Data Privacy Statement of The George Hotel Hamburg GmbH

We appreciate you visiting our websites and we thank you for your interest in our hotel.

The protection of personal data is an important concern for us. Therefore, the processing of personal data is carried out in accordance with the applicable European and national legal provisions.

You can of course revoke your declaration(s) of consent at any time with effect for the future. Please contact the person responsible for this.

The following declaration provides an overview of the type of data collected, how this data is used and passed on, what security measures we take to protect your data and how you can obtain information about the information given to us.

Legal basis for the processing of personal data

Insofar as we obtain the consent of the data subject for processing operations involving personal data, Article 6 (1) sentence 1 lit. a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis.

When processing personal data that is necessary for the performance of a contract to which the data subject is a party, Article 6 (1) sentence b) GDPR serves as the legal basis. This also applies to processing operations that are necessary for the implementation of pre-contractual measures.

Insofar as the processing of personal data is necessary for the fulfilment of a legal obligation to which we are subject, Art. 6 (1) sentence 1 lit. c) GDPR serves as the legal basis.

If the processing is necessary to protect a legitimate interest of our company or a third party and the interests, fundamental rights and freedoms of the data subject do not outweigh the first-mentioned interest, Article 6 (1) sentence 1 lit. f) GDPR serves as the legal basis for the processing.

Data deletion and storage period

The personal data of the data subject will be deleted or blocked as soon as the purpose of the storage no longer applies. Storage may also take place if this has been provided for by the European or national legislator in Union regulations, laws or other provisions to which we are subject. Data will also be blocked or deleted if a storage period prescribed by the aforementioned standards expires, unless there is a necessity for the continued storage of the data for the conclusion or fulfilment of a contract.

The data controller and the data protection officer

Name and address of the person responsible

The responsible person within the meaning of the General Data Protection Regulation and other national data protection laws of the member states as well as other data protection provisions is:

The George Hotel Hamburg GmbH

Barcastr. 3

22087 Hamburg

Germany

Tel.: +49 (0) 40/ 2800 30-0

Fax: +49 (0) 40/ 2800 3030

Email: info@thegeorge-hotel.de

Website: www.thegeorge-hotel.de

Name and address of the data protection officer

The data protection officer of the data controller is:

Akwiso Data Protection & Audit

Dieter Grohmann

Beethovenstraße 23
87435 Kempten
Germany

Tel.: +49 (0) 831 5124-7030

Fax: +49 (0) 831 / 5124-7031
E-mail: info@akwiso.de

Website: www.akwiso.de

Definitions

The data protection declaration is based on the terms used by the European legislator when adopting the EU General Data Protection Regulation (hereinafter: "GDPR"). The data protection declaration is intended to be easy to read and understand. To ensure this, the most important terms are explained below:

a) Personal data means any information relating to an identified or identifiable natural person (hereinafter referred to as "data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

b) Data subject means any identified or identifiable natural person whose personal data are processed by the controller.

c) Processing is any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, filing, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

d) Profiling is any form of automated processing of personal data which consists in using such personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects relating to that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or change of location.

e) Pseudonymisation is the processing of personal data in such a way that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.

f) The controller or person responsible for processing is the natural or legal person, public authority, agency or other body which alone or jointly with others determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its designation may be provided for under Union or Member State law.

g) Processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

h) A recipient is a natural or legal person, public authority, agency or other body to whom personal data are disclosed, whether or not a third party. However, public authorities that may receive personal data in the context of a specific investigative task under Union or Member State law shall not be considered as recipients.

i) Third party means a natural or legal person, public authority, agency or other body other than the data subject, the controller, the processor and the persons authorised to process the personal data under the direct responsibility of the controller or the processor.

j) Consent shall mean any freely given specific and informed indication of the data subject's wishes in the form of a statement or other unambiguous affirmative act by which the data subject signifies his or her agreement to the processing of personal data relating to him or her.

Provision of the website and creation of log files

In the case of purely informational use of the website, i.e. if you do not register or otherwise transmit information to us, we automatically collect the following data and information from the computer system of the calling computer each time the website is called up:

a) The IP address of the user
b) Information about the browser type and version used
c) The operating system of the user
d) The user's internet service provider
e) Date and time of access
f) Websites from which the user's system accesses the Internet page
g) Websites that are called up by the user's system via our website
h) Content of the calls (concrete pages)
i) Amount of data transmitted in each case
j) Language and version of the browser software
k) Search engines used
l) Names of downloaded files

The data is also stored in the log files of our system. This data is not stored together with other personal data of the user.

The legal basis for the temporary storage of the log files is Art. 6 para. 1 p. lit. f) GDPR.

The temporary storage of the IP address by the system is necessary in order to

a) to enable delivery of the website to the user's computer. For this purpose, the user's IP address must remain stored for the duration of the session.
b) to optimise the content of our website and the advertising for it
c) Ensure the functionality of our information technology systems and the technology of our website
d) Provide law enforcement authorities with the information necessary for prosecution in the event of a cyber-attack.

The storage in log files is done to ensure the functionality of the website. In addition, we use the data to optimise the website and to ensure the security of our information technology systems. An evaluation of the data for marketing purposes does not take place in this context.

These purposes also constitute our legitimate interest in data processing pursuant to Art. 6 (1) sentence 1 lit. f) GDPR.

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected - in this case at the end of the usage process.

In the case of storage of data in log files, this is the case after seven days at the latest. Storage beyond this period is possible. In this case, the IP addresses are deleted or made anonymous so that it is no longer possible to assign the calling client.

The collection of data for the provision of the website and the storage of the data in log files is absolutely necessary for the operation of the website, which is why there is no possibility of objection.

