Privacy policy

Last updated: 2 November 2026

1. Controller

Nova Wohnraum Oberfranken GmbH, Spiegel 53, 95326 Kulmbach, Germany. Phone +49 9221 3959949, e-mail datenschutz@novawohnraum.de.

This policy applies to novawohnraum.de, zanova.eu, heykairos.de and checkin.heykairos.de and to every booking, stay and contact with us.

2. What data we process and why

Booking and stay: name, address, contact details, travel, booking and payment data, your messages to us, access codes and door events, in order to handle your stay. Legal basis: Art. 6(1)(b) GDPR; for door events Art. 6(1)(f) GDPR (our interest in being able to investigate damage to the property). If you book through a platform such as Airbnb, Booking.com or Fewo-direkt, we receive this data from the platform.

Registration form: the details required by Section 30 of the German Federal Registration Act (BMG). Legal basis: Art. 6(1)(c) GDPR in conjunction with Sections 29 and 30 BMG. We process a photo of your ID document in the online check-in only with your consent (Art. 6(1)(a) GDPR).

Invoices and accounting: Art. 6(1)(c) GDPR (tax and commercial law obligations).

Review request: after your stay we may ask you for a review. Legal basis: Art. 6(1)(f) GDPR (our interest in feedback).

Owners of the flats we manage: contract, bank and statement data. Legal basis: Art. 6(1)(b) and (c) GDPR.

Enquiries and job applications: your contact details and the content of your message or application. Legal basis: Art. 6(1)(b) GDPR.

Visiting our websites: connection data such as IP address, browser and page accessed, for secure operation, spam protection of our forms and, on zanova.eu, audience measurement without cookies. Legal basis: Art. 6(1)(f) GDPR (secure operation and knowing how our pages are used). In the booking window on zanova.eu, which is provided by Smoobu, the payment service Stripe sets two cookies for fraud prevention (Section 25(2) no. 2 TDDDG).

Telephone and call notes: When you call us or we call you, the call runs through the telephone system of sipgate GmbH, Düsseldorf. It works for us as a processor (Art. 28 GDPR). For calls with our staff, an AI converts the call into text so that no request gets lost. The audio is stored only briefly for this purpose and then deleted; there is no permanent recording. From the text, sipgate creates a summary, answers to fixed questions and a task list, using AI models operated in the EU (Microsoft Azure in Ireland or Mistral AI in France). These models receive only the text, not the audio. We store the note together with the phone number, time and length of the call. It contains what was said in the call, such as name, request and dates; we do not store the wording of the call in our system (for storage at sipgate, see Section 5). A further AI reads the text only in working memory and gives us fixed details about the request, for example type of request, number of people, period and place. For this we use an AI model (Claude) through the Amazon Bedrock service of Amazon Web Services EMEA SARL, Luxembourg. Processing takes place in data centres in the EU; Amazon Web Services works for us as a processor. The AI does not make any decision about you. Legal basis: Art. 6(1)(b) GDPR where your enquiry or your contract is concerned, otherwise Art. 6(1)(f) GDPR (our interest in recording requests completely and not losing a call-back). If you do not want this, say so at the start of the call; we will then switch the AI off for that call.

AI telephone assistant: If nobody on our team answers a call, an AI telephone assistant from sipgate answers. At the start it says that it is an artificial intelligence, takes down your request and passes it on to our team; on request it hands over to a member of staff. We process your phone number, your name, your request and what you tell the assistant; audio is not stored, only text. If your phone number is stored with us, we pass your name and company to the assistant at the start of the call and, if you have a booking with us, the apartment and dates of your current or upcoming stay, so that it does not have to ask you again. We do not pass on prices, payment details, access codes, e-mail addresses or postal addresses. Legal basis: Art. 6(1)(b) GDPR for booking enquiries, otherwise Art. 6(1)(f) GDPR (our interest in being reachable and not losing a call-back).

When handling messages and documents we also use AI services, for example for translation.

Office assistant for our staff (“Pilot”) and AI-assisted sorting of incoming messages: Our staff use an AI assistant in our internal management system for office work. For example, it helps to prepare an offer, an invoice or a message with access information for your booking, to look up bookings, offers and invoice data, and to sort incoming messages by request and urgency.

A person decides. The assistant does not send anything on its own and does not change anything by itself. Anything that is sent to you or recorded in the system is first shown to a member of staff as a draft with the recipient and the full wording; it is carried out only once that member of staff confirms it.

