suitespot Privacy Policy

Last updated: October 29, 2026

This Privacy Policy informs you about which personal data we process when you visit suitespot.com, create an account, take out a suitespot Premium membership, book hotels, villas, trains or yachts through us, or communicate with us – for what purposes, on what legal basis and for how long. The terms used are not gender-specific.

1. Controller

reisetopia GmbH (operator of suitespot)
Dessauer Straße 28–29
10963 Berlin
Germany
Authorized representative: Moritz Lindner (Managing Director)
Email: [email protected]
Phone: +49 173 2828744
Legal notice (Impressum): https://suitespot.com/en-US/imprint

2. Data Protection Officer

Legaltrust GmbH
Contact person: Mr. Michael Michalak
Lietzenburger Str. 94, 10719 Berlin, Germany
Phone: +49 30 887 27 609
Email: [email protected]

3. Overview and Legal Bases

In particular, we process: master and contact data (name, form of address, email address, phone number, postal address), account and membership data (membership type, term, trial period, cancellation status, voucher codes), booking and travel data (hotel, travel dates, fellow travelers, special requests, loyalty program numbers), payment data (payment method, invoices – card data itself is processed only by our payment service providers), communication data (content of emails and WhatsApp messages, phone notes), usage and device data (IP address, browser, pages visited, times) as well as consent data.

Legal bases under the General Data Protection Regulation (GDPR):

Consent (Art. 6(1)(a) GDPR), e.g. for newsletters, analytics and marketing cookies, and measuring email opens;
Contract and pre-contractual measures (Art. 6(1)(b) GDPR), e.g. for your account, your membership, booking requests and bookings;
Legal obligations (Art. 6(1)(c) GDPR), e.g. retention under tax and commercial law;
Legitimate interests (Art. 6(1)(f) GDPR), e.g. secure and stable operation of the website, fraud prevention, customer service and – to the extent described in Section 12.3 – marketing of our own similar services.

For access to your terminal equipment (cookies and similar technologies), § 25 of the Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (TDDDG) (German Telecommunications Digital Services Data Protection Act) applies in addition: access that is not technically necessary takes place only with your consent.

For users in Switzerland, the Swiss Federal Act on Data Protection (FADP) applies additionally; please refer to the Swiss version of this policy (in German).

4. Recipients and Transfers to Third Countries

We disclose data only where this is necessary for the purposes stated: to hotels, villa providers, rail and yacht operators with whom you book or make inquiries through us (to carry out the booking and to grant your benefits), to partners through which your membership is provided (see Section 8), to processors (technical service providers we have contractually bound under Art. 28 GDPR), and to public authorities where we are legally required to do so.

Some service providers are based in the USA or the United Kingdom. Transfers to the USA are made to providers certified under the EU-U.S. Data Privacy Framework (DPF) (adequacy decision of the European Commission of 10 July 2023), otherwise on the basis of the EU Standard Contractual Clauses. An adequacy decision exists for the United Kingdom. For bookings of hotels outside the EU, we transfer the data required for the booking to the respective hotel (Art. 49(1)(b) GDPR).

5. Retention Period

We delete personal data as soon as it is no longer necessary for the purpose and no retention obligation prevents deletion. We store account data for as long as your account exists; after the account is deleted, we delete it unless retention obligations apply. We retain booking and invoice records in accordance with § 147 AO (German Fiscal Code) and § 257 HGB (German Commercial Code) for up to eight or ten years (accounting vouchers eight years, annual financial statements and books ten years), and business letters for six years. We store newsletter data until you unsubscribe; proof of your consent for up to three years thereafter. After your membership ends or your account is deleted, we retain data required to defend against possible contractual claims for the regular limitation period of three years (§§ 195, 199 BGB, German Civil Code). Periods of at least one year begin at the end of the calendar year in which the triggering event (e.g. the cancellation taking effect) occurred. You can find the storage period of cookies in the cookie settings.

6. Your Rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and the right to withdraw consent at any time with effect for the future (Art. 7(3)). An informal message to the address stated in Section 1 is sufficient.

Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests, you may object at any time on grounds relating to your particular situation. You may object to the use of your data for direct marketing at any time without giving reasons; we will then no longer use your data for this purpose. To do so, simply click the unsubscribe link in any marketing email or send a message to [email protected].

You also have the right to lodge a complaint with a supervisory authority, e.g. the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, Germany.