Use of cookies

This website uses so-called cookies. Below you will find a list of cookies with a description of which ones are used.
Cookies are small text files that are sent to your browser by a web server as soon as you visit a website and are stored locally on your end device (PC, notebook, tablet, smartphone, etc.) and are stored on your computer and provide the user (i.e. us) with certain information. Cookies are used to make the website more customer-friendly and secure, and in particular to collect usage-related information, such as frequency of use and number of users of the pages and behaviour patterns of page use. Cookies do not cause any damage to the computer and do not contain viruses. This cookie contains a characteristic string of characters (known as a cookie ID) that enables the browser to be uniquely identified when the website is called up again.

We use cookies to make our website more user-friendly. Some elements of our website require that the calling browser can be identified even after a page change. The following data is stored and transmitted in the cookies:

Language settings
Items in a shopping cart

We also use cookies on our website that enable an analysis of your surfing behaviour. The following data can be transmitted in this way:

Search terms entered
Frequency of page views
Use of website functions

The data collected in this way is pseudonymised by technical precautions. Therefore, it is no longer possible to assign the data to the calling user. The data is not stored together with other personal data. When you access our website, you will be informed by an information banner about the use of cookies for analysis purposes and referred to this data protection declaration. In this context, you will also be informed how to prevent the storage of cookies in the browser settings.

The legal basis for the processing of personal data using cookies is Art. 6 para. 1 p. 1 lit. f) GDPR.

The purpose of using technically necessary cookies is to simplify the use of websites for you. Some functions of our website cannot be offered without the use of cookies. For these, it is necessary that the browser is recognised even after a page change.

We need cookies for the following applications:

Shopping cart
Adoption of language settings
Remembering search terms

The user data collected through technically necessary cookies are not used to create user profiles.

The purpose of using technically unnecessary cookies is to improve the quality of our website and its content. Through the analysis cookies, we learn how the website is used and can thus constantly optimise our offer. [This information is used to automatically recognise you when you visit the website again with the same end device and to make navigation easier for you. These purposes are also our legitimate interest in processing personal data according to Art. 6 (1) lit. f GDPR.

Cookies remain stored even if the browser session is terminated and can be accessed again when you visit the site again. However, cookies are stored on your computer and transmitted from it to our site. Therefore, you also have full control over the use of cookies. If you do not wish data to be collected via cookies, you can set your browser via the menu under "Settings" so that you are informed about the setting of cookies or generally exclude the setting of cookies or can also delete cookies individually. However, please note that the functionality of this website may be limited if cookies are deactivated. As far as session cookies are concerned, these will be automatically deleted after leaving the website anyway.

Newsletter

If you purchase goods or services from us and provide us with your e-mail address, we may subsequently use it to send you a newsletter. In such a case, only direct advertising for our own similar goods or services will be sent via the newsletter. The legal basis for sending the newsletter is Article 7 (3) UWG.

In order to avoid abusive or incorrect e-mail entries, we use the so-called double-opt-in procedure. This means that we send you an e-mail to the e-mail address you have provided, in which we ask you to confirm that the e-mail address is correct. If you do not confirm your details within 24 hours, your information will be blocked and automatically deleted after one month. In addition, we store your IP addresses and the times of registration and confirmation.

The collection of the user's email address serves to deliver the newsletter. The collection of other personal data in the context of the confirmation process pursuant to para. 2 serves to prevent misuse of the services or the e-mail address used.

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. Accordingly, the user's email address will be stored as long as you do not revoke receipt of the newsletter.

You can unsubscribe from receiving our emails at any time by clicking on the "Unsubscribe" box in our newsletter unsubscriber or by sending us a text message (email, letter or fax) to the contact details provided in the imprint, indicating that you no longer wish to receive our promotional emails.

Voucher sales via Incert

On our website we have integrated the voucher and ticket system of Incert eTourismus GmbH & Co. KG, Leonfeldnerstr. 328, A-404 Linz, www.incert.at for ordering vouchers.
If you order vouchers from us, it is necessary for the conclusion of the contract that you provide your personal data, which we require for the processing of your order. Mandatory data required for the processing of the contract are marked separately, other data are voluntary. The data is entered in an input mask and transmitted to us and stored. The following data is collected during the booking process:

IP address
Date and time of booking
Salutation
Title, if applicable
Name
Date of birth
Address
E-mail addresses
Telephone number
Country
Purchased vouchers
Payment method
Posting date
Value/amount
Gift cards
Different billing address, if applicable
If applicable, depending on the payment method, further data - see under payment services.

Apart from that, data is only passed on to third parties if the passing on is necessary for the purpose of processing the contract or for billing purposes or for collecting the fee, or if you have expressly consented to this. In this respect, we only pass on the data required in each case. The data recipients are the respective delivery/shipping company (transfer of name and address)

Collection companies, insofar as the payment must be collected (forwarding of name, address, order details), payment institutions for the purpose of collecting debts, insofar as you have selected direct debit as the payment method, payment service providers - depending on the selection of the payment method. The legal basis is Art. 6 para. 1 p. 1 lit. b) GDPR. With regard to the voluntary data, the legal basis for the processing of the data is Art. 6 para. 1 p. 1 lit. a) GDPR. An order processing contract has been concluded between the data controller and Incert.

The compulsory data collected is necessary for the fulfilment of the contract with the user (for the purpose of sending the goods and confirming the content of the contract). We therefore use the data to answer your enquiries, to process your booking, if necessary to check creditworthiness or to recover a debt and for the purpose of technical administration of the websites. The voluntary information is provided for the prevention of misuse and, if necessary, for the investigation of criminal offences. We may also process the data you provide to inform you about other interesting products from our portfolio or to send you e-mails with information.

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. Due to commercial and tax law requirements, we are obliged to store your address, payment and order data for a period of ten years after the execution of the contract. However, we restrict processing after 7 years, i.e. your data is only used to comply with legal obligations. If a continuing obligation exists between us and the user, we store the data for the entire duration of the contract and for ten years thereafter (see above). With regard to data provided voluntarily, we will delete the data upon expiry of 7 years after the execution of the contract, provided that no further contract is concluded with the user during this period; in this case, the data will be deleted upon expiry of 7 years after the execution of the last contract.

