Kirsebærkroen — The Inn Between
Last updated: 14 October 2026 · Version 1.0

This policy is available in Danish and English. In case of doubt or discrepancy, the Danish version prevails.

1. Data controller

The Inn Between ApS, which operates Kirsebærkroen — The Inn Between, is the data controller for the personal data we process about you.

The Inn Between ApS
Kirsebærvej 1, 4720 Præstø
Company reg. no.: 42076627
Phone: +45 51 95 05 59 (Mon–Fri 10:00–14:00)
Email: info@kirsebaerkroen.dk

2. What personal data we process

• Identification and contact details: name, address, email, phone number, country and language.
• Booking details: arrival and departure dates, room/accommodation, sauna times, table reservations, treatments, gift vouchers, number of guests, special requests.
• Payment details: card type, masked card number, transaction reference, and whether the stay is paid for by a company. Full card numbers are handled by our PCI-compliant payment provider, not by us.
• Identification at check-in: information from a passport or other photo ID where required by law.
• Communication: emails, messages and phone notes relating to your booking or your stay.
• Newsletter: your email address, your first name if you provide it, language, the topics you have chosen (for example sauna, the kitchen, rooms, retreats, events, that you live nearby), and records of your sign-up: which text you agreed to, when, on which page and from which IP address. Also whether you have opened our emails and clicked on links in them.
• Interests we infer from your purchases: which areas you have purchased in (rooms, sauna, retreats, food), which products, the date of your most recent purchase, and whether your stay is paid for by a company. Treatments (for example psychotherapy, NADA, connective tissue therapy and massage) are health data and are never used for marketing.
• Whether you live nearby: we assess whether you are likely to live near the inn. We base this on whether you have stayed in a room with us, what you have told us yourself and, if you have accepted marketing cookies, whether you usually visit our website from the area (see section 9).
• Audience and advertising data: where you have given consent, data used to segment audiences and to deliver and measure online advertising on third-party platforms.
• Technical information: IP address, browser type, device information and cookies when you use our website, including marketing and analytics cookies set with your consent.

3. Purposes and legal basis

We process your personal data for the following purposes (with reference to Article 6 of the GDPR):

• Administering your booking and your stay (Art. 6(1)(b), performance of a contract).
• Handling payments and refunds (Art. 6(1)(b)).
• Complying with legal obligations, including bookkeeping (Art. 6(1)(c)).
• Communicating about your booking, including service messages (Art. 6(1)(b)).
• Improving our services and securing our IT systems (Art. 6(1)(f), legitimate interest).
• Newsletter, if you have signed up: on the basis of your consent (Art. 6(1)(a) and section 10(1) of the Danish Marketing Practices Act). You confirm your sign-up via a link in an email before we write to you.
• Marketing to existing customers: if you have bought from us without signing up for the newsletter, we may write to you about similar services within the area you bought in, for example sauna if you bought sauna. This applies only if, when you made the purchase, you were clearly told that we would do so and could easily and free of charge say no. You can opt out at any time via the link in every email. This right ends 24 months after your most recent purchase in that area (section 10(2) of the Danish Marketing Practices Act and Art. 6(1)(f)).
• Targeting of newsletters: we group recipients by interests, purchases and whether they live nearby, so that you receive what is relevant to you (Art. 6(1)(a) and (f)). This is profiling within the meaning of the GDPR, but it produces no legal effects concerning you and does not similarly significantly affect you. It only determines which emails you receive.
• Digital marketing, including audience segmentation, advertising on third-party platforms and measuring campaign performance, where you have given consent (Art. 6(1)(a)).

4. Sources

We collect personal data directly from you, for example when you book, make a purchase or sign up for the newsletter, and from third-party booking platforms (for example Booking.com, Expedia, Hotels.com). Where relevant, we also collect it from payment providers, channel managers and advertising platforms that report on campaign performance. If you sign up for the newsletter without having been a guest, we create you as a contact in our guest system (Mews), so that we have one place for your data and choices.

