Privacy

This website is built so that simply visiting it produces as little data as possible. Fonts, images and the promotional film are delivered from our own server, and no marketing tools are used.

Two things come from other people's servers, and both only after an action on your part: audience measurement with Google Analytics, if you agree to it in the notice on your first visit (section 5), and the enquiry form on the “Booking enquiry” page, if you open that page deliberately (section 8). Without those actions, no connection is made to either provider and no cookie is set.

We only receive data from you if you fill in and send one of the two forms: the contact form (section 6) or the job application form (section 7). Neither stores anything on the server; both send your entries straight to us as an email.

The only exception is the internal administration area, through which staff maintain content such as the weekly programme. It is reachable only after signing in and is of no relevance to visitors of this website. Details in section (14).

This website runs on a server operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The server is located in Germany. We have a data processing agreement with Hetzner under Art. 28 GDPR; processing takes place solely on our instructions.

When the site is called up, your browser transmits technically necessary data which is logged on the server: the address requested, the date and time, the volume of data transferred, a message about whether the request succeeded, browser type and version, operating system, the referring page and the IP address.

This processing serves the secure and stable operation of the website and the defence against attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in providing and securing the service technically. The data is not combined with other sources and is not used to analyse your behaviour.

All typefaces, images and the promotional film are delivered from our own server. There is no connection to Google Fonts, to a video service such as YouTube or Vimeo, or to any other external provider, and no data is transmitted to third parties in the process.

The map section on our pages is likewise not an embedded map but an image with a link. Only when you click that link does Google Maps open in a new window, and Google's terms apply from that point on.

On the home page we show reviews from our Google business profile. These are retrieved exclusively by our server through the Google Places API and cached there for several hours. Our server makes the request under our own access key; it contains no data about you.

Your browser makes no connection to Google in the process. Neither your IP address nor any other data about you is transmitted to Google. The profile pictures belonging to the reviews are also fetched by our server and served by us, so that displaying them involves no request to Google.

Only content published by the authors themselves is shown: name, review text, star rating and, where present, the public profile picture. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in displaying publicly accessible guest reviews.

The interface is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google LLC in the USA; the basis for this is the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework. Since our requests contain no data about visitors to this website, none of your data is affected.

If you agreed on your first visit, we use Google Analytics 4 to understand which pages get read and where guests get stuck. Without your agreement the necessary script is not loaded, no connection to Google is made and no cookie is set.

The legal basis for storing and reading information on your device is your consent under § 25(1) TDDDG, and for the subsequent processing of your data, Art. 6(1)(a) GDPR. You give it voluntarily; without it you can use this website in full and without restriction.

You can withdraw your consent at any time with effect for the future. At the foot of every page you'll find “Cookie settings” for that purpose. On withdrawal we delete the cookies set by Google Analytics immediately, and the script is no longer loaded from the next page view onwards. The lawfulness of processing carried out up to that point is unaffected.

The following is processed: the pages called up and the time spent on them, the referring page, approximate location at city or region level, browser, operating system and device type, and a randomly generated identifier that recognises your device across several page views. That identifier sits in the cookies “_ga” and “_ga_2NLNQMT048” and is deleted after two years.

We have configured the measurement so that your IP address is truncated, and thereby anonymised, before it is stored. Advertising features, the linking with Google accounts (“Google signals”) and ad personalisation are expressly switched off. We do not combine the data with other sources and do not build profiles of individuals from it.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We have a data processing agreement with them under Art. 28 GDPR. Data may be transferred to Google LLC in the USA; the basis is the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework, to which Google has subscribed.

If you contact us by email or telephone, we process your details solely in order to deal with your enquiry and any follow-up questions. The legal basis is Art. 6(1)(b) GDPR where the enquiry serves the preparation or performance of a contract, and otherwise Art. 6(1)(f) GDPR.

There is also a form on the “Contact” page. We ask there for your name, your email address and your message; the telephone number is optional. What you enter goes to our server, is immediately put into an email to wallnau@strandcamping.de and is then discarded. No database and no archive is created on the server; your message subsequently exists only in our mailbox.

Sending requires you to confirm that your details may be used to deal with your enquiry. The legal basis is Art. 6(1)(a) GDPR in conjunction with (b) or (f) GDPR. You can withdraw your consent at any time with effect for the future; the lawfulness of processing carried out up to that point is unaffected. We do not use your details for advertising.

To protect against automated messages, the form contains a field that is invisible to you and is only filled in by machines, and it measures the time between the page being built and the form being sent. We also count, for at most fifteen minutes, how many messages arrive from one IP address, in order to prevent bulk sending. This counting happens purely in memory; the IP address is not stored for it and is not analysed. A service such as reCAPTCHA is not used.

For sending these emails we use a service provider for technical email delivery, which processes the messages and any attachments solely on our instructions and exclusively within the European Union. Open and click tracking are switched off. A data processing agreement under Art. 28 GDPR is in place.

