Data Protection

The responsible party, within the meaning of basic data protection regulation and other national data protection laws of the member states as well as other data protection regulations is the:

ATLANTIC Hotels Management GmbH
Ludwig-Roselius-Allee 2
28329 Bremen
Deutschland
Telephone: +49 (0) 421 944888-0
Telefax: +49 (0) 421 944888-552
Email: info@atlantic-hotels.de
Website: https://www.atlantic-hotels.de

The data protection officer of the responsible party is:

SHIELD GmbH Datenschutz & Sicherheit
Managing Director: Martin Vogel
Ohlrattweg 5
25497 Prisdorf
Phone: +49 (0) 4101 8050600
E-mail: datenschutz@atlantic-hotels.de
www.shield-datenschutz.de

1. Scope of processing of personal data
We process personal data from our users principally only to the extent necessary to provide a functional website and our content and services. The processing of personal data of our users is regularly only carried out with their consent. These consents can be revoked at any time with effect for the future by informing the responsible. The contact details can be found under "I. Name and address of the responsible".

2. Legal basis for the processing of personal data

Insofar as we obtain the consent of the data subject for the processing of personal data, art. 6 (1) (a) EU General Data Protection Regulation (GDPR) serves as the legal basis for the processing of personal data.

In the processing of personal data necessary for the performance of a contract to which the data subject is a party, art. 6 (1) (b) GDPR serves as the legal basis. This also applies to processing operations required to carry out pre-contractual actions.

Insofar as processing of personal data is required to fulfill a legal obligation that is required for our company, art. 6 (1) (c) GDPR serves as the legal basis. In the event that vital interests of the data subject or another natural person require the processing of personal data, art. 6 (1) (d) GDPR serves as the legal basis. If processing is necessary to safeguard the legitimate interests of our company or a third party, and if the interests, fundamental rights and freedoms of the data subject do not prevail over the first interest, art. 6 (1) (f) GDPR serves as legal basis for processing.

3. Data deletion and storage duration
The personal data of the data subject will be deleted or blocked as soon as the purpose of the storage expires. Additional storage may take place if provided for by the European or national legislator in EU regulations, laws or other regulations to which the data controller is subject. Blocking or deletion of the data also takes place when a storage period prescribed by the standards mentioned expires, unless there is a need for further storage of the data for conclusion of a contract or fulfillment of the contract.

1. Processing of personal data of domestic guests at hotel check-in

In order to process the accommodation contract, the following personal data must be collected and stored from you as a domestic guest at hotel check-in:

• Date of arrival and expected departure (for planning and organising your stay)
• Surname and first name (for identification and contact purposes)
• E-mail address (to participate in the online check-in/out process to simplify and speed up the check-in and check-out process, to confirm your booking and to send relevant information about your reservation, to send your invoice after the end of your stay)

• Address (for identification and contact purposes) - unless you initiate a card-based payment transaction with Strong Customer Authentication (SCA), in which case the earmarked allocation number of the payment method used is collected. In this case, the earmarked allocation number of the payment method used is stored together with the above-mentioned data.

• Federal State law may stipulate that further data may be collected on the registration form for the collection of tourist and spa fees (fulfilment of the requirements of the tourist and spa administrations).

Strong customer authentication is a requirement of the EU Payment Services Directive PSD2, which ensures that online payments are secure, and fraud is reduced. It requires users to confirm their identity when making payments using two of three factors - knowledge (something that only the user knows, e.g. a password), possession (something that only the user has, e.g. a smartphone) and inherence (something that only the user has, e.g. a fingerprint).

Entering your e-mail address is voluntary. Please note, however, that if you do not provide it, you will not be able to take advantage of the digital procedures, such as online check-in/out, digital reservation confirmation or electronic invoicing.

Other data collected during the reservation process or during your stay - such as your private or business billing address - will be processed in accordance with the purposes stated in this privacy policy.

Your personal data is processed on the basis of Art. 6 Para. 1 lit. b GDPR (fulfilment of a contract) and Art. 6 Para. 1 lit. f GDPR (legitimate interest). Our legitimate interest lies in improving our service offering by simplifying processes and digital communication. Voluntary information such as your e-mail address is processed on the basis of Art. 6 Para. 1 lit. a GDPR (consent). You have the right to withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

Your data will only be passed on to departments and, if necessary, to so-called ‘processors’ within the meaning of Art. 4 No. 8 GDPR, who are entrusted with the processing of your booking and the realisation of your stay. Processors within the EU are not considered third parties. Data will only be passed on to third parties if this is necessary for the fulfilment of the accommodation contract or if you have given us your explicit consent, which can be revoked at any time, or if this is required by law.

Your personal data will only be stored for as long as is necessary for the fulfilment and processing of the accommodation contract. Statutory retention obligations remain unaffected by this.

2. Processing of personal data of foreign guests at hotel check-in

The collection and storage of the following personal data from you as a foreign guest at hotel check-in is necessary for the processing of the accommodation contract and due to legal obligations arising from the Federal Registration Act:

• Date of arrival and expected departure (to plan and organise your stay and to fulfil the requirements of the Federal Registration Act)
• Surname and first name (for identification and contact purposes and to fulfil the requirement of the Federal Registration Act)
• Date of birth (fulfilment of the requirement under the Federal Registration Act)
• Nationalities (fulfilment of the requirement under the Federal Registration Act)
• Address (for identification and, if necessary, contacting and to fulfil the requirement under the Federal Registration Act)
• Number of foreign fellow travellers and their nationality (fulfilment of the requirement under the Federal Registration Act)
• Serial number of the recognised and valid passport or passport replacement document (identity document) (fulfilment of the requirement under the Federal Registration Act)
• Federal State law may stipulate that further data may be collected on the registration form for the collection of tourist and spa fees (fulfilment of the requirements of the tourist and spa administrations)

The details on the registration form are compared with those on your identity document. If there are any discrepancies, this will be noted on the registration form. If you do not present any or no valid identity document, this will also be noted on the registration form.

Other data collected during the reservation process or during the stay - for example the private or business billing address - will be processed in accordance with the purposes stated in this privacy policy.

Your personal data is processed on the basis of Art. 6 Para. 1 lit. c GDPR (legal obligation) in conjunction with §§ 29, 30 Federal Registration Act, Art. 6 Para. 1 lit. b GDPR (fulfilment of a contract) and Art. 6 Para. 1 lit. f GDPR (legitimate interest). Our legitimate interest lies in improving our service offering by simplifying processes and digital communication. Voluntary information is processed on the basis of Art. 6 Para. 1 lit. a GDPR (consent). You have the right to withdraw your consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Your data will only be passed on to departments and, if necessary, to so-called ‘processors’ within the meaning of Art. 4 No. 8 GDPR, who are entrusted with the processing of your booking and the realisation of your stay. Processors within the EU are not considered third parties. Data will only be passed on to third parties if this is necessary for the fulfilment of the accommodation contract or if you have given us your explicit consent, which can be revoked at any time, or if this is required by law.

Your personal data will only be stored for as long as is necessary for the fulfilment and processing of the accommodation contract. Statutory retention obligations remain unaffected by this. The Federal Registration Act stipulates, among other things, that registration forms must be kept for one year from the date of departure and destroyed within three months of expiry of the retention period.

1. Description and scope of data processing

Each time our website is accessed, our system automatically collects data and information from the computer system of the calling computer.

The following data is collected:

1. Information about the browser type and the version used
2. The operating system of the users
3. The Internet service provider of the user
4. The IP address of the user
5. Date and time of access
6. Websites from which the user's system accesses our website
7. Websites accessed by the user's system through our website

The data is also stored in the log files of our system. A storage of this data together with other personal data of the user does not take place.

2. Legal basis for data processing

The legal basis for the temporary storage of data and log files is Art. 6 (1) (f) GDPR.

3. Purpose of the data processing

The temporary storage by the system of the IP address is necessary to allow delivery of the website to the computer of the user. To do this, the user's IP address must be kept for the duration of the session.

Storage in log files is done to ensure the functionality of the website. In addition, the data is used to optimize the website and to ensure the security of our information technology systems. An evaluation of the data for marketing purposes does not take place in this context.

We have a justified interest in the processing of data for this purpose, according to Art. 6 (1) (f) GDPR.

In diesen Zwecken liegt auch unser berechtigtes Interesse an der Datenverarbeitung nach Art. 6 Abs. 1 lit. f DSGVO.

4. Duration of storage

The data will be deleted as soon as it is no longer necessary for the purpose of its collection. In the case of collecting the data for providing the website, this is the case when the session is completed. In the case of storing the data in log files, data is stored for no more than seven days. After one day, the IP addresses of the users are anonymized, so that an assignment of the calling client is no longer possible.

5. Objection and removal possibility

The collection of data for the provision of the website and the storage of the data in log files is essential for the operation of the website. Consequently, there is no possibility for the user to object.

Our website uses cookies. Cookies are text files that are stored in the Internet browser or by the Internet browser on the user's computer system. When a user visits a website, a cookie may be stored on the user's operating system. This cookie contains a characteristic string that allows the browser to be uniquely identified when the website is reopened.

We use cookies to make our website more user-friendly. Some elements of our website require that the calling browser be identified even after switching pages. In addition, we use cookies on our website that allow an analysis of users' browsing behavior.
In this way, the following data is transmitted:

1. IP address, age, gender, interests
2. activities on the website during the visit
3. frequency of page views
4. use of website features
5. origin / visitor source

Technical precautions pseudonymize the data of the users collected in this way. This makes it much more difficult to assign the data to the calling user and is only possible with the help of an appropriate "key". The data will not be stored together with other personal data of the user.

2. Legal basis for data processing
The legal basis for the processing of personal data using cookies that are technically necessary or necessary for the provision of the service is Art. 6 (1) (f) GDPR.
The legal basis for the processing of personal data using all other cookies or cookies not strictly necessary for the provision of the service is Art. 6 (1) (a) GDPR.

3. Purpose of the data processing
The purpose of using technically necessary cookies is to simplify the use of websites for users. Some features of our website cannot be offered without the use of cookies. For these, it is necessary that the browser is recognized even after switching pages. The user data collected through technically necessary cookies will not be used to create user profiles. The use of the analysis cookies is for the purpose of improving the quality of our website and its contents. Through the analysis cookies, we learn how the website is used and so we can constantly optimize our services offered.

4. Duration of storage, objection and removal options
Cookies are stored on the computer of the user and transmitted by it to our page. For cookies requiring consent, a so-called cookie consent banner is made available to you when you visit the website. There you have the possibility, if you wish, to use our website only with the technically necessary cookies.

Furthermore, you as a user also have full control over the use of cookies. By changing the settings in your internet browser, you can disable or restrict the transmission of cookies. Already saved cookies can be deleted at any time. This can also be done automatically. If cookies are disabled for our website, it may not be possible to fully use all the functions of the website.

You can find an overview of the cookies and the option to edit your consent in our Cookie Declaration.

1. Description and scope of data processing
On our website, it is possible to subscribe to a free newsletter that informs customers and business partners about the company’s offers and news at regular intervals. During registration for the newsletter, the data from the input mask are transmitted to us. Here it is mandatory to enter the e-mail address and select the newsletter. Optionally, the salutation, title, first name and last name can be entered.

In addition, the following data are collected during registration:
1. IP address of the calling computer
2. Date and time of registration
3. URL
4. Date/time and IP of the order

For the processing of the data, your consent is obtained in the context of the registration process and reference is made to this privacy policy.

