Privacy Policy

General information

Below, we would like to inform you about data protection on our website and about the type, scope, and purpose of the personal data we collect, use, and process. Data protection is very important to us.

Personal data is any data that could be used to identify you personally, e.g. your name, IP address, telephone number, etc.

Some of this data is processed automatically when you visit the website (e.g., IP address, browser type, operating system, etc.), or when you give us your consent to process it, or when you voluntarily provide us with your data, e.g., by entering your data in a form on our website.

We would also like to inform you about your rights under the GDPR.

You have the right to obtain information about the origin, recipient, and purpose of your personal data processed by us at any time and free of charge, as well as the right to correct or delete this data.

You also have the right to request the restriction of the processing of your personal data under certain circumstances. If you have given us your consent to process your data, you can revoke this consent at any time with future effect. Furthermore, you have the right to lodge a complaint with the competent data protection supervisory authority.

THE DATA PROTECTION OFFICER / PROCESSING ENTITY IS

Hotel Nothaft GmbH
Ittlinger Hauptstrasse 3
D-94315 Straubing
(Germany)

Phone +49 9421 183390
Fax +49 9421 183399
Email info@hotel-nothaft.de

Managing Director Anton Nothaft

PROCESSING OF YOUR DATA WITHIN THE SCOPE OF THE SERVICES WE PROVIDE

For our guests or business partners, or in the event that you are interested in our services, the type, scope, and purpose of the processing of your personal data are based on the contractual or pre-contractual relationships existing between us. We process personal data that we request from you or that you provide to us in order to respond to your enquiry, prepare an offer for you or process your booking. Data subjects are prospects, guests, business and contractual partners. The purpose of processing is the performance of contractual services, communication, responding to contact enquiries and office and organisational procedures.

Unless otherwise stated in this privacy policy, the processing of your data and its transfer to third parties is limited to data that is necessary and appropriate for responding to your inquiries and/or fulfilling the contract, protecting our rights, and complying with legal obligations.

The data concerned is:

Inventory data (e.g., names, addresses)
Payment data (e.g., bank details, invoices)
Contact details (e.g., email address, telephone number, postal address)
Contract data (e.g., subject matter of the contract, duration of the contract)

The legal basis for data processing is Art. 6 I 1 lit. b GDPR, the fulfillment of the contract or the fulfillment of pre-contractual requests.

Unless a specific storage period is specified in this privacy policy, we will store your personal data until the purpose for which it was collected no longer applies. We will delete your personal data when we no longer need it, i.e. after the contractual relationship between us has ended, or after our legitimate interest in further processing the data has ceased to exist, or if you request us to delete it. Mandatory legal provisions – in particular statutory retention periods – remain unaffected. It may also be necessary to process your personal data until the expiry of these periods in order to assert, exercise or defend legal claims arising from contractual relationships or to protect the rights of another natural or legal person. We will then delete the personal data required for this purpose only after these periods have expired. Until these periods expire, however, we will restrict the processing of this data to these purposes.

ACCESSING THE WEBSITE - PROCESSING OF PERSONAL DATA AND TYPE AND PURPOSE OF USE

When you access our website, you transmit data to our web server via your Internet browser (due to technical necessity). The following data is processed in the server log files during an ongoing connection for communication between your Internet browser and our web server:

the page from which the file was requested - referrer URL
the name of the file
the date and time of the request
a description of the type of web browser/browser version and operating system used
IP address of the requesting computer
access status (file transferred, file not found, etc.)
amount of data transferred

For technical reasons (access to the website), this data is stored temporarily. We cannot identify individual persons based on this data. The IP addresses are deleted or anonymized after 7 days at the latest.

The data is evaluated exclusively for internal purposes and does not allow us to draw any conclusions about your person. The data is not compared with other data sets.The data mentioned is processed for the following purposes:

To ensure that the website connects properly and smoothly
To ensure that the website is easy to use
To evaluate system security and stability

The legal basis for data processing is Art. 6 I S. 1 lit. f GDPR. The legitimate interest follows from the purposes listed above for data collection. Under no circumstances will we use the data collected to draw conclusions about your person. You can visit the website without providing any personal information.

