Privacy Policy

At a glance: who is responsible

Meldefein is software provided by Theobase GmbH for hosts of holiday accommodation.

• If you are a guest: Your host is the controller for your booking, registration and visitor tax data. Your host is legally obliged to complete a registration form (Meldeschein) for foreign guests and to register guests for the visitor tax (Kurtaxe). Theobase GmbH processes these data only on your host's behalf and in accordance with your host's instructions (Art. 28 GDPR). If you receive your check-in link by email, your host is named in it; replies to this email go directly to your host.
• If you use our website, send us an enquiry or have a host account: In that case Theobase GmbH is the controller (section 1).

In both cases you can also exercise your rights with us. We forward requests concerning guest data to your host.

1. Controller for the website, enquiries and host accounts

Theobase GmbH

Represented by: Thomas Theobald

Purkersdorfer Straße 35
79713 Bad Säckingen

Data protection contact: info@theobase.de

We have not appointed a data protection officer; there is no obligation to do so under Art. 37 GDPR and Section 38 of the German Federal Data Protection Act (BDSG). For questions about data protection, you can reach us via the data protection contact given above.

Register court: Amtsgericht Freiburg im Breisgau
Register number: HRB 735685

2. Guest data: purposes, data and legal bases

Your host is the controller; we process these data on your host's behalf.

