Privacy at the voucher shop
As of 29 September 2026
This is a translation. The German version is legally binding. Zur deutschen Fassung
This notice applies to the voucher shop at pay.guthuegle.de/gutschein, the spa cards at pay.guthuegle.de/spa, the balance and card pages, vouchers and spa cards in Apple Wallet and Google Wallet, and vouchers and spa cards you buy at our reception. It supplements our privacy policy (guthuegle.de/gut-huegle/datenschutzerklaerung).
The controller is Gut Hügle GmbH, Bottenreute 5–7, 88214 Ravensburg, Germany, phone 0751 95143996, email info@guthuegle.de.
What data we process
- Order: the buyer’s first and last name and email address and, for delivery by post, the delivery address. Also the amount, design and type of delivery, the name of the person receiving the gift and, optionally, a greeting and the sender’s name. Optionally a company name and billing address for the invoice. Also the order number, payment reference and time of the order. For purchases at reception, also the payment method; name and email address only if you give them.
- Payment: for your bank transfer we receive from our bank the account holder’s name and IBAN, the amount, the payment reference and the booking date. Our voucher system stores only the booking ID and matches it to the order. If it cannot match a payment with certainty, our team receives an email with the payer’s name and payment reference.
- Voucher: voucher code, value, remaining balance, validity and redemptions (date, amount, area, for overnight stays the reservation number, the device of our team). For vouchers by post, when they were printed and sent.
- Payment page: whether and when you chose “I have transferred the money”.
- Abuse protection: to prevent mass orders and the trying out of voucher codes, we count requests per device and hour. For this we do not store your IP address but a hash of the IP address and a random key that is newly generated every day. We delete the counters and the key the following day; after that the hash can no longer be linked to an IP address.
- Withdrawal: name, order number or voucher code, email address, optionally a reason, and the date and time of receipt.
- Offers by email: when you were told about the advertising and whether you objected.
Purposes and legal bases
- Purchase, matching the payment, issuing, sending, redeeming and withdrawing from the voucher: Art. 6(1)(b) GDPR.
- Name, greeting and, where applicable, address of the person receiving the gift, and redemption by other holders of the voucher: Art. 6(1)(f) GDPR. Our legitimate interest, and that of the buyer, is to personalise, deliver and redeem the voucher as ordered.
- Retention under commercial and tax law and the acknowledgement of receipt of a withdrawal: Art. 6(1)(c) GDPR in conjunction with section 147 of the German Fiscal Code (AO), section 257 of the German Commercial Code (HGB) and section 356a of the German Civil Code (BGB).
- Abuse protection, the “I have transferred the money” note, and the establishment, exercise and defence of legal claims: Art. 6(1)(f) GDPR. Our legitimate interest is a safe, quick and traceable process.
The buyer’s name and email address, the name of the person receiving the gift and, for delivery by post, the delivery address are required for the order. Without them we cannot sell a voucher. The greeting and the sender’s name are optional.
Spa cards
Everything said here about vouchers also applies to spa cards, with these differences: instead of a remaining balance we keep the visits. For every visit we store the date and time, the number of people, the device of our team and, if entered, the name of the staff member who deducted the visit. We do not store guest names at the visit. The legal basis is Art. 6(1)(b) GDPR.
The QR code on the spa card does not contain the card code but a signed ID of the card. Whoever scans it sees the free visits and the validity. In Google Wallet we transmit the card code, the number of free visits and the validity, no names and no greeting.
The same retention periods apply to spa cards as to vouchers; “fully redeemed” here means that all visits have been used.
Offers by email
When you buy and pay for a voucher in the voucher shop, we also use your email address to send you occasional offers for similar services from Gut Hügle (overnight stays, restaurant, spa, farm shop, events and vouchers). The legal basis is Art. 6(1)(f) GDPR in conjunction with section 7(3) of the German Unfair Competition Act (UWG); our legitimate interest is advertising our services.
You can object to this use at any time without incurring any costs other than the transmission costs at the basic rates: via the “No more offers” link in every email or with a message to info@guthuegle.de. So that we respect your objection permanently, also for later purchases, we enter a hash of your email address in a block list.
For purchases at reception we do not use your address for advertising. Three months after your voucher expires we delete your email address; the offers end with it.
Matching the payment
As soon as a transfer arrives in our account, our system compares the payment reference, the amount and the account holder with the open orders and issues the voucher. Unclear cases are checked by hand by our team.
