Last updated: October 2026
This English version is provided for convenience. In case of discrepancies, the German version shall prevail.
Protecting your data matters to us. MinibarClub is built to process only the data that is truly necessary for the membership. In accordance with Art. 13 and 14 GDPR, this notice explains which data we process, for what purpose and what rights you have.
Controller
Philip P.M. Jansohn
Canettistrasse 1 / 1201, 1100 Vienna, Austria
Email: hello@minibarclub.com
No data protection officer has been appointed as there is no legal obligation to do so.
Visiting the website
When you access the website, our hosting provider processes technically necessary data (IP address, date and time, page accessed, browser information) in server logs in order to provide the website securely and reliably. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR). Fonts and images are loaded exclusively from our own server; there is no connection to Google Fonts or other third parties. We do not use any analytics, tracking or advertising tools.
Membership
For the free membership we process:
- first name, last name and email address
- your member ID and membership status
- the time of registration, consent and confirmation of your email address
- your preferred language (German or English)
The purpose is to provide the membership, including the digital member card and login via email link. The legal basis is the performance of the membership contract (Art. 6(1)(b) GDPR). No password is stored.
Stays and benefits
When you add a stay, we process the hotel, arrival and departure dates, your booking number, your confirmation that you booked directly with the hotel, the selected benefits and the hotel’s reply (including any comment).
Disclosure to the hotel: So that the hotel can confirm and grant your benefits, we pass your name, member ID, membership status and the details of your stay to the hotel you selected – and only to that hotel. The hotel processes this data as an independent controller. The legal basis is the performance of the membership contract (Art. 6(1)(b) GDPR); the disclosure takes place because you add the stay yourself.
Wish list
As a member you can add hotels to your wish list using the heart symbol. For this we only store which hotel you saved and when. Only you can see your wish list. Partner hotels only learn the number of members who saved them – never names or other details. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR). You can remove entries at any time; your wish list is deleted immediately when you delete your account.
Hotel partners and partner requests
If a hotel requests a partnership via our form, we process the data provided (hotel, location, website, number of rooms, name and position of the contact person, email, phone, message) to handle the request (Art. 6(1)(b) GDPR, pre-contractual measures). For users of the hotel dashboard we store the email address, role and time of last login.
Information for hotels by email
We send information about MinibarClub by email to hotels we have spoken to beforehand – for example by phone – and that have agreed to receive it. For this we process the email address, hotel name, name of the contact person, language and the time and status of sending (Art. 6(1)(a) GDPR, consent). Every email contains an unsubscribe link; consent can be withdrawn at any time. After unsubscribing, we only store an unreadable checksum of the address so that we do not contact it again. We delete the sending data as soon as it is no longer needed for the contact, at the latest after two years.
Contact form and email
If you write to us via the contact form or by email, we process your name, email address, topic and message in order to respond (Art. 6(1)(b) or (f) GDPR).
Emails we send
We only send emails that are necessary for the membership: confirmation and login links, information on stays you have added and replies from hotels. We log recipient, subject, time and delivery status to be able to trace delivery. These logs are deleted automatically after 12 months. We only send newsletters with separate consent.
Abuse prevention
To prevent abuse (e.g. mass login attempts), we briefly store the IP address and the email address used for logins, registrations and forms. These entries are deleted after 24 hours at the latest (Art. 6(1)(f) GDPR).
Cookies and local storage
| mbc_session | Keeps you logged in after login (max. 30 days). Strictly necessary. |
|---|---|
| mbc_lang | Stores the language you selected (max. 12 months). Strictly necessary for the display you requested. |
| mbc_consent | Stores your choice in the cookie banner (max. 12 months). Technically necessary so that we can respect your decision. |
| Google Maps | Only if you click “Show map” on a hotel page: Google may set its own cookies. See Maps (Google Maps). |
| Local storage (mbc-recent) | Only with your consent (“Comfort” category): Remembers the hotels you viewed most recently (max. 5) so you can find them quickly when adding a stay. Stays exclusively in your browser and is not transmitted to us. |
We use necessary cookies without consent because they are strictly required for the service you have requested (§ 165(3) Austrian Telecommunications Act 2021). We only use the comfort feature and visitor statistics with Umami (see below) if you agree in the cookie banner (Art. 6(1)(a) GDPR). You can change or withdraw your choice at any time via the Cookie settings link in the footer; when you withdraw, the stored history is deleted immediately. We do not use advertising cookies.
Web analytics with Umami
If you agree to the “Statistics” category in the cookie banner, we use the web analytics service Umami Cloud provided by Umami Software, Inc. (USA). Umami helps us understand which pages are visited so we can improve the website. Without your consent, Umami is not loaded.
No cookies: Umami does not set cookies and does not store anything on your device. It records the pages viewed, the referring page, browser, operating system, device type, screen size, language and the approximate country or region. Your IP address is used only briefly to determine the approximate location and is not stored. The statistics are anonymous, do not allow you to be identified and are not linked to your membership account. If “Do Not Track” is enabled in your browser, no data is recorded.
Location and provider: The data is stored in the EU region of Umami Cloud. A data processing agreement pursuant to Art. 28 GDPR is in place with Umami. As Umami Software, Inc. is based in the USA, access from the USA cannot be completely ruled out; for this case the agreement provides appropriate safeguards (EU Standard Contractual Clauses).
The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time via the Cookie settings link in the footer; this does not affect the lawfulness of processing carried out before the withdrawal. More information: umami.is/privacy.
Maps (Google Maps)
On hotel pages you can display a map showing the hotel’s location. The map is provided by Google Maps (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) and is only loaded once you click “Show map”. No connection to Google is made before that. When you click, data such as your IP address, browser information and the address shown are transmitted to Google; Google may also set cookies and transfer data to the USA. The legal basis is your consent given by clicking (Art. 6(1)(a) GDPR and § 165(3) of the Austrian Telecommunications Act 2021). More information: policies.google.com/privacy.
Processors
The website, database and email delivery are operated by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. A data processing agreement pursuant to Art. 28 GDPR is in place. Data is processed within the European Union. For web analytics we use – only with your consent – Umami Software, Inc. (see “Web analytics with Umami”).
Retention
- Member account: until you delete it. Unconfirmed sign-ups are deleted automatically after 7 days.
- Stays, benefits and wish list: as long as your account exists; they are deleted immediately when you delete your account.
- Login sessions: max. 30 days; login links expire after 15 minutes.
- Partner and contact requests: until resolved, at most 12 months after the last contact unless a partnership results.
- Abuse prevention entries: 24 hours.
Statutory retention obligations remain unaffected.
Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR). You can change your name in your profile at any time and delete your account there completely with one click. For all other requests, simply email hello@minibarclub.com.
If you believe that we are not processing your data lawfully, you can lodge a complaint with the Austrian Data Protection Authority: Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.