1. General information on data protection

We are pleased that you are visiting our website and appreciate your interest in our hotel. The protection of your personal data is important to us.

This Privacy Policy provides information about the nature, scope and purposes of the processing of your personal data. It covers both processing activities carried out when you visit and use our website and those carried out in connection with our business services and operations.

Personal data is processed in accordance with the applicable data protection legislation, in particular the General Data Protection Regulation (GDPR), as well as any supplementary applicable national data protection legislation.

The controller responsible for the processing of personal data is Hotel Am Terrassenufer Dresden GmbH & Co. KG – hereinafter also referred to as “we” or “us”.

This Privacy Policy also informs you about your rights.

Controller

The controller responsible for the processing of personal data within the meaning of Art. 4 No. 7 GDPR is:

Hotel Am Terrassenufer Dresden GmbH & Co. KG

Terrassenufer 12

01069 Dresden

Deutschland

Phone: +49 351 4409 500

Email: hat@hotel-terrassenufer.de

Authorised management: Dipl.-Kfm. Max C. Trapp

Data Protection Officer

The controller’s Data Protection Officer is:

SHIELD GmbH

Ohlrattweg 5

25497 Prisdorf

Germany

Phone: +49 4101 80 50 600

Email: info@shield-datenschutz.de

Authorised management: Martin Vogel, Martin Dalecki

RIGHT TO OBJECT TO DATA PROCESSING IN PARTICULAR CASES AND TO DIRECT MARKETING

WHERE THE PROCESSING OF YOUR PERSONAL DATA IS BASED ON ART. 6 PARA. 1 LIT. E OR F GDPR, YOU HAVE THE RIGHT TO OBJECT TO THE PROCESSING AT ANY TIME ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION. THIS ALSO APPLIES TO PROFILING BASED ON THOSE PROVISIONS (ART. 21 PARA. 1 S. 1 GDPR). THE RELEVANT LEGAL BASIS FOR THE PROCESSING CAN BE FOUND IN THE CORRESPONDING INFORMATION IN THIS PRIVACY POLICY.

WHERE YOU OBJECT, WE WILL NO LONGER PROCESS THE PERSONAL DATA AFFECTED BY YOUR OBJECTION. THIS DOES NOT APPLY WHERE WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR WHERE THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS (ART. 21 PARA. 1 S. 2 GDPR).

WHERE YOUR PERSONAL DATA IS PROCESSED FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR SUCH MARKETING. THIS ALSO APPLIES TO PROFILING TO THE EXTENT THAT IT IS RELATED TO SUCH DIRECT MARKETING (ART. 21 PARA. 2 GDPR).

WHERE YOU OBJECT TO PROCESSING FOR DIRECT MARKETING PURPOSES, YOUR PERSONAL DATA WILL NO LONGER BE PROCESSED FOR SUCH PURPOSES (ART. 21 PARA. 3 GDPR).

Definitions

The terms used in this Privacy Policy generally have the meanings assigned to them in the General Data Protection Regulation (GDPR). To ensure that the information is provided in a transparent, intelligible and easily accessible manner, we explain the key terms below (Art. 12 Para. 1 S. 1 GDPR).

In this Privacy Policy, we use the following terms in particular:

Personal data means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly. This may occur in particular by reference to an identifier such as a name, an identification number, location data or an online identifier. Identification may also be possible by reference to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person (Art. 4 No. 1 GDPR).

A data subject is the identified or identifiable natural person to whom the personal data relates (Art. 4 No. 1 GDPR).

Processing means any operation or set of operations performed on personal data, whether or not by automated means. This includes in particular the collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data (Art. 4 No. 2 GDPR).

Restriction of processing means the marking of stored personal data with the aim of limiting its processing in the future (Art. 4 No. 3 GDPR).

Profiling means any form of automated processing of personal data in which such data is used to evaluate certain personal aspects relating to a natural person. This applies in particular to the analysis or prediction of aspects concerning that person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements (Art. 4 No. 4 GDPR).

Pseudonymisation means the processing of personal data in such a manner that the data can no longer be attributed to a specific data subject without the use of additional information. This requires the additional information to be kept separately and to be subject to technical and organisational measures which ensure that the personal data cannot be attributed to an identified or identifiable natural person (Art. 4 No. 5 GDPR).

