Privacy Policy
Version: 26 October 2026
How we process your data when you book and stay with us is explained in our privacy notice for guests: legal.bright-sight.com/privacy
1. Controller
1.1 The controller responsible for processing personal data on this website is Bright Sight GmbH, Virchowstraße 17a, 90409 Nürnberg, Germany, commercial register Amtsgericht Nürnberg HRB 36664 (referred to below as “we”). For data protection enquiries you can reach us at .
1.2 This policy applies to the websites astoria-apartments.de, lorenz-apartments.de, brunnen-apartments.de and brightsightapartments.com.
1.3 You can reach our Data Protection Officer, Daniel Schneiderbanger, at or by post at the address above, marked “Data Protection Officer, personal”.
2. Visiting the Website
2.1 When you open a page, your browser sends technically necessary information to our server: IP address, date and time, the page requested, the page visited before, and your browser and operating system. We process this information to deliver the website and to keep it secure and stable. The legal basis is Article 6(1)(f) GDPR, based on our legitimate interest in operating the website securely.
2.2 The website is run by a hosting provider in Germany that processes this data on our behalf.
2.3 Server logs are kept only for as long as needed to deliver the website and fend off attacks, and are then deleted automatically.
2.4 The connection to the website is encrypted.
3. Cookies and Consent
3.1 We store on your device only information that is strictly necessary to operate the website (Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG):
- a cookie that stores your choice in the consent banner, for 182 days;
- on the websites of the apartment houses, a cookie that stores your chosen language, for one year.
3.2 You can change your choice in the consent banner at any time, or withdraw it with effect for the future, using the “Cookie Settings” link at the bottom of every page. The legal basis for storing your choice is Article 6(1)(c) in conjunction with Article 7(1) GDPR.
4. Website Analytics
4.1 To understand how our websites are used, we use analytics software that runs on our own web server. It records the pages viewed, the time and length of the visit, the page visited before, the device type and browser, clicks on links and on the booking button, and which steps of the booking window are opened (such as dates, category, rate, summary, guest details). Entries made in the booking window, such as name, contact or payment details, are not recorded. Your IP address is shortened before it is stored, so that it can no longer be linked to you. No cookies are set, no information is stored on your device, and the data is not passed on to third parties.
4.2 The legal basis is Article 6(1)(f) GDPR, based on our legitimate interest in designing our websites to meet visitors’ needs.
4.3 We delete the individual visit records after six months. After that, only aggregated reports without any personal reference remain.
5. Booking Window
5.1 The websites of the apartment houses include the booking window of our booking and property management provider for direct bookings. It is only loaded when you click the booking button. Your browser then loads program code from this provider’s servers, and your IP address is transmitted to the provider. In doing so, the provider stores identifiers on your device and uses its own services for error analysis and for evaluating how its booking window is used. The legal basis is Article 6(1)(f) GDPR, based on our legitimate interest in letting you book directly on our website.
5.2 As soon as you enter details in the booking window, our privacy notice for guests applies.
6. Contact by E-mail
6.1 If you send us an e-mail, we process your details to answer your enquiry. The legal basis is Article 6(1)(b) GDPR where your enquiry concerns a booking or a stay, and otherwise Article 6(1)(f) GDPR, based on our legitimate interest in answering your enquiry.
6.2 We delete e-mails three years after receipt or dispatch, unless a statutory retention obligation applies.
7. Fonts and Links
7.1 The fonts used on our websites are loaded from our own server. No data is transmitted to third parties in doing so.
7.2 Our websites contain links to map services, booking platforms and other offerings. Data is transmitted to these providers only when you click a link. The provider concerned is responsible for the processing there.
8. Your Rights
8.1 You have the right of access (Article 15 GDPR), rectification (Article 16 GDPR), erasure (Article 17 GDPR), restriction of processing (Article 18 GDPR) and data portability (Article 20 GDPR). You may withdraw any consent at any time with effect for the future (Article 7(3) GDPR).
8.2 Right to object: You have the right to object at any time, on grounds relating to your particular situation, to processing based on Article 6(1)(f) GDPR (Article 21(1) GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
8.3 An e-mail to is sufficient for any request.
9. Right to Lodge a Complaint
9.1 Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR), in particular in the Member State of your habitual residence, place of work or place of the alleged infringement.
9.2 The authority responsible for us is the Bavarian Data Protection Authority, Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, Germany.
10. Other Information
10.1 Automated decision-making, including profiling, does not take place.
10.2 You are not obliged to provide us with personal data. Without the technical information listed in section 2, however, the website cannot be displayed.
10.3 We update this policy when the website or the legal requirements change. The version published here, with the version date shown above, applies.
