Privacy Policy
As of September 23, 20261. Controller
The controller responsible for data processing on Banaki is Kogge Digitalagentur, owner Morris Mehnert, Memellandstraße 2, 24537 Neumünster, moin@kogge.digital, +49 4321 7574160. Further details are given in the Imprint.
2. What data we process and why
We process your data to enable bookings between guests and hosts, to keep the platform running, and to meet our legal obligations. The following sections list every service we use, together with its purpose, legal basis and retention period.
3. Account data and bookings
When you register, we collect your name, e-mail address and the information required for a booking. The legal basis is performance of the usage contract with Banaki (Article 6(1)(b) GDPR). Account data remains stored for as long as your account exists, and is deleted afterwards in accordance with the retention periods under commercial and tax law.
4. Payment processing via Stripe
For payment processing we use Stripe Payments Europe, Ltd. (Dublin, Ireland). Stripe processes your payment data to settle the booking and to make payouts to hosts (Stripe Connect Express). The legal basis is performance of the contract (Article 6(1)(b) GDPR). Stripe sets its own cookies for fraud prevention; see the Cookie Policy.
5. Google Analytics
If you consent, Google Analytics (Google Ireland Limited) measures the use of banaki.app, so we can understand which regions and offers are in demand. The legal basis is your consent (Article 6(1)(a) GDPR, Section 25 TDDDG). Without consent, the service does not load. The data is stored for 24 months, and you can withdraw your consent at any time via "Cookie settings" in the footer.
6. Google Maps
Maps on listings and in search results are only loaded if you consent or actively click "Load map". The provider is Google Ireland Limited. The legal basis is your consent (Article 6(1)(a) GDPR). Without consent, the map remains replaced by a placeholder.
7. Google Places (location search)
When you type in the location search, we send your input to the Google Places API to show you matching location suggestions. No cookie is set in the process. The legal basis is our legitimate interest in a functioning search (Article 6(1)(f) GDPR), together with your deliberate input. This transmission does not fall under Section 25 TDDDG, because nothing is stored on your device.
8. Google reCAPTCHA
The contact form is protected against automated abuse by Google reCAPTCHA (Google Ireland Limited). The service only loads once you expressly consent to it on the form. The legal basis is your consent (Article 6(1)(a) GDPR, Section 25 TDDDG).
9. Sign in with Google
You can sign in using your Google account. In doing so, Google Ireland Limited transmits your name and e-mail address to Banaki. The legal basis is performance of the contract (Article 6(1)(b) GDPR); the service is only activated if you use it.
10. Images via Cloudinary
We deliver images of accommodation via Cloudinary. In doing so, your IP address is transmitted to Cloudinary. The legal basis is our legitimate interest in fast image delivery (Article 6(1)(f) GDPR). A data processing agreement is in place with Cloudinary.
11. Error logging via Sentry
Errors on our server are logged via Sentry to help us fix disruptions. This runs exclusively server-side; no script is loaded in your browser. The legal basis is our legitimate interest in a functioning operation (Article 6(1)(f) GDPR).
12. Hosting
Banaki is hosted by Hetzner Online GmbH (Germany). The legal basis is our legitimate interest in stable operation (Article 6(1)(f) GDPR). A data processing agreement is in place with Hetzner.
13. E-mail delivery
We send system messages such as booking confirmations via emailit. The legal basis is performance of the contract (Article 6(1)(b) GDPR).
14. Messages between guest and host
Messages within a booking run through a direct connection to our server (Socket.io), without the involvement of third parties. The legal basis is performance of the contract (Article 6(1)(b) GDPR).
15. Availability and listing data via Campnerd
For hosts who also manage their accommodation through a channel manager, Banaki exchanges availability and listing data with Campnerd. The legal basis is performance of the contract with the host (Article 6(1)(b) GDPR).
16. Tax information for hosts (DAC7 / PStTG)
As a reporting platform operator, we collect from hosts their name, address, tax number or tax identification number, VAT ID, where applicable their commercial register number and date of birth, as well as, for each listing, the address and the number of rental days. The legal basis is compliance with a legal obligation (Article 6(1)(c) GDPR in conjunction with the Platform Tax Transparency Act). We report this data once a year to the Federal Central Tax Office and store it for ten years (Section 24 PStTG).
17. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interest (Articles 15 to 21 GDPR). You can withdraw any consent given at any time with effect for the future. To do so, contact moin@kogge.digital. You can also lodge a complaint with a data protection supervisory authority; the competent authority is the Unabhängige Landeszentrum für Datenschutz Schleswig-Holstein.
