Updated 9 September 2026
Controller and scope
Apollo Trading UG, Arnstädter Straße 50, 99096 Erfurt, Germany, is the controller for personal data processed through this independent website. Contact booking@bahiapalace.org for privacy enquiries. This notice concerns our service; external websites and the venue are responsible for their own processing.
Information used to provide the service
Depending on your interaction, we process the contact details you enter, visitor and appointment selections, booking references, order status, relevant transaction references, and messages you send us. Website operation may also involve technical information such as IP addresses, browser information, session identifiers and security records. Please provide only information needed for the booking or enquiry, and ensure you are authorised to share another traveller's details.
Purposes and legal bases
We use necessary booking and contact information to respond to a request and perform the service contract under Article 6(1)(b) GDPR. Statutory accounting and other legal obligations may require processing under Article 6(1)(c). Protecting the website, investigating misuse and defending legal claims can rely on legitimate interests under Article 6(1)(f), subject to your rights and interests. Optional processing requiring consent relies on Article 6(1)(a); consent can be withdrawn without affecting earlier lawful processing.
Recipients
Information needed to fulfil a booking may be shared with the relevant venue or fulfilment provider. Hosting, booking software, communications and payment providers may process data as needed for their respective functions. Professional advisers or public authorities may receive information where necessary for legal obligations or claims. Access should be limited to the relevant purpose. We do not need your full card number or security code in a support email.
International processing
A visit in Morocco or the use of an overseas service provider may involve processing outside the European Economic Area. Where GDPR transfer rules apply, an appropriate legal transfer mechanism and safeguards are required. Contact us to ask which recipients, countries and safeguards apply to your booking.
Retention
Booking and support information is retained for as long as needed for the service, applicable recordkeeping duties and the establishment or defence of legal claims. Data that is no longer needed should be deleted or anonymised. Retention depends on the record and legal obligation; you can request information about your records.
Your rights
Subject to the conditions in applicable law, you may request access, correction, erasure, restriction and portability of your personal data. You may object to processing based on legitimate interests and withdraw consent for consent-based processing. Contact us to exercise these rights; proportionate information may be needed to verify identity. You may also lodge a complaint with a competent data protection supervisory authority, including one in your place of residence or the Thuringian authority responsible for our establishment.
Choices and required fields
Required booking fields identify information needed to process the requested booking. If it is not provided, the service may be unable to proceed. Cookie choices are explained in the Cookie Policy linked in the footer. Contact us if you need help understanding a field or how a decision affecting your booking was made.
Changes and enquiries
The date above identifies this version. Material changes to the way data is used should be reflected in this notice. Include your booking reference where relevant to a privacy enquiry, but never send a password or full payment-card details.
Contact and company details
Apollo Trading UG
Arnstädter Straße 50
99096 Erfurt, Germany
Company registration number: HRB 516591
booking@bahiapalace.org