The company Revinate Inc, 1 Letterman Dr., Building C, Suite CM100, San Francisco, CA 94129, USA (hereinafter referred to as ‘Revinate’) is commissioned to process the dispatch of the newsletter. Revinate is a service that can be used to organise and analyse the sending of newsletters, among other things.

If you enter data for the purpose of subscribing to the newsletter (e.g. e-mail address), it will be stored on Revinate's servers in the USA.
Revinate complies with the ‘EU-US Privacy Shield’. The ‘Privacy Shield’ is an agreement between the European Union (EU) and the USA, which is intended to ensure compliance with European data protection standards in the USA.
Further information can be found in Revinate's privacy policy at: https://www.revinate.com/privacy/

We have concluded a data processing agreement (‘Data Processing Addendum’) with Revinate. In this agreement, we oblige Revinate to protect our customers' data and not to pass it on to third parties.
The data will be used exclusively for sending the newsletter. In connection with the data processing for the dispatch of newsletters, the data will not be passed on to third parties.

2. Legal basis for data processing
The legal basis for the processing of data after registration by the user for the newsletter and for data processing as part of newsletter tracking is Article 6(1)(a) GDPR if the user has given consent.

3. Purpose of data processing
The collection of the user’s e-mail address serves to deliver the newsletter. The collection of other personal data as part of the registration process serves to address the user personally. The provision of further personal data is voluntary.

4. Duration of storage
The data will be deleted as soon as they are no longer necessary for the purpose of their collection. The user’s e-mail address and the personal data optionally provided during the registration process are therefore stored as long as the newsletter subscription is active.

5. Objection and removal possibility
The subscription of the newsletter can be cancelled by the data subject at any time. For this purpose, there is a corresponding unsubscribe link in every newsletter.
The e-mail address of the user and the personal data collected in the registration process will be deleted immediately in the event of an objection (unsubscribe).
In addition, you can at any time object to the storage of your data with effect for the future via newsletter@atlantic-hotels.de. Your data will then be deleted immediately and you will no longer receive a newsletter.

6. Newsletter tracking
The newsletter contains a so-called web beacon. A web beacon is a transparent 1x1 pixel graphic that is embedded in the e-mail. This is only possible in HTML mails, not in plain text mails, and makes it feasible to record a log file analysis. This allows a statistical evaluation of the success or failure of online marketing campaigns to be carried out. Based on the embedded web beacon, ATLANTIC Hotels Management GmbH can detect if and when an e-mail was opened by a data subject and which links in the e-mail were accessed by the data subject.

Such personal data collected via the web beacons contained in the newsletters are stored and evaluated by the data controller in order to optimize the newsletter distribution and to adapt the content of future newsletters even better to the interests of the data subject. This personal data will not be passed on to third parties. Data subjects are entitled at any time to revoke the relevant separate declaration of consent submitted via the double opt-in procedure. After revocation, this personal data will be deleted by the data controller. ATLANTIC Hotels Management GmbH automatically interprets any subscription cancellation from the newsletter as a revocation.

Openings, clicks, cancellations etc. are saved as activities for the respective recipient. These data can be viewed in the recipient data record for each recipient addressed. This has a retention period of up to six months and is then deleted again. Then no more evaluations, follow-up campaigns or the like can be carried out.

The data are also not stored permanently in the report area. Reports that are older than one year are automatically archived by the system. The archived reports can still be viewed by ATLANTIC Hotels Management GmbH, but personalized data are not evaluated here. These are only visible up to six months after the newsletter has been sent.

1. Description and scope of data processing
On our website, it is possible to subscribe to a free newsletter that informs customers and business partners about the company’s offers and news at regular intervals. During registration for the newsletter, the data from the input mask are transmitted to us. Here it is mandatory to enter the e-mail address and select the newsletter. Optionally, the salutation, title, first name and last name can be entered.

In addition, the following data are collected during registration:
1. IP address of the calling computer
2. Date and time of registration
3. URL
4. Date/time and IP of the order

For the processing of the data, your consent is obtained in the context of the registration process and reference is made to this privacy policy.

The company Revinate Inc, 1 Letterman Dr., Building C, Suite CM100, San Francisco, CA 94129, USA (hereinafter referred to as ‘Revinate’) is commissioned to process the dispatch of the newsletter. Revinate is a service that can be used to organise and analyse the sending of newsletters, among other things.

If you enter data for the purpose of subscribing to the newsletter (e.g. e-mail address), it will be stored on Revinate's servers in the USA.
Revinate complies with the ‘EU-US Privacy Shield’. The ‘Privacy Shield’ is an agreement between the European Union (EU) and the USA, which is intended to ensure compliance with European data protection standards in the USA.
Further information can be found in Revinate's privacy policy at: www.revinate.com/privacy/

We have concluded a data processing agreement (‘Data Processing Addendum’) with Revinate. In this agreement, we oblige Revinate to protect our customers' data and not to pass it on to third parties.
The data will be used exclusively for sending the newsletter. In connection with the data processing for the dispatch of newsletters, the data will not be passed on to third parties.

2. Legal basis for data processing
The legal basis for the processing of data after registration by the user for the newsletter and for data processing as part of newsletter tracking is Article 6(1)(a) GDPR if the user has given consent.

3. Purpose of data processing
The collection of the user’s e-mail address serves to deliver the newsletter. The collection of other personal data as part of the registration process serves to address the user personally. The provision of further personal data is voluntary.

4. Duration of storage
The data will be deleted as soon as they are no longer necessary for the purpose of their collection. The user’s e-mail address and the personal data optionally provided during the registration process are therefore stored as long as the newsletter subscription is active.

5. Objection and removal possibility
The subscription of the newsletter can be cancelled by the data subject at any time. For this purpose, there is a corresponding unsubscribe link in every newsletter.
The e-mail address of the user and the personal data collected in the registration process will be deleted immediately in the event of an objection (unsubscribe).
In addition, you can at any time object to the storage of your data with effect for the future via newsletter@atlantic-hotels.de. Your data will then be deleted immediately and you will no longer receive a newsletter.

6. Newsletter tracking
The newsletter contains a so-called web beacon. A web beacon is a transparent 1x1 pixel graphic that is embedded in the e-mail. This is only possible in HTML mails, not in plain text mails, and makes it feasible to record a log file analysis. This allows a statistical evaluation of the success or failure of online marketing campaigns to be carried out. Based on the embedded web beacon, ATLANTIC Hotels Management GmbH can detect if and when an e-mail was opened by a data subject and which links in the e-mail were accessed by the data subject.

Such personal data collected via the web beacons contained in the newsletters are stored and evaluated by the data controller in order to optimize the newsletter distribution and to adapt the content of future newsletters even better to the interests of the data subject. This personal data will not be passed on to third parties. Data subjects are entitled at any time to revoke the relevant separate declaration of consent submitted via the double opt-in procedure. After revocation, this personal data will be deleted by the data controller. ATLANTIC Hotels Management GmbH automatically interprets any subscription cancellation from the newsletter as a revocation.

Openings, clicks, cancellations etc. are saved as activities for the respective recipient. These data can be viewed in the recipient data record for each recipient addressed. This has a retention period of up to six months and is then deleted again. Then no more evaluations, follow-up campaigns or the like can be carried out.

The data are also not stored permanently in the report area. Reports that are older than one year are automatically archived by the system. The archived reports can still be viewed by ATLANTIC Hotels Management GmbH, but personalized data are not evaluated here. These are only visible up to six months after the newsletter has been sent.

1. Description and scope of data processing

On our website, we offer users the opportunity to register in connection with the online booking by providing personal information. The data is entered into an input mask and transmitted to us. The data is processed and stored by our service provider Quality Reservations Deutschland GmbH and their partner SHS Sabre Hospitality. The Company provides guarantees under contract to ensure that appropriate technical and organizational measures are taken to ensure that the processing complies with the EU GDPR and ensures the protection of the data subject's rights. A transfer of data to third parties does not take place.

The following data is collected during the registration process:

Required Fields::

1. Title
2. First name
3. Last name
4. E-mail address
5. Password
6. Security question / answer
7. Telephone number for inquiries

Optional information:

1. Company
2. Country
3. Billing address
4. City
5. Postal code
6. State / province

At the time of registration, the following data will also be stored:
Date and time of registration

2. Legal basis for data processing

The registration serves the fulfillment of a contract of which the user is a party or the implementation of pre-contractual measures. The legal basis for processing the data is Art. 6 (1) (b) GDPR.

3. Purpose of the data processing

Registration of the user is required for providing certain content and services on our website or for the fulfillment of a contract. The user has the possibility to create a customer account before or during a booking. The creation of a customer account facilitates the booking process for repeated bookings, since after logging in, the data stored by the user in the booking mask are filled out. In addition, a registered user has the opportunity to look up their current bookings with e-mail and password. When making an online booking, the user is asked to provide his e-mail address, title, salutation, first name, last name and telephone number. The processing and storage of the data is required for the processing of the booking, among other things to clarify inquiries about the booking.

4. Duration of storage

The data will be deleted as soon as it is no longer necessary for the purpose of its collection. This is the case for the data collected during the registration process to fulfill a contract or to carry out pre-contractual measures, if the data is no longer necessary for the performance of the contract. Even after the conclusion of the contract, there may be a need to store personal data from the contracting party in order to comply with contractual or legal obligations.

5. Objection and removal possibility

You can cancel the registration at any time or change the data you have stored. To do this, please send an e-mail to info@atlantic-hotels.de. If the data are necessary for the fulfillment of a contract or for the execution of precontractual measures, a premature deletion of the data is only possible, as far as contractual or legal obligations do not preclude a deletion.

1. Description and scope of data processing

On our website contact forms are available, which can be used for electronic communication. If a user uses this option, the data entered into the input mask will be transmitted to us and saved. Required data is:

Hotel websites on www.atlantic-hotels.de

1. Subject
2. Salutation
3. First name
4. Last name
5. Telephone number
6. E-mail address
7. Message

Optionally, there is the possibility to select the mentioned hotel, to provide the title, company name and fax number as well as to register for our newsletter.

At the time of sending the message, the following data is also stored:
Date and Time

For the processing of the data, your consent is obtained in the context of the sending process and reference is made to this privacy statement. Alternatively, contact via the provided e-mail address is possible. In this case, the user's personal data that are transmitted by e-mail will be stored. In this context, data is not passed on to third parties. The data is used exclusively for processing the conversation.

2. Legal basis for data processing

The legal basis for the processing of the data is in the presence of the consent of the user Art. 6 (1) (a) GDPR. The legal basis for the processing of the data transmitted in the course of sending an e-mail is Art. 6 (1) (f) GDPR. If the e-mail contact aims to conclude a contract, then additional legal basis for the processing is Art. 6 (1) (b) GDPR.

3. Purpose of the data processing

The processing of the personal data from the input mask serves us only to establish contact with the user. In the case of contact via e-mail, this also includes the required legitimate interest in the processing of the data. The other personal data processed during the sending process serve to prevent misuse of the contact form and to ensure the security of our information technology systems.

4. Duration of storage

The data will be deleted as soon as it is no longer necessary for the purpose of its collection.

5. Objection and removal possibility

The user has the option at any time to revoke his or her consent to the processing of the personal data. If the user contacts us by e-mail, he or she may object to the storage of his or her personal data at any time. In such a case, the conversation can not continue. You can always object to the storing of your data for the future by contacting info@atlantic-hotels.de, by mail to ATLANTIC Hotels Management GmbH, Ludwig-Roselius-Allee 2, 28329 Bremen or by phone +49 (0) 421 944888-0. All personal data stored in the course of the conversation will be deleted in this case.