• Booking import. From your host's booking platform (for example Lodgify) we import the booking number, accommodation, arrival and departure dates, number of persons and booking channel as well as name, email address and telephone number, where these are stored there. These data come from your booking and not from the online check-in (Art. 14 GDPR). Legal basis: Art. 6(1)(b) GDPR (performance of the accommodation contract).
• Accommodation enquiry. We forward your name, email address, travel dates, number of persons and your message to the host by email; you receive a confirmation of receipt. The enquiry is not stored in the application's database. Legal basis: Art. 6(1)(b) GDPR.
• Check-in link. Your host sends you a personal link to the online check-in, either by email via our email delivery service (email address, first name, accommodation, link) or personally by SMS or WhatsApp. Legal basis: Art. 6(1)(b) GDPR.
• Registration form (Meldeschein; only guests without German citizenship). Dates of arrival and departure, surnames and first names, date of birth, nationalities, address and the serial number of the passport or passport substitute (Section 30(2) of the Federal Registration Act, BMG). Accompanying spouses, registered civil partners and children under 18 on the day of arrival appear on the registration form only as a headcount (number of persons) and with their nationality. Other foreign fellow travellers are themselves subject to registration (Section 29(2) sentence 2 BMG); from them we additionally collect the serial number of the passport or passport substitute. For this check we ask foreign fellow travellers about their relationship to the main guest: spouse, registered civil partnership, child or other person. If the relationship is missing or only given as free text, or if a valid date of birth is missing for a child, we require the serial number of the passport or passport substitute. We do not transmit the relationship to the municipality. The details of fellow travellers come from the main guest or from your host. Since 1 January 2025, the special registration obligation in accommodation establishments only applies to guests without German citizenship. Legal basis: Art. 6(1)(c) GDPR in conjunction with Sections 29 and 30 of the Federal Registration Act (BMG).
• Visitor tax and guest card (all non-resident guests). Names, dates of birth (for the age bands), address and period of stay, the information on business travel and, if you state one, a reason for exemption. On the registration form, accompanying spouses, registered civil partners and children under 18 appear only as a headcount (number of persons) and with their nationality (Section 29(2), Section 30(2) no. 7 BMG); we collect the names and dates of birth of fellow travellers for the visitor tax and guest card where the municipality's visitor tax statute requires this. Legal basis: Art. 6(1)(c) GDPR in conjunction with Section 43 of the Baden-Württemberg Municipal Charges Act (Kommunalabgabengesetz) and the municipality's visitor tax statute.
• Visitor tax reduction (voluntary). For each person, a business stay can be stated as a characteristic. We no longer collect health data (Art. 9 GDPR), that is, a severe disability card with a degree of disability of at least 70 % or a companion (mark B on the card of the person accompanied), neither in the online check-in nor through your host on site. Anyone entitled to claim a reduction because of severe disability should contact your host directly. Health data stored earlier with explicit consent remain stored until they are deleted together with the registration data, the consent is withdrawn or the data are no longer necessary (for example without a companion). They were stored only with the explicit consent of the data subject, for children with the consent of a person with parental responsibility; in the online check-in the main guest gave consent by ticking a separate box, for accompanying children under 18 the person filling in the form gave it, and consents given orally were entered by your host in Meldefein. As proof of consent (Art. 7(1) GDPR) we store for each person the characteristic, the time of consent, how it was given (online or orally on site), who gave it (the data subject, the person filling in the form or a person with parental responsibility, without their name), which version of the consent text was shown in which language and, for consent given orally, which of your host's user accounts received it. Only these details are stored, not the degree of disability, not the number of the severe disability card and no copy of the card. Information stored earlier without consent as “stated, confirmation pending” has no effect, is not transmitted and is deleted; the visitor tax for that person is based on age. Your host submits the proof required by the municipality outside Meldefein. Children below the age limit of the visitor tax statute do not pay visitor tax; no separate health characteristic was stored for them, and a severe disability card stored earlier remains stored only as a reference for a companion. Recipients are your host and, if your host registers electronically, the municipality (section 5). We transmit to the municipality only the visitor tax category for each person (“Behinderte ab 70 % / Begleitperson” [disabled from 70 % / companion] or “Beruflich” [business]), never the time or the proof of consent. Without stored consent, a person with a health characteristic is registered according to age, or with the category “Beruflich” in the case of a booking stated as a business trip. If no characteristic is stated, the visitor tax is based on age; there are no other disadvantages. Legal basis: for stored health data Art. 9(2)(a) GDPR (explicit consent), for retention during a legal hold (section 8) Art. 9(2)(f) GDPR; for a business stay Art. 6(1)(c) GDPR in conjunction with the municipality's visitor tax statute. Withdrawal is described in section 11.
• Further details in the online check-in. We use the form of address only for the welcome; it is not included in the registration form. Email address and telephone number are voluntary. Legal basis: Art. 6(1)(b) GDPR. We do not store an identity document number for guests with German citizenship; a number read during the ID scan is also discarded. We remove a previously stored number the next time the data are saved, at the latest after the periods for identity document numbers in section 8.
• Identity check on arrival. Your host compares your details with your identity document and records the result and the time; if details differ or the document is missing, your host records this as well. Legal basis: Art. 6(1)(c) GDPR in conjunction with Section 29(3) and Section 30(2) BMG.
• Transmission to the municipality. If your host uses electronic registration, we transmit the registration and visitor tax data, including your email address if provided, as well as the document type and issuing state to the municipality's registration form and guest card system (section 5). We transmit the document number only for foreign main guests and foreign fellow travellers who are themselves subject to registration, for fellow travellers only in electronic transmission via the web service, not when importing as an XML file. For each person we transmit a visitor tax category, a health category only if consent has been stored; we do not collect new health data. Legal basis: Art. 6(1)(c) GDPR in conjunction with the provisions mentioned above, for stored health data Art. 9(2)(a) GDPR.
• Copy of the registration form and guest card. If your host has printed the registration form and guest card after registration with the municipality, you can retrieve a copy as a PDF via your personal check-in link, from the day of arrival until check-out. It contains the details of the registration form including fellow travellers, but no identity document numbers. If your host ticks the box for sending when printing, you additionally receive an email with your first name, the accommodation and a personal link, without a PDF attachment and without registration data. The copy is not a travel ticket. Legal basis: for the person who made the booking Art. 6(1)(b) GDPR; for fellow travellers Art. 6(1)(f) GDPR; legitimate interest: delivery of all guest cards of a booking together.
• Notification of your host. As soon as you have completed the online check-in, your host receives an email with the accommodation, the arrival date and a link to the host area, without your details. Legal basis: Art. 6(1)(f) GDPR; legitimate interest: prompt identity check and registration.
• Welcome in the accommodation. During your stay, the display in the accommodation (e-paper display or touch terminal) shows a welcome with your form of address and surname as well as the period of your stay. Legal basis: Art. 6(1)(f) GDPR; legitimate interest: personal welcome of guests.
• Security and abuse prevention. To limit requests per connection, we count a pseudonymised check value of the IP address; we do not store the IP address in plain text for this purpose. Legal basis: Art. 6(1)(f) GDPR; legitimate interest: protection against misuse.

3. Website, enquiries and host accounts

The controller is Theobase GmbH.