If the data is required for the fulfilment of a contract or for the implementation of pre-contractual measures, early deletion of the data is only possible insofar as contractual or legal obligations do not prevent deletion. Otherwise, you are free to have the personal data provided during registration completely deleted from the data stock of the person responsible in accordance with § 1. With regard to the voluntary data, you can declare your revocation to the person responsible according to § 1 at any time. In this case, the voluntary data will be deleted immediately.

Registration

We offer you the opportunity to register on our website by providing personal data. The data is entered in an input mask and transmitted to us and stored. As a matter of principle, this data is not passed on to third parties unless there is a legal obligation to pass it on or the passing on serves criminal or legal prosecution purposes.

The following data is collected as part of the registration process:

E-mail address
IP address
Date and time of registration

You can manage and change all details in the protected customer area. In the frame of the registration process, the user's consent to the processing of these Data obtained.

We use the so-called double-opt-in procedure for registration. This means that after you have registered, we will send you an email to the email address you have provided in which we ask you to confirm that you wish to register. If you do not confirm your registration within 48 hours, your information will be blocked and automatically deleted after one month. In addition, we store your respective IP addresses used and times of registration and confirmation. The purpose of this procedure is to be able to prove your registration and, if necessary, to clarify a possible misuse of your personal data.

The legal basis for the processing of the data is Art. 6 para. 1 p. 1 lit. a) GDPR if the user has given his consent.

If the registration serves the fulfilment of a contract to which you are a party or the implementation of pre-contractual measures, the additional legal basis for the processing of the data is Art. 6 para. 1 sentence 1 lit. b) GDPR.

Registration is necessary for the performance of the contract or for the implementation of pre-contractual measures. (further description of the contract; norms according to EGBGB and BGB)

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected.

This is the case for data collected during the registration process for the fulfilment of a contract or for the implementation of pre-contractual measures if the data is no longer required for the implementation of the contract. Even after the conclusion of the contract, it may be necessary to store personal data of the contractual partner in order to fulfil contractual or legal obligations. Continuing obligations require the storage of personal data during the term of the contract. In addition, warranty periods must be observed and data must be stored for tax purposes. The storage periods to be observed cannot be determined in general terms, but must be determined for each individual contract and contracting party.

If the data is required for the performance of a contract or for the implementation of pre-contractual measures, early deletion of the data is only possible insofar as contractual or legal obligations do not prevent deletion.

Otherwise, you are free to have the personal data provided during registration completely deleted from the controller's database. The controller will provide you with information on the personal data stored about the data subject at any time upon request. Furthermore, the controller shall correct or delete personal data at the request or indication of the data subject, insofar as this does not conflict with any statutory retention obligations. You can write to the data controller or the data protection officer in accordance with § 1 at any time by e-mail or post and ask for the data to be deleted/changed.

E-commerce

If you would like to order in our webshop, it is necessary for the conclusion of the contract that you provide your personal data, which we need for the processing of your order. Mandatory data required for the processing of contracts are marked separately, other data are voluntary. The data is entered in an input mask and transmitted to us and stored.

The following data is collected within the framework of the webshop:

Name
Address (different billing address, if applicable)
E-mail address
Telephone number
Bank details
IP address
Date and time of the order

Data will only be passed on to third parties if this is necessary for the purpose of processing the contract or for billing purposes or for collecting the fee, or if you have expressly consented to this. In this regard, we only pass on the data required in each case.

The data recipients are

Collection companies, insofar as payment must be collected (disclosure of name, address, order details)
The bank to collect the payment, insofar as the payment is made via direct debit
Accounting

The legal basis is Art. 6 para. 1 p. 1 lit. b) GDPR. With regard to voluntary data, the legal basis for the processing of the data is Art. 6 para. 1 p. 1 lit. a) GDPR.

The compulsory data collected is required for the fulfilment of the contract with the user (for the purpose of sending the goods and confirming the content of the contract). We therefore use the data to answer your enquiries, to process your order, if necessary to check creditworthiness or to recover a debt and for the purpose of technical administration of the websites. The voluntary information is provided to prevent misuse and, if necessary, to investigate criminal offences. We may also process the data you provide to inform you about other interesting products from our portfolio or to send you e-mails with technical information.

If a continuing obligation exists between us and the user, we store the data for the entire duration of the contract and for ten years thereafter (see above). With regard to data provided voluntarily, we will delete the data upon expiry of two years after execution of the contract, provided that no further contract is concluded with the user during this period; in this case, the data will be deleted upon expiry of two years after execution of the last contract. Statutory retention periods remain unaffected and take precedence.

DialogShift chat application on our website

Our website uses the chat application of DialogShift GmbH, Rheinsberger Str. 76/77, 10115 Berlin. This application processes and stores data for the purpose of web analysis, to operate the chat application and to respond to enquiries.

For the operation of the chat function, the chat texts are stored and a cookie with a unique ID is set - this is used to recognise you as a customer.
A cookie is a small text file that is stored locally in the cache on your device. Using this cookie, our application recognises the device and can retrieve past chat logs. This cookie is stored for 90 days since last use. You can disable the storage of cookies in your browser settings. However, without the use of cookies, the chat function will not work.

The possible disclosure of e.g. name, e-mail address or a telephone number is voluntary and with the consent to temporarily use and store this data for the purpose of contacting you until the end of the contact. This personal data is deleted after 90 days.

The legal basis for data processing is Article 6 (1) lit. f GDPR based on our legitimate interest in effective customer service, for statistical analysis of user behaviour and for optimisation purposes of our offers.

DialogShift offers further information on the collection and use of data as well as your rights and options for protecting your privacy at https://www.dialogshift.com/datenschutz.

Otherwise, you are free to have the personal data provided during registration completely deleted from the controller's database. The controller will provide you with information about which personal data is stored about you at any time upon request. Furthermore, the controller will correct or delete personal data at the request or indication of the data subject, provided that this does not conflict with any statutory retention obligations. You can write to the data controller or the data protection officer in accordance with § 1 at any time by e-mail or post and ask for the data to be deleted/changed.