7. Provision of the Website, Hosting and Security

When you access suitespot.com, technically necessary data is processed (IP address, date and time, page accessed, referrer, browser and operating system). This serves the delivery, stability and security of the website (Art. 6(1)(f) GDPR). Server log files are deleted or anonymized after no more than 30 days, unless they are needed for longer to investigate a security incident.

Cloudflare (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA): content delivery network, protection against attacks and bots, anonymized performance measurement (Cloudflare Web Analytics). Third-country transfer: DPF.
Server hosting: We operate our application and its interface (api.suitespot.com) at DigitalOcean, LLC, 101 6th Ave, New York, NY 10013, USA, in a data center in Frankfurt am Main (Germany). Individual content pages (e.g. destination pages) are delivered via Netlify, Inc., 512 2nd Street, San Francisco, CA 94107, USA. Third-country transfer: DPF or Standard Contractual Clauses.
Sentry (Functional Software Inc., 132 Hawthorne Street, San Francisco, CA 94107, USA): detection of software errors; device and error information is processed in pseudonymized form (IP masking). Third-country transfer: DPF.
Google Fonts (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland): to display text consistently, we load fonts from Google servers (fonts.googleapis.com, fonts.gstatic.com). In the process, your IP address is transmitted to Google; a transfer to Google LLC in the USA is possible. The legal basis is our legitimate interest in a consistent presentation of our website (Art. 6(1)(f) GDPR). Third-country transfer: DPF.

8. Account, Membership and Partner Programs

For a suitespot account, we collect your name, email address and password (stored in encrypted form) as well as your language. With a suitespot Premium membership, you enter into a contract with reisetopia GmbH; for this purpose we additionally process membership type, start date, trial period, term, cancellation status, redeemed vouchers and payment information. The legal basis is Art. 6(1)(b) GDPR.

We use your email address to send you account-related messages (confirmation of registration, activation, information about the trial period, renewal, payments and changes to the services).

Membership via partners (e.g. UBS, Top Card): If your membership is included in a partner's card product, we verify your eligibility upon registration. We exchange with the partner only the data required to prove your eligibility and to settle the membership. The legal basis is Art. 6(1)(b) GDPR.

Chargebee (CHARGEBEE B.V., Piet Heinkade 55, 1019 GM Amsterdam, Netherlands): management of memberships, invoices and membership notifications (trial period, renewal, payment reminders). Third-country transfer: Standard Contractual Clauses.
Salesforce (salesforce.com Germany GmbH, Erika-Mann-Str. 31, 80636 München, Germany): customer relationship management (CRM), handling of inquiries and bookings, sending of service messages. Third-country transfer: Binding Corporate Rules for Processors approved by the European data protection authorities, and certification under the DPF.
Cancellation via “Cancel contracts here” (Formsite, Zapier): If you cancel via the button “Cancel contracts here”, you enter your details in a form provided by our service provider Formsite (Vroman Systems, Inc., a Formstack company, USA): name, email address or customer number, type and date of the cancellation, the reason in the case of an extraordinary cancellation, and the email address for the confirmation. If you are logged in, we pass on your name, email address and membership ID so that the form is prefilled. Formsite sends you the confirmation of receipt by email. Zapier (Zapier, Inc., 548 Market St #62411, San Francisco, CA 94104, USA) transfers the details to Salesforce, where our service team processes the cancellation. The legal basis is Art. 6(1)(b) and (c) GDPR in conjunction with Section 312k of the German Civil Code (BGB). Third-country transfer: Formsite Standard Contractual Clauses, Zapier DPF.

9. Bookings and Inquiries

When you book or make an inquiry via suitespot, we process the data required for this (travelers, dates, room preference, special requests, loyalty program number, contact details) and transmit it to the respective hotel or provider so that the booking and benefits can be implemented (Art. 6(1)(b) GDPR). Hotels and providers subsequently process your data under their own responsibility. We pass on your loyalty program number only if you provide it, so that points and status can be credited to you.

10. Payments

We process payments for memberships and bookings through payment service providers. They process card and account data under their own responsibility and may carry out fraud checks (Art. 6(1)(b) and (f) GDPR).

Adyen (Adyen N.V., Simon Carmiggeltstraat 6–50, 1011 DJ Amsterdam, Netherlands): processing of card payments and SEPA direct debits for memberships (connected via Chargebee, see Section 8), as well as card payments and card guarantees for bookings. When you sign up, Adyen verifies your card with an authorization of €1 or equivalent, which is not charged.
Card schemes (e.g. Visa, Mastercard, American Express) and, for SEPA direct debits, your bank.