If your personal data are processed, you are the person affected within the meaning of  GDPR and you have the following rights vis-à-vis the data controller:

1. Right to information
You may ask the person responsible to confirm whether personal data concerning you is processed by us.
If your data is being processed, you can request information from the person responsible about the following information:

1. the purposes for which the personal data are being processed;
2. the categories of personal data being processed;
3. the recipients or the categories of recipients to whom personal data concerning you have been disclosed or are being disclosed;
4. the planned duration of the storage of your personal data or, if specific information is not available, criteria for determining the duration of storage;
5. the existence of a right to rectification or deletion of your personal data, a right to restriction of processing by the data controller or a right to object to such processing;
6. the existence of a right of appeal to a supervisory authority;
7. all available information on the source of the data, if the personal data is not collected from the data subject;
8. the existence of automated decision-making, including profiling under Article 22 (1) and (4) GDPR and, at least in these cases, meaningful information about the logic involved, and the scope and intended impact of such processing on the data subject.

You have the right to request information about whether your personal information is passed on to a third country or an international organization. In this context, you can request to be informed of the appropriate guarantees in accordance with Art. 46 GDPR in connection with the transfer.

2. Right to rectification

You have a right to rectification and / or completion by the data controller, if your personal data being processed is incorrect or incomplete. The responsible person must make the correction immediately.

3. Right to restriction of processing

You may request the restriction of the processing of your personal data under the following conditions:

1. if you contest the accuracy of the information relating to you for a period of time, that allows the data controller to verify the accuracy of your personal information;
2. the processing is unlawful and you refuse the deletion of the personal data and instead demand restriction of the use of your personal data;
3. the data controller no longer needs the personal data for the purposes of processing, but you need it in order to assert, exercise or defend legal claims; or
4. if you have objected to the processing pursuant to Art. 21 (1) GDPR, and it is not yet certain whether the legitimate reasons of the data controller outweigh your reasons.

If the processing of personal data concerning you has been restricted, this data may only be used with your consent or for the purpose of asserting, exercising or defending legal claims or protecting the rights of another natural or legal person, or for reasons of important public interests of the Union or a Member State. If the restriction of processing was restricted according to the above conditions, you will be informed by the data controller before the restriction is lifted.

4. Right to deletion

a) Obligation to delete

You may demand that the controller delete your personal information immediately, and the controller is required to delete that information immediately if one of the following is true:

1. Personal data concerning you are no longer necessary for the purposes for which they were collected or otherwise processed.
2. You revoke your consent, which the processing was based on according to Art. 6 (1) (a) or Art. 9 (2) (a) GDPR and there is no other legal basis for processing.
3. You object to the processing according to Art. 21 (1) GDPR and there are no prior justifiable reasons for the processing, or you object to the processing according to Art. 21 (2) GDPR.
4. Your personal data have been processed unlawfully.
5. The deletion of personal data concerning you is required, in order to fulfill a legal obligation under Union law or the law of the Member States to which the controller is subject.
6. The personal data concerning you were collected in relation to information society services, pursuant to Article 8 (1) of the GDPR.

b) Information to third parties

If the data controller has made the personal data concerning you public and is required to delete them according to  Article 17 (1) of the GDPR, he must take appropriate measures, including technical means, with due regard to available technology and implementation costs, to inform data controllers that you, the data subject, have requested the deletion of all links to such personal data or copies or replications of this personal data.

Exceptions

The right to erasure is not in force if the processing is necessary:

1. to exercise the right to freedom of expression and information;
2. to fulfill a legal obligation required by the law of the Union or of the Member States to which the controller is subject, or performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
3. for reasons of public interest in the field of public health pursuant to Art. 9 (2) (h) and (i) and Art. 9 (3) GDPR;
4. for archival purposes of public interest, scientific or historical research purposes or for statistical purposes according to Article 89 (1) GDPR, to the extent that the law referred to in subparagraph (a) is likely to render impossible or seriously affect the achievement of the objectives of that processing, or
5. to assert, exercise or defend legal claims.

5. Right to information

If you have the right of rectification, erasure or restriction of processing to the controller, he / she is obliged to notify all recipients, to whom your personal data have been disclosed, of this correction or deletion of the data or restriction of processing, unless: this proves to be impossible or involves a disproportionate effort. You have a right to be informed about these recipients by the data controller.

6. Right to Data Portability

You have the right to receive personally identifiable information that you provided to the controller in a structured, common and machine-readable format. In addition, you have the right to transfer this data to another person without hindrance by the person responsible for providing the personal data, provided that

1. the processing is based on consent according to Art. 6 (1) (a) GDPR or Art. 9 (2) (a) GDPR or on a contract according to Art. 6 (1) (b) GDPR
2. the processing is done by automated means.

In exercising this right, you also have the right to obtain that your personal data are transmitted directly from one controller to another, as far as technically feasible. This situation should not affect the freedoms and rights of other persons.
The right to data portability does not apply to the processing of personal data necessary for the performance of a task in the public interest or in the exercise of official authority vested in the controller.

7. Right to object

You have the right at any time, for reasons arising from your particular situation, to object to the processing of your personal data, which occurs pursuant to Art. 6 (1) (e) or (f) GDPR; this also applies to profiling based on these provisions.
The controller will no longer process the personal data concerning you, unless he can demonstrate compelling legitimate grounds for processing that outweigh your interests, rights and freedoms, or the processing is for the purpose of enforcing, exercising or defending legal claims.
If the personal data relating to you are processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for the purpose of such advertising; this also applies to profiling insofar as it is associated with such direct advertising.
If you object to processing for direct advertising purposes, your personal data will no longer be processed for these purposes.
Regardless of Directive 2002/58/EC, you have the option, in the context of the use of information society services, to exercise your right to object through automated procedures that use technical specifications.

8. Right to revoke the data protection consent declaration

You have the right to revoke your data protection declaration at any time. The revocation of consent does not affect the legality of the processing carried out on the basis of the consent before the revocation.

9. Automated decision in individual cases, including profiling

You have the right not to be subjected to a decision based solely on automated processing - including profiling - that will have legal effect or negatively affect you in a similar manner. This does not apply if the decision

1. is required for the conclusion or performance of a contract between you and the controller,
2. is permitted by Union or Member State legislation to which the controller is subject, and where such legislation contains appropriate measures to safeguard your rights and freedoms and legitimate interests, or
3. occurs with your express consent.
4. However, these decisions may not be based on special categories of personal data pursuant to Art. 9 (1) GDPR, unless Art. 9 (2) (a) or (g) apply, and reasonable measures have been taken to protect your rights and freedoms and your legitimate interests.
5. With regard to the cases referred to in (1) and (3), the person responsible shall take reasonable measures to safeguard your rights and freedoms and your legitimate interests, including at least the right to obtain the intervention of a person from the side of the controller, to present the case and to challenge the decision.
6. Right to complain to a supervisory authority

Without prejudice to any other administrative or judicial remedy, you shall have the right to complain to a supervisory authority, in particular in the Member State of your place of residence, employment or the place of the alleged infringement, if you believe that the processing of the personal data concerning you violates the GDPR.

The supervisory authority to which the complaint has been submitted shall inform the complainant of the status and results of the complaint, including the possibility of a judicial remedy pursuant to Article 78 of the GDPR.

Die Landesbeauftragte für Datenschutz und Informationsfreiheit der Freien Hansestadt Bremen (State Data Protection and Freedom of Information Officer)
Arndtstraße 1, 27570 Bremerhaven
Tel.: +49 471 596 2010 oder +49 421 361 2010
Fax: +49 421 496 18495
E-Mail: office@datenschutz.bremen.de

1. Description and scope of data processing
On our website, we offer users the opportunity to buy vouchers, for certain values or services, by providing personal information. The data is entered into an input mask and transmitted to us and stored. The company Jolioo Technologies GmbH, Geidorfplatz 1, 8010 Graz from Austria is responsible for processing and sending the voucher. This service provider signed a data processing agreement with us. The collected data will be used exclusively for the delivery of the voucher. The data will not be passed on to third parties.

The following data is collected as part of the voucher order:
Required Fields:
1. First name
2. Last name
3. Street
4. Postal code
5. City
6. Country
7. E-Mail
8. Payment method

Optional:
1. Company
2. Phone number
3. E-mail address of additional coupon recipients
4. Gift message (For, From, Message)

At the time of the voucher order, the following data is also stored:
1. The IP address of the user
2. Date and time of booking
3. Order number
4. Coupon code
5. Value
6. Transaction number
2. Legal basis for data processing

The legal basis for the processing of the data is in the presence of the consent of the user Art. 6 (1) (a) GDPR. If the registration serves the fulfillment of a contract of which the user is a party or the implementation of pre-contractual measures, then additional legal basis for the processing is Art. 6 (1) (b) GDPR.

3. Purpose of the data processing
Registration of the user is necessary to fulfill a contract with the user or to carry out pre-contractual measures. When making a voucher order, the user is requested to provide personal data. The processing and in this sense also storage of personal data is necessary for the processing of the voucher dispatch, among other things, to clarify inquiries about the booking or to allocate the payment.

4. Duration of storage
The data will be deleted as soon as the warranty periods and the storage for tax purposes allow it.

5. Opposition and removal possibility
If the data are necessary for the fulfillment of a contract or for the execution of pre-contractual measures, a premature deletion of the data is only possible, as far as contractual or legal obligations do not preclude a deletion.

On our website we have integrated the voucher and ticket system of Incert eTourismus GmbH & Co. KG (Leonfeldnerstr. 328, A-4040 Linz, Austria) to order vouchers.

If you order vouchers from us, it is necessary for the conclusion of the contract that you provide your personal data, which we need to process your order. Mandatory information required for the execution of the contracts is marked separately, further information is voluntary. The data is entered in an input mask and transmitted to us and saved. The following data is collected during the booking process:

Mandatory information:

• First name
• Surname
• Street
• Postcode
• City
• Country
• E-mail address
• Payment method

Optional information:

• Company
• Telephone number
• E-mail address of additional voucher recipient
• Dedication (For, From, Message)
• Own pictures
• Own videos

The following data is also stored at the time the voucher is ordered:

• The user's IP address
• Date and time of the booking
• Order number
• Voucher code
• value
• Transaction number

For the processing of the data, your consent is obtained as part of the sending process and reference is made to this Data Protection Statement.

In addition, the data will only be passed on to third parties if the transfer is necessary for the purpose of contract execution or for billing purposes or for collecting the fee or if you have given your express consent. In this regard, we only pass on the data required in each case. 

The data recipients are typically delivery / shipping companies, payment institutions, payment service providers and, in the event of payment default, also collection agencies.

A Data Processing Agreement was concluded with Incert eTourismus GmbH & Co. KG in accordance with Art. 28 Para. 3 GDPR.

The legal basis is Art. 6 Para. 1 lit. b GDPR. Regarding the voluntary data, the legal basis for the processing of the data is Art. 6 Para. 1 lit. a GDPR.

The mandatory data collected is required for the fulfillment of the contract with the user (for the purpose of sending the goods and confirming the content of the contract). We therefore use the data to answer your inquiries, to process your booking, if necessary to check creditworthiness or to collect a debt and for the purpose of technical administration of the websites. The voluntary information is provided for the prevention of misuse and, if necessary, for the investigation of criminal offences. We may also process the data you provide to inform you about other interesting products from our portfolio or to send you e-mails with information.