INQUIRIES BY EMAIL, FAX, OR PHONE

If you contact us by email, fax, or phone, your request, including all personal data arising from it (e.g., name, request), will be stored and processed by us for the purpose of processing your request. The data will not be passed on without your consent. There is no legal or contractual obligation to provide your data, but it is not possible to process your request without providing your data.

The processing of this data is based on Art. 6 I S 1 lit. b GDPR, provided that your request is related to the fulfillment of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, processing is based on your consent (Art. 6 I 1 lit. a GDPR) and/or on our legitimate interest (Art. 6 I S 1 lit. f GDPR), as we have a legitimate interest in the effective processing of inquiries addressed to us.

The data sent to us via contact requests (e-mail) will be stored by us until you request us to delete it, revoke your consent to its storage, or the purpose for data storage no longer applies (e.g., after your request has been processed). Mandatory legal provisions—in particular statutory retention periods—remain unaffected.

RESERVATIONS / ROOM BOOKINGS – HS/3 HOTELSOFTWARE

We use the external service provider HS/3 Hotelsoftware GmbH & Co. KG, Leonardo-da-Vinci-Weg 3, 32760 Detmold, Germany, info@hs3.de (HS3). We are jointly responsible with HS3 for the processing of personal data.

The processing of this data is based on Art. 6 I S 1 lit. b GDPR, provided that your request is related to the fulfillment of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, processing is based on your consent (Art. 6 I 1 lit. a GDPR) and/or on our legitimate interest (Art. 6 I S 1 lit. f GDPR), as we have a legitimate interest in the effective processing of inquiries addressed to us.

If you contact us via our booking page, your request, including all personal data arising from it (e.g., name, request), will be processed by HS3 for the purpose of processing your request. The data will not be passed on to anyone other than us without your consent.There is no legal or contractual obligation to provide your data, but it is not possible to process your request without providing your data.

The HS3 privacy policy can be found at https://hs3-hotelsoftware.de/datenschutz/

EMAIL ADVERTISING AND YOUR RIGHT TO OBJECT

If we have received your email address in connection with a booking or service and you have not objected, we reserve the right, on the basis of § 7 III UWG, to send you regular offers for similar services. The legal basis for this is our legitimate interest in advertising to our customers, and the processing of the data is permissible under Art. 6 I S1 lit f GDPR within the scope of a balancing of interests.

You can object to the use of your email address at any time by sending us a message or via the corresponding link in the advertising email. Once the legal basis for data processing for advertising emails no longer applies, your email address will be deleted, unless statutory retention obligations (e.g., under tax or commercial law) prevent this.

We would also like to point out that you can object to the future processing of your personal data at any time in accordance with the legal requirements of Art. 21 GDPR. The objection can be made in particular against processing for direct marketing purposes.

POSTAL ADVERTISING AND YOUR RIGHT TO OBJECT

We reserve the right to use your first and last name and the postal address you provided to us in connection with bookings for our own advertising purposes, e.g., to send you interesting offers by post. This serves to protect our legitimate interests in advertising to our customers, which outweigh any interests in data protection, in accordance with Art. 6 I S. 1 lit. f GDPR.

You can object to the storage and use of your data for these purposes at any time by sending us a message. The objection can be made in particular against processing for direct marketing purposes. Once the legal basis for data processing for postal advertising has ceased to exist, your address data will be deleted unless there are legal obligations to retain it.

DATA PROTECTION WHEN SENDING APPLICATION DOCUMENTS

If you send us your application documents, we will use them exclusively for the purpose of deciding on your application and will not pass on your data to third parties. Please note that we do not currently offer encryption of your data when sending application documents by email. However, you can encrypt your attachments using a program such as 7ZIP (http://www.7-zip.de/) and send them to us by email, providing us with your password separately, e.g. by telephone. You will receive an email from us confirming receipt of your application at your email address. You can also send us your application by post at any time.

