in New Relic’s privacy policy:
https://newrelic.com/privacy/

4.1.4 Snowplow

We use the open-source web analytics service Snowplow, provided by Snowplow Analytics Limited, 32–38 Scrutton Street, London EC2A 4RQ, United Kingdom. Cookies are used for this purpose. The information generated by the cookie about your use of the website includes:

• browser type/version,

• operating system used,

• referrer URL (the previously visited page),

• hostname of the accessing computer (IP address),

• time of the server request,

• search queries and filter settings,

• clicks on the website.

This data is transmitted to and stored on a server operated by Interhome in Frankfurt, Germany.

The information is used to evaluate the use of the website, compile reports on website activity, and provide other services related to website and internet usage for market research and tailored design purposes.

4.1.5 TrackJS

We use the services of TrackJS LLC. TrackJS enables the analysis of technical errors in JavaScript, allowing us to check and improve the quality of our website and app.

Further information can be found in TrackJS’s privacy policy:
https://trackjs.com/privacy/

4.1.6 Matomo

We also use the open-source web analytics service Matomo (formerly Piwik), provided by InnoCraft Ltd., 150 Willis St, 6011 Wellington, New Zealand (“Matomo”). Cookies are used, which allow an analysis of the use of our website.

Pseudonymized usage profiles may be created and evaluated from this data. The information generated by the cookie, such as the browser used and the pseudonymized IP address, is processed on our own servers.

The information generated in the pseudonymized user profile is not used to personally identify anyone and is not merged with personal data.

Further information on Matomo’s privacy policy can be found at:
https://matomo.org/privacy-policy/

There you can also object to website tracking using the “opt-out” function.

4.2 Marketing cookies

The following marketing and targeting measures we use are based on your consent pursuant to Article 6(1)(a) GDPR.

Targeting serves the purpose of personalized advertising. The marketing and targeting measures we use are intended to ensure that the advertisements shown on your device are based on your personal interests.

4.2.1 DoubleClick

We use Google’s DoubleClick technology. This collects and evaluates information to optimize advertising content. Cookies are used for this purpose, which may record information such as which of our products you were interested in. This enables us to show personalized offers on third-party websites based on your previous behavior.

Data collection and evaluation take place exclusively in pseudonymized form. We do not merge this with any personal data. Cookies are automatically deleted after 30 days.

You can manage your ad settings via Google’s Ads Settings Manager:
https://adssettings.google.com/authenticated?hl=de
Further details:
https://www.google.com/policies/technologies/ads/
https://business.safety.google/privacy/

4.2.2 Google Ads (Conversion + Enhanced Conversions)

We use Google Ads and its conversion tracking feature to measure the success of our ads and optimize interactions. When you click on a Google ad, a cookie is set for 30 days, which allows us to determine if you returned to our offer page.

Each Google Ads customer receives a different cookie. If you are signed into a Google service, your visit can be associated with your account.

We also use Enhanced Conversions: hashed user data (e.g. email address, customer IDs) is shared with Google after a transaction to match it with existing Google accounts. We receive aggregated reports.

Legal basis: your consent under Art. 6(1)(a) GDPR; our legitimate interests in analytics, measuring reach, and optimizing advertising.

More info:
https://services.google.com/sitestats/de.html
https://business.safety.google/privacy/

4.2.3 Google Dynamic Remarketing

We use Google Dynamic Remarketing in combination with Google Ads and DoubleClick. It allows interest-based, cross-device advertising. If you gave consent to Google, your browsing behavior is linked to your Google account so you can be shown the same ads on multiple devices.

Google Analytics temporarily links authenticated Google user IDs with our Analytics data.

You can opt out of cross-device advertising here:
https://www.google.com/settings/ads/onweb/
Privacy info:
https://www.google.com/policies/technologies/ads/

4.2.4 Google AdSense

We use Google AdSense to show ads on our website. These may be interest-based. AdSense uses web beacons and cookies. Data (including your IP address) is transferred to Google servers in the USA.

Third-party providers may also receive data:
https://support.google.com/dfp_sb/answer/94149

Disable interest-based ads via:
http://www.google.de/ads/preferences

Privacy info:
https://www.google.com/policies/technologies/ads/

4.2.5 Google AdMob

We use Google AdMob to show ads in the Interhome app. It uses the Apple Advertising Identifier (Apple Ad-ID) to assign users to segments for targeted advertising. The Ad-ID is a pseudonym.