The data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. We are required by commercial and tax law to store your address, payment 
and order data for a period of ten years after the execution of the contract. However, we will restrict processing after six years, i.e. your data will only be used to comply with legal  obligations. If a continuing obligation exists between us and the user, we store the data for the entire term of the contract and for ten years thereafter (see above). Regarding data provided voluntarily, we will delete the data upon expiration of six years after execution of the contract, provided that no further contract is concluded with the user during this period; in this case, the data will be deleted upon expiration of six years after execution of the last contract.

If the data is required for the performance of a contract or for the execution of pre-contractual measures, early deletion of the data is only possible insofar as contractual or legal obligations do not prevent deletion. Otherwise, you are free to have the personal data provided during registration completely deleted from the data stock of the responsible party. Regarding the voluntary data, you can declare your revocation to the person responsible at any time. In this case, the voluntary data will be deleted immediately.

More information on data protection at Incert eTourismus GmbH & Co. KG can be found at: https://www.incert.at/unternehmen/datenschutz/ (in German only)

Payment provider

Your security is our top priority! For this reason, data such as credit card number, bank sort code, account number, name and address are transmitted via a secure SSL/TLS connection 
when paying by credit card. This means that no unauthorised person can read the data you enter during transmission over the Internet.

We offer the following payment methods in the voucher shop:

Credit Card - NEXI Germany GmbH

If you choose “credit card” as the payment method, the payment processing is carried out by NEXI Germany GmbH, Helfmann-Park 7, 65760 Eschborn, Germany.

NEXI Germany GmbH uses your personal data in particular to process the payments, to prevent card abuse, to limit the risk of payment defaults and also for statutory purposes, such as the prevention of money laundering and criminal prosecution.

We as the credit card accepting entity, NEXI Germany GmbH and the payment service providers are each separately responsible for the processing of personal data within the respective technical sphere of influence.

We would like to point out that NEXI Germany GmbH transfers your personal data to other bodies necessary for the processing of the transaction, in particular to the credit institutions, banks and credit card companies involved. Processing of your personal data for the completion of the payment also takes place at these points. You will find the respective privacy policies on the websites of NEXI Germany GmbH and the payment service providers. Please address any enquiries regarding data protection and the exercise of your rights to NEXI Germany GmbH or the respective payment service providers.

Your data is transmitted on the basis of Art. 6 Para. 1 lit. b GDPR to process the contract or your order. The secure transfer of your data takes place in accordance with the statutory provisions, § 25a KWG (German Banking Act), § 27 ZAG (Payment Services Oversight Act) and the provisions of the respective credit card companies. The processing and transfer are based on GDPR Article 6(1)(c) (legal obligations) and (f) (our legitimate interest). You have the possibility of revoking your consent to data processing at NEXI Germany GmbH and the respective payment service providers at any time for the future. A revocation does not affect the effectiveness of data processing operations in the past. In the event of cancellation, we will no longer be able to offer you the "credit card" payment method.

Further information on data protection and your rights pursuant to GDPR Articles 15 to 21 for NEXI Germany GmbH can be found at Data Policy | Nexi.

PayPal - PayPal (Europe) S.à.r.l. & Cie. S.C.A

As an alternative to credit card, we offer payment processing via the online payment service provider PayPal. Payments are processed via so-called PayPal 
accounts, which are virtual private or business accounts. PayPal also offers the option of processing virtual payments via credit cards if a user does not have a PayPal account. A PayPal account is managed via an e-mail address, which is why there is no classic account number. PayPal makes it possible to initiate online payments to third parties or to receive payments. PayPal also acts as a trustee and offers buyer protection services.

The European operating company of PayPal is PayPal (Europe) S.à.r.l. & Cie. S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg, Luxembourg.

If the data subject selects "PayPal" as the payment option during the ordering process in our online shop, the data of the data subject is automatically transmitted to PayPal. By selecting this payment option, the data subject consents to the transfer of personal data required for payment processing.

The personal data transmitted to PayPal is usually first name, surname, address, email address, IP address, telephone number, mobile phone number or other data required for 
payment processing. Personal data relating to the respective order is also required to process the purchase contract.

The purpose of transmitting the data is payment processing and fraud prevention. The controller will transmit personal data to PayPal in particular if there is a legitimate interest in the transmission. The personal data exchanged between PayPal and the controller may be transmitted by PayPal to credit reference agencies. The purpose of this transmission is to 
check identity and creditworthiness.

PayPal may pass on the personal data to affiliated companies and service providers or subcontractors if this is necessary to fulfil the contractual obligations or if the data is to be 
processed on behalf of PayPal. The data subject has the option to withdraw consent to the handling of personal data from PayPal at any time. A revocation does not affect personal 
data that must be processed, used or transmitted for (contractual) payment processing.

The applicable data protection provisions of PayPal may be retrieved under https://www.paypal.com/myaccount/privacy/privacyhub

1. Description and scope of data processing

On our website, we offer users the opportunity to make a table reservation in a restaurant, by providing personal information. The data is entered into an input mask and transmitted to us and stored. This service is provided by the service provider RESERViSiON GmbH in Reinheim, Germany. The Company provides guarantees under contract to ensure that appropriate technical and organizational measures are taken to ensure that the processing complies with the EU GDPR and ensures the protection of the data subject's rights. A transfer of data to third parties does not take place.

The following data is collected during the registration process:

Mandatory information
(1) First name
(2) Last name
(3) E-mail address
(4) Telephone number

Additional information
(5) Salutation
(6) Titel
(7) Company

At the time of online table reservation, the following data is also stored

1. The IP address of the user
2. Date and time of registration

Im Zuge der Tischreservierung hat der Nutzer die Möglichkeit sich zeitgleich zu dem Restaurant-Newsletter zu registrieren. Hierbei gelten die Regelungen wie unter XII Restaurant-Newsletter & Mittagstisch-Newsletter beschrieben.

2. Legal basis for data processing

Legal basis for the processing of the data if consent of the user is at hand is Art. 6 (1) (a) GDPR. If the registration serves the fulfillment of a contract of which the user is a party or the implementation of pre-contractual measures, an additional legal basis for the processing of the data is Art. 6 (1) (b) GDPR.

3. Purpose of data processing

The collection of personal data in the context of the table reservation is necessary for the operational processes of the restaurant concerned.

4. Duration of storage

The data will be deleted as soon as it is no longer necessary for the purpose of its collection. This is the case for the data collected during the registration process to fulfill a contract or to carry out pre-contractual measures, if the data is no longer necessary for the performance of the contract. Even after the conclusion of the contract, there may be a need to store personal data from the contracting party in order to comply with contractual or legal obligations.

5. Objection and removal possibility

As a user, you have the option to cancel the registration at any time. You can change the data stored about you at any time. The e-mail address of the user and the personal data collected in the registration process will be deleted immediately in the event of an objection (unsubscribe). You can object to the storage of your data for the future at the e-mail address of the respective restaurant, postal address or telephone number. Your data will be deleted immediately. If the data are necessary for the fulfillment of a contract or for the execution of pre-contractual measures, a premature deletion of the data is only possible, as far as contractual or legal obligations do not preclude a deletion.

1. Scope of processing of personal data

For our online job application procedure, we use a plugin of the portal HOTELCAREER of the YOURCAREERGROUP, Kaiserswerther Strasse 282, 40474 Düsseldorf. The company provides guarantees under contract to ensure that appropriate technical and organizational measures are taken to ensure that the processing complies with the EU GDPR and ensures the protection of the data subject’s rights. The data will be used exclusively for the application procedure. In this context, the data will not be passed on to third parties.

In the case of online applications, the salutation, first name, last name, e-mail address as well as CV details and a cover letter are mandatory. You can also use the contact form to create a CV or cover letter, upload additional digital attachments and submit data relevant to your application.

In addition to the online application, it is also possible to recommend a job advertisement by e-mail. It is mandatory to enter your e-mail address, your first and last name and the e-mail address of the recipient.

If you click www.hotelcareer.de, YOURCAREERGROUP GmbH is responsible for data processing when you create a profile and apply to other companies. Please also note the information provided in the data protection policy there.

2. Legal basis for the processing of personal data

ATLANTIC Hotels Management GmbH collects, processes and stores your applicant data on the basis of § 26 (1) sentence 1 of the Federal Data Protection Act 2018 (BDSG 2018) and Article 6(1)(b) and (f) GDPR.

3. Purpose of data processing

The processing of the personal data serves us to initiate the contact. The personal data you provide as part of the application process will be processed and used by ATLANTIC Hotels Management GmbH exclusively for the purpose of applicant selection and recruitment.

4. Duration of storage

If your application is not successful, your data will be deleted three months after completion of the application procedure on the basis of § 15 (4) of the General Equal Treatment Act (AGG). See also “XIV. Data protection notice for the job application process”.

5. Objection and removal possibility

You can change the data stored about you at any time. In addition, you have the possibility of revoking your consent to the processing of the data transmitted by you. Send your revocation to bewerbung@atlantic-hotels.de, by post to ATLANTIC Hotels Management GmbH, Human Resources, Ludwig-Roselius-Allee 2, 28329 Bremen, or call us on +49 (0)421 944888-564. The data will then be deleted by us without delay. In such a case, the communication cannot be continued.

If the data are necessary for the fulfilment of a contract or for the execution of pre-contractual measures, premature deletion of the data is only possible insofar as contractual or legal obligations do not preclude such a deletion.

The protection of your personal data is important to us. ATLANTIC Hotels Management
GmbH collects, processes your applicant data on the basis of § 26 (1) sentence 1 of the
Federal Data Protection Act new version (BDSG-new). The personal data you provide as part of the application process will be processed and used by ATLANTIC Hotels Management GmbH exclusively for the purpose of applicant selection and recruitment.

We would like to point out that the transmission of personal data via e-mail is classified as insecure. Please make sure that you only send application documents by e-mail if you
consider the risk to be low. You are welcome to send further documents that you do not
wish to send by e-mail (such as medical reports and doctor’s certificates) by post or to
submit them at the interview.

If your application is followed by the conclusion of a contract, your data will be stored and
used within the scope of the usual organizational and administrative processes in
compliance with the applicable legal regulations.
If your application is not successful, your data will be deleted three months after completion of the application procedure on the basis of § 15 (4) of the General Equal Treatment Act (AGG).

Should you wish to submit an unsolicited application or wish to have ATLANTIC Hotels
Management GmbH keep your application documents for further vacancies after an
unsuccessful application, we require written notification that we have been requested to
save the application documents. ATLANTIC Hotels Management GmbH will hold applications for further recruitment procedures for a maximum of 12 months.