A filing system means any structured collection of personal data which is accessible according to specific criteria. It is irrelevant whether the collection is maintained centrally, on a decentralised basis or according to functional or geographical criteria (Art. 4 No. 6 GDPR).

A controller is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of processing personal data. Where the purposes and means of processing are determined by Union law or the law of a Member State, the controller or the specific criteria for its nomination may also be provided for by Union law or the law of a Member State (Art. 4 No. 7 GDPR).

A processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller (Art. 4 No. 8 GDPR).

A recipient is a natural or legal person, public authority, agency or other body to which personal data is disclosed, regardless of whether or not it is a third party.

Public authorities which may receive personal data in the context of a particular inquiry in accordance with Union law or the law of a Member State are not regarded as recipients. The processing of such data by those public authorities must comply with the applicable data protection rules according to the purposes of the processing (Art. 4 No. 9 GDPR).

A third party is a natural or legal person, public authority, agency or other body other than the data subject, the controller, the processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data (Art. 4 No. 10 GDPR).

Consent means any freely given, specific, informed and unambiguous indication of the data subject’s wishes. It is given by a statement or another clear affirmative action by which the data subject signifies agreement to the processing of personal data relating to them (Art. 4 No. 11 GDPR).

A personal data breach is a breach of security which accidentally or unlawfully leads to the destruction, loss, alteration, unauthorised disclosure of or access to personal data transmitted, stored or otherwise processed (Art. 4 No. 12 GDPR).

Genetic data means personal data relating to the inherited or acquired genetic characteristics of a natural person which provides unique information about that person’s physiology or health. Such data may result in particular from the analysis of a biological sample from the person concerned (Art. 4 No. 13 GDPR).

Biometric data means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person which allows or confirms the unique identification of that person. This includes, for example, facial images or fingerprint data (Art. 4 No. 14 GDPR).

Data concerning health means personal data relating to the physical or mental health of a natural person. This includes the provision of healthcare services where the data reveals information about the health status of the person concerned (Art. 4 No. 15 GDPR).

A supervisory authority is an independent public data protection authority established by a Member State pursuant to Art. 51 GDPR (Art. 4 No. 21 GDPR).

Legal bases for the processing of personal data

We process personal data only where there is a legal basis for doing so. Depending on the purpose and circumstances of the processing, the following legal bases may apply in particular:

• Consent: You have consented to the processing of your personal data for one or more specific purposes (Art. 6 Para. 1 lit. a GDPR).
• Contract and pre-contractual measures: The processing is necessary for the performance of a contract to which you are a party or in order to take pre-contractual measures at your request (Art. 6 Para. 1 lit. b GDPR).
• Legal obligation: The processing is necessary for compliance with a legal obligation to which we are subject (Art. 6 Para. 1 lit. c GDPR).
• Vital interests: The processing is necessary to protect your vital interests or those of another natural person (Art. 6 Para. 1 lit. d GDPR).
• Public interest: The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us (Art. 6 Para. 1 lit. e GDPR).
• Legitimate interests: The processing is necessary for the purposes of our legitimate interests or those of a third party, except where your interests, fundamental rights and freedoms requiring the protection of personal data override those interests (Art. 6 Para. 1 lit. f GDPR).

Special categories of personal data are generally subject to a prohibition on processing (Art. 9 Para. 1 GDPR). Such data is processed only where a legal basis under Art. 6 Para. 1 GDPR applies and at least one of the conditions set out in Art. 9 Para. 2 GDPR is also met.

The applicable legal basis and, where relevant, the applicable exception to the prohibition on processing are specified in the information relating to the respective processing activity (Art. 13 Para. 1 lit. c and Art. 14 Para. 1 lit. c GDPR).

Retention periods and erasure of personal data

We retain personal data only for as long as this is necessary for the respective purposes of processing or for as long as statutory retention obligations or other legal grounds require continued storage (Art. 5 Para. 1 lit. e and Art. 6 Para. 1 lit. c GDPR).

Where the purpose of the processing no longer applies and there is no statutory retention obligation or other legal basis for continued storage, the personal data will be erased in accordance with the applicable legal requirements (Art. 17 Para. 1 lit. a GDPR).