You can prevent this via iOS settings under “Privacy > Advertising” by enabling “Limit Ad Tracking” or resetting the Ad-ID.

4.2.6 AppsFlyer

Our app uses AppsFlyer Ltd., 14 Maskit St., Herzliya, Israel. It collects:

• IP address,
  
  

• device ID (including ad ID),
  
  

• (de-)installation data,
  
  

• HTTP headers (e.g. country, language, OS, app version),
  
  

• device and browser behavior.
  
  

Used for ad performance and fraud prevention.

Opt-out & privacy:
https://www.appsflyer.com/legal/privacy-policy

4.2.7 Criteo

We use Criteo SA, 32 Rue Blanche, 75009 Paris, France. Data is collected via pixels, which may include your IP address, referrer URL, browser, and cookies.

Criteo analyzes browsing behavior to show personalized ads. Data is pseudonymized and not used to identify you personally.

More info + opt-out:
https://www.criteo.com/de/privacy/
https://www.criteo.com/de/privacy/criteo-works-with-the-following-platforms/

4.2.8 Microsoft Advertising

We use Microsoft Advertising (Microsoft Corporation, USA). When you click on one of our ads, a cookie is set and a tag tracks time on site, page visits, and referral ad.

Data is stored in the US for up to 180 days.

More info:
https://help.ads.microsoft.com/#apex/3/de/53056/2
https://privacy.microsoft.com/de-de/privacystatement

4.2.9 Taboola

We use Taboola Inc., 28 West 23rd St., New York, USA. Taboola sets cookies to evaluate which content you use and recommends content accordingly.

Data is pseudonymized.
Opt-out:
https://www.taboola.com/privacy-policy

4.2.10 Facebook Custom Audiences

We use Facebook Custom Audiences. A JavaScript pixel collects non-personal data (e.g. IP address, browser, referrer). Facebook compares this data with its cookie to determine if the user is part of a target group.

You can opt out here:
https://www.facebook.com/ads/website_custom_audiences

Privacy info:
https://www.facebook.com/privacy/explanation

4.2.11 RTB House

We use RTB House S.A., Złota 61/101, Warsaw, Poland, for retargeting. Cookies track which content you viewed and display related recommendations on other websites.

More info:
https://www.rtbhouse.com/privacy/

4.2.12 Clicktripz

We use Clicktripz, 1112 Ocean Drive, CA 90266 Manhattan Beach, USA, to process user travel preferences and behavior for displaying travel offers.

Privacy info:
http://www.clicktripz.com/privacy_policy.php

4.2.13 Ad Up

We use Ad Up (Axel Springer Teaser Ad GmbH) for conversion tracking and ad performance. Cookies are used. Data is anonymized or pseudonymized.

Opt-out:
https://www.adup-tech.com/datenschutz/

5. Affiliate services

We use affiliate networks where publishers earn a commission if they refer users via affiliate links.

No tracking is performed on our website directly — cookies are set after redirection. We work with:

• Performance Horizon Group Ltd
  Privacy policy:
  http://performancehorizon.de/docs/Datenschutzrichtlinie.pdf
  
  

• CJ Affiliate (Commission Junction LLC)
  http://de.conversantmedia.eu/legal/datenschutzerklaerung
  
  

• TradeTracker Deutschland GmbH
  https://tradetracker.com/privacy-policy/
  
  

• AWIN AG
  https://www.awin.com/de/rechtliches/privacy-policy-DACH
  
  

AdCell / Firstlead GmbH
https://www.adcell.de/datenschutz

6. Online presence on social networks

We operate online profiles on platforms like Facebook and Instagram (Meta). These platforms may provide us with aggregated usage statistics, such as demographics and engagement data.

We use this data to improve our content. The legal basis is:

• Art. 6(1)(b) GDPR: to interact with customers and interested parties,

• Art. 6(1)(f) GDPR: our legitimate interest in effective communication and public presence.

Meta may use this data for its own purposes beyond our control.

Privacy info:
https://www.facebook.com/privacy/polic

7. Use of third-party plugins

7.1 Google Maps

Used for displaying interactive maps. IP addresses are transmitted to Google servers in the US.