Joint controllers

ATLANTIC Hotels Management GmbH, Ludwig-Roselius-Allee 2 - 28329 Bremen - Deutschland, central administration Bremen, and the respective operating companies of the affiliated hotels (see operating companies) jointly determine the purposes and means of certain group-wide coordinated processing activities (incl. central administration or control).

operating companies

ATLANTIC Hotel Airport GmbH (Hotelwebsite)
ATLANTIC Grand Hotel Bremen GmbH (Hotelwebsite)
ATLANTIC Hotel Rennbahn GmbH (Hotelwebsite)
ATLANTIC Hotel Universum GmbH (Hotelwebsite)
ATLANTIC Hotel Vegesack GmbH (Hotelwebsite)
ATLANTIC Hotel Sail City GmbH (Hotelwebsite)
ATLANTIC Hotel Kiel GmbH (Hotelwebsite)
ATLANTIC Hotel Lübeck / Hotel Betriebsgesellschaft Schmiedestraße mbH (Hotelwebsite)
ATLANTIC Grand Hotel Travemünde GmbH (Hotelwebsite)
ATLANTIC Hotel Wilhelmshaven GmbH  (Hotelwebsite)
ATLANTIC Hotel Münster GmbH (Hotelwebsite)
ATLANTIC Hotel Heidelberg Europaplatz Betriebsgesellschaft mbH (Hotelwebsite)
ATLANTIC Hotel Landgut Horn / OPATZ Hotel und Services GmbH (Hotelwebsite)
gottlieb Bremen/ ATLANTIC Hotel Rennbahn Catering GmbH (Website)
ATLANTIC Hotel Frankfurt Messe GmbH (Hotelwebsite)
unique by ATLANTIC Hotels Management GmbH (Hotelwebsite)
Linnemann Hotel GmbH (Hotelwebsite)
unique by ATLANTIC Hotels Betriebs GmbH Kiel (Hotelwebsite)
Severin*s Resort & Spa GmbH (Hotelwebsite Severin*s Resort & Spa) / (Hotelwebsite Landhaus Severin*s) / (Hotelwebsite Severin*s Tegernsee)
Severin's Lech GmbH (Hotelwebsite)
LOUIS HOTEL GmbH (Hotelwebsite)

Legal bases and intra-group data transfers

We process personal data on the basis of Art. 6 GDPR, in particular for the initiation and performance of contracts such as accommodation agreements, for legal obligations and for legitimate interests. Intra-group transfers between the management company and the hotels are additionally based on the “small group privilege” (Recital 48 GDPR) for internal administrative purposes and, where applicable, on joint controllership under Art. 26 GDPR. Consents within the meaning of Art. 6 Para. 1 lit. a GDPR and, where applicable, Art. 9 Para. 2 lit. a GDPR are obtained separately where required and may be withdrawn at any time with effect for the future.

Data categories and sources

The data concerned may include in particular master and contact data, contract or booking and billing data, communication and usage data, and security or log data. Special categories of personal data are processed only with the relevant consent, e.g. health information. The data originate from you, from parties involved in handling your booking or stay, e.g. travel agencies, online travel agencies and other travel intermediaries, or from internal group systems for the purposes described above.

Recipients and transfers to third countries

Recipients include internal units of the central administration in Bremen and of the hotels. Processors within the meaning of Art. 4 No. 8 GDPR and Art. 28 GDPR may also receive data, e.g. IT, cloud, communications and support service providers, as well as other third parties where required, e.g. banks, advisers and authorities. For transfers to third countries, we ensure an adequate level of data protection, e.g. by an adequacy decision of the European Union such as the EU-US Data Privacy Framework or by Standard Contractual Clauses with supplementary measures.

Retention

Personal data are stored only for as long as necessary for the purposes or as long as statutory retention obligations apply. Afterwards the data are deleted or anonymised. Applicable periods include in particular commercial and tax retention periods.

Obligation to provide data

Certain information is required for the initiation or performance of contracts and for compliance with legal obligations. Without this information services may not be provided.

Your rights

You may exercise all rights described in this data protection statement, incl. those under Chapter III GDPR, against any of the joint controllers. We coordinate requests internally within the framework of the joint controllership. The contact details of our data protection officer are provided in this data protection statement.

The data controller has integrated on this website the component Google Analytics. Google Analytics is a web analytics service. Web analysis is the collection and analysis of data about the behavior of visitors to websites. Among other things, a web analysis service collects data about referrers - from which website the user came to the website, which subpages of the website were accessed, or how often and for how long a subpage was viewed. A web analysis is mainly used for optimization of a website and for cost-benefit analysis of Internet advertising.

The operating company of the Google Analytics component is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland.

The controller uses the addition "_gat._anonymizeIp" for web analytics via Google Analytics. By means of this addition, the IP address of the Internet connection of the data subject will be shortened and anonymized by Google, if the access to our website is from a Member State of the European Union or from another state party to the Agreement on the European Economic Area.

The purpose of the Google Analytics component is to analyze streams of visitors on our website. Among other things, Google uses the data and information obtained to evaluate the use of our website, to compile online reports for us showing the activities on our websites, and to provide other services related to the use of our website.

Google Analytics uses a cookie on the information technology system of the person concerned. What cookies are has already been explained above. Using this cookie makes it possible for Google to analyze the usage of our website. Each time one of the pages of this website, that is processed by the data controller and where a Google Analytics component is integrated, is accessed, the Internet browser on the information technology system of the person concerned is automatically initiated by the respective Google Analytics component to submit data to Google for online analysis purposes. As part of this technical process, Google receives information about personal data, such as the IP address of the person concerned, which among other things serves Google to track the origin of visitors and clicks, and subsequently to allow commission billing.
The cookie stores personal data, such as access time, the location from which access was made, and the frequency of site visits by the data subject. Each time a user visits our website, this personal information, including the IP address of the Internet connection used by the data subject, is transferred to Google in the United States of America. This personal data is stored by Google in the United States of America. Google may transfer such personal data collected through this technical process to third parties.

The data subject can prevent the setting of cookies at any time by our website, as explained above, by changing the Internet browser settings and thus permanently preventing the setting of cookies. Such Internet browser settings would also prevent Google from setting a cookie on the data subject's information technology system. In addition, a cookie already set by Google Analytics can be deleted at any time through the Internet browser or other software programs.
Furthermore, the data subject has the option of objecting to and preventing the collection of the data generated by Google Analytics for the use of this website and the processing of this data by Google. To do this, the person must download and install a browser add-on at tools.google.com/dlpage/gaoptout. This browser add-on informs Google Analytics via JavaScript that no data and information about website visits may be transmitted to Google Analytics. The installation of the browser add-on is considered by Google to be an objection. If the data subject's information technology system is later deleted, formatted or reinstalled, the data subject must re-install the browser add-on to disable Google Analytics. If the browser add-on is uninstalled or disabled by the data subject or any other person within their sphere of control, it is possible to reinstall or reactivate the browser add-on.
Additional information and Google's privacy policy can be found at https://www.google.com/intl/en/policies/privacy/ and http://www.google.com/analytics/terms/en.html. Google Analytics is explained in more detail at https://www.google.com/intl/de_de/analytics/.

You can prevent collection by Google Analytics by clicking on the following link. An opt-out cookie will be set, which prevents the future collection of your data when visiting this website: Disable Google Analytics

This website uses Google Enhanced Conversion - an enhanced version of Google Conversion. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter referred to as "Google").

With the help of Google Enhanced Conversion, Google and we can recognise whether the user has performed certain actions. For example, we can evaluate which buttons on our website were clicked how often and which content was viewed or used particularly frequently. This information is used to create conversion statistics. We learn the total number of users who clicked on our ads and what actions they took. We do not receive any information with which we can personally identify the user. Google itself uses cookies or comparable recognition technologies for identification.

Google Enhanced Conversion allows us to increase the accuracy of conversion measurement compared to Google Conversion. It securely sends hashed first-party conversion data from our website to Google as part of an addendum to existing conversion tags. User information is not shared with other advertisers. Access controls and encryption are in place to prevent unlawful access.

The legal basis for the use of Google Conversion is your consent in accordance with Art. 6 para. 1 lit. a GDPR and § 25 Para. 1 TDDDG. This consent can be revoked at any time.

More information on Google Enhanced Conversion can be found in Google's privacy policy at https://policies.google.com/privacy.

A web service from Google Ireland Limited, Gordon House, Barrow Street, 4 Dublin, Ireland (hereinafter: DoubleClick) is loaded on our website. We use this data to ensure the full functionality of our website. In this context, your browser may transmit personal data to DoubleClick.

You can prevent DoubleClick from collecting and processing your data by refusing your consent when you enter the website, deactivating the execution of script code in your browser or installing a script blocker in your browser.
The legal basis for the use of Google Double Click is your consent in accordance with Art. 6 Para. 1 lit. a GDPR.

The data will be deleted as soon as the purpose of their collection has been fulfilled. Further information on the handling of the transferred data can be found in the DoubleClick data protection declaration: policies.google.com/privacy

Our website uses conversion tracking from Microsoft (Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA). Microsoft Bing Ads places a cookie on your computer if you have reached our website via a Microsoft Bing ad. In this way, Microsoft Bing and we can recognize that someone clicked on an ad, was redirected to our website and reached a previously determined target page (conversion page). We only find out the total number of users who clicked on a Bing ad and were then forwarded to the conversion page. No personal information about the identity of the user is disclosed. If you do not want to participate in the tracking process, you can also reject the setting of a cookie required for this - for example via a browser setting that generally disables the automatic setting of cookies.

The legal basis for the use of Bing Ads is your consent pursuant to Art. 6 Para. 1 lit. a GDPR.

Further information on data protection and the cookies used by Microsoft Bing can be found on the Microsoft website: https://www.microsoft.com/en-us/privacy/privacystatement

We use Google Tag Manager, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager allows us to manage and deploy website tags via a centralized interface. While the Tag Manager itself does not set cookies or directly access personal data collected by individual tags, it may process personal data such as your IP address or other metadata during the loading process. It cannot be ruled out that Google may use this data for its own purposes, such as service optimization or error analysis.

For this reason, Google Tag Manager is only activated after you have given your explicit consent via our cookie banner.

The storage and processing of the data collected takes place in the USA, i.e. a third country for which there is no adequacy decision by the European Commission.

However, Google bases the data transfer to the USA on the EU-U.S. Data Privacy Framework of the European Commission.

The legal basis for the use of Google Tag Manager is your consent pursuant to Art. 6 Para. 1 lit a GDPR and, where applicable, Section 25 Para. 1 TDDDG, insofar as the processing involves access to information on your device (e.g., IP address, device configuration).

You can withdraw your consent at any time with future effect by adjusting your preferences in the cookie settings.

For more information about how Google handles your data, please refer to Google's Tag Manager Use Policy:
marketingplatform.google.com/about/analytics/tag-manager/use-policy/

This website uses the "Google Maps" service from Google to display maps or map sections and thus enables you to conveniently use the map function on the website. The Google Maps Geocoding API is used to determine and display locations. Google Maps is operated by Google LLC, 1600 Amphitheater Parkway, Mountain View, CA 94043, USA.

When you visit the website, Google receives the information that you have accessed the
corresponding subpage of our website. In addition, the data mentioned under the "Access data" section is transmitted to Google. This takes place regardless of whether Google provides a user account that you are logged in to or whether there is no user account. If you are logged in to Google, your data will be assigned directly to your account. If you do not want your profile to be assigned to Google, you must log out before activating the button.

Google also processes your personal data in the USA and has submitted to the EU-US Privacy Shield. You can view Google's certification here: https://www.dataprivacyframework.gov/participant/5780

The legal basis for the use of Google Maps is your consent in accordance with Art. 6 Para. 1 lit. a GDPR. We have no knowledge of the storage period at Google and have no influence on it.

Further information on the purpose and scope of processing by the plug-in provider can be found in Google's privacy policy. There you will also find further information on your rights and setting options to protect your privacy: http://www.google.de/intl/de/policies/privacy

Further information on the terms of use of Google Maps can be found at:
https://www.google.com/intl/de_de/help/terms_maps.html

A web service from Google Ireland Limited, Gordon House, Barrow Street, 4 Dublin, Ireland (hereinafter: Gstatic) is loaded on our website. We use this data to ensure the full functionality of our website. In this context, your browser may transmit personal data to Gstatic.