In your browser and on our server
While you fill in the order form, your browser keeps your entries in session storage (sessionStorage) so that they survive a reload and going back. They are deleted after the order or when you close the tab. After the order, only the link to your payment page stays there until you close the tab, for at most seven days, so that we can point you to an open order (section 25(2) no. 2 of the German TDDDG).
For guests we use no cookies and no analytics or advertising services on the voucher pages. Only devices of our team receive a technically necessary sign-in cookie after signing in. We load fonts and images from our own server.
When you open the pages, Cloudflare processes connection data such as your IP address for technical reasons, to deliver and protect the pages. The technical logs of our system contain internal IDs and error messages, but no complete voucher codes, and are deleted after seven days at most.
The voucher code is the key to the voucher: whoever knows it can see the remaining balance and validity and can load the wallet pass.
Apple Wallet and Google Wallet
If you add the voucher to Apple Wallet, we create a pass file with the value, remaining balance, validity, voucher code, the name of the person receiving the gift, the greeting and the sender’s name. The file is stored on your device. So that the balance stays up to date, your device registers with our server; we store a device ID created by Apple Wallet and a push token. After a redemption we send a notification without content through the Apple Push Notification Service, whereupon your device fetches the current pass; Apple receives only the push token. We delete the registration when you remove the pass, and three months after the end of the voucher at the latest. Whether you are near Gut Hügle (shown on the lock screen) is checked only by your device.
If you choose “Add to Google Wallet”, we transmit the voucher code, value, remaining balance and validity to Google, but no names and no greeting. After every redemption we update the balance. Google processes this data as a controller under its own privacy terms and, under the Google Wallet terms, may also use it for its own services.
The legal basis is Art. 6(1)(b) GDPR; we act at your request and using the wallet is voluntary.
Recipients
- Cloudflare, Inc. (USA): operation of the voucher pages and storage of order and voucher data (processor).
- Our IT service provider for the domain guthuegle.de: forwards requests from pay.guthuegle.de to our system, also via Cloudflare (processor).
- Google Ireland Limited with Google LLC (USA): sending email, mailbox and storing the invoices in Google Drive via Google Workspace (processor). Google Wallet only if you use it (own responsibility).
- DATEV eG, Nuremberg: storing the invoices for accounting in DATEV Unternehmen online (processor).
- Qonto (Olinda SAS, France, with a branch in Germany): our account-holding payment institution. It processes the transfer data as a controller.
- apaleo GmbH, Munich: our hotel management system. When a voucher is redeemed for an overnight stay, we book the amount with the voucher number (not the voucher code) as a payment on the reservation (processor).
- Lightspeed (till system): for sales at reception and redemption in the restaurant, the spa and the farm shop, the amount and the ID of the order or redemption (processor).
- Deutsche Post AG: delivery of printed vouchers (own responsibility).
- Apple Inc. (USA): Apple Push Notification Service, only if you use Apple Wallet.
- Tax authorities within the scope of legal obligations, and our tax adviser.
Where data is transferred to the USA, this is based on the adequacy decision of the European Commission on the EU-US Data Privacy Framework, under which Cloudflare, Google and Apple are certified, and additionally on EU standard contractual clauses.
Retention
- Unpaid orders: 60 days after the seven-day payment period ends.
- Payments for which no voucher was issued (cases to check): one year.
- Delivery address: three months after the voucher was sent.
- Greeting, sender’s name and name of the person receiving the gift: three months after the voucher is fully redeemed, blocked or expired.
- The buyer’s email address: three months after the validity ends.
- Invoice with the buyer’s name and, where applicable, billing address, order number, amount, payment and redemption data that we need for accounting and tax: until the end of the eighth year after the year in which the voucher expires (section 147 AO). After that we delete the voucher completely.
- Withdrawals: until the end of the sixth year after receipt (section 257 HGB); statements for which there is no order, after one year.
- Emails about the order, voucher and withdrawal (commercial and business letters): six years from the end of the calendar year.
- Abuse protection: the following day.
- Block list for offers: for as long as we send offers by email.
- Registration of a device for Apple Wallet: when you remove the pass, and three months after the end of the voucher at the latest.
Note for people who receive a gift
We received your name, the greeting and, where applicable, your address from the person who bought the voucher. You have the same rights as all data subjects.
Your rights
You have the right of access, rectification, erasure, restriction of processing and data portability, and the right to lodge a complaint with a supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg. You can object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR). An email to info@guthuegle.de is enough.