Legal basis: Art. 6(1)(f) GDPR
Terms:https://www.google.com/intl/de_de/help/terms_maps.html
Privacy:https://policies.google.com/privacy

7.2 Google Fonts

Used to display fonts. Fonts are requested from Google servers in the USA.

Legal basis: Art. 6(1)(f) GDPR
More info:
https://policies.google.com/privacy
https://business.safety.google/

7.3 Use of Artificial Intelligence (AI)

We use modern AI technologies, including OpenAI, Google Vertex AI, and others, for:

• internal process optimization,
  
  

• enhanced user functions (e.g. chatbots),
  
  

• content support (e.g. summaries, code generation).
  
  

Personal data is only processed if absolutely necessary and never used to train models. Transfers to the U.S. are based on SCCs or the EU-U.S. DPF.

Legal basis: Art. 6(1)(f) GDPR.

8. Corporate Group

Interhome is a company of the HomeToGo Group, HomeToGo GmbH, Pappelallee 78/79, 10439 Berlin, Germany. We occasionally transfer personal data to affiliated companies within the HomeToGo Group. The HomeToGo Group includes all current and future companies that are directly or indirectly controlled by HomeToGo GmbH (“HomeToGo”) or are under common control with HomeToGo.

The transfer of data within the corporate group takes place for the following purposes:

a) Provision of our services and our other platforms
b) Provision of services within the scope of customer service
c) Sending advertising with consent or if otherwise permitted by applicable law
d) Analysis, optimization, and improvement of our website and application
e) Detection and investigation of fraud and illegal activities
f) Compliance (observance and adherence to legal obligations)

The legal basis for data sharing within the HomeToGo Group is Article 6(1)(a), (b), and (f) GDPR.

Specifically, the legal basis for purposes a) and b) is Article 6(1)(b) GDPR. The sharing of data enables us to fulfill our contractual obligations arising from our Terms of Use.

The legal basis for purpose c) is the explicit consent granted by you (Article 6(1)(a) GDPR), which you may withdraw at any time. Alternatively, it is our legitimate interest in conducting marketing for existing customers (Article 6(1)(f) GDPR). The lawfulness of the processing carried out prior to revocation remains unaffected.

For purposes d), e), and f), our legitimate interest arises from the improvement of our services, the protection of identity, and the prevention of fraudulent activities (Article 6(1)(f) GDPR).

9. Customer service inquiries via email, contact form, voicemail, and chat, as well as surveys and satisfaction analyses (feedback)

9.1

You can send us inquiries via email or the contact form on our website by providing your name, email address, and phone number (and, in the case of cancellations, also the booking number). Use of the contact form is voluntary; the processing of this data is carried out for the performance of our contractual service obligations (Art. 6(1)(b) GDPR).

Before responding to inquiries, we may require further information to verify identity, in order to protect personal data, if identification is not otherwise possible.

The inquiries and the information entered are transferred to our ticketing system. We use the services of Salesforce.com, Inc., Salesforce Tower, 415 Mission Street, San Francisco, CA 94105, USA (“Salesforce”) for this purpose. If you do not wish your data to be processed by Salesforce, you can contact our customer service directly at [email protected].

Further information can be found in Salesforce’s privacy policy:
https://www.salesforce.com/company/privacy/

9.2 Live Chat and Chatbot

We also offer a live chat for electronic communication.

When starting the live chat, a functional cookie is set in the browser and the following data is collected:

• First and last name

• Email address

• Browser type/version

• IP address

• Operating system used

• URL of the previously visited website

During the chat, you may also provide additional personal information, depending on the nature of your inquiry.

We process and store this data to enable and ensure the quality of the live chat functionality. The legal basis is Art. 6(1)(f) GDPR. The chat history is deleted no later than 12 months after the interaction.

Before you are connected with a human support agent, basic questions may be asked by the chatbot via a chat form and answered automatically using FAQs. These data are stored as part of the support ticket, as described above.

9.3 Feedback

We offer various options for submitting feedback, suggestions, or criticism regarding our website, products, or services. This can be done via dedicated feedback forms (e.g., pop-ups), by email, or through other input fields on our website.