The legal basis for the use of this web service is your consent in accordance with Art. 6 Para. 1 lit. a GDPR.

You can prevent Gstatic from collecting and processing your data by refusing your consent when you enter the website, deactivating the execution of script code in your browser or installing a script blocker in your browser.

The data will be deleted as soon as the purpose of their collection has been fulfilled. Further information on the handling of the transferred data can be found in Google's data protection declaration: https://policies.google.com/privacy

Google Fonts (https://fonts.google.com/) are used to visually improve the presentation of various information on this website. The web fonts are transferred to the cache of the browser when the page is called up so that they can be used for display. If the browser does not support Google Fonts or prevents access, the text is displayed in a standard font.

When the page is called up, no cookies are stored by the website visitor. Data that are transmitted in connection with the page view are sent to resource-specific domains such as fonts.googleapis.com or fonts.gstatic.com. You will not be associated with data that may be collected or used in connection with the parallel use of authenticated Google services such as Gmail.

You can prevent the collection and processing of your data by this web service by refusing your consent when entering the website, deactivating the execution in your browser or installing a script blocker in your browser. If your browser does not support the Google Fonts or you prevent access to the Google servers, the text is displayed in the system's standard font.

The legal basis for the use of this web service is your consent in accordance with Art. 6 Para. 1 lit. a GDPR.

You can find information on the data protection conditions of Google Fonts at: https://developers.google.com/fonts/faq#Privacy

General information on data protection can be found in the Google Privacy Center at: https://policies.google.com/privacy

On this website we use MyFonts Counter, a web analytics service provided by Monotype Imaging Holdings Inc, 600 Unicorn Park Drive, Woburn, Massachusetts 01801 USA (hereinafter referred to as "MyFonts").

Under the terms of the license agreement, page-view tracking is performed by counting the number of visits to the website for statistical purposes and transmitting this information to MyFonts. MyFonts only collects anonymous data. The data may be passed on by activating Java-Script code in your browser.

The legal basis for the use of this web service is your consent in accordance with Art. 6 Para. 1 lit. a GDPR.

To prevent the execution of Java-Script code from MyFonts, you can install a Java-Script blocker (e.g. www.noscript.net).

Further information on MyFonts Counter can be found in the MyFonts data protection Statement at: https://www.monotype.com/legal/terms-conditions-business#Privacy

Videos from the YouTube platform are integrated on our website. The provider of this service is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland or Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter referred to as ‘YouTube’).
When you access a page with an embedded YouTube video, personal data is transmitted to YouTube/Google, in particular your IP address and - depending on the configuration - other device and browser-related information. If you are logged into your Google account, this assignment can also be made directly to your user profile. The data processing is carried out by Google under its own responsibility.

The data collected may also be stored and processed in the USA, i.e. a third country for which there is no adequacy decision by the European Commission.

However, Google bases the data transfer to the USA on the EU-U.S. Data Privacy Framework of the European Commission. The integration of YouTube videos and the associated data processing are based on your consent in accordance with Art. 6 Para. 1 lit. a GDPR in conjunction with § 25 Para. 1 TDDDG. Consent can be revoked at any time with effect for the future via our Consent Banner. Further information on data processing by YouTube can be found in Google's privacy policy at https://policies.google.com/privacy

To measure conversion rates, this website uses the visitor activity pixel of Meta (formerly "Facebook Pixel"). The provider of this service is Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (hereinafter referred to as "Meta"). According to Meta’s statement the collected data will be transferred to the USA and other third-party countries too.

The storage and processing of the collected data takes place in the USA, i.e. a third country for which there is no adequacy decision by the European Commission.

However, Meta bases the data transfer to the USA on the EU-U.S. Data Privacy Framework of the European Commission.

This tool allows the tracking of page visitors after they have been linked to the website of the provider after clicking on a Facebook ad. This makes it possible to analyze the effectiveness of Facebook ads for statistical and market research purposes and to optimize future advertising campaigns.

For us as the operators of this website, the collected data is anonymous. We are not in a position to arrive at any conclusions as to the identity of users. However, Facebook archives the information and processes it, so that it is possible to make a connection to the respective user profile and Facebook is in a position to use the data for its own promotional purposes in compliance with the Facebook Data Usage Policy (https://www.facebook.com/about/privacy/). This enables Facebook to display ads on Facebook pages as wellas in locations outside of Facebook. We as the operator of this website have no control over the use of such data.

The use of these services occurs on the basis of your consent pursuant to Art. 6 Para. 1 lit.a GDPR and § 25 Para. 1 TDDDG. You may revoke your consent at any time.

Within the meta pixel, we are using the expanded alignment function. The expanded alignment allows us to transfer to Meta (Facebook) different types of data (e.g., place of residence, federal state, zip code, hashed email addresses, names, gender, date of birth or phone number) of our customers and prospects we collect through our website. As a result of this activation, we can tailor the offers presented in our advertising campaigns on Facebook to individuals interested in what we offer even more precisely. Moreover, this expanded alignment optimizes the allocation of website conversions and expands custom audiences.

Insofar as personal data is collected on our website with the help of the tool described here and forwarded to Facebook, we and Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland are jointly responsible for this data processing (Art. 26 DSGVO). The joint responsibility is limited exclusively to the collection of the data and its forwarding to Facebook. The processing by Facebook that takes place after the onward transfer is not part of the joint responsibility. The obligations incumbent on us jointly have been set out in a joint processing agreement. The wording of the agreement can be found under: https://www.facebook.com/legal/controller_addendum. According to this
agreement, we are responsible for providing the privacy information when using the Facebook tool and for the privacy-secure implementation of the tool on our website. Facebook is responsible for the data security of Facebook products.

You can assert data subject rights (e.g., requests for information) regarding data processed by Facebook directly with Facebook. If you assert the data subject rights with us, we are obliged to forward them to Facebook. Data transmission to the US is based on the Standard Contractual Clauses (“SCCs”) of the European Commission. Details can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum and https://de-de.facebook.com/help/566994660333381.

In Facebook’s Data Privacy Policies, you will find additional information about the protection of your privacy at: https://www.facebook.com/about/privacy/. 

You also have the option to deactivate the remarketing function “Custom Audiences” in the ad settings section under https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen.To do this, you first have to log into Facebook.

If you do not have a Facebook account, you can deactivate any user-based advertising by Facebook on the website of the European Interactive Digital Advertising Alliance: http://www.youronlinechoices.com/de/praferenzmanagement/. 

This website uses the Insight Tag from LinkedIn. The provider of this service is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland (hereinafter referred to as "LinkedIn").

With the help of the LinkedIn Insight Tag, we receive information about visitors to our website. If a website visitor is registered with LinkedIn, we can, among other things, analyse the key professional data (e.g. career level, company size, country, location, industry and job title) of our website visitors and thus better tailor our site to the respective target groups. Furthermore, we can use LinkedIn Insight Tags to measure whether visitors to our websites make a purchase or take another action (conversion measurement). Conversion measurement can also take place across devices (e.g. from PC to tablet). LinkedIn Insight Tag also offers a retargeting function that allows us to display targeted advertising outside the website to visitors to our website, whereby, according to LinkedIn, no identification of the advertising addressee takes place.

LinkedIn itself also collects so-called log files (URL, referrer URL, IP address, device and browser properties and time of access). The IP addresses are shortened or (if they are used to reach LinkedIn members across devices) hashed (pseudonymised).

The direct identifiers of LinkedIn members are deleted by LinkedIn after seven days. The remaining pseudonymised data is then deleted within 180 days.

The data collected by LinkedIn cannot be assigned to specific individuals by us as website operators. LinkedIn will store the collected personal data of website visitors on its servers in the USA and use it in the context of its own advertising measures.

The use of LinkedIn Insight exclusively on the basis of your consent pursuant to Art. 6 Para. 1 lit. a GDPR and § 25 Para. 1 TDDDG. The consent can be revoked at any time with effect for the future.

Data transfer to the USA is based on the standard contract clauses of the EU Commission (“SCC”). Details can be found here: https://www.linkedin.com/legal/l/dpa and https://www.linkedin.com/legal/l/eu-sccs

You can object to the analysis of usage behaviour and targeted advertising by LinkedIn at the following link: https://www.linkedin.com/psettings/guest-controls

Furthermore, LinkedIn members can control the use of their personal data for advertising purposes in their account settings. To prevent LinkedIn from linking data collected on our website with your LinkedIn account, you must log out of your LinkedIn account before visiting our website. For more information on data protection at LinkedIn, please see their privacy policy at https://www.linkedin.com/legal/privacy-policy#choices-oblig

To improve your user experience on our hotel website, we use a software provided by The Hotels Network (Muntaner 262, 3º, 08021 Barcelona, Spain). Using The Hotels Network, we are able to measure your user behavior in an anonymised way to better understand how visitors use our website and offer a more relevant user experience. To enable this, The Hotels Network uses cookies to store data from website users such as browser information, pages viewed, scrolls etc. As any analysis or processing is always anonymised, it is impossible to identify the user in person from this data.

Should it nevertheless become necessary to process personal data, this will be done exclusively on the basis of your consent in accordance with Art. 6 Para. 1 lit. a GDPR. We have entered into a contract Data Processing Agreement (“DPA”) with The Hotels Network and implement the strict provisions of the EU General Data Protection Regulation to the fullest when using it.
Further information can be found on the website and in the privacy statement of The Hotels Network:

https://www.thehotelsnetwork.com/en

https://www.thehotelsnetwork.com/en/privacy-policy

ATLANTIC Hotels use the services of Perspective Software GmbH to make potential applicants aware of vacancies at ATLANTIC Hotels.

Provision of the online offer

We use an external service provider for the provision of our online offer:
Perspective Software GmbH, Mailbox 659770, D-96035 Bamberg (hereinafter "Perspective").

Perspective itself stores your data exclusively on European servers. However, there is a possibility that your data may be accessible to entities in the United States of America, as Perspective uses sub-processors located in the USA. As the European Union Commission has determined that the data protection laws of the United States do not ensure an adequate level of protection for personal data collected from data subjects in the European Union, Perspective provides additional measures and safeguards for data transfers to the United States in accordance with the requirements of the GDPR to ensure an adequate level of protection. For example, by entering into standard contractual clauses between Perspective and sub-processors.

I. Description and scope of data processing
Perspective processes your data for us in order to provide you with our online services. For this purpose, Perspective will automatically transmit your IP address to deliver the content and functionality of our Online Services to your browser or terminal device.

The following data may be collected:
1. information about the type of browser and the version used
2. the operating system of your computer
3. the Internet service provider you are using
4. the IP address of your terminal device
5. the date and time you access the Funnel
6. websites from which you came to our website ("referrer")

II. legal basis for data processing
Perspective stores the data mentioned under I. in so-called log files. This is done to ensure
- to ensure a smooth connection of the website,
- to ensure a comfortable use of our website
- the evaluation of system security and stability, and
- for other administrative purposes.

The temporary storage of the IP address by the system is also necessary to enable delivery of the website to your computer. For this purpose, the IP address of your computer must remain stored for the duration of the session. Our legitimate interest in data processing also lies in these purposes. The legal basis for data processing is therefore Art. 6 para. 1 p. 1 lit. f DSGVO.