If you write to us. Incoming e-mails and messages to our business mailboxes as well as WhatsApp and booking platform messages may be read by a separate AI evaluation step. It passes only fixed details to the assistant that plans the work (for example the request, date, apartment, number of people, language, urgency), not the wording. It does not read attachments. We process your name and contact details, insofar as you provide them, and the content of your message; the source is your message to us. Please do not send us health data or documents subject to professional secrecy.

Other data: the data we process anyway for your enquiry, booking, offer or invoice (name, company, e-mail address, booking and offer data, invoice recipient). The assistant does not receive access codes, account numbers or keys.

Who processes the data: The AI model (Claude by Anthropic) runs as a service of Amazon Web Services EMEA SARL (Luxembourg) in data centres in the European Union. Amazon Web Services acts as our processor (Art. 28 GDPR).

Legal basis: Art. 6(1)(b) GDPR insofar as your enquiry, booking, offer or invoice is concerned, otherwise Art. 6(1)(f) GDPR (our legitimate interest in fast and accurate handling). You can object at any time to processing based on legitimate interests (Art. 21 GDPR, see Section 6). Enquiries: datenschutz@novawohnraum.de.

Click identifier for Google ads

If you reach our website via an advertisement on Google, the page address contains a click identifier assigned by Google. If you then send us a booking request via the request form, this identifier is transmitted to us together with your request. Nothing is stored on your device for this purpose, and no script from Google is loaded. If the request leads to a booking, we transmit the identifier together with the date and value of the booking, but without your name and without your contact details, to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, so that we can see which advertisements lead to bookings. The processing is based on our legitimate interest in measuring the success of our advertising (Art. 6(1)(f) GDPR). You may object to this processing at any time; please contact the controller named above.

Measuring our Google ads (only with your consent)

On zanova.eu we ask you in a banner whether we may measure which of our Google ads lead to booking requests. Only if you agree does your browser load the Google tag (Google Ads conversion tracking) of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It stores cookies on your device, such as _gcl_au and _gcl_aw, for up to 90 days, and reports to Google when you send a booking request after clicking on one of our ads. Google receives your IP address, information about your browser and device, the page accessed and the click identifier, but not your name, your contact details or the content of your request. We do not use this measurement for personalised advertising. Google also processes the data in the USA; Google LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). The legal basis is your consent (Art. 6(1)(a) GDPR and Section 25(1) TDDDG). We store your choice in the banner in a cookie of our own (cc_cookie, six months) so that we do not have to ask again on every page (Section 25(2) no. 2 TDDDG). You can withdraw your consent at any time with effect for the future via “Cookie settings” in the website footer; Google's cookies are then deleted.

3. Recipients

We only pass on data where this is necessary for these purposes: to service providers for hosting, booking management and payments, e-mail and message delivery, locking systems, telephony, accounting, AI services, error analysis and office and team communication; to Google Ireland Limited, where you have consented to the measurement of our ads; to the booking platform you booked through; to our tax advisers; and to public authorities where required by law, such as the registration office and the tax office.

4. Transfers to third countries

Some service providers also process data in the USA. This is based on the European Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) or on standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR). You can obtain a copy of the standard contractual clauses on request.

5. Retention

We delete data as soon as we no longer need it for the relevant purpose and no statutory retention obligation applies. In particular: booking and invoice records and business letters for up to ten years (Section 147 AO, Section 257 HGB); registration forms one year after departure (Section 30(4) BMG); access codes and door events about six months (limitation period under Section 548 BGB); call notes 90 days after the call; call logs of the AI telephone assistant 30 days; job applications six months after the end of the procedure. At our processor sipgate, call transcripts, summaries and call data remain stored for as long as our contract with sipgate lasts. We delete the histories of work with the office assistant one year after the last activity. We delete approval records and logs after two years.

6. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)). You can lodge a complaint with a data protection supervisory authority (Art. 77); the authority responsible for us is the Bavarian Data Protection Authority (BayLDA) in Ansbach. Please write to us at datenschutz@novawohnraum.de.

Right to object (Art. 21 GDPR)

Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. You may object to a review request at any time without giving reasons.

7. Obligation to provide data

The registration details are required by law, and we need the booking data for the contract. Without them we cannot accommodate you.

8. Automated decisions

Our system decides some requests itself according to fixed rules, for example a later check-out or the release of your access details once your payment is confirmed; an AI may read a proof of payment you send us in the process. Anything the system cannot confirm is checked by a member of staff. You can ask for a member of staff to review such a decision and to express your point of view. The office assistant (Section 2) does not make any decision with legal effect for you; anything that takes effect outside our company requires confirmation by a member of staff.