Where personal data must continue to be stored due to statutory retention obligations or for the establishment, exercise or defence of legal claims, it will be processed only for those purposes and erased once the relevant reason for retention no longer applies (Art. 17 Para. 3 lit. b and e GDPR).

Where possible, the specific retention period or the criteria used to determine it are stated in the information relating to the respective processing activity (Art. 13 Para. 2 lit. a and Art. 14 Para. 2 lit. a GDPR).

Cooperation with processors and other recipients

In the course of our processing activities, we may disclose personal data to processors, other controllers and other recipients, transfer personal data to them or otherwise grant them access to it. We do so only where the disclosure is necessary for the respective purpose and an appropriate legal basis applies (Art. 6 Para. 1 GDPR).

Where external service providers process personal data exclusively on our behalf and in accordance with our instructions, we engage them as processors (Art. 4 No. 8 GDPR). We engage only processors that provide sufficient guarantees that appropriate technical and organisational measures will be implemented. The processing is governed by a contract or another legal act that meets the applicable statutory requirements (Art. 28 Para. 1 and 3 GDPR).

Where we jointly determine the purposes and means of processing with another party, we are joint controllers. In such cases, we determine in an arrangement which party is responsible for fulfilling the respective data protection obligations. The essence of this arrangement is made available to the data subjects (Art. 26 Para. 1 and 2 GDPR).

The respective recipients or categories of recipients and the applicable legal basis are specified in the information relating to the relevant processing activity (Art. 13 Para. 1 lit. c and e and Art. 14 Para. 1 lit. c and e GDPR).

Where personal data is transferred to recipients outside the European Union or the European Economic Area, we also comply with the statutory requirements governing transfers to third countries (Art. 44 et seq. GDPR).

General information on transfers to third countries

Where we transfer personal data to recipients in countries outside the European Economic Area (EEA) or to international organisations, or enable such recipients to access personal data, we comply with the specific statutory requirements governing transfers to third countries.

Such a transfer takes place only where the general requirements for processing personal data are met and an additional transfer mechanism under Art. 44 et seq. GDPR applies (Art. 6 Para. 1 and Art. 44 GDPR).

Adequacy decision

A transfer may take place where the European Commission has determined that the third country concerned, a territory or one or more specified sectors within that third country, or the international organisation concerned, ensures an adequate level of data protection. In such cases, no additional authorisation or safeguards under Art. 46 GDPR are required (Art. 45 GDPR).

Appropriate safeguards

Where no adequacy decision exists, a transfer may take place if appropriate safeguards are provided to protect the personal data and enforceable rights and effective legal remedies are available to data subjects (Art. 46 Para. 1 GDPR).

Appropriate safeguards may include in particular:

• Standard contractual clauses adopted by the European Commission (Art. 46 Para. 2 lit. c GDPR)
• Binding corporate rules (Art. 46 Para. 2 lit. b and Art. 47 GDPR)
• Approved codes of conduct or certification mechanisms together with binding and enforceable commitments by the recipient of the data (Art. 46 Para. 2 lit. e and f GDPR)
• Other contractual or administrative arrangements, where the applicable statutory requirements are met and any required authorisations have been obtained (Art. 46 Para. 2 and 3 GDPR)

Where necessary, we assess whether the transfer mechanism used ensures an adequate level of protection, taking into account the laws and practices of the recipient country. Where required, we implement additional contractual, technical or organisational safeguards.

Derogations for specific situations

Where neither an adequacy decision nor appropriate safeguards are available, a transfer may take place only in specific exceptional circumstances. This may apply, for example, where you have expressly consented to the transfer after having been informed of the possible risks, where the transfer is necessary for the performance of a contract or where it is required for the establishment, exercise or defence of legal claims (Art. 49 Para. 1 GDPR).

Derogations under Art. 49 GDPR are relied upon only where the applicable statutory requirements are met.

Further information on specific transfers

Whether personal data is transferred to a third country or an international organisation in connection with a specific processing activity, and the legal basis for that transfer, will be stated in the information relating to the relevant processing activity. Where required, we will provide information in particular about:

• The recipient or category of recipients
• The third country or international organisation concerned
• The existence of an adequacy decision
• The appropriate safeguards used
• The means of obtaining or accessing a copy of those safeguards

This information is provided in accordance with the applicable statutory information requirements (Art. 13 Para. 1 lit. f and Art. 14 Para. 1 lit. f GDPR).