III. Duration of processing
The personal data processed by Perspective are deleted as soon as they are no longer necessary to achieve the purpose for which they were collected:
- In the case of the collection of data for the provision of the website, this is the case when the respective session has ended.
- In the case of storage of the IP address in log files, this is the case after 7 days at the latest.

IV. Data subject rights
You have the right to obtain information free of charge at any time about the origin, recipient and purpose of your stored personal data. You also have the right to demand the correction, blocking or deletion of this data. You can contact us at any time at the address given in the imprint with regard to this and other questions on the subject of data protection. Furthermore, you have the right to lodge a complaint with the competent supervisory authority in the event of violations of the GDPR. Because the data processing is based on Art. 6 (1) sentence 1 lit. f DSGVO, you have the right to object to the processing of your personal data at any time for reasons arising from your particular situation. If you object, we will no longer process your personal data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the purpose of asserting, exercising or defending legal claims (objection under Article 21(1) DSGVO). Since the collection of data for the provision of the website and the storage of the data in log files is absolutely necessary for the operation of our website, there should mostly be no possibility for you to object. You also have the right to request the restriction of the processing of your personal data under certain circumstances.
The right to restriction of processing exists in the following cases:
- If you dispute the accuracy of your personal data stored by us, we usually need time to verify this. For the duration of the verification, you have the right to request the restriction of the processing of your personal data.
- If the processing of your personal data has happened / is happening unlawfully, you can request the restriction of data processing instead of deletion.
- If we no longer need your personal data, but you need it to exercise, defend or assert legal claims, you have the right to request restriction of the processing of your personal data instead of erasure.
- If you have lodged an objection pursuant to Art. 21 (1) DSGVO, a balancing of your and our interests must be carried out. As long as it has not yet been determined whose interests prevail, you have the right to demand the restriction of the processing of your personal data.

If you have restricted the processing of your personal data, such data may - apart from being stored - only be processed with your consent or for the assertion, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or a Member State.

Contact and enquiry management

We use an external service provider for the provision of contact, enquiry or application forms: Perspective Software GmbH, Mailbox 659770, D-96035 Bamberg (hereinafter "Perspective"). Perspective itself stores your data exclusively on European servers.
However, there is a possibility that your data may be accessible to entities in the United States of America because Perspective uses sub-processors located in the United States. As the European Union Commission has determined that the data protection laws of the United States do not ensure an adequate level of protection for personal data collected from data subjects in the European Union, Perspective provides additional measures and safeguards for data transfers to the United States in accordance with the requirements of the GDPR to ensure an adequate level of protection. For example, by concluding standard contractual clauses between Perspective and the sub-processors.

I. Description and scope of data processing
When using Perspective's contact, enquiry or application forms, the following data is transmitted to Perspective's servers:
- Date and time of access
- Websites from which you came to our website ("referrer")
- Context information (e.g. button clicks on the pages, selections made on the pages)
- Contents of all completed text fields (e.g. contact data, such as your name or address, or other personal data, depending on the question posed in the specific text field)
- Files uploaded by you

II. Purpose Legal basis of data processing
The purpose of this data processing is to ensure the communication you have entered into. The processing of your data from contact or enquiry or application forms is therefore initially based on your consent. The legal basis is Art. 6 para. 1 p. 1 lit. a DSGVO. If a contract is initiated via an enquiry form, the legal basis is also Art. 6 para. 1 p. 1 lit. b DSGVO. The legal basis for the processing of data in an application form may also be Art. 88 DSGVO in conjunction with 26 BDSG in addition to Art. 6 para. 1 p. 1 lit. f DSGVO.

III. Duration of processing
Your personal data will be kept for as long as it is necessary to fulfil the purpose of the processing or until you withdraw your consent. Exempt from this principle is data that Perspective must retain due to legal obligations. These include, for example, the retention obligations under commercial and tax law. These retention periods are - currently - up to ten years.

IV. Data subject rights
You have the right at any time to receive information free of charge about the origin, recipient and purpose of your stored personal data. You also have the right to demand the correction, blocking or deletion of this data. You can contact us at any time at the address given in the imprint for this purpose and for further questions on the subject of data protection.
Furthermore, you have the right to lodge a complaint with the competent supervisory authority in the event of violations of the GDPR. You can revoke your consent to data processing at any time by informally notifying us (e.g. by e-mail). The revocation does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation. You also have the right to request the restriction of the processing of your personal data under certain circumstances.
The right to restriction of processing exists in the following cases:
- If you dispute the accuracy of your personal data stored by us, we usually need time to check this. For the duration of the verification, you have the right to request the restriction of the processing of your personal data.
- If the processing of your personal data has happened / is happening unlawfully, you can request the restriction of data processing instead of erasure.
- If we no longer need your personal data, but you need it to exercise, defend or assert legal claims, you have the right to request restriction of the processing of your personal data instead of erasure.
- If you have lodged an objection pursuant to Art. 21 (1) DSGVO, a balancing of your and our interests must be carried out. As long as it has not yet been determined whose interests prevail, you have the right to demand the restriction of the processing of your personal data. If you have restricted the processing of your personal data, this data may - apart from being stored - only be processed with your consent or for the assertion, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of an important public interest of the European Union or a Member State.

We also process personal data that we receive from data subjects when they contact us, e.g. in the form of a business card during an event. It is also possible to network with us directly via a digital business card. We use Lemontaps, a service provided by Lemon Innovation & Technology GmbH, Seyfferstraße 34, 70197 Stuttgart (hereinafter referred to as "Lemontaps").

Your personal data is processed insofar as this is necessary to initiate a contract, execute a contract or for other business relationships, or to pursue our legitimate interests in the presumably desired contact.
The legal basis, insofar as the processing takes place for contract initiation or contract execution, is Art. 6 Para. 1 lit. b GDPR. If this is not the case, your personal data will be processed to protect legitimate interests in accordance with Art. 6 Para. 1 lit. f GDPR. If you have given us your consent to process personal data for specific purposes, the lawfulness of this processing is based on your consent within the meaning of Art. 6 Para. 1 lit. a GDPR. If necessary, we process and store your personal data for subsequent contact. For this purpose, it may be necessary to digitise the personal data you provide to us (e.g. business cards).

The personal data collected by us will be stored for the duration of the business relationship (Art. 6 Para. 1 lit. b GDPR) and then deleted, unless we are obliged to store it for a longer period due to legal storage and documentation obligations or you have consented to storage beyond this period in accordance with Art. 6 Para. 1 lit. a GDPR. As soon as the storage of the data is no longer required for the aforementioned storage purposes or you object to this, your data will be deleted immediately.

A so-called order Data Processing Agreement (“DPA”) pursuant to Art. 28 Para. 3 GDPR has been concluded with Lemontaps. In this contract, we oblige this service provider to protect your data and not to pass it on to third parties. Lemontaps uses the data collected exclusively on our behalf for the purpose stated here. The data will not be used for any other purpose.
Lemontaps also takes all technical and organisational measures to protect this data.
Further information on data protection in connection with Lemontaps can be found in their privacy policy at https://docs.lemontaps.com/legal/Lemontaps_Datenschutzerklaerung.pdf (in German)
 

On this website, we use the ‘Curator’ service of the provider Curator Group, 69 Ruthven Street, Bondi Junction, New South Wales 2022, Australia (hereinafter referred to as ‘Curator’).

We use Curator to display content from our social media channels in the sense of a ‘social wall’. For this service, data is read from various social media platforms and displayed and linked on our website.

The legal basis for the integration of the tool is Art. 6 Para. 1 lit. f GDPR. Our legitimate interests lie in optimising the user-friendliness of the website and enabling the integration of social media posts that are of interest to you. Otherwise, the services are only actively loaded if you have previously given your consent to this within the meaning of Art. 6 Para. 1 lit. a GDPR and § 25 Para. 1 TDDDG. You can revoke your consent at any time with effect for the future. The legality of the processing carried out on the basis of the consent until the revocation remains unaffected.

Further details on the data processing carried out in connection with the service can be found in the provider's privacy policy at curator.io/privacy-policy

If you write us an email, in particular booking enquiries, this email including its metadata may also be passed on to external operators of third-party software that supports us in responding to emails. The provider is:
 
Hotel Res Bot UG
Mönchsgasse 48
50737 Cologne
Germany
 
Personally identifiable information, including your email address and the content of the email, will then be processed and a reply email will be generated via this system. The legal basis for the processing is Art. 6 Para. 1 lit. b GDPR.
 
E-mails received or sent are automatically deleted after 5 days. The temporarily stored personal data, which includes the content of the email and the offer details, is deleted 2 weeks after the requested departure date in the case of booking enquiries or 2 weeks after receipt of the email in the case of other email intentions.
 
Automated decision making is used to suggest the most suitable products (room and rate types) to the agent based on the written enquiry. Your data is securely shared with third party processors (e.g. AWS, where the application is hosted, or an email service provider for sending and receiving emails). A targeted transfer of your personal data to a country outside the EU or UK is not intended.
 
To prevent unauthorised third parties from accessing your personal data, the email is encrypted at rest during transport.
 
A so-called order Data Processing Agreement (“DPA”) has been concluded with Hotel Res Bot UG in accordance with Art. 28 Para. 3 GDPR. In this contract, we oblige this service provider to protect the data of our guests and not to pass it on to third parties. In addition, this service provider takes all technical and organisational measures to protect your data.
 
You can find further information on data protection at Hotel Res Bot UG at: https://www.hotel-reservation-bot.de/en-privacy-policy/

We use the web analysis software Microsoft Clarity for our website. The service provider is the US company Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA (hereinafter referred to as "Microsoft").

Microsoft Clarity refers to a procedure by Microsoft in which user analysis is possible on the basis of a pseudonymous user ID and thus on the basis of pseudonymous data, such as the evaluation of data on mouse movements or performance data on certain Internet presentations.

In particular, we process usage data (for example, internet presentations visited, interest in content, access times), meta or communication data (for example, device information, IP addresses), location data (information on the geographical position of a device or a person), movement data (mouse movements, scrolling movements) in pseudonymised form. We have made the corresponding settings in such a way that the data collection to and by Microsoft alone is pseudonymised, in particular in the form of IP masking (pseudonymisation of the IP address).

The purpose of the processing is tracking (e.g. interest/behavioural profiling, use of cookies), remarketing, conversion measurement (measurement of the effectiveness of marketing measures), interest-based and behavioural marketing, profiling (creation of user profiles), reach measurement (e.g. access statistics, recognition of returning users), cross-device tracking (cross-device processing of user data for marketing purposes).

The storage and processing of the collected data takes place in the USA, i.e. a third country for which there is no adequacy decision by the European Commission.

However, Microsoft bases the data transfer to the USA on the EU-U.S. Data Privacy Framework of the European Commission.

All visitors to our website who have consented to the corresponding use via our consent banner are affected by data processing by Microsoft Clarity. The data processing is thus based solely on your consent in accordance with Art. 6 Para. 1 lit. a GDPR and § 25 Para. 1 TDDDG.

Please note that we have concluded a so-called Data Processing Agreement (“DPA”) with Microsoft to enable this activity in accordance with Art. 28 Para. 3 S. 1 GDPR.