5. Recipients and data processors

We disclose personal data to the following categories of recipient, who are either our data processors or independent data controllers:

• Mews Systems s.r.o.: our guest and property management system (data processor).
• The Rocket Science Group LLC (Mailchimp), USA: sending newsletters and handling sign-ups and unsubscribes (data processor).
• Payment providers: for processing card payments.
• Online travel agencies and channel managers: when bookings are made through their platforms.
• Communication and CRM providers: for guest communication and follow-up after a stay.
• Advertising, social media and analytics providers: for digital marketing and measurement where you have given consent. These may be joint controllers for parts of the processing.
• IT, hosting and email providers used in running our business.
• Auditors, bookkeepers and other advisers where necessary.
• Public authorities where required by law (for example tax or police authorities).

6. Transfers outside the EU/EEA

Some of our data processors may transfer personal data to countries outside the EU/EEA, including the United States. This applies in particular to Mailchimp and certain advertising, analytics and IT providers. Where this happens, we ensure an appropriate transfer basis, for example the EU-U.S. Data Privacy Framework, the European Commission's standard contractual clauses, or an adequacy decision.

7. Retention

• Booking and stay records: kept for as long as necessary to provide the service, and thereafter for up to 5 years from the end of the financial year in accordance with the Danish Bookkeeping Act.
• Newsletter: until you unsubscribe. After that, we keep only a record that you have unsubscribed, so that we do not write to you again.
• Records of your consent: for as long as we write to you, and then for up to 3 years, so that we can document that you said yes.
• Marketing to existing customers: ends 24 months after your most recent purchase in the area concerned.
• Where you visit the website from (section 9): individual visits are deleted after 13 months.
• Other CRM and marketing records: until you withdraw your consent or unsubscribe, and otherwise for up to 2 years of inactivity.
• Audience and advertising data shared with third-party platforms: in accordance with that platform's retention rules. They are removed when you withdraw your consent.
• Website data and cookies: see our cookie information for retention periods.

8. Your rights

Under the GDPR you have the right to:

• Access the personal data we process about you.
• Have inaccurate data corrected.
• Have data erased where the conditions for this are met.
• Have the processing restricted.
• Object to processing based on legitimate interest. You can always object to direct marketing, including profiling for that purpose, and we will then stop.
• Receive your data in a structured, commonly used and machine-readable format (data portability).
• Withdraw your consent at any time where processing is based on consent. This also covers unsubscribing from the newsletter (via the link in every email) and opting out of sharing audience data for advertising. Withdrawal does not affect the lawfulness of processing before the withdrawal.

To exercise your rights, contact us at info@kirsebaerkroen.dk. If you ask us to erase your data, we erase it both in our guest system and in Mailchimp, unless we are required to keep it, for example under the Danish Bookkeeping Act.

You also have the right to lodge a complaint with the Danish Data Protection Agency, Carl Jacobsens Vej 35, 2500 Valby, www.datatilsynet.dk.

9. Cookies and tracking

Our website uses cookies for functionality, statistics and, where you have given consent, marketing and advertising. This may include tracking pixels and similar technologies from third-party providers, which make it possible to measure the effect of our marketing and deliver relevant content on third-party platforms. You can change or withdraw your cookie consent at any time via the cookie banner on our website. Details of the cookies we use, their purpose and their retention period can be found in our separate cookie information.

Where you visit us from. If you have signed up for the newsletter and accepted marketing cookies, your browser stores a random number. When you later visit the website, we record, at most once a day, whether the visit came from the area around Præstø or from further away. We determine this from your IP address. The IP address itself is not stored, and visits from the inn's own network are not counted. Only when there is a pattern over several days do we use it to assess whether you live nearby. Individual visits are deleted after 13 months. If you withdraw your consent to marketing cookies, the recording stops.

We look up IP addresses in a database that we hold ourselves, so the IP address is not passed on. IP Geolocation by DB-IP (licence CC BY 4.0).

If you close our newsletter pop-up, your browser remembers this for 30 days so that it does not appear again.

10. Changes to this policy

We may update this privacy policy from time to time, including when we start using new tools, data processors or marketing channels. The current version is always available on our website, with the date it was last updated.