Disclosure of personal data to third parties

Embedding YouTube videos

We have integrated YouTube videos into our online offer, which are stored on http://www.YouTube.com and can be played directly from our website. [These are all integrated in "extended data protection mode", i.e. no data about you as a user is transmitted to YouTube if you do not play the videos. Only when you play the videos will the data mentioned in paragraph 2 be transmitted. We have no influence on this data transmission. By visiting the website, YouTube receives the information that you have accessed the corresponding sub-page of our website.

The following data will be transmitted

Device-specific information, for example, the hardware used; the version of the operating system; unique device identifier and mobile network information including your phone number.
Log data in the form of server logs. These include, but are not limited to, details of how the services were used, such as search queries; IP address; hardware settings; browser type; browser language; date and time of your request; source page; cookies that uniquely identify your browser or Google account.
Location-based information. Information about your actual location may be collected by Google. This may include, for example, your IP address, Wi-Fi access points or cell towers.
For more information on the data collected by Google LLC. please see the following link: https://policies.google.com/privacy?hl=de&gl=de

This takes place regardless of whether YouTube provides a user account via which you are logged in or whether no user account exists. If you are logged in to Google, your data will be directly assigned to your account.

The legal basis for the processing of the users' personal data is Art. 6 para. 1 sentence 1 lit. f) GDPR.

The integration of the videos serves to make the website more vivid for the user and to increase the search engine ranking of the website on Google. YouTube stores your data as usage profiles and uses them for the purposes of advertising, market research and/or demand-oriented design of its website. Such an evaluation is carried out in particular (even for users who are not logged in) to provide needs-based advertising and to inform other users of the social network about your activities on our website.

If you do not wish to be associated with your YouTube profile, you must log out before activating the button.

You have the right to object to the creation of these user profiles, and you must contact YouTube to exercise this right.

For more information on the purpose and scope of data collection and processing by YouTube, please see the privacy policy. There you will also find further information on your rights and setting options to protect your privacy: https://www.google.de/intl/de/policies/privacy.

Data transmission upon conclusion of a contract for services and digital content

We only transmit personal data to third parties if this is necessary for the processing of the contract, for example to the credit institution commissioned with the processing of payments.

No further transmission of data will take place or only if you have expressly consented to the transmission. Your data will not be passed on to third parties without your express consent, for example for advertising purposes.

The basis for the data processing is Art. 6 para. 1 lit. b) GDPR, which permits the processing of data for the fulfilment of a contract or pre-contractual measures.

Payment methods

With us, you can pay in different ways. Whether on, PayPal, credit card or voucher - choose the option that suits you best. There are no additional costs for any of the alternatives offered. In principle, we reserve the right to limit the selection of payment options based on our own risk assessments.

If, after the conclusion of a contract with costs, there is an obligation to provide us with your payment data (e.g. account number in the case of direct debit authorisation), this data is required for the processing of payments.

Payment transactions via the common means of payment are made exclusively via an encrypted SSL or TLS connection. You can recognise an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line.

With encrypted communication, your payment data that you transmit to us cannot be read by third parties.

11.1 Admissions (Online Ticketing)

Mastercard https://www.mastercard.de/de-de/datenschutz.html
Visa https://www.visa.de/promotions/geldzurueck/datenschutz.html
Paypal https://www.paypal.com/de/webapps/mpp/ua/privacy-full
Voucher

Links to external websites

This website contains links to external sites. We are responsible for our own content. We have no influence on the contents of external links and are therefore not responsible for them, in particular we do not adopt their contents as our own. If you are directed to an external site, the data protection declaration provided there applies. If you notice any illegal activities or content on this site, you are welcome to point this out to us. In this case we will check the content and react accordingly (notice and take down procedure).

Contact form and e-mail contact

Our website contains a contact form that can be used to contact us electronically. If you use this option, the data entered in the input mask will be transmitted to us and stored.

These data are:

First name, last name
Telephone number
Message
E-mail

The following data is also stored at the time the message is sent:

IP address of the user
Date and time of registration

For the processing of the data, your consent is obtained during the submission process and reference is made to this privacy policy.

Alternatively, it is possible to contact us via the e-mail address provided. In this case, the personal data transmitted with the e-mail will be stored.

Insofar as this involves information on communication channels (e.g. e-mail address, telephone number), you also consent to us contacting you via this communication channel, if necessary, in order to respond to your request.

In this context, the data will not be passed on to third parties. The data is used exclusively for processing the conversation.

The legal basis for the processing of data is Art. 6 para. 1 p. lit. a) GDPR if the user has given his or her consent. The legal basis for the processing of data transmitted in the course of sending an e-mail is Art. 6 para. 1 p. 1 lit. f) GDPR. If the e-mail contact aims at the conclusion of a contract, the additional legal basis for the processing is Art. 6 para. 1 p. 1 lit. b) GDPR.

The processing of the personal data from the input mask serves us solely to process the contact. We will of course use the data from your e-mail enquiries exclusively for the purpose for which you provided them when contacting us. In the case of contacting us by e-mail, we also have the necessary legitimate interest in processing the data. The other personal data processed during the sending process serve to prevent misuse of the contact form and to ensure the security of our information technology systems.

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. For the personal data from the input mask of the contact form and those sent by e-mail, this is the case when the respective conversation with the user has ended. The conversation is ended when the circumstances indicate that the matter in question has been conclusively clarified. The additional personal data collected during the sending process will be deleted after a period of seven days at the latest.

You have the possibility to revoke his consent to the processing of personal data at any time. If you contact us by e-mail, you can object to the storage of your personal data at any time. In such a case, the conversation cannot be continued. Regarding the revocation of consent/opposition to storage, we ask you to contact the person responsible or the data protection officer as per § 1 via e-mail or by post. All personal data stored in the course of contacting us will be deleted in this case.