Application data is stored and managed separately from other data records.

If we conclude an employment contract with an applicant, the data transmitted will be stored for the purpose of processing the employment relationship in accordance with the statutory provisions. If no employment contract is concluded with the applicant, the application documents will be automatically deleted no later than 6 months after notification of the rejection decision, unless other legitimate interests of the controller responsible for processing prevent deletion or the applicant has expressly consented to longer storage and retention of their application, e.g. for possible future contact in the event of vacancies. Other legitimate interests in this sense include, for example, a burden of proof in proceedings under the General Equal Treatment Act (AGG).

Data processing for the purpose of contacting you and processing your application data is carried out in accordance with Art. 6 I S. 1 lit. a,b GDPR on the basis of your voluntary consent, as well as for the implementation of pre-contractual measures.

AMAZON CLOUDFRONT - CLOUDFLARE - CONTENT DELIVERY NETWORKS (CDN)

CDN server (content delivery network) technologies may be used on our websites. CDNs reduce the loading times of JavaScript libraries and fonts, as these files are transferred from fast or less busy servers. The proxy servers store the files locally, thereby improving the access speed during download. Content such as web videos or other large media files can thus be delivered quickly and securely.

We use the services of Cloudflare (Clouflare Inc., 101 Townsend St, San Francisco, CA 94107, USA) and Amazon CloudFront (service provider is Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg - AWS).

The use of CDN requires the processing of your IP address so that the content of the website can be sent to your browser.

Data processing is carried out on the basis of our legitimate interests in the optimization and economic operation of our website (Art. 6 I S. 1 f GDPR). Cloudflare and AWS are recipients acting as processors on our behalf. This corresponds to our legitimate interest within the meaning of Art. 6 I S. 1 lit. f GDPR in not operating a content delivery network ourselves.

The transfer of your IP address to the US is based on the adequacy decision of the EU Commission (EU-U.S. Data Privacy Framework). Based on adequacy decisions by the EU, personal data can flow freely and securely from the European Economic Area to the third country in question without further conditions or approvals being required. This means that data can be transferred to the third country in the same way as within the EU.Cloudflare Inc and Amazon.com Inc. are Data Privacy Framework certified.The Amazon AWS privacy policy can be found at https://aws.amazon.com/de/compliance/gdpr-center/

The Cloudflare privacy policy can be found at https://www.cloudflare.com/privacypolicy/

The programming language JavaScript is used to integrate the content. You can object to data processing by deactivating JavaScript in your browser or installing a JavaScript blocker. Please note that this may result in functional restrictions on the website.

PRIVACY POLICY FOR THE USE OF ADOBE FONTS FOR WEBSITES

Adobe Fonts (Adobe Systems Software Ireland Limited (Adobe Ireland), 4-6 Riverwalk, Citywest Business Park, Dublin 24, Ireland – a subsidiary of Adobe Inc., USA) may be used on the website to ensure consistent font display. When you visit the pages, your browser loads the required fonts into your browser cache to display text and fonts correctly.

Adobe does not place or use cookies in the course of providing the service. In order to provide the service, Adobe may collect information about the fonts provided on the website. The information is used for billing and compliance purposes and may include the following:

Fonts provided
Web project ID
JavaScript version of the web project (string)
Type of web project (string “configurable” or “dynamic”)
Embedding type (whether you use JavaScript or CSS embedding code)
Account ID (identifies the customer from whom the web project originates)
Server that provides the fonts (e.g., Adobe Fonts server or company CDN)
Host name of the page where the fonts are loaded

Adobe uses the information collected to provide the Adobe Fonts service and to diagnose delivery or download problems. This information is also used to pay and fulfill Adobe's contracts with the font manufacturers whose fonts are used. Adobe shares aggregated reports with font manufacturers and may confirm to a font manufacturer that we have a valid license from Adobe, but does not otherwise disclose personal information to font manufacturers.

The use of Typekit by Adobe is in the interest of a uniform and appealing presentation of the website. This constitutes a legitimate interest within the meaning of Art. 6 I S 1 lit. f GDPR.