Where a transfer is based on appropriate safeguards, you may use the contact details provided in the section entitled “Controller” to request further information and a copy of the relevant safeguards. Content may be appropriately redacted where necessary to protect trade secrets, confidential information and the rights and freedoms of other persons (Art. 15 Para. 2 GDPR).

Security of processing

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, we implement appropriate technical and organisational measures to ensure a level of security appropriate to the respective risk. These measures are intended in particular to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access (Art. 5 Para. 1 lit. f, Art. 25 Para. 1 and Art. 32 Para. 1 and 2 GDPR).

The measures implemented are reviewed regularly and adapted where necessary to reflect technological developments or changes in risk (Art. 32 Para. 1 lit. d GDPR).

Despite these measures, internet-based data transmissions may generally be subject to security risks, meaning that complete protection cannot be guaranteed. Where we offer suitable alternative means of communication, you may also provide us with personal data by those means, for example by telephone or post.

2. Your rights

As a data subject, you have the rights set out below, subject to the applicable statutory requirements. We will facilitate the exercise of your rights. You may contact us using the contact details provided in the section entitled “Controller” (Art. 12 Para. 2 GDPR).

Right of access

You have the right to obtain confirmation from us as to whether or not we process personal data concerning you. Where this is the case, you have the right to access that personal data and to receive the information prescribed by law.

This information includes, in particular, the purposes of the processing, the categories of personal data concerned, the recipients or categories of recipients, the envisaged retention period or the criteria used to determine that period, the source of the data where it was not collected directly from you, and information about any automated decision-making, including profiling. Where personal data is transferred to a third country or an international organisation, you may also request information about the appropriate safeguards relating to the transfer (Art. 15 Para. 1 and 2 GDPR).

You also have the right to receive a copy of the personal data undergoing processing. The term “data copy” means a faithful and intelligible reproduction of the personal data processed (Art. 15 Para. 3 S. 1 GDPR).

The right generally relates to the personal data itself and does not automatically include the provision of complete records or documents. Extracts from documents, complete documents or extracts from databases must, however, be provided where this is essential to enable you to understand the personal data processed and to exercise your rights under the GDPR effectively (Art. 15 Para. 3 S. 1 GDPR).

The first copy is generally provided free of charge. For any further copies requested by you, we may charge a reasonable fee based on administrative costs (Art. 15 Para. 3 S. 2 GDPR). The right to receive a copy must not adversely affect the rights and freedoms of others (Art. 15 Para. 4 GDPR).

Right to rectification

You have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you also have the right to have incomplete personal data completed. This may include providing a supplementary statement (Art. 16 GDPR).

Right to erasure

You have the right to obtain from us the erasure of your personal data without undue delay where one of the following grounds applies:

• The personal data is no longer necessary for the purposes for which it was collected or otherwise processed.
• You withdraw your consent and there is no other legal basis for the processing.
• You object to the processing and there are no overriding legitimate grounds for the processing.
• You object to the processing of your personal data for direct marketing purposes.
• The personal data has been unlawfully processed.
• The personal data must be erased to comply with a legal obligation under Union law or the law of a Member State.
• The personal data was collected in relation to the offer of information society services under the conditions set out in Art. 8 Para. 1 GDPR (Art. 17 Para. 1 GDPR).

The right to erasure does not apply to the extent that processing is necessary:

• For exercising the right of freedom of expression and information
• For compliance with a legal obligation requiring processing
• For the performance of a task carried out in the public interest or in the exercise of official authority
• For reasons of public interest in the area of public health
• For archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, where erasure is likely to render impossible or seriously impair the achievement of those purposes
• For the establishment, exercise or defence of legal claims (Art. 17 Para. 3 GDPR)

Right to restriction of processing

You have the right to obtain restriction of processing from us where one of the following conditions applies:

• You contest the accuracy of the personal data. In this case, processing is restricted for the period required for us to verify the accuracy of the data.
• The processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead.
• We no longer require the personal data for the purposes of the processing, but you require it for the establishment, exercise or defence of legal claims.
• You have objected to the processing. The restriction applies while it is being determined whether our legitimate grounds override your grounds (Art. 18 Para. 1 GDPR).