Our mailbox itself is operated by our hosting provider, which likewise processes the messages solely on our instructions. A data processing agreement under Art. 28 GDPR is in place for this as well.

The application form on the jobs page works like the contact form under (6): your details go to our server, are immediately put into an email to wallnau@strandcamping.de and are then discarded. We ask for your first and last name, email address, the area you're interested in and your message; telephone number and availability dates are optional.

You can attach application documents such as a CV and references. Those files are at no point stored on our server: they are put into the email within the same request and then discarded. Afterwards they exist only in our mailbox.

The legal basis is § 26(1) BDSG in conjunction with Art. 88 GDPR and Art. 6(1)(b) GDPR. If an appointment follows, we keep your documents for the employment relationship. Otherwise we delete them no later than six months after the process ends, unless you have expressly agreed to a longer retention period.

The measures against automated messages described under (6) and the email delivery provider named there apply to this form in the same way.

Please do not send us information about health, religion or trade union membership unless we expressly ask for it.

For firm bookings we link to the external booking system at campbuchung.de. As soon as you follow that link you leave our website; from that point the provider's privacy terms apply.

On the “Booking enquiry” page you can fill in that same provider's enquiry form here with us. It is loaded in an embedded frame from campbuchung.de, and it is loaded as soon as the page is called up. The same note appears again underneath the form.

In doing so your browser transmits the usual connection data to the provider, in particular your IP address, browser type and operating system. What you subsequently enter in the form goes directly to the provider and from there to us. The legal basis is Art. 6(1)(b) GDPR, since the processing serves the enquiry you have asked for and thereby the initiation of a contract.

campbuchung.de is operated by our service provider for booking and enquiry management. It processes the data solely on our instructions; a data processing agreement under Art. 28 GDPR is in place.

To adjust the height of the frame we use the iFrame Resizer library. It sits on our own server; nothing is loaded from an external server for it.

For the linked offerings of our partner businesses and our profiles on Instagram, Facebook and YouTube the following still applies: these are plain links — only your click establishes the connection.

We do not pass your data on for advertising purposes and we do not sell it. The recipients are exclusively the processors named in this policy who support us in operating the site: Hetzner Online GmbH for the server, our hosting provider for the mailbox, our provider for the technical delivery of form emails, our provider for booking and enquiry management, and — only with your consent — Google Ireland Limited for audience measurement.

Beyond that we pass data on only where we are legally obliged to do so or where it is necessary to enforce our rights.

You have the right of access to the data stored about you (Art. 15 GDPR), to rectification (Art. 16 GDPR), to erasure (Art. 17 GDPR), to restriction of processing (Art. 18 GDPR) and to data portability (Art. 20 GDPR). Where processing is based on a legitimate interest, you may object to it under Art. 21 GDPR.

For this, contact us informally using the details in the Impressum. Independently of that, you have the right to complain to a data protection supervisory authority; for us that is the Independent Centre for Privacy Protection Schleswig-Holstein.

This site is delivered exclusively over HTTPS. You can see this in your browser's address bar. With encryption active, the data you transmit to us cannot be read by third parties.

Where no explicit retention period is stated in this policy, your data remains with us until the purpose for processing no longer applies. If you make a legitimate request for erasure or withdraw a consent, your data is deleted unless we have other legally permissible grounds for storing it, such as retention periods under commercial or tax law. In that case deletion follows once those grounds no longer apply.

We hereby object to the use of contact data published under our legal notice obligations for the purpose of sending advertising and information material that has not been expressly requested. We expressly reserve the right to take legal action in the event of unsolicited advertising, for example by spam email.

At the address /admin there is a password-protected area in which Strandcamping Wallnau staff maintain their own content — currently the weekly plan of the activity and sports programme, the reception hours and short-notice notices. The area is not aimed at guests and cannot be used without credentials.

On signing in, a technically necessary cookie named sc_admin is set. It contains only an expiry time and a signature, but no name, no identifier and no personal details. It serves solely to maintain the session across several page views, and it expires after eight hours at the latest and on signing out. It cannot be read by scripts in the browser. The legal basis for this cookie is § 25(2)(2) TDDDG, since it is strictly necessary for the expressly requested use of the protected area; consent is not required for it.

Where sign-in attempts fail, the IP address is counted in the server's memory for at most 15 minutes in order to prevent automated password guessing. No permanent storage takes place. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in securing access.

Every saved change is logged with the time, the area affected and a checksum of the content. The log serves to make editorial changes traceable. The legal basis is Art. 6(1)(f) GDPR.

For visitors who do not sign in, this area produces no processing whatsoever; in particular, no cookie is set.

We are not legally obliged to appoint a data protection officer. Please direct questions about data protection to the contact details given above.

We update this policy whenever something changes on the website that matters for data protection — for instance when a new service is added. The version published here always applies to your visit.

Last updated: August 2026.