Privacy Policy

Last updated: 5 October 2026

This is a translation for convenience. In case of any discrepancy, the German version shall prevail.

1. Data Controller

The controllers responsible for the processing of personal data in connection with this website are:

Andreas Wolf and Verena Wolf
Lilo-Hermann-Weg 3
74523 Schwäbisch Hall
Germany

Telephone: +49 151 52415666
Email: hello@magicalcapevibes.com

You may use these contact details for any questions regarding data protection and to exercise the rights described in section 2.

2. Your rights as a data subject

Access. You may at any time request, free of charge, information about which data we process about you, where it originates, to whom it may have been disclosed, and for what purpose.

Rectification. If data stored by us is inaccurate or incomplete, you may request that it be rectified.

Erasure. You may request the erasure of your data, provided that no statutory retention obligation applies, for example under commercial or tax law. In that case, erasure will take place once the relevant retention period has expired.

Restriction of processing. Under certain conditions, you may request that we restrict the processing of your data, in particular where you contest its accuracy, where you consider the processing to have been unlawful, where you require the data to establish your own legal claims even though the original purpose no longer applies, or for as long as an objection you have lodged has not yet been decided.

Objection. Where processing is based on our legitimate interests (Art. 6(1)(f) of the General Data Protection Regulation (EU) 2016/679, "GDPR"), you may object at any time on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

Withdrawal of consent. Where processing is based on your consent, you may withdraw that consent at any time with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected.

Data portability. You may receive data that we process by automated means on the basis of your consent or for the performance of a contract in a commonly used, machine-readable format, or, where technically feasible, have it transmitted directly to another controller.

Complaint to a supervisory authority. Irrespective of the rights set out above, you have the right to lodge a complaint with the data protection supervisory authority competent for you, for example in the place of your habitual residence, your place of work or the place of the alleged infringement.

3. Overview of legal bases

The processing operations described below are each based, as individually specified, on one or more of the following legal bases: the performance of a contract with you or pre-contractual measures (Art. 6(1)(b) GDPR); our legitimate interest in the secure and functional operation of this website and in straightforward booking processing (Art. 6(1)(f) GDPR); your consent (Art. 6(1)(a) GDPR, where applicable in conjunction with Section 25(1) TDDDG (German Telecommunications Digital Services Data Protection Act, Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz), insofar as access to your terminal device is concerned); or compliance with a legal obligation (Art. 6(1)(c) GDPR). You may withdraw any consent given at any time with effect for the future.

4. Provision of the website

Hosting. This website is hosted by an external service provider:

Netlify, Inc.
101 2nd Street
San Francisco, CA 94105
USA

Each time the website is accessed, technical information transmitted by your browser is collected automatically: browser type and version, the operating system used, the previously visited page (referrer URL), the host name of the accessing computer, the time of the server request and your IP address. These so-called server log data are not combined with other data sources. The legal basis is our legitimate interest in the technically error-free and secure provision of the website (Art. 6(1)(f) GDPR) and the performance of the hosting contract (Art. 6(1)(b) GDPR). We have concluded a data processing agreement with Netlify pursuant to Art. 28 GDPR. As Netlify, Inc. is based in the USA, this involves a transfer of data to a third country. Netlify is certified under the EU-US Data Privacy Framework (DPF); the transfer is therefore based on the adequacy decision of the European Commission (Art. 45 GDPR). In addition, the European Commission's Standard Contractual Clauses have been agreed in the data processing agreement (Art. 46(2)(c) GDPR). Further information: https://www.netlify.com/gdpr-ccpa/

Encryption. This website uses SSL/TLS encryption, recognisable by "https://" in the address bar and by the padlock symbol in your browser. All data you transmit to us via the website, including payment data in the context of a booking, is thereby protected against access by third parties.

Cookies. This website may use cookies, small text files that are stored on your terminal device and remain there either for the duration of your session or permanently. We use technically necessary cookies, without which individual functions of the website would not work properly, on the basis of our legitimate interest in functional operation (Art. 6(1)(f) GDPR). Should any further cookies be used, for example for analytics or marketing purposes, this will take place exclusively on the basis of your prior consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can configure your browser so that cookies are set only with your consent or not at all; this may limit the functionality of the website.

At present, only the following technically necessary cookies are set, namely by the Smoobu booking module embedded in our website (booking.smoobu.com):

These cookies are strictly necessary for secure booking and payment (Section 25(2) no. 2 TDDDG, Art. 6(1)(b) and (f) GDPR). We do not use cookies for analytics or marketing purposes.

5. Contacting us

Contact form and enquiries by email and telephone. If you contact us via a contact form, by email or by telephone, we process the information you provide, in particular your name, contact details and the content of your enquiry, in order to handle it and to clarify any follow-up questions. The legal basis is Art. 6(1)(b) GDPR insofar as your enquiry concerns a booking or its initiation, and otherwise our legitimate interest in the orderly handling of incoming enquiries (Art. 6(1)(f) GDPR). This data is erased as soon as the purpose of the respective enquiry no longer applies and no statutory retention obligations prevent erasure.