Where processing has been restricted, the personal data concerned may, with the exception of storage, be processed only with your consent, for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest. We will inform you before the restriction of processing is lifted (Art. 18 Para. 2 and 3 GDPR).

Right to notification of recipients

Where we have rectified or erased personal data or restricted its processing, we will generally communicate this to each recipient to whom the personal data has been disclosed. This does not apply where such communication proves impossible or involves disproportionate effort. At your request, we will inform you about those recipients (Art. 19 GDPR).

Right to data portability

You have the right to receive personal data which you have provided to us in a structured, commonly used and machine-readable format. You also have the right to transmit that data to another controller without hindrance from us.

This right applies where the processing is based on your consent or on a contract and is carried out by automated means (Art. 20 Para. 1 GDPR).

Where technically feasible, you may request that we transmit the personal data directly to another controller (Art. 20 Para. 2 GDPR).

The right to data portability does not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority. The exercise of this right must not adversely affect the rights and freedoms of others (Art. 20 Para. 3 and 4 GDPR).

Right to object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data where the processing is based on the performance of a task carried out in the public interest, the exercise of official authority or legitimate interests. This also applies to profiling based on those provisions (Art. 6 Para. 1 lit. e or f GDPR and Art. 21 Para. 1 S. 1 GDPR).

Following an objection, we will no longer process the personal data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or unless the processing is required for the establishment, exercise or defence of legal claims (Art. 21 Para. 1 S. 2 GDPR).

Where your personal data is processed for direct marketing purposes, you may object to that processing at any time. This also applies to profiling to the extent that it is related to such direct marketing. Following your objection, your personal data will no longer be processed for direct marketing purposes (Art. 21 Para. 2 and 3 GDPR).

Right to withdraw consent

You have the right to withdraw consent at any time with effect for the future. The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of your consent before its withdrawal. It must be as easy to withdraw consent as it was to give it (Art. 7 Para. 3 GDPR).

Rights relating to automated individual decision-making

We do not make decisions that are based solely on automated processing of personal data, including profiling, and that produce legal effects concerning you or similarly significantly affect you.

You generally have the right not to be subject to such a decision based solely on automated processing, including profiling (Art. 22 Para. 1 GDPR).

This right does not apply where the decision:

• Is necessary for entering into or performing a contract between you and us
• Is authorised by Union law or the law of a Member State which also lays down suitable measures to safeguard your rights, freedoms and legitimate interests
• Is based on your explicit consent (Art. 22 Para. 2 GDPR)

In the cases referred to in Art. 22 Para. 2 lit. a and c GDPR, we will implement suitable measures to safeguard your rights, freedoms and legitimate interests. These include, at a minimum, the right to obtain human intervention, to express your point of view and to contest the decision (Art. 22 Para. 3 GDPR).

Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority where you consider that the processing of your personal data infringes the GDPR. You may, in particular, contact a supervisory authority in the Member State of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 Para. 1 GDPR).

An overview of the data protection supervisory authorities is available here:

https://www.bfdi.bund.de/DE/Service/Anschriften/anschriften_table.html (in German)

The data protection supervisory authority responsible for us is:

Saxon Commissioner for Data Protection and Transparency

Dr. Juliane Hundert

P.O. Box 11 01 32

01330 Dresden

or

Maternistraße 17

01067 Dresden

Phone: +49 351 85471-101

Email: post@sdtb.sachsen.de

3. Data processing when visiting our website

Website encryption

For security reasons and to protect the transmission of confidential content, our website uses TLS encryption. This applies in particular to enquiries and other information that you submit to us via our website (Art. 5 Para. 1 lit. f and Art. 32 Para. 1 lit. a GDPR).

You can generally recognise an encrypted connection by the fact that the internet address displayed in your browser’s address bar begins with “https://”. Depending on the browser used, the encrypted connection may also be indicated by a padlock, security or connection icon.

When TLS encryption is enabled, the data transmitted between your browser and our server is encrypted. This helps protect the data against unauthorised interception or alteration during transmission. However, complete protection against all security risks cannot be guaranteed.

Collection of access data and server log files

Whenever you access our website, your browser or the terminal equipment you use automatically transmits certain data to our website server. This data may be temporarily stored in server log files.

