Privacy policy

Last updated: November 2026

Controller

The controller responsible for processing personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Represented by: Kutbettin Eroglu (managing director)

Phone

+49 30 24336560

Email

eroglu@eroglumail.com

MonaLiving GmbH operates Monalisa Hotel & Living (Eiswerderstraße 12, 13585 Berlin). The best way to reach us with questions about data protection or about your rights is by email to eroglu@eroglumail.com.

Summary

• This website sets no cookies and does not itself store any data in your browser. Only the security check on the inquiry form may store technically necessary information there (see “Security check with Cloudflare Turnstile”).
• For visitor statistics we use Cloudflare Web Analytics: without cookies, without recognising you and with aggregated figures only (see “Visitor statistics with Cloudflare Web Analytics”). Beyond that, we use no analytics, statistics or advertising services, no social media plugins, no embedded maps or videos and no fonts from other servers. We do not track how you move around the website. (For the counting pixel in the confirmation email, see “Emails via Brevo”.)
• There is no cookie banner: we set no cookies and use no services that recognise you or track you across websites.
• We process personal data only to deliver and protect the website, to count how many people visit it, and to answer your inquiry when you write to us through the form. For this we use Cloudflare (hosting, visitor statistics, database, security check) and Brevo (sending emails); your inquiry arrives in the hotel’s inbox at Google (Gmail).

Hosting and delivery of the website

The website is delivered through the global server network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (“Cloudflare”). When you open a page, your browser connects to one of Cloudflare’s data centres, usually one near you. To deliver the page, Cloudflare processes the data your browser technically has to send with every request:

• your IP address,
• the date and time of the request,
• the address (URL) requested and the page you came from (referrer), if your browser sends it,
• details of your browser, operating system and language settings (user agent and other request headers),
• the amount of data transferred and whether the request succeeded.

The purpose is to deliver the pages quickly and reliably and to protect the website against attacks and overload. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and stable operation of the website.

Cloudflare acts as our processor under a contract pursuant to Art. 28 GDPR. Where Cloudflare also processes data for its own purposes, for example to secure its network against attacks, Cloudflare is itself responsible for that. We do not keep log files of your page views and do not analyse access data about individuals. You can find out more in Cloudflare’s privacy policy.

Visitor statistics with Cloudflare Web Analytics

To see how many people visit our website and how fast the pages load, we use Cloudflare Web Analytics. The provider is Cloudflare, Inc. (address under “Hosting and delivery of the website”). When you open a page, your browser loads a small script from static.cloudflareinsights.com for this. It measures how long the page takes to load and display, and sends these measurements, together with the address requested and the page you came from (referrer), to our own domain, where Cloudflare receives them. As with every request, Cloudflare also receives your IP address and your browser’s details (see “Hosting and delivery of the website”).

The script sets no cookies and stores nothing in your browser’s storage. According to Cloudflare, it does not recognise you, does not fingerprint your browser, and discards your IP address at the receiving data centre without storing it. We only see aggregated figures, such as visits and page views, countries, referring websites, device types, browsers and load times, and no details about individuals. If your browser blocks the script, for example with a content blocker, the website works just the same.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to know how many people use our website, how they find us and whether the pages load fast enough. Cloudflare acts as our processor for this. You can find out more in Cloudflare’s privacy policy.

Inquiry form

You can send us an inquiry through the form on our home page. We then process:

• your name and email address (required),
• the type of stay you choose (short stay, long stay, group / company or other),
• your travel dates (arrival, departure) and your message – we need at least one of the two to be able to reply,
• optionally, your phone number and the number of guests,
• the language of the page you send the inquiry from, so that we can reply in that language,
• the date and time we receive it and a randomly generated reference number.

By ticking the box below the form, you confirm that you have read this privacy policy. This is not consent, and we do not store the tick.

Purpose and legal basis

We use your details to handle your inquiry and to reply to you, for example with information about a stay or an offer. The legal basis is Art. 6(1)(b) GDPR: handling your inquiry is a step taken at your request before entering into a contract. If your inquiry is not about a stay, for example a general question, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest is answering the inquiries we receive.