Request by e-mail, telephone or fax

If you contact us by e-mail, telephone or fax, your enquiry including all resulting personal data (name, enquiry) will be stored and processed by us for the purpose of processing your request. We will not pass on this data without your consent.

The processing of this data is based on Art. 6 (1) lit. b) GDPR if your request is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on your consent (Art. 6 para. 1 lit. a) GDPR) and/or on our legitimate interests (Art. 6 para. 1 lit. f) GDPR), as we have a legitimate interest in effectively processing the enquiries addressed to us.

The data you send to us via contact requests will remain with us until you request us to delete it, revoke your consent to store it or the purpose for storing the data no longer applies (e.g. after we have completed processing your request). Mandatory statutory provisions - in particular statutory retention periods - remain unaffected.

Use and application of web analysis by Google Analytics

We use the analysis tracking tool Google Analytics (GA) of the American company Google LLC on our website. For the European area, the company Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland) is responsible for all Google services. Google Analytics collects data about your actions on our website. For example, when you click on a link, this action is stored in a cookie and sent to Google Analytics. The reports we receive from Google Analytics help us to better tailor our website and service to your preferences. In the following, we will go into more detail about the tracking tool and inform you in particular about what data is stored and how you can prevent this.

Google Analytics is a tracking tool used to analyse the traffic on our website. In order for Google Analytics to work, a tracking code is built into the code of our website. When you visit our website, this code records various actions you take on our website. As soon as you leave our website, this data is sent to the Google Analytics servers and stored there.

Google processes the data and we receive reports about your user behaviour. These reports may include, but are not limited to, the following:

Target group reports: Through target group reports we get to know our users better and know more precisely who is interested in our service.
Ad reports: Ad reports make it easier for us to analyse and improve our online advertising.
Acquisition reports: Acquisition reports give us helpful information on how to get more people interested in our service.
Behavioural reports: This tells us how you interact with our website. We can track the path you take on our site and which links you click on.
Conversion reports: Conversion is the name given to a process in which you take a desired action as a result of a marketing message. For example, when you go from being just a website visitor to a buyer or newsletter subscriber. These reports help us learn more about how our marketing efforts are working for you. This is how we want to increase our conversion rate.
Real-time reports: Here we always know immediately what is happening on our website. For example, we can see how many users are currently reading this text.

Our goal with this website is clear: we want to offer you the best possible service. The statistics and data from Google Analytics help us to achieve this goal.

The statistically evaluated data show us a clear picture of the strengths and weaknesses of our website. On the one hand, we can optimise our site so that it is found more easily by interested people on Google. On the other hand, the data helps us to better understand you as a visitor. We thus know exactly what we need to improve on our website in order to offer you the best possible service. The data also helps us to carry out our advertising and marketing measures in a more individual and cost-effective way. After all, it only makes sense to show our products and services to people who are interested in them.

Google Analytics uses a tracking code to create a random, unique ID that is linked to your browser cookie. This is how Google Analytics recognises you as a new user. The next time you visit our site, you will be recognised as a "returning" user. All collected data is stored together with this user ID. This is what makes it possible to evaluate pseudonymous user profiles in the first place.

In order to be able to analyse our website with Google Analytics, a property ID must be inserted into the tracking code. The data is then stored in the corresponding property. For each newly created property, the Google Analytics 4 property is standard. Alternatively, you can also create the Universal Analytics property. Depending on the property used, data is stored for different periods of time.

Identifiers such as cookies and app instance IDs are used to measure your interactions on our website. Interactions are all types of actions you take on our website. If you also use other Google systems (such as a Google Account), data generated through Google Analytics may be linked to third-party cookies. Google does not share Google Analytics data unless we, as the website operator, authorise it. Exceptions may occur if required by law.

Google creates so-called heat maps. Heat maps show exactly those areas that you click on. This gives us information about where you are "travelling" on our site.

Google defines session duration as the time you spend on our site without leaving. If you have been inactive for 20 minutes, the session ends automatically.

Bounce rate: A bounce is when you view only one page on our website and then leave our website again.

Account creation: When you create an account or place an order on our website, Google Analytics collects this data.

The IP address is only shown in abbreviated form so that no clear assignment is possible.

The IP address can be used to determine the country and your approximate location. This process is also called IP location determination.

Technical information includes your browser type, internet service provider or screen resolution.

Source of origin: Google Analytics or, of course, we are also interested in which website or which advertisements you came to our site from.

Other data include contact details, any ratings, playing media (e.g. when you play a video via our site), sharing content via social media or adding to your favourites. This list does not claim to be complete and only serves as a general orientation of the data storage by Google Analytics.

Google has their servers spread all over the world. Most servers are located in America and consequently your data is mostly stored on American servers. You can read exactly where Google's data centres are located here: https://www.google.com/about/datacenters/locations/?hl=de

Your data is distributed on different physical data carriers. This has the advantage that the data can be retrieved more quickly and is better protected against manipulation. In every Google data centre, there are corresponding emergency programmes for your data. If, for example, the hardware at Google fails or natural disasters paralyse servers, the risk of a service interruption at Google still remains low.

The retention period of the data depends on the properties used. When using the newer Google Analytics 4 properties, the retention period of your user data is set to 14 months. For other so-called event data, we have the option to choose a retention period of 2 months or 14 months.

For Universal Analytics properties, Google Analytics has a default retention period of 26 months for your user data. Then your user data is deleted. However, we have the option to choose the retention period of user data ourselves. Five variants are available to us for this purpose.

In addition, there is also the option that data is only deleted when you no longer visit our website within the period we have chosen. In this case, the retention period is reset each time you visit our website again within the specified period.

Once the specified period has expired, the data is deleted once a month. This retention period applies to your data linked to cookies, user recognition and advertising IDs (e.g. DoubleClick domain cookies). Reporting results are based on aggregated data and are stored separately from user data. Aggregated data is a merging of individual data into a larger unit.