WhatsApp. For communication regarding your stay, in particular to arrange check-in, we use the messaging service WhatsApp. The provider is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The actual message content is end-to-end encrypted and therefore cannot be viewed by WhatsApp or other third parties; however, WhatsApp does have access to metadata of the communication, such as sender, recipient and time. According to its own statements, WhatsApp also shares personal data with its US-based parent company, Meta. The legal basis is our legitimate interest in being quickly and easily reachable for our guests (Art. 6(1)(f) GDPR). For the associated transfer of data to the USA, the company states that it relies on certification under the EU-US Data Privacy Framework; further details on this and on data processing by WhatsApp can be found in its privacy policy at https://www.whatsapp.com/legal/#privacy-policy. The content of communications exchanged remains with us until you request its erasure, withdraw any consent given, or the purpose of storage no longer applies; statutory retention periods remain unaffected.

6. Fonts and map display

Fonts. The fonts used on this website are hosted locally on our own server. No connection to servers operated by Google or any other third party is established when a page is accessed.

Google Maps. For directions, we link to Google Maps, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. On our website, we show the location of the apartment only as an image stored on our own server; no connection to Google is established when the page is accessed. Only when you click on the image or the "Open in Google Maps" link will you be redirected to Google Maps. From that point on, Google processes your data, in particular your IP address, under its own responsibility and generally also on servers in the USA. According to its own statements, Google bases the transfer of data to the USA on the European Commission's Standard Contractual Clauses and on certification under the EU-US Data Privacy Framework. Details can be found at https://privacy.google.com/businesses/gdprcontrollerterms/ and in Google's privacy policy at https://policies.google.com/privacy?hl=en-GB.

7. Booking processing and payments

If you wish to book the apartment via this website, we and the service providers named below process the data required for this purpose, in particular your name, your contact details, the requested arrival and departure dates, the number of guests and your payment data. The legal basis is the performance of the accommodation contract concluded or being initiated with you (Art. 6(1)(b) GDPR). This data is erased once the booking has been completed and any statutory retention periods, in particular under tax and commercial law, have expired.

Smoobu. The booking form on this website is technically provided by Smoobu. The provider is Smoobu GmbH, Dircksenstraße 45, 10178 Berlin, Germany. As soon as the booking form is accessed, an iFrame is loaded from Smoobu's servers, whereby technical data such as your IP address is transmitted to Smoobu. In the further booking process, Smoobu processes the data you enter in order to process the booking technically and forward it to us. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in processing bookings directly without an intermediary platform (Art. 6(1)(f) GDPR). Further information can be found in Smoobu's privacy policy at https://www.smoobu.com/en/privacy-policy/.

Stripe. Credit card payments in connection with a booking are processed by the payment service provider Stripe. The provider for customers within the EU is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Your payment data, such as name, payment amount and card details, is processed directly by Stripe for the purpose of payment processing. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and our interest in a smooth and secure payment process (Art. 6(1)(f) GDPR). According to its own statements, Stripe bases any transfer of data to the USA on the European Commission's Standard Contractual Clauses. Details can be found in Stripe's privacy policy at https://stripe.com/privacy and at https://stripe.com/de/guides/general-data-protection-regulation.

Swikly. We use the service provider Swikly for the security deposit required for a booking. The provider is Swikly SAS, 92 Cours Lafayette, 69003 Lyon, France. Through a technical interface between Smoobu and Swikly, Swikly receives the booking data required for the deposit, in particular your name, email address and arrival and departure dates. On this basis, Smoobu automatically sends you a message asking you to secure a deposit of EUR 100 via Swikly; the amount is merely held on your card and not charged immediately. The legal basis is the performance of the accommodation contract (Art. 6(1)(b) GDPR). Swikly processes your data as our processor and on our instructions; the obligations under Art. 28 GDPR are set out in Swikly's terms of use. Where Swikly uses sub-processors outside the EU for individual services, Swikly states that such transfers are protected by appropriate safeguards under Art. 46 GDPR. Further information can be found in Swikly's privacy notice.

Registration with the residential complex security service. The apartment is located in the Disa Park residential complex in Cape Town, South Africa. The trustees of the Disa Park Body Corporate (the owners' association of the complex) only grant guests of short-term rentals access through the entrance gate if the host has registered them with the security service prior to arrival. Before your arrival, we will therefore send you the link to an online form (Google Forms) provided and managed by the Disa Park Trustees. You complete this form yourself. It requests the apartment number, arrival and departure dates, number of persons, name of the lead guest, ID or passport number of the lead guest, and confirmation that the lead guest has been informed of the house rules of the complex.

Your information goes directly to the Disa Park Trustees, not to us. The Trustees process it under their own responsibility for the purposes of access control and security of the complex and are themselves the controllers for this processing. They are based in South Africa, a country for which there is no adequacy decision of the European Commission; in addition, Google, as the provider of the form service, may also process data in the USA. Information on how your data is handled can be obtained directly from the Disa Park Trustees. Our involvement is limited to sending you the link; the legal basis for this is the performance of the accommodation contract (Art. 6(1)(b) GDPR), as access to the residential complex, and therefore to the apartment, is not possible without this registration.

8. Overview of storage periods

Unless a more specific period is stated in this privacy policy, we store personal data only for as long as the respective processing purpose requires. Once the purpose no longer applies, the data is erased unless a statutory retention obligation applies, for example under commercial or tax law; in that case, erasure takes place once the relevant period has expired.