Privacy Policy

You can read this whole index without giving us anything and without agreeing to anything, no account, no address, nothing. There are no advertising cookies, no tracking pixels, and no analytics company involved. Four things are optional and off until you choose them: measuring which pages are read, loading the map on a hotel page, the email selection, and an account that carries your shortlist between devices.

S Grade Hotels, sole proprietor Tim Schander

Spessartstraße 9, 53119 Bonn, Germany, info@sgradehotels.com

No data protection officer has been appointed. The thresholds of Art. 37 GDPR and § 38 BDSG are not met by a sole proprietorship of this size.

The site is delivered from Cloudflare's network. Delivering a page technically requires your IP address, and the hosting provider keeps short-lived operational logs to deliver the site and to defend against attacks (Art. 6 (1)(f) GDPR, legitimate interest). We do not run our own analysis over those logs and do not combine them with anything else.

The index is stored in a PostgreSQL database hosted in Frankfurt, Germany, run for us by our hosting provider. When you search or filter, the query runs on our server against that database. Search terms are not stored with your identity, see the measurement section below for the one case in which a term is recorded at all.

Two things on this site are put together by a language model: the paragraph headed “What the classifiers highlight” on a house’s page, which summarises the awards that house holds, and the amenity list beside it. Both are derived from the house’s own record, its name, its country, its awards and the description we hold , and neither states anything that is not in that record. Both say so where they appear: the paragraph carries a line naming its origin, and the amenity list says whether it was read from the house’s own website or classified by AI.

The model is Google Gemini, reached through the AI gateway of our hosting provider. Nothing about you is sent to it. Not your search terms, not your shortlist, not your email address, not your booking request, not your IP address. The request contains hotel data and nothing else. It is made by our server the first time a house’s page is opened, and the result is stored with the house, so it happens once and never again for that house.

Your booking requests are read and answered by a person. No decision about you is taken by automated means.

If you allow it, we record which pages are read and in what order within a single visit. This runs on our own servers and in our own database. No analytics provider is involved and nothing is shared.

What is recorded: the page path, the position within the visit, a coarse device class (mobile, tablet or desktop), the host of the page that referred you (for example "google.com", never the full address with your search query), and on a hotel page which house it was. Search terms are recorded only to find out what people look for and do not find; they are lower-cased and stored without any link to a person.

What is not recorded: your IP address, your browser's user-agent string, cookies, or any identifier that survives closing the tab. The only identifier is a random number held for the duration of one visit, in your tab's session storage. It is gone when the tab closes and cannot be joined to another visit, to another site, or to you.

Legal basis: your consent (Art. 6 (1)(a) GDPR). Kept for 400 days, then deleted.

Hotel pages can show a map. The tiles come from Esri (Environmental Systems Research Institute, Inc., United States), which receives your IP address when it draws them. Nothing is requested from Esri unless you allowed maps when you were asked. If you did not, no map is drawn and you are not asked again on the page, the address of the property is written out as text, which is the actual information. You can change your mind at any time from the footer of any page.

Legal basis: your consent (Art. 6 (1)(a) GDPR). The transfer to the United States takes place on the basis of the EU–US Data Privacy Framework and Esri's standard contractual clauses. We have no agreement with Esri and use a publicly available service; you should treat this as a transfer to a third country and switch maps off if you would rather it did not happen.

Pressing “Reserve” opens a request form on this site. What you enter there (email address, optional name, optional phone number, travel dates, number of guests, the houses you asked about and any note) is stored on our database provider (Supabase, acting as our processor under Art. 28 GDPR) and used for exactly one thing: answering that request with rates, availability and any benefits we can arrange. Legal basis: Art. 6 (1)(b) GDPR, steps taken at your request prior to entering into a contract. That is why there is no consent checkbox: this processing is what you asked for, not an extra.

Your address is not added to the newsletter and is not used for any other purpose. A confirmation and our reply are sent through an email provider acting as our processor. Requests are deleted once the stay is over or the request has clearly come to nothing, at the latest after twelve months.

Who else sees a request. Nothing leaves this site while you are only asking. Once you ask us to go ahead, the details needed for the reservation, your name, the dates, how many of you and any request you made of the room, are passed to two places: to the hotel itself, and to Fora Travel (United States), the host agency through whose accreditation the reservation is placed. Neither receives your data for their own advertising.

Where the hotel is outside the EU, that transfer rests on Art. 49 (1)(b) GDPR: it is necessary to perform the contract you asked for, since no house can hold a room for a guest it cannot name. The transfer to the host agency rests on the standard contractual clauses adopted by the European Commission. If you would rather we did not pass your details on, say so, the consequence is simply that we cannot make the booking.