Storage in the database

So that no inquiry is lost even if sending the email fails, we store every inquiry with the details listed above in a database at Cloudflare (Cloudflare D1), together with a note of whether the email to us was sent. The database is set up to run and store its data exclusively within the European Union.

An automated job deletes every inquiry from the database 90 days after we receive it. Once a day, the same job checks whether an email was not delivered; its report contains only the reference number and the date, no content. For recovery after technical faults, Cloudflare keeps earlier states of the database, so a deleted inquiry can still be restored for up to 30 days; after that it is gone for good. We use this only to rescue inquiries lost through a fault. Our server writes no form content and no IP addresses to its error logs, and these logs are not kept.

Emails via Brevo

We send your inquiry as an email to the hotel’s inbox. The email contains all the details from the form; your email address is set as the reply-to address so that we can answer you directly. We also send a short confirmation of receipt to the email address you entered. It consists of a fixed text and contains none of your details.

We send both emails through the email service Brevo. Our contractual partner is Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany (“Brevo”). Brevo acts as our processor under a contract pursuant to Art. 28 GDPR and stores the data in data centres in the EU. For every email sent, Brevo keeps a sending log with the recipient’s address, the subject, the time and the delivery status; the subject of the email to us contains your name. Our Brevo account is set to delete these logs after one month and not to store a preview of the email content. You can find out more in Brevo’s privacy policy.

For technical reasons, Brevo adds an invisible counting pixel to emails in HTML format. If your email program loads images when you open the confirmation of receipt, it fetches this pixel from a Brevo server; Brevo then receives your IP address and details of your email program and can count the open. Our Brevo account is set so that opens are not linked to you but only counted anonymously in aggregate statistics. We ourselves do not evaluate whether or when you open our emails. If your email program does not load images automatically, the pixel is not fetched. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is sending our emails reliably through a specialised service.

We keep the email in the hotel’s inbox for as long as we need it for your inquiry and any stay that follows from it. We then delete it unless statutory retention obligations apply, for example under German commercial and tax law if your inquiry leads to a booking.

The hotel’s inbox is a Gmail account. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google stores the emails on its servers to provide the inbox to us, and in doing so also processes the details of your inquiry. You can find out more in Google’s privacy policy.

Security check with Cloudflare Turnstile

To stop programs from filling the form with spam, we use Cloudflare Turnstile to check that a human is sending it. The provider is Cloudflare, Inc. (address under “Hosting and delivery of the website”). Turnstile is loaded only on the home page with the form, and usually only when you scroll to the form or use it. Your browser then loads a script and a small check frame from challenges.cloudflare.com. The check runs automatically; only occasionally does Turnstile ask you to tick a box.

For the check, Cloudflare collects data about your browser and your connection, in particular your IP address, your browser’s identifier (user agent), technical characteristics of the encrypted connection (TLS fingerprint) and our website’s key and address. To do so, Turnstile reads information from your browser and may store information in your browser’s storage. The result of the check is a token that is valid only once and is sent with the form. Our server sends the token together with your IP address to Cloudflare to have it confirmed; without a valid token we do not accept the inquiry.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protecting the form and our inbox against automated abuse. Reading and storing information in your browser is permitted without consent under Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG), because it is strictly necessary to provide the service you have expressly requested: sending your inquiry securely.

For the check, Cloudflare acts as our processor. Cloudflare also uses the data on its own responsibility to improve Turnstile’s bot detection. Details are in Cloudflare’s Turnstile privacy addendum.

Protection against abuse

So that nobody can overload the form with mass submissions, we accept no more than 5 inquiries from the same IP address within 60 seconds. For IPv6 addresses we count the /64 address block, which usually belongs to a single internet connection. Our server uses Cloudflare’s rate limiting for this: the address serves only as the key of a counter that expires after 60 seconds. We store it neither in our database nor in logs.

The form also contains a field that people cannot see. If it is filled in – which almost only programs do – we discard the submission without storing or forwarding it.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protecting the form against abuse and overload.

External links

Our pages link to other websites, for example to Google Maps with “Plan your route”. These are plain links: until you click one, your browser does not connect to these providers and they receive no data. Only when you click a link does the other website open. The provider then receives the usual connection data, such as your IP address and usually the address of our website you came from. For “Plan your route” that provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The provider of each website is responsible for the processing there, and its privacy information applies; for Google Maps, Google’s privacy policy.