Depending on the technical configuration, the following data in particular may be collected:

• IP address of the terminal equipment accessing the website
• Date and time of access
• Page or file accessed
• Volume of data transferred
• Notification indicating whether the retrieval was successful or unsuccessful
• Website from which access was made, known as the referrer URL
• Browser used, including its type and version
• Operating system used
• Other comparable technical data used to provide the website and ensure its security and stability

This data is processed in particular for the following purposes:

• Providing and displaying our website correctly from a technical perspective
• Ensuring the stability and security of our information technology systems
• Identifying, isolating and resolving technical faults
• Identifying and preventing attacks and other forms of unauthorised or improper access
• Investigating security-related incidents
• Establishing, exercising or defending legal claims
• Providing necessary information to the competent authorities, where the applicable statutory requirements are met

Where accessing our website involves access to information already stored in your terminal equipment, such access takes place only to the extent strictly necessary to provide the website that you have expressly requested (Section 25 Para. 2 No. 2 TDDDG).

The subsequent processing of personal access data is carried out for the purposes of our legitimate interests in operating a secure, stable and technically reliable website and protecting our information technology systems (Art. 6 Para. 1 lit. f GDPR).

The server log files are not used to evaluate individual website visitors or to create user profiles. They are not combined with data from other sources unless such processing is described separately in this Privacy Policy.

Recipients of the data may include hosting, IT and IT security service providers engaged by us. Where these service providers process personal data exclusively on our behalf, they are engaged under a data processing agreement that complies with the applicable statutory requirements (Art. 28 GDPR).

Server log files are retained only for as long as necessary for the stated purposes of processing. The relevant considerations include, in particular, the requirements of technical website provision, system security and the investigation of potential security-related incidents.

Where the purpose of processing no longer applies and there is no statutory retention obligation or other legal basis for continued storage, the data will be erased. Where there are specific indications of a security-related incident, the relevant data may be retained until the incident has been fully investigated, evidence has been preserved or any legal claims have been established, exercised or defended (Art. 5 Para. 1 lit. e and Art. 17 Para. 1 lit. a and Para. 3 lit. e GDPR).

Cookies

Our website uses cookies. Cookies are small text files or comparable data records that can be stored on or read from your terminal equipment when you visit a website. Terminal equipment includes, for example, computers, notebooks, tablets and smartphones.

Cookies may contain a unique identifier known as a cookie ID. Such an identifier allows a particular browser to be recognised for the duration of the cookie’s validity. This may be necessary, for example, to maintain a session, store selected settings or provide certain website functions.

Depending on their specific configuration, cookies may serve the following purposes in particular:

• Providing our website securely and from a technical perspective
• Storing your settings and preferences
• Recording the status of your consent choices
• Providing convenience and additional functions
• Analysing the use of our website
• Measuring the reach and effectiveness of our services
• Displaying and measuring the success of personalised advertising

Not all of these purposes are necessarily pursued on our website. Details of the cookies and comparable technologies actually used can be found in the consent management tool and in the information about the respective services provided in this Privacy Policy.

First-party cookies and third-party cookies

First-party cookies are set through the domain that you access directly. They may be read again when you subsequently visit the same domain.

Third-party cookies originate from a domain other than the one you are visiting directly. They may be set, for example, through embedded content or services provided by other providers. Such cookies may allow the respective provider to recognise a browser when other websites incorporating the same service are visited.

The distinction between first-party and third-party cookies does not in itself indicate how long a cookie is stored, the purpose for which it is used or whether consent is required for its use.

Session cookies and persistent cookies

Session cookies are stored for the duration of a browser session and are generally deleted automatically when the session ends. They may be used, for example, to assign multiple page views to the same session.

Persistent cookies remain stored on your terminal equipment after the end of a browser session. They are removed when their specified validity period expires or when they are deleted manually. The respective retention period may vary depending on the cookie.

Legal bases

The storage of information on your terminal equipment or access to information already stored there is governed by Section 25 TDDDG.

Where a cookie or comparable technology is strictly necessary to provide a digital service expressly requested by you, no consent is required (Section 25 Para. 2 No. 2 TDDDG).

We generally use all other cookies and comparable technologies only with your consent (Section 25 Para. 1 TDDDG).