A hotel page links to that hotel's own website, so you can look at rates and room types at the source. It is an ordinary link: it goes straight there, it carries no identifier, and it does not pass through a redirect on our domain. We do not learn that you followed it.

From the moment you arrive, that hotel's privacy policy applies, and your browser contacts their servers as it would after any other link. There are no booking-portal or affiliate links anywhere on this site.

If you sign up, we store your email address, the theme your sign-up is filed under ("Resort & Beach" or "City & Luxury"; the form does not ask at present, so every sign-up is filed under "City & Luxury"), the time you consented, and the exact wording you agreed to. The wording is stored because Art. 7 (1) GDPR requires us to be able to demonstrate consent.

Sign-up uses double opt-in: nothing is sent until you click the link in a confirmation email. If you never click it, the entry is deleted after 30 days. Every message carries an unsubscribe link, and using it deletes your address rather than merely flagging it. What remains is the fact and time of the unsubscribe, kept so we can show the request was honoured and so the address is not re-imported later.

Legal basis: your consent (Art. 6 (1)(a) GDPR). Confirmation email delivery is handled by an email provider acting as our processor under Art. 28 GDPR.

You can read this whole index, search it and keep a shortlist without an account. If you create one, it exists for a single purpose: so your shortlist follows you from one device to another.

What we store: your email address, an encrypted form of your password, the time the account was created and last used, and the short names of the houses you have kept. That is the whole record. No name, no postal address, no telephone number, no date of birth, no payment details, we do not ask for them and there is nowhere to put them.

Signing in through Google is optional and happens only if you press that button. Nothing from Google runs on these pages, so nothing reaches them while you read; the first contact is the moment you press it and your browser is sent to their sign-in page. Google then tells us your email address and that the sign-in succeeded. We receive nothing else and send them nothing about what you read here. Google's own privacy policy applies to what happens on their page.

Legal basis: Art. 6 (1)(b) GDPR, performance of the arrangement you enter into by creating the account. Kept until you ask us to delete it; write to the address above and the account goes, shortlist included. Creating an account does not sign you up for any email, that is a separate choice with its own consent.

Pressing the key on a house adds it to a shortlist. It holds the short names of the houses and the time you kept each one, nothing else.

Without an account that list is written to your own browser's storage and stays there. It is never sent to us, and we cannot see what anyone has kept. With an account a copy is kept in our database so the list follows you to another device, that is the only reason accounts exist here. Removing a house, or "Clear" on the shortlist page, deletes both copies.

Because the list exists only to provide something you asked for by pressing the key, it is covered by § 25 (2) no. 2 TDDDG and needs no consent, the same rule that lets a shop remember a basket. If measurement is switched on, the fact that a house was kept is counted; which houses you kept is not, because there is nothing tying that count to you or to your account.

If you never sign in, no cookie is set by this site at all; four items may be written to your browser's local or session storage instead. Signing in adds two cookies, both first-party and both set so that no script on the page can read them. The full list, with names and lifetimes, is on the storage page.

Fonts are served from this domain. Nothing is requested from Google Fonts, from a CDN, or from any other third party while you read a page.

You can change or withdraw any of the optional choices at any time, and withdrawing is as easy as giving consent (Art. 7 (3) GDPR). Withdrawal does not affect the lawfulness of what happened before it.

Open privacy choices

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21), and the right to lodge a complaint with a supervisory authority. For Bonn this is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen.

Write to the address above. Requests are handled by hand, there is no automated self-service portal, and we would rather say so than pretend otherwise. Please allow up to one month (Art. 12 (3) GDPR).

One honest limitation: measurement data has no identifier that could be traced back to you, so we cannot find "your" rows in it and therefore cannot export or delete them individually. That is a consequence of collecting as little as possible, not an evasion , the data is not personal data about an identifiable person in the first place. For your email address, which is personal data, access and erasure work normally.

The controls on this site are applied to everyone, regardless of where you are: the optional categories are off until switched on, no matter which country you visit from. This is stricter than several regimes require and is the same for all readers.

United States: we do not sell personal information and do not share it for cross-context behavioural advertising as those terms are defined under the CCPA/CPRA, so no "Do Not Sell or Share" mechanism is offered; there is nothing for it to switch off. California residents may exercise access and deletion rights through the contact address above. United Kingdom and Switzerland: the same rights apply under the UK GDPR and the revised Swiss FADP. Canada, Australia, Brazil, Japan: the rights under PIPEDA, the Privacy Act 1988, the LGPD and the APPI are honoured through the same contact route.

If the categories you are asked about change, the stored record of your choice becomes invalid and you will be asked again rather than carried over. The date at the top of this page shows when the text last changed.