Under European Union data protection law, you have the right to access, update, delete or restrict your data. You can prevent Google Analytics from using your data by using the browser add-on to deactivate Google Analytics JavaScript (ga.js, analytics.js, dc.js). You can download and install the browser add-on at https://tools.google.com/dlpage/gaoptout?hl=de. Please note that this add-on only disables the collection of data by Google Analytics.

If you generally want to deactivate, delete or manage cookies, you will find the corresponding links to the respective instructions of the most popular browsers under the section "Cookies".

The use of Google Analytics requires your consent, which we have obtained with our cookie pop-up. According to Art. 6 para. 1 lit. a GDPR (consent), this consent constitutes the legal basis for the processing of personal data, as may occur during the collection by web analytics tools.

In addition to consent, we have a legitimate interest in analysing the behaviour of website visitors in order to improve our offer technically and economically. With the help of Google Analytics, we recognise website errors, can identify attacks and improve economic efficiency. The legal basis for this is Art. 6 para. 1 lit. f GDPR (legitimate interest). Nevertheless, we only use Google Analytics if you have given your consent.

Google also processes data from you in the USA, among other places. We would like to point out that according to the opinion of the European Court of Justice, there is currently no adequate level of protection for the transfer of data to the USA. This may be associated with various risks for the legality and security of the data processing.

Google uses so-called standard contractual clauses (= Art. 46 para. 2 and 3 GDPR) as the basis for data processing for recipients based in third countries (outside the European Union, Iceland, Liechtenstein, Norway, i.e. in particular the USA) or for data transfer there. Standard Contractual Clauses (SCC) are templates provided by the EU Commission and are intended to ensure that your data comply with European data protection standards even if they are transferred to third countries (such as the USA) and stored there. Through these clauses, Google undertakes to comply with the European level of data protection when processing your relevant data, even if the data is stored, processed and managed in the US. These clauses are based on an implementing decision of the EU Commission. You can find the decision and the corresponding standard contractual clauses here, among other places: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de

The Google Ads Data Processing Terms, which refer to the standard contractual clauses, can be found at https://business.safety.google/intl/de/adsprocessorterms/.

If you want to learn more about the tracking service, we recommend these two links:
https://marketingplatform.google.com/about/analytics/terms/de/ as well as https://support.google.com/analytics/answer/6004245?hl=de

Social Media Plugins

Facebook
Social plugins of the social network Facebook (Facebook, 1601 South California Avenue, Palo Alto, CA 94304, USA) are used on these pages. This plugin allows you to bookmark these pages and thus share them with other participants of the social network. You can recognise this plugin by the Facebook logo or the typical "Like" button. You can find an overview of the Facebook plugins at http://developers.facebook.com/docs/plugins/.
We use the so-called two-click solution. This means that when you visit our site, no personal data is initially passed on to Facebook. We give you the opportunity to communicate directly with Facebook via the button. Only when you click on the marked field and thereby activate it, does Facebook receive the information that you have accessed the corresponding website of our online offer.
The data transfer takes place regardless of whether you have an account with Facebook and are logged in there.
If you click the Facebook "Like" button while logged into your Facebook account, the content of these pages can also be linked to your Facebook profile. In this case, Facebook can also assign the visit to these pages to your user account. If you click the activated button and link to the page, for example, Facebook will also store this information in your user account and share it publicly with your contacts. We recommend that you log out regularly after using a social network, but especially before activating the button, as this will prevent it from being assigned to your profile.
If you are not a member of Facebook or have logged out of Facebook before visiting this site, it is still possible that Facebook will obtain and store your IP address. If you do not want Facebook to be able to associate your visit to our website with your Facebook user account, you must log out of Facebook before visiting our website or do not activate the plugin.
In this case, the following data is generally transmitted to Facebook:
Browser-related data such as IP address, browser type, operating system, time and date of the request, website visited.
User ID (if a Facebook account is logged in)
According to Facebook in Germany, the IP addresses are anonymised immediately after collection. By activating the plugin, personal data is therefore transmitted from you to Facebook and stored in the USA. Since Facebook collects data in particular via cookies, we recommend that you delete all cookies via your browser's security settings before clicking on the greyed-out box.
We have no influence on the data collected and data processing procedures, nor are we aware of the full extent of the data collection, the purposes of the processing, the storage periods. We also have no information on the deletion of the collected data by Facebook.
Facebook stores the data collected about you as usage profiles and uses these for the purposes of advertising, market research and/or designing its website in line with requirements. Such an evaluation is carried out in particular (also for users who are not logged in) for the display of needs-based advertising and to inform other users of the social network about your activities on our website. Via the plugins, we offer you the opportunity to interact with the social networks and other users so that we can improve our offer and make it more interesting for you as a user. The
legal basis for the use of the plugins is Art. 6 para. 1 p. 1 lit. a GDPR.
You have the right to object to the creation of these user profiles, whereby you must contact Facebook to exercise this right.
Settings and objections to the use of data for advertising purposes are possible within the Facebook profile settings at https://www.facebook.com/settings?tap=ads. Further information on the purpose and scope of the data collection and its processing as well as your respective rights by and vis-à-vis Facebook can be found at http://www.facebook.com/policy.php, http://www.facebook.com/help/186325668085084, http://www.facebook.com/about/privacy/your-info-on-other#applications and http://www.facebook.com/about/privacy/your-info#everyoneinfo.

Instagram
Social plugins of the social network InstagramMeta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland)are used on these pages. This plugin allows you to bookmark these pages and thus share them with other participants of the social network. You can recognise the plugin by the square camera, possibly with the lettering "in".

We use the so-called two-click solution. This means that when you visit our site, no personal data is initially passed on to Instagram. We give you the opportunity to communicate directly with Instagram via the button. Only if you click on the marked field and thereby activate it, Instagram receives the information that you have called up the corresponding website of our online offer.

The data transfer takes place regardless of whether you have an account with Instagram and are logged in there.
If you click on the Instagram button while logged into your Instagram account, the content of these pages can be linked to your Instagram profile. In this case, Instagram can also assign the visit to these pages to your user account. If you click the activated button and link to the page, for example, Instagram also saves this information in your user account and shares it publicly with your contacts. We recommend that you log out regularly after using a social network, but especially before activating the button, as this will help you to avoid an assignment to your profile.