You will be informed of your rights of objection in accordance with this data protection statement. In addition, you can set an opt-out with the respective provider:

• Europe: https://www.youronlinechoices.eu
• Canada: https://www.youradchoices.ca/choices
• USA: https://www.aboutads.info/choices
• Cross-territory: https://optout.aboutads.info

For further information on data protection at Microsoft, please see the data protection declaration at https://privacy.microsoft.com/en-us/privacystatement

Our website uses the chat application from DialogShift GmbH, Torstr. 201, 10115 Berlin. This application processes and stores data for the purpose of web analysis, operating the chat application, and responding to inquiries. For the operation of the chat function, chat texts are stored, and a cookie with a unique ID is set—this serves to recognize you as a customer. A cookie is a small text file that is stored locally in the cache on your device. With the help of this cookie, our application recognizes the device again and can retrieve past chat logs. This cookie is stored for 90 days since its last use. You can disable the storage of cookies in your browser settings. However, without the use of cookies, the chat function cannot be executed. The possible disclosure of, for example, names, email addresses, or a telephone number is voluntary and with the consent to temporarily use and store these data for the purpose of making contact until the end of the contact. These personal data are deleted after 90 days. The legal basis for data processing is according to Art. 6 Para. 1 lit. a GDPR, § 25 Para. 1 TDDDG based on your consent. DialogShift offers further information on data collection and use as well as your rights and options for protecting your privacy at https://www.dialogshift.com/datenschutz.

We use the Facebook Conversion API (CAPI), a service provided by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (hereinafter referred to as ‘Meta’), to transmit usage data to Meta from our web server. The purpose is to measure the effectiveness of our advertising on Facebook and Instagram and to optimise our marketing activities in a targeted manner.

The Conversion API enables us to transmit certain events (e.g. page visits, submitted forms) directly from our web server to Meta – independent of the user’s browser or device. No client-side tracking technologies are used in this context.

Depending on the configuration, the following categories of personal data may in particular be processed when using the Conversion API:

• IP address
• Information about the device and browser used
• Visited URLs and timestamps
• HTTP header information
• Facebook-specific parameters (e.g. click ID)
• Hashed user information (e.g. email address, telephone number, if available)
• Transaction or conversion data (e.g. order values)

Personal data may be transferred to Meta Platforms Inc., 1601 Willow Road, Menlo Park, California 94025, USA. For the United States, there is an adequacy decision pursuant to Art. 45 Para. 1 GDPR.

Meta is certified under the EU-U.S. Data Privacy Framework (DPF). The current certification can be viewed at:

https://www.dataprivacyframework.gov/s/participant-search

To the extent that the use of the Conversion API involves access to information stored on the end user’s device (e.g. by reading the Facebook click ID from cookies), this is carried out on the basis of your consent pursuant to § 25 Para. 1 TDDDG.

The subsequent transmission of personal data to Meta is carried out on the basis of your consent pursuant to Art. 6 Para. 1 lit. a GDPR.

Consent is obtained through our consent management platform. You may withdraw your consent at any time with effect for the future.

Further information on data processing by Meta can be found at: https://www.facebook.com/privacy/policy

To enable our guests to use a digital check-in and check-out process, we use the service Hotelbird provided by hotelbird GmbH, Plinganserstraße 150, 81369 Munich, Germany (hereinafter referred to as 'Hotelbird').

Prior to arrival, guests receive an email invitation from Hotelbird to complete their online check-in. In this process, data required to fulfil the accommodation contract and – for foreign guests additionally to comply with statutory obligations under the German Federal Registration Act (Bundesmeldegesetz) – are collected. These data may be stored in the user profile for future check-ins. If credit card details are provided, processing takes place in compliance with the requirements of the PSD2 Directive.

You can also use the “Hotelbird” app to check in and out digitally. To do so, you must install the app on your device and register. When you use the app, we receive from hotelbird GmbH the data necessary for check-in or check-out.

The personal data processed by Hotelbird include, in particular:

• First and last name, date of birth, gender, address, language, nationality
• Optionally: company name, business address, invoice assignment information
• Payment information (e.g. credit card details, transaction information)

Data processing is carried out – depending on the module used – on the basis of Art. 6 Para. 1 lit. b GDPR (performance of a contract), insofar as processing is necessary for carrying out the check-in/check-out process, or on the basis of your consent pursuant to Art. 6 Para. 1 lit. a GDPR, insofar as additional functions or communication services are used. In addition, processing may take place on the basis of our legitimate interests pursuant to Art. 6 Para. 1 lit. f GDPR, in particular our interest in ensuring a secure and efficient digital check-in and check-out process. You may withdraw your consent at any time with effect for the future.

We have concluded a Data Processing Agreement within the meaning of Art. 28 Para. 3 GDPR with Hotelbird, under which Hotelbird is obliged to protect our guests’ data and not to disclose them to third parties. Hotelbird implements all necessary technical and organisational measures to ensure the security of your data.

Further information on data processing by Hotelbird can be found in Hotelbird’s Privacy Policy at https://hotelbird.com/en/privacy-policy/ 

If you make an online payment in connection with the use of Hotelbird (e.g. during digital check-in or to guarantee your booking), the payment process is carried out via the external payment service provider Adyen N.V., Simon Carmiggeltstraat 6-50, 1011 DJ Amsterdam, Netherlands (hereinafter referred to as 'Adyen').

Adyen processes the data required for payment processing (e.g. name, credit card or bank account details, amount, transaction number, date, time and IP address).

Processing takes place for the purpose of payment handling and fraud prevention on the basis of Art. 6 Para. 1 lit. b GDPR (performance of a contract) and Art. 6 Para. 1 lit. f GDPR (legitimate interest in secure payment processing).

Further information on data processing by Adyen can be found in Adyen’s Privacy Policy at https://www.adyen.com/policies-and-disclaimer/privacy-policy

We use the straiv solution provided by straiv GmbH, Industriestraße 23, 70565 Stuttgart, Germany (hereinafter referred to as 'straiv').

Straiv enables hotels to offer their guests digital information (e.g. digital guest directory, guest messaging) and services (e.g. digital check-in and check-out including registration form) on their own devices throughout all phases of the stay.

Each hotel decides independently which contents and services are provided through straiv.

Personal data are only collected if you provide them voluntarily or if legal regulations require their collection. For certain functions, entering personal data may be necessary to verify your authorisation to use a service. In particular, the following categories of data may be processed:

• Cookie ID, geo-data, room number
• Usage data (e.g. modules used and duration of visit)
• Booking data (e.g. booking number, arrival and departure date)

Not all of the data categories mentioned above are necessarily processed; this depends on the specific configuration and modules used by each hotel. The use of the solution is generally possible without registration. When submitting or requesting a service, you will at least once be asked to give your consent to data processing.

Categories of recipients:

• Public authorities where overriding legal provisions apply
• Other external recipients if you have given your consent or the transfer is permissible due to overriding legitimate interests
• The respective hotel and its authorised employees with system access

Data processing is carried out – depending on the module used – either on the basis of your consent pursuant to Art. 6 Para. 1 lit. a GDPR or on the basis of our legitimate interests pursuant to Art. 6 Para. 1 lit. f GDPR, in particular our interest in efficiently providing digital guest services. You may withdraw your consent at any time with effect for the future.

If, in the course of using straiv, data are transferred to third countries, such transfer is carried out on the basis of appropriate safeguards pursuant to Art. 46 GDPR, in particular the standard contractual clauses.

We have concluded a Data Processing Agreement within the meaning of Art. 28 Para. 3 GDPR with straiv, under which straiv is obliged to protect our guests’ data and not to disclose them to third parties. Straiv implements all necessary technical and organisational measures to ensure the security of your data.

Further information on data processing by straiv can be found in straiv’s Privacy Policy at https://straiv.io/en/legal/privacy/ 

If you make an online payment in connection with the use of straiv (e.g. during digital check-in or to guarantee your booking), the payment process is carried out via the external payment service provider Adyen N.V., Simon Carmiggeltstraat 6-50, 1011 DJ Amsterdam, Netherlands (hereinafter referred to as 'Adyen').

Adyen processes the data required for payment processing (e.g. name, credit card or bank account details, amount, transaction number, date, time and IP address).

Processing takes place for the purpose of payment handling and fraud prevention on the basis of Art. 6 Para. 1 lit. b GDPR (performance of a contract) and Art. 6 Para. 1 lit. f GDPR (legitimate interest in secure payment processing).

Further information on data processing by Adyen can be found in Adyen’s Privacy Policy at https://www.adyen.com/policies-and-disclaimer/privacy-policy

If you select “credit card” as the payment method, the payment processing is carried out by NEXI Germany GmbH, Helfmann-Park 7, 65760 Eschborn, Germany.

NEXI Germany GmbH uses your personal data in particular to process the payments, to prevent card abuse, to limit the risk of payment defaults and also for statutory purposes, such as the prevention of money laundering and criminal prosecution.

We as the credit card accepting entity, NEXI Germany GmbH and the payment service providers are each separately responsible for the processing of personal data within the respective technical sphere of influence.

We would like to point out that NEXI Germany GmbH transfers your personal data to other bodies necessary for the processing of the transaction, in particular to the credit institutions, banks and credit card companies involved. Processing of your personal data for the completion of the payment also takes place at these points. You will find the respective privacy policies on the websites of NEXI Germany GmbH and the payment service providers. Please address any enquiries regarding data protection and the exercise of your rights to NEXI Germany GmbH or the respective payment service providers.

The transmission of your data takes place on the basis of GDPR Article 6(1)(b) for the processing of the contract or your order. The secure transfer of your data takes place in accordance with the statutory provisions, § 25a KWG (German Banking Act), § 27 ZAG (Payment Services Oversight Act) and the provisions of the respective credit card companies. The processing and transfer are based on GDPR Article 6(1)(c) (legal obligations) and (f) (our legitimate interest). You have the possibility of revoking your consent to data processing at NEXI Germany GmbH and the respective payment service providers at any time for the future. Revocation has no effect on the effectiveness of data processing operations that have taken place in the past. However, in the event of revocation, we can no longer offer you the payment method “credit card”.

Further information on data protection and your rights pursuant to GDPR Articles 15 to 21 for NEXI Germany GmbH can be found at Data Policy | Nexi.

If you make payments with us (e.g. by credit card on site or as part of digital payment processes), payment processing is carried out via the payment service provider Adyen N.V., Simon Carmiggeltstraat 6, 1011 DJ Amsterdam, Netherlands (hereinafter referred to as 'Adyen').

In doing so, Adyen processes the personal data required for payment processing, in particular payment and transaction data (e.g. amount, time, transaction reference), card or payment instrument data (e.g. card type, partially masked card details), merchant and terminal data and, in the case of online payments, potentially also technical data (e.g. IP address, device and browser information). As the accepting entity, we generally only receive the information necessary to confirm and account for the payment.

Adyen processes personal data in particular for payment handling, preventing card misuse and fraud, managing risk and complying with statutory requirements (e.g. anti-money laundering obligations and supervisory requirements). In this context, Adyen may transfer data to other parties required to complete the transaction, in particular participating banks, financial institutions, payment networks and card schemes.

We, as the accepting entity, and Adyen each process personal data as separate controllers for processing activities within our respective areas of responsibility. The same applies to banks and payment networks involved in the payment process to the extent they carry out their own processing.

Processing in connection with payment handling is carried out on the basis of Art. 6 Para. 1 lit. b GDPR (performance of a contract), insofar as processing is necessary to carry out the payment. In addition, processing may be based on Art. 6 Para. 1 lit. c GDPR (legal obligation) where required by law, and on Art. 6 Para. 1 lit. f GDPR (legitimate interest) for fraud prevention, misuse prevention and ensuring the security of payment processing.

Further information on data processing by Adyen can be found in Adyen’s Privacy Policy at https://www.adyen.com/privacy-policy