• Visiting the website. When you visit, our hosting provider processes technically necessary connection data such as IP address, time, requested address, status code and browser identifier in server logs. Legal basis: Art. 6(1)(f) GDPR; legitimate interest: secure and error-free operation.
• Needs check on the home page. Name, email address and the selection in the needs check (type of accommodation, number, booking channel, wishes) as fixed choices, without free text. Legal basis: Art. 6(1)(a) GDPR (consent in the form).
• Waiting list. Email address and, if selected, the type of accommodation. We receive the sign-up as an email via Resend and do not store it in the application's database. Legal basis: Art. 6(1)(b) GDPR (pre-contractual request).
• Host account. Email address, name, address, contact email and, if provided, telephone number, details of accommodations and of the host's organisation account as well as the version of the terms and conditions and the privacy policy confirmed at registration; sign-in with a code sent to the email address or with a password; invitation of further members by email. Name, address, contact email and, if provided, telephone number are shown to your guests as details of the controller (on the guest page; name and town on the terminal). Legal basis: Art. 6(1)(b) GDPR.
• Termination and withdrawal. The details from the termination or withdrawal form and the confirmation of receipt. Legal basis: Art. 6(1)(c) GDPR in conjunction with Section 312k of the German Civil Code (BGB).
• Customer care. Contact, contract and case notes on hosts and prospective customers in our customer management system. Legal basis: Art. 6(1)(b) and (f) GDPR; legitimate interest: support of prospective and existing customers.
• Operator log. Who accesses which data in the operator area, when and for what purpose. Legal basis: Art. 6(1)(f) GDPR; legitimate interest: traceability and protection of access.

4. Data minimisation in this app

• No tracking or advertising cookies.
• No analytics scripts and no tag managers.
• Guest links use random tokens; only a check value is stored, not the link itself.
• The display in the accommodation shows a welcome with form of address and surname, the period of stay and general information about the accommodation, but no email address, telephone number, address, dates of birth or document number.
• If your host sends you the check-in link by SMS or WhatsApp, your host uses their own device and account for this.
• External map and information services are only opened as links; the privacy rules of the respective provider apply there.
• The town is looked up from the postcode on our own server. No external service is queried. The postcode is transmitted in the body of the request and not in the address, so it does not appear in the hosting provider's access log. It is neither stored for the lookup nor linked to a booking. Data source: postcodes from geonames.org, prepared by zauberware, licence CC-BY-4.0.
• The ID scan is evaluated exclusively locally on the device used: in the guest form on the guest's device, in the check-in conducted by the operator on the operator's device. No image is uploaded to the app server and none is stored by the application. The text recognition loads its program files from our own server; no external service is used and nothing is cached in the browser.
• An enquiry via the needs check is only transmitted when you click “Send enquiry” (“Anfrage senden”) and only with consent confirmed in the form, and is stored in the application's database for processing the enquiry. So that the enquiry can be answered promptly, Meldefein additionally receives an internal notification by email with the name, email address and selection of the person making the enquiry; it is sent via the email service Resend named in section 5. No automatic email is sent to the person making the enquiry. Name and email address do not appear in the application's logs. To protect against misuse, the number of enquiries per connection is limited; for this the IP address is only counted as a pseudonymised check value and is not stored in plain text.

5. Recipients

We use the following service providers as processors. They process the data on our behalf and in accordance with our instructions (Art. 28 GDPR):

• Vercel Inc., USA – hosting and delivery of the application. The server functions run in the region Frankfurt am Main (fra1). Vercel also processes account, support and certain technical log data in the USA.
• Supabase Pte. Ltd., Singapore – database, file storage and sign-in for hosts. The database is located in the region Frankfurt am Main (eu-central-1). Subprocessors of Supabase, including Supabase, Inc. and Amazon Web Services, are also located in the USA.
• Resend, USA – sending the application's emails (check-in link and link to the guest card copy to guests, confirmations of receipt, messages to hosts and internal notifications). Resend stores email and log data in the USA for 30 days.
• Resend (Plus Five Five, Inc.), San Francisco, USA – sending the sign-in codes for hosts via Supabase's email delivery.

Other recipients of guest data:

• Municipality of the accommodation via the registration form and guest card system of AVS Abrechnungs- und Verwaltungs-Systeme GmbH, Bayreuth – registration form, visitor tax and guest card including the visitor tax category for each person, if your host uses electronic registration.
• Authorities on request, in particular police and security authorities to which the host must present or make available registration forms under Section 30(4) BMG.
• Your host's booking platform (for example Lodgify): we import your booking data from there; we do not send any guest data back there.
• Open-Meteo: for the weather display, our server only queries the coordinates of the town or the accommodation, without your data and without your IP address.

Google Maps, Bad Säckingen Tourismus, Aqualon and other official websites are only accessed by clicking external links.

6. Transfers to third countries

Vercel and Resend have their registered office in the USA, Supabase Pte. Ltd. in Singapore. Resend stores data exclusively in the USA. Vercel's server functions run in Frankfurt am Main (fra1), Supabase's database is located in Frankfurt am Main (eu-central-1); certain account, support and operational data as well as subprocessors of these providers are also located in the USA.

For the USA there is an adequacy decision of the European Commission (EU-US Data Privacy Framework) for companies certified under it. Certified under this framework are: Vercel Inc. and Resend (Plus Five Five, Inc.). There is no adequacy decision of the European Commission for Singapore.