11. Cookies and Consent Management

We use cookies and similar technologies. We use technically necessary cookies on the basis of § 25(2) TDDDG and Art. 6(1)(f) GDPR (e.g. storing your cookie choice, security, login). All other cookies – for statistics, functionality, social media and marketing – are used only with your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You can change or withdraw your choice at any time via "Cookie Settings" in the footer of the website.

OneTrust (OneTrust Technology Limited, 82 St John St, London EC1M 4JN, United Kingdom): management and documentation of your consents, including the IAB Transparency & Consent Framework (TCF). Third-country transfer: adequacy decision (UK).

12. Email Communication

12.1 Service and Contract Emails

We send messages that are necessary for the performance of your account, your membership or your bookings (e.g. confirmations, information on using your membership, notifications about the trial period, renewal and payments) on the basis of Art. 6(1)(b) GDPR. You cannot unsubscribe from these messages as long as the contractual relationship exists.

SendGrid (Twilio Ireland Limited, 25–28 North Wall Quay, Dublin 1, D01 H104, Ireland): sending of account and transactional emails. Third-country transfer: DPF.
Chargebee and Salesforce (see Section 8).

12.2 Newsletter (with Consent)

With your consent, we send you newsletters with offers, travel inspiration and news about suitespot (e.g. "Dealstag"). Registration takes place via the double opt-in procedure: you are only added after confirming the link in an email. We log the registration, confirmation, time and IP address as proof.

Our newsletters contain a so-called tracking pixel. It records whether and when a newsletter was opened and which links were clicked, so that we can improve our content. This measurement is part of the newsletter; the legal basis is your consent to receive the newsletter (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). If you do not want this measurement, you can unsubscribe from the newsletter at any time.

You can unsubscribe from the newsletter at any time via the unsubscribe link in any email or by sending a message to [email protected].

ActiveCampaign (ActiveCampaign, Inc., 1 N Dearborn St, 5th Floor, Chicago, IL 60602, USA): sending of newsletters, management of subscriptions, analysis. Third-country transfer: DPF.

12.3 Marketing of Our Own Similar Services to Customers

If you have taken out a suitespot Premium membership or made a booking with us, we may use the email address obtained in that context, even without separate consent, to inform you about our own similar services – for example hotel offers and benefits that you can book as a member – and to ask you to review our services (see Section 15). The legal basis is § 7(3) UWG (German Act against Unfair Competition) and Art. 6(1)(f) GDPR. This requires that we informed you of this use and of your right to object when we collected your email address. You may object to this use at any time without incurring any costs other than the transmission costs according to the basic rates – via the unsubscribe link in any email or by sending a message to [email protected]. We measure opens and clicks of these emails only with your consent.

13. Contact by Email, Phone and WhatsApp

When you contact us, we process your information in order to handle your request (Art. 6(1)(b) GDPR, otherwise point (f)). We store inquiries in our CRM (Salesforce).

WhatsApp (WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland): If you write to us via WhatsApp, WhatsApp processes your messages with end-to-end encryption; metadata may be transferred to Meta Platforms, Inc. in the USA (DPF). Alternatively, you can reach us at any time by email or phone.

14. Statistics and Marketing (Only with Consent)

Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland): audience measurement using a pseudonymous identifier and truncated IP address; cookies _ga, _ga_*. Third-country transfer: DPF.

In each case, the legal basis is your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR), which you can withdraw at any time in the cookie settings.

15. Reviews

Trustpilot (Trustpilot A/S, Pilestræde 58, 5th floor, 1112 Copenhagen, Denmark): display of customer reviews on our website (Art. 6(1)(f) GDPR).

Review invitations: After a booking or during your membership, we invite you by email to review your experience on Trustpilot. For this purpose, we transmit your name, email address and a reference number to Trustpilot so that a personal review link can be generated. Whether you leave a review is up to you; Trustpilot processes published reviews under its own responsibility. You can object to these invitations at any time – via the unsubscribe link or by sending a message to [email protected]. The legal basis for these invitations is § 7(3) UWG and Art. 6(1)(f) GDPR (see Section 12.3).

16. Social Media Presences

We maintain profiles on Instagram, Facebook, TikTok and X (formerly Twitter). When you interact with us there, the platform operators also process your data, in some cases in the USA. For page statistics ("Insights") on Facebook and Instagram, we are joint controllers with Meta Platforms Ireland Limited (Art. 26 GDPR).

17. Job Applications

Information on the processing of applicant data can be found in the reisetopia privacy policy at https://reisetopia.de/datenschutzerklaerung/#m210 (section "Bewerbungsverfahren", in German).