Recipients

Your data is received only by:

• the hotel staff who handle your inquiry,
• Cloudflare as our processor for hosting, visitor statistics, the database, the security check and rate limiting,
• Brevo as our processor for sending emails,
• Google as the provider of the hotel’s inbox (Gmail), where your inquiry arrives,
• IT service providers who look after the website on our behalf, where they need access to do so.

Our processors in turn use sub-processors, such as data centre operators. We do not sell your data or pass it on for advertising. We disclose data to other parties only where we are legally obliged to, for example by order of an authority or a court.

Transfers to third countries

Cloudflare is based in the USA and runs data centres all over the world. When you visit the website, for the visitor statistics, and when you send the form or go through the security check, data may therefore also be processed in the USA or in other countries outside the EU. Cloudflare is certified under the EU-U.S. Data Privacy Framework, so transfers to the USA are based on the European Commission’s adequacy decision (Art. 45 GDPR). For other third countries, the European Commission’s standard contractual clauses, which form part of our contract with Cloudflare, apply (Art. 46(2)(c) GDPR). The database with your inquiries, by contrast, is located exclusively in the EU.

Brevo stores the data in data centres in the EU. For maintenance and support, Brevo also uses companies of its own group and service providers outside the EU, including in the USA and India. Where they get access to data, the transfer is safeguarded by the EU-U.S. Data Privacy Framework or by standard contractual clauses.

Google may also process the emails in the hotel’s inbox on servers outside the EU, in particular in the USA. According to Google, it bases such transfers on the EU-U.S. Data Privacy Framework, under which Google LLC is certified, and on standard contractual clauses.

Storage periods

Access data when you visit the website

We do not store it ourselves. According to Cloudflare, it keeps log data only for as long as the respective purpose requires.

Visitor statistics data

Cloudflare does not store your IP address for this. According to Cloudflare, it keeps the measurements in full for 7 days, after that only as a sample of about 10 %. We can view the aggregated statistics for 6 months.

Inquiries in the database

Deleted automatically 90 days after receipt; after that, still in the database’s recovery states for up to 30 days.

Email in the hotel’s inbox

Until your inquiry and any stay that follows from it are completed; longer only where statutory retention periods apply, for example under commercial and tax law.

Sending logs at Brevo

One month. Brevo counts opens only anonymously, without a link to you.

Rate limit counter

60 seconds.

Turnstile check data

The token is valid for one check only. According to Cloudflare, it keeps the check data only for as long as the respective purpose requires.

Your rights

Under the GDPR you have the right

• to access the data we process about you (Art. 15),
• to have inaccurate data rectified (Art. 16),
• to have your data erased (Art. 17),
• to have processing restricted (Art. 18),
• to be told which recipients we have notified of a rectification, erasure or restriction (Art. 19),
• to receive the data you have given us in a common, machine-readable format or to have it transmitted to another controller (Art. 20),
• to object to processing (Art. 21, see below).

Just write to us at eroglu@eroglumail.com or by post to the address under “Controller”. So that we do not disclose data to the wrong person, we may ask you to confirm your identity.

Right to object

Where we process data on the basis of Art. 6(1)(f) GDPR (legitimate interests), you may object to this processing at any time on grounds relating to your particular situation (Art. 21(1) GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Lodging a complaint with a supervisory authority

If you believe that we are not processing your data lawfully, you can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state where you live or work or where the alleged infringement took place. The authority responsible for us is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information)
Alt-Moabit 59-61
10555 Berlin
Germany

Lodge a complaint with the Berlin Commissioner (in German)

Do you have to provide data?

You are under no statutory or contractual obligation to provide us with personal data. Without your name, your email address and your travel dates or a message, however, we cannot handle your inquiry; all other details in the form are optional. Your IP address is processed for technical reasons when you visit the website and when you send the form; without it, the website cannot be delivered.

No automated decision-making

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). The automated security check and the rate limit only protect the form against abuse: if a submission is rejected, you can simply send it again. Your inquiry itself is handled by people.

Changes to this privacy policy

We update this privacy policy when the website or our processing of data changes, for example when new features are added. The version published on this page applies; the date at the top shows when we last changed it.