The data processing agreements of Vercel, Supabase and Resend contain the standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR). For Supabase they are the basis of the transfer. You can obtain a copy of these safeguards on request to info@theobase.de. The agreements of Vercel and Supabase are also available at vercel.com/legal/dpa and supabase.com/legal/dpa.

7. Cookies and browser storage

In the online check-in and on the other pages for guests we do not set any cookies and do not store anything in browser storage.

In the host and operator area we only use cookies that are strictly necessary for secure sign-in (Section 25(2) no. 2 TDDDG, German Telecommunications Digital Services Data Protection Act); no consent is required for this:

In the host area, after a check has been saved, the browser stores a short success message in the tab's session storage (sessionStorage) until it is displayed, at the longest until the tab is closed.

8. Storage period

• Registration form, visitor tax and stay data: 365 days from the day of departure, then deletion within a further 90 days (Section 30(4) BMG).
• Identity card and passport numbers (foreign main guests and fellow travellers who are themselves subject to registration): We remove them from Meldefein 7 days after transmission to the municipality; without transmission 7 days after departure.
• Check-in links: Only a check value is stored; it is deleted 2 days after the link expires, is used or is blocked.
• Characteristic for the visitor tax reduction: It is deleted together with the registration form, visitor tax and stay data. If “No reduction” is chosen or consent is withdrawn, we immediately delete the characteristic, the time and the proof of consent. Information stored without confirmation and a reference that is no longer needed (for example without a companion) are also deleted.
• Copy of the registration form and guest card as PDF: until check-out on the day of departure; after that it can no longer be retrieved and the file is deleted. Copies already downloaded remain with you.
• Legal hold in individual cases: If retention is necessary in an individual case for the establishment, exercise or defence of legal claims, because of a request by an authority or for documented preservation, we suspend deletion for the booking concerned with all persons until the hold is lifted (Art. 17(3)(b) and (e) GDPR, for health data Art. 9(2)(f) GDPR). During the hold the data are only stored and cannot be changed either via the check-in link or by the host in Meldefein. You can still withdraw your consent to the visitor tax reduction (section 11). Even during a hold, the copy of the registration form and guest card can only be retrieved until check-out.
• Counters for abuse prevention: until their time window expires.
• Emails at the delivery service: Resend stores email and log data for 30 days.
• Server logs at the hosting provider: Vercel stores the runtime logs of the server functions for 30 days, Supabase stores the database and API logs for 7 days.
• Enquiries, waiting list, host accounts, records of termination and withdrawal, customer management and operator log: No automatic deletion period has been set up for these. The purpose (processing the enquiry, duration of the contract) and statutory retention and documentation obligations are decisive.

9. Obligation to provide data

Guests without German citizenship are legally obliged to sign a registration form with the details listed in section 2 on the day of arrival and to identify themselves (Section 29 BMG). For the visitor tax, the municipality's visitor tax statute requires the registration of all non-resident guests. Email address, telephone number and the characteristic for the visitor tax reduction are voluntary. Without the mandatory details the online check-in cannot be completed; the legal obligation towards your host then still applies on arrival.

10. No automated decision-making

We do not make any decisions based solely on automated processing within the meaning of Art. 22 GDPR and do not create profiles.

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). To exercise these rights, contact info@theobase.de; for guest data also your host. Statutory retention obligations, for example under Section 30(4) BMG, and a legal hold in an individual case (section 8) take precedence over erasure before the end of the period.

You can withdraw any consent given, for example in the needs check or for the visitor tax reduction because of severe disability, at any time with effect for the future, for example by email to info@theobase.de. You can also withdraw your consent to the visitor tax reduction by choosing “No reduction” in the online check-in, as long as your check-in link is valid and online registration is available; an informal message to your host is always sufficient. The withdrawal takes effect immediately, even during a legal hold: the characteristic, the time and the proof of consent are deleted and no longer transmitted. After that the visitor tax is based on age, or for a booking stated as a business trip the category “Beruflich” (business) continues to apply. Transmissions made before the withdrawal remain effective; a category already transmitted to the municipality does not change there automatically, your host clarifies the change with the municipality.

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR). The supervisory authority competent for Theobase GmbH is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg), Heilbronner Straße 35, 70191 Stuttgart.

12. Security

We protect the data, among other things, through encrypted transmission, access restrictions per host, random guest links stored only as a check value, CSRF protection in the host area, request limiting, reduced logging with masking of personal data and separate views for guests and hosts.

13. Changes

We adapt this policy when processing changes. The version stated above applies.