We are not aware that Adobe processes the IP address and other personal data of website visitors. Adobe itself states that it does not store cookies when loading fonts and does not collect data such as IP addresses and browser versions. The data processed by Adobe is only used to identify the website and the associated Adobe font account. Any transfer of personal data to the US is based on the adequacy decision of the EU Commission (EU-U.S. Data Privacy Framework). Based on adequacy decisions by the EU, personal data can flow freely and securely from the European Economic Area to the third country in question without any further conditions or approvals being required. This means that data can be transferred to the third country in the same way as within the EU.

Further information on Typekit by Adobe can be found in Adobe's privacy policy at https://www.adobe.com/de/privacy/policies/adobe-fonts.html or at https://www.adobe.com/de/privacy.html.

DATA SECURITY - SSL ENCRYPTION

We use SSL (Secure Socket Layer) encryption on our website to encrypt and protect the transmission of confidential content. When SSL encryption is activated, the data you transmit to us cannot be read by third parties. You can recognize whether an individual page of our website is transmitted in encrypted form by the closed representation of the key or lock symbol in the status bar of your browser—the address line of your browser displays “https://” when SSL encryption is activated.

PROCESSING/TRANSFER OF DATA

Your personal data will not be transferred to third parties for purposes other than those listed above or below. We will only pass on your personal data to third parties if:

You have given your express consent in accordance with Art. 6 I S. 1 lit. a GDPR,
this is legally permissible and necessary for the fulfillment of contractual relationships or for the implementation of pre-contractual measures with you in accordance with Art. 6 I S. 1 lit. b GDPR,
in the event that we are legally obliged to disclose the data in accordance with Art. 6 I S. 1 lit. c GDPR,
the processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

RIGHTS OF DATA SUBJECTS

You have the right:

to request information about your personal data processed by us in accordance with Art. 15 GDPR;
to request the immediate correction of incorrect or incomplete personal data stored by us in accordance with Art. 16 GDPR;
pursuant to Art. 17 GDPR, to request the erasure of your personal data stored by us, unless processing is necessary for exercising the right of freedom of expression and information, for fulfilling a legal obligation, for reasons of public interest, or for asserting, exercising, or defending legal claims;
pursuant to Art. 18 GDPR, to request the restriction of the processing of your personal data;
pursuant to Art. 20 GDPR, to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format or to request its transfer to another controller;
ursuant to Art. 7 III GDPR, to revoke your consent once you have given it to us at any time. As a result, we will no longer be allowed to continue processing the data based on this consent in the future;
pursuant to Art. 77 GDPR, to lodge a complaint with a supervisory authority if you believe that the processing of personal data concerning you violates the GDPR. As a rule, you can contact the supervisory authority of your usual place of residence or workplace or our registered office for this purpose. A list of data protection officers in Germany and their contact details can be found at the following link: https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html.

RIGHT TO OBJECT TO DATA COLLECTION IN SPECIAL CASES AND TO DIRECT MARKETING (ART. 21 GDPR)

If we process your personal data in accordance with Art. 6 I 1 lit. f GDPR in order to protect our legitimate interests, which outweigh your interests, you have the right to object to the processing of your personal data with effect for the future in accordance with Art. 21 GDPR. If the processing is for direct marketing purposes, you can exercise this right at any time. This also applies to profiling insofar as it is related to such direct marketing. If the processing is carried out for other purposes, you only have the right to object if there are reasons arising from your particular situation.

If you wish to exercise your right to object, simply send us an email.

After you exercise your right to object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or if the processing serves to assert, exercise, or defend legal claims.

If you object to the processing of your personal data for direct marketing purposes, your personal data will no longer be processed for these purposes.

No automatic decision-making or profiling takes place on our websites.

CHANGES TO THIS PRIVACY POLICY

Due to the further development of our website and offers or due to changes in legal or official requirements, it may be necessary to amend this privacy policy in accordance with the applicable data protection regulations. The current privacy policy can be accessed and printed out at any time on our website under the link Privacy Policy.