If you are not a member of Instagram or have logged out of Instagram before visiting this page, there is still the possibility that Instagram will find out and save your IP address. If you do not want Instagram to be able to assign your visit to our pages to your Instagram user account, you must log out of Instagram before visiting our website or must not activate the plugin.

The following data is generally transmitted to Instagram: -
IP address, browser type, date and time of access, original page, operating system, screen resolution
- linking of this data with your account data of the social media operator.

By activating the plugin, your personal data is transmitted to Instagram and stored in the USA.
Instagram stores the data collected about you as usage profiles and uses them for purposes of advertising, market research and/or demand-oriented design of its website. Such an evaluation is carried out in particular (also for users who are not logged in) for the display of needs-based advertising and to inform other users of the social network about your activities on our website. Via the plugins, we offer you the opportunity to interact with the social networks and other users so that we can improve our offer and make it more interesting for you as a user. This is also our legitimate interest.

The legal basis for the use of the plugins is Art. 6 para. 1 p. 1 lit. f) GDPR. There is therefore a risk that your data will be processed by US authorities for control and monitoring purposes without you having your data subject rights or other legal remedies.

We have no influence on the data collected and data processing procedures, nor are we aware of the full extent of the data collection, the purposes of the processing, the storage periods. We also have no information on the deletion of the collected data by Instagram.
You have the right to object to the creation of these user profiles, whereby you must contact Instagram to exercise this right.

Further information on the purpose and scope of the data collection and its processing as well as on your respective rights by and vis-à-vis Instagram can be found at http://instagram.com/about/legal/privacy/.

Processing data (customer and contract data)

We collect, process and use personal data only insofar as they are necessary for the establishment, content or amendment of the legal relationship (inventory data). This is done on the basis of Art. 6 para. 1 lit. b) GDPR, which permits the processing of data for the fulfilment of a contract or pre-contractual measures. We collect, process and use personal data about the use of our internet pages (usage data) only insofar as this is necessary to enable the user to use the service or to bill the user.

The collected customer data will be deleted after completion of the order or termination of the business relationship. Statutory retention periods remain unaffected.

Applications

We offer you the opportunity to apply to us (e.g. by e-mail, post or via the online application form). In the following, we inform you about the scope, purpose and use of your personal data collected as part of the application process. We assure you that the collection, processing and use of your data will be carried out in accordance with applicable data protection law and all other legal provisions and that your data will be treated in strict confidence.

If you send us an application, we process your associated personal data (e.g. contact and communication data, application documents, notes in the context of job interviews, etc.) to the extent that this is necessary to decide on the establishment of an employment relationship. The legal basis for this is § 26 BDSG-neu under German law (initiation of an employment relationship), Art. 6 para. 1 lit. b) GDPR (general contract initiation) and - if you have given your consent - Art. 6 para. 1 lit. a) GDPR. The consent can be revoked at any time. Your personal data will only be passed on within our company to persons who are involved in processing your application.

If the application is successful, the data submitted by you will be stored in our data processing systems on the basis of § 26 BDSG-neu and Art. 6 para. 1 lit. b) GDPR for the purpose of implementing the employment relationship.

If we are unable to make you a job offer, you reject a job offer, withdraw your application, revoke your consent to data processing or request us to delete the data, the data you have provided, including any remaining physical application documents, will be stored or retained (retention period) for a maximum of 6 months after completion of the application process in order to be able to trace the details of the application process in the event of discrepancies (Art. 6 (1) f) GDPR).

YOU CAN OBJECT TO THIS STORAGE IF YOU HAVE LEGITIMATE INTERESTS THAT OUTWEIGH OUR INTERESTS.

After the retention period has expired, the data will be deleted unless there is a legal obligation to retain the data or another legal reason for further storage. If it is evident that it will be necessary to retain your data after the retention period has expired (e.g. due to an impending or pending legal dispute), the data will only be deleted once it has become irrelevant. Other statutory retention obligations remain unaffected.

Hotelcareer / Job offers

In order to be able to offer the services of Hotelcareer, a widget from Hotelcareer is integrated on this page. The provider of this widget is StepStone Deutschland GmbH (Völklinger Straße 1, 40219 Düsseldorf) - hereinafter referred to as Stepstone. 2.
In order to use the functions of the Hotelcareer widget, it is necessary to store your IP address, browser information (name, version), website, user's operating system, user's screen resolution, language settings of the browser or the user's operating system. If you use Hotelcareer, this data is usually transmitted to a Stepstone server and stored there. We have no influence on this data transmission. The use of Hotelcareer is in the interest of simple and convenient use.
3. the legal basis for the use of the Hotelcareer widget is the balance of interests pursuant to Art. 6 (1) lit. f GDPR.
4 Stepstone uses the cookie "AWSALBCORS". For
further information on the handling of user data at Stepstone, please refer to the privacy policy at: https://www.hotelcareer.de/datenschutzerklärung./.

SSL encryption

For reasons of security and to protect the transmission of confidential content, such as enquiries that you send to us as the site operator, this site uses SSL encryption. You can recognise an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line. If SSL encryption is activated, the data you transmit to us cannot be read by third parties.

Rights of the data subject

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller:

Right to information

You may request confirmation from the controller as to whether personal data concerning you are being processed by us. If such processing is taking place, you may at any time request from the controller free of charge information about the personal data stored about you and about the following information:

a) the purposes for which the personal data are processed;

b) the categories of personal data which are processed;

c) the recipients or categories of recipients to whom the personal data concerning you have been or will be disclosed;

d) the planned duration of the storage of the personal data relating to you or, if specific information on this is not possible, criteria for determining the storage duration;

e) the existence of a right to rectify or erase personal data concerning you, a right to have processing restricted by the controller or a right to object to such processing;

f) the existence of a right of appeal to a supervisory authority;

g) any available information on the origin of the data if the personal data are not collected from the data subject;

h) the existence of automated decision-making, including profiling, pursuant to Article 22(1) and (4) of the GDPR and, at least in these cases, meaningful information about the logic involved and the scope and intended effects of such processing for the data subject.

