Legal
Privacy Policy under the GDPR
1. Controller
The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:
Sylthotel Raffelhüschen GmbH & Co. KG
Boysenstraße 8
25980 Sylt/Westerland
Germany
Phone: +49 4651 83 62 10
Email: info@sylthotel-raffelhueschen.de
2. Data Protection Officer
We have appointed an external data protection officer. You can contact him at:
Stephan Wagner
LexGeneralis-Datenschutzconsulting
Gorch-Fock-Straße 11a
25980 Sylt
Germany
Email: stephan.wagner@lex-generalis.com
3. General information on data processing
Scope of processing
We process personal data of visitors to this website only to the extent necessary to provide a functioning website and our content and services, or where you have given your consent. We do not use any analytics or tracking services, advertising networks or social media plugins.
Legal bases
Where we obtain your consent, the legal basis is Art. 6(1)(a) GDPR. Where processing is necessary for the performance of a contract with you or for steps taken prior to entering into a contract, for example when you enquire about a room, the legal basis is Art. 6(1)(b) GDPR. Where we are subject to a legal obligation, for example retention obligations under commercial and tax law, the legal basis is Art. 6(1)(c) GDPR. Where processing is necessary for the purposes of our legitimate interests and your interests, fundamental rights and freedoms do not override them, the legal basis is Art. 6(1)(f) GDPR. The storing of information on your device and access to it are additionally governed by Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG).
Storage period
We delete personal data as soon as the purpose of storage no longer applies and no statutory retention obligations prevent deletion. Where such an obligation exists, we restrict processing until the retention period expires and delete the data afterwards.
4. Hosting and provision of the website
This website is operated by SteW-Internet Sylt UG (haftungsbeschränkt), Gorch-Fock-Straße 11a, 25980 Sylt, Germany. The servers are located in a data centre of Host Europe GmbH in Germany. A data processing agreement pursuant to Art. 28 GDPR is in place with the hosting provider.
Each time this website is accessed, the server automatically processes information transmitted by your browser and stores it in log files (server log files). This information is:
- IP address of the requesting device
- date and time of access
- page or file accessed
- amount of data transferred and status message
- website from which the access was made (referrer)
- browser and operating system used
This processing is necessary to deliver the website, to ensure its stability and security and to fend off attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in these purposes. The log data are not merged with other data sources and are deleted automatically once the storage period has expired, unless they are needed to investigate a specific security incident.
To deliver pages faster, the server keeps ready-made pages in a cache. This cache does not contain any personal data of visitors.
5. SSL/TLS encryption
For security reasons, this website uses SSL/TLS encryption. You can recognise an encrypted connection by the “https://” in your browser’s address bar and by the padlock symbol. When encryption is active, the data you transmit to us cannot be read by third parties.
6. Cookies and local storage
This website sets a single cookie. It is called “pll_language” and stores whether you are viewing the website in German or in English, so that the language you have chosen is shown the next time you open a page. The cookie is set on our own domain by the website’s language management, contains only the language code and is deleted automatically after one year. It is not passed on to third parties.
Storing this cookie is strictly necessary to display the website in the language you have requested. The legal basis is Section 25(2) No. 2 TDDDG and, for any processing of personal data, Art. 6(1)(f) GDPR. Our legitimate interest lies in a user-friendly, bilingual website.
In addition, WordPress places a technical entry in your browser’s session storage which records whether your browser can display emojis. This entry contains no personal data and is deleted when you close the browser window.
We do not use any other cookies, in particular none for analytics or advertising purposes. You can delete or block cookies in your browser settings at any time. The website remains usable, but your language choice will not be saved.
7. Contact by email or phone
If you contact us by email or phone, we process the information you provide, such as your name, contact details, preferred travel dates and your message, in order to answer your enquiry. The “Enquire now” buttons merely open your own email program; no data is transmitted via the website itself.
The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a booking or the performance of a contract, and otherwise Art. 6(1)(f) GDPR. Our legitimate interest lies in answering the enquiries addressed to us. We delete your enquiry once it has been dealt with in full and no statutory retention obligations apply.
8. OpenStreetMap map
On the “Contact” page you can display a map showing our location. The map is provided by the OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom.
The map is only loaded when you click “Load map”. Before that, there is no connection to OpenStreetMap. After the click, your browser connects to the servers of the OpenStreetMap Foundation. In the process, your IP address in particular, as well as information about your browser and the page accessed, is transmitted.
The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG, which you give by clicking. It applies only to the page view in question; on your next visit the map will only be loaded after you click again. The European Commission has adopted an adequacy decision pursuant to Art. 45 GDPR for the United Kingdom. Further information can be found in the privacy policy of the OpenStreetMap Foundation at https://osmfoundation.org/wiki/Privacy_Policy.
9. Weather display
The temperature and wind information in the header of the website is retrieved by our server from the weather service Open-Meteo and cached. Your browser does not connect to Open-Meteo, and none of your data is transmitted to the weather service.
10. Links to other websites
Our website contains links to other providers, for example to our reviews on Google. The guest reviews on our home page are stored as text; no connection to Google is made when the page is opened. Only when you click such a link do you leave our website, and the privacy provisions of the respective provider then apply.
11. Your rights
You have the following rights with regard to the personal data concerning you:
- right of access (Art. 15 GDPR)
- right to rectification (Art. 16 GDPR)
- right to erasure (Art. 17 GDPR)
- right to restriction of processing (Art. 18 GDPR)
- right to data portability (Art. 20 GDPR)
- right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR)
Right to object
Where processing is based on Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (Independent Centre for Privacy Protection Schleswig-Holstein), Holstenstraße 98, 24103 Kiel, Germany.
To exercise your rights, an informal message to the contact details above or to our data protection officer is sufficient.
12. Version
This privacy policy is dated September 2026. We will update it if the website or the legal requirements change. This is a translation of the German privacy policy; in case of any discrepancy, the German version shall prevail.