Among other tools, we use the services of zenloop GmbH, part of SaaS.group, Attilastraße 18, 12529 Schönefeld, and headquartered at Pappelallee 78/79, 10437 Berlin. Zenloop allows us to collect and analyze user feedback through various channels.

Zenloop collects the following information:

• IP address

• Device and browser data

• The website from which the feedback tool was accessed

We have concluded a data processing agreement with Zenloop.

The purpose of processing the data you submit is to evaluate and use your feedback to improve our services and the quality of our offerings.

Depending on the feedback method, we may process the following data:

• Feedback content

• Contact information (email address and, where applicable, name) — if needed to respond or better categorize the feedback

• Technical data (e.g., date and time of submission, IP address) — to prevent misuse and ensure traceability

The legal basis for processing personal data for feedback handling is our legitimate interest (Art. 6(1)(f) GDPR), which lies in continuously improving our service quality and user experience. The processing serves internal analysis and optimization and typically does not override the rights and freedoms of data subjects, since the feedback is provided voluntarily.

Even without a separate and active declaration of consent (e.g., checkbox), submitting feedback via interactive web forms is voluntary and shall be considered consent once submitted. In this case, the explicit legal basis is Art. 6(1)(a) GDPR. You may withdraw this consent at any time with future effect.

10. Data transfers to third countries

As outlined in this privacy policy, we use systems and software from service providers who are either based outside the European Union or the European Economic Area (i.e., in so-called third countries such as the USA), or where it cannot be ruled out that data may be transferred from the EU to a third country.

In some cases, an adequacy decision by the European Commission exists for the respective country, confirming an adequate level of data protection (e.g. Canada, the USA under the EU-U.S. Data Privacy Framework).

In other cases, the level of data protection may not be equivalent to that in the EU. Where no adequacy decision exists (Art. 45 GDPR), we implement appropriate safeguards, such as the EU Standard Contractual Clauses (SCCs), as well as other contractual measures (where required), to ensure an adequate level of data protection for such transfers.

Where this is not possible, we rely on the exceptions outlined in Art. 49 GDPR, particularly your explicit consent.

If a data transfer to a third country is planned or cannot be ruled out and no adequacy decision or safeguards exist, it is possible — and there is a risk — that authorities in the third country (e.g. intelligence services) may access, collect, and analyze the transferred data. Additionally, enforcement of your rights may not be guaranteed. You are also informed of this when providing consent via the cookie banner.

11. Rights of the data subject

Requests to exercise your rights, along with our responses, are stored for documentation purposes for up to three years, and, in individual cases, for a longer period if required for the assertion, exercise, or defense of legal claims. Legal basis: Art. 6(1)(f) GDPR, based on our interest in defending against possible civil claims under Art. 82 GDPR, avoiding fines under Art. 83 GDPR, and fulfilling our accountability obligations under Art. 5(2) GDPR.

11.1 Overview

In addition to the right to withdraw any previously given consent, you are entitled — if the legal requirements are met — to the following rights under Articles 12–22 GDPR, particularly:

• Right of access to personal data stored by us (Art. 15 GDPR)

• Right to rectification of inaccurate or incomplete data (Art. 16 GDPR)

• Right to erasure of stored data (Art. 17 GDPR)

• Right to restriction of data processing (Art. 18 GDPR)

We also confirm that we do not carry out automated decision-making as defined in Art. 22 GDPR that would have legal effects on the data subject.

11.2 Right to object

Under the conditions of Art. 21(1) GDPR, you have the right to object to data processing on grounds relating to your particular situation.

This general right to object applies to all data processing activities described in this privacy policy that are based on Art. 6(1)(f) GDPR. Unlike the special right to object to direct marketing, we are only obligated to comply with this general objection if you provide compelling legitimate grounds (e.g., potential risk to life or health).

11.3 Supervisory authority

You may also contact the supervisory authority responsible for Interhome:

Federal Data Protection and Information Commissioner (EDÖB)
Feldeggweg 1, CH-3003 Bern, Switzerland
Phone: +41 58 462 43 95
Online contact form: www.edoeb.admin.ch

12. Changes to this Privacy Policy

We may occasionally update this privacy policy, for example, when we adapt our website/applications or services, or when legal, technical, or regulatory requirements change.

The current version is always available on our website and applies to all data processing activities from the time of publication.

Version – Effective from November 2025