You have the right to request information on whether personal data concerning you is transferred to a third country or to an international organisation. In this context, you may request to be informed about the appropriate safeguards pursuant to Art. 46 of the GDPR in connection with the transfer.

Right of rectification

You have the right to obtain from the controller the rectification and/or completion without undue delay of any personal data processed concerning you which is inaccurate or incomplete.

Right to restrict processing

Under the following conditions, you may request the controller to immediately restrict the processing of personal data concerning you:

a) if you contest the accuracy of the personal data concerning you for a period enabling the controller to verify the accuracy of the personal data;

b) the processing is unlawful and you refuse to erase the personal data and instead request the restriction of the use of the personal data;

c) the controller no longer needs the personal data for the purposes of processing, but you need it for the assertion, exercise or defence of legal claims, or

d) if you have objected to the processing pursuant to Art. 21 (1) GDPR and it has not yet been determined whether the legitimate grounds of the controller outweigh your grounds.

Where the processing of personal data concerning you has been restricted, such data may be processed, with the exception of storage, only with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of substantial public interest of the Union or of a Member State. If the restriction of processing has been restricted in accordance with the above conditions, you will be informed by the controller before the restriction is lifted.

Right to erasure

You may request the controller to delete the personal data concerning you without delay if one of the following reasons applies:

a) The personal data concerning you are no longer necessary for the purposes for which they were collected or otherwise processed.

b) You revoke your consent on which the processing was based pursuant to Art. 6 (1) a) or Art. 9 (2) a) GDPR and there is no other legal basis for the processing.

c) You object to the processing pursuant to Art. 21 (1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21 (2) GDPR.

d) The personal data concerning you has been processed unlawfully.

e) The deletion of the personal data concerning you is necessary for compliance with a legal obligation under Union or Member State law to which the controller is subject.

f) The personal data concerning you was collected in relation to information society services offered pursuant to Art. 8 (1) GDPR.

If the controller has made the personal data concerning you public and is obliged to erase it pursuant to Article 17(1) of the GDPR, it shall take reasonable measures, including technical measures, having regard to the available technology and the cost of implementation, to inform data controllers which process the personal data that you, as the data subject, have requested that they erase all links to, or copies or replications of, that personal data.

The right to erasure does not exist insofar as the processing is necessary

a) to exercise the right to freedom of expression and information;

b) for compliance with a legal obligation which requires processing under Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

c) for reasons of public interest in the area of public health in accordance with Art. 9(2)(h) and (i) and Art. 9 (3) GDPR;

d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes pursuant to Article 89(1) of the GDPR, where the right referred to in Section a) is likely to render impossible or seriously prejudice the achievement of the purposes of such processing, or

e) for the assertion, exercise or defence of legal claims.

Right to information

If you have asserted the right to rectification, erasure or restriction of processing against the controller, the controller is obliged to inform all recipients to whom the personal data concerning you have been disclosed of this rectification/erasure/restriction of processing, unless this proves impossible or involves a disproportionate effort. You have the right to be informed of these recipients by the controller.

Right to data portability

You have the right to receive the personal data concerning you that you have provided to the controller in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller to whom the personal data has been provided, provided that

a) the processing is based on consent pursuant to Art. 6 para. 1 lit. a) GDPR or Art. 9 para. 2 lit. a) GDPR or on a contract pursuant to Art. 6 para. 1 lit. b) GDPR and

b) the processing is carried out with the aid of automated procedures.

In exercising this right, you also have the right to have the personal data concerning you transferred directly from one controller to another controller, insofar as this is technically feasible. This must not affect the freedoms and rights of other persons.

The right to data portability shall not apply to processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

In order to assert the right to data portability, the data subject may at any time contact the controller.

Right of objection

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data relating to you which is carried out on the basis of Article 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions.

The controller shall no longer process the personal data concerning you unless it can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims.

If the personal data concerning you is processed for the purpose of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing; this also applies to profiling insofar as it is related to such direct marketing. If you object to the processing for direct marketing purposes, the personal data concerning you will no longer be processed for these purposes.

You have the possibility, in connection with the use of information society services, notwithstanding Directive 2002/58/EC, to exercise your right to object by means of automated procedures using technical specifications.

To exercise the right to object, the data subject may directly contact the controller.

Right to revoke the declaration of consent under data protection law

You have the right to revoke your declaration of consent under data protection law at any time. The revocation of the consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation. You can contact the responsible person for this purpose.

Automated decision in individual cases including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision

a) is necessary for the conclusion or performance of a contract between you and the responsible person,

b) is authorised by legislation of the Union or the Member States to which the controller is subject and that legislation contains adequate measures to safeguard your rights and freedoms and your legitimate interests, or

c) is done with your express consent.

However, these decisions must not be based on special categories of personal data pursuant to Art. 9(1) GDPR, unless Art. 9(2)(a) or (g) GDPR applies and appropriate measures have been taken to protect the rights and freedoms and your legitimate interests.

With regard to the cases referred to in (1) and (3), the controller shall take reasonable steps to safeguard the rights and freedoms of, and your legitimate interests, including at least the right to obtain the intervention of a person on the part of the controller, to express his or her point of view and to contest the decision.

If the data subject wishes to exercise rights concerning automated decisions, he or she may, at any time, contact the controller.

Right to complain to a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, place of work or the place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR. The supervisory authority to which the complaint has been lodged shall inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy under Article 78 GDPR.

Changes to the privacy policy

We reserve the right to change our privacy practices and this policy to comply with changes in relevant laws or regulations or to better meet your needs. Possible changes to our privacy practices will be posted here accordingly. Please note the current version date of the privacy policy.