Where personal data is processed in connection with cookies, the subsequent processing is also governed by the GDPR. Processing requiring consent is carried out on the basis of your consent (Art. 6 Para. 1 lit. a and Art. 7 GDPR). Depending on its purpose, processing in connection with strictly necessary cookies may be required for the performance of a contract or to take pre-contractual measures, for compliance with a legal obligation or for the purposes of legitimate interests (Art. 6 Para. 1 lit. b, c or f GDPR).

The cookies and technologies used, their providers, purposes, legal bases and retention periods are described in more detail in the consent management tool or in the information relating to the respective service.

Managing your consent

Where consent is required, you can use the consent management tool provided on our website to decide which cookies and comparable technologies you wish to accept. You may withdraw or change your consent there at any time with effect for the future (Art. 7 Para. 3 GDPR).

Browser settings

You can configure your browser to notify you when cookies are set, permit cookies only in individual cases, reject certain cookies or delete cookies automatically when the browser is closed. You can also remove cookies that have already been stored through your browser settings.

Disabling or deleting cookies may result in certain functions of our website being unavailable or available only to a limited extent. Managing cookies through your browser does not replace giving or withdrawing consent through the consent management tool provided on our website.

Data transmission via forms

We provide forms on our website through which you can submit personal data to us. The personal data processed in this context is determined by the respective input form and any supplementary information provided for that form.

We process the data you submit in order to handle your request, communicate with you and provide the content or services offered through the relevant form. The specific purpose of the processing is determined by the respective form.

Information marked as mandatory is required so that we can handle your request or provide the requested service. Without this information, we may be unable to process the form. The provision of any additional information is voluntary (Art. 13 Para. 2 lit. e GDPR).

Where the transmission of data relates to a contract to which you are a party or to pre-contractual measures taken at your request, the processing is based on Art. 6 Para. 1 lit. b GDPR.

In other cases, the processing is carried out for the purposes of our legitimate interests in handling submitted requests appropriately and efficiently and in maintaining our business contacts (Art. 6 Para. 1 lit. f GDPR).

Where the processing is necessary for compliance with a legal obligation, it is based on Art. 6 Para. 1 lit. c GDPR. Where we obtain your consent for a specific processing activity, the processing is based on Art. 6 Para. 1 lit. a and Art. 7 GDPR.

When a form is submitted, additional technical access data may be processed. This may include, in particular, the IP address of the terminal equipment used and the date and time of submission. This data is processed where necessary for the technical transmission of the form, the security of our information technology systems or the detection and prevention of misuse (Art. 6 Para. 1 lit. f GDPR). Further information is available in the section entitled “Collection of access data and server log files”.

Form data is generally transmitted in encrypted form. Further information is available in the section entitled “Website encryption”.

Within our organisation, access to your personal data is restricted to those persons and departments that require it to handle your request.

Recipients may also include hosting, IT, communications and other service providers engaged by us. Where these service providers process personal data exclusively on our behalf, they are engaged under a data processing agreement that complies with the applicable statutory requirements (Art. 28 GDPR).

Personal data is disclosed to other recipients only where an appropriate legal basis applies and the disclosure is necessary for the respective purpose. The relevant recipients or categories of recipients will be specified, where required, in connection with the respective form or elsewhere in this Privacy Policy (Art. 13 Para. 1 lit. e GDPR).

We retain personal data submitted through forms only for as long as necessary to handle your request and fulfil the respective purposes of processing. Where the purpose of processing no longer applies and there is no statutory retention obligation or other legal basis for continued storage, the data will be erased (Art. 5 Para. 1 lit. e and Art. 17 Para. 1 lit. a GDPR).

Where the data is required for a contractual relationship, compliance with statutory retention obligations or the establishment, exercise or defence of legal claims, it may be retained for a correspondingly longer period. It will be erased once the respective reason for retention no longer applies (Art. 6 Para. 1 lit. b and c and Art. 17 Para. 3 lit. b and e GDPR).

Contact by email, telephone or fax

Where you contact us by email, telephone or fax, we process the personal data you provide in order to handle your enquiry and communicate with you. This may include, in particular, your contact details and identification data, the content of your enquiry, any documents submitted, and the date and time of contact.

Where your enquiry relates to a contract to which you are a party or to pre-contractual measures taken at your request, the processing is based on Art. 6 Para. 1 lit. b GDPR.

In other cases, the processing is carried out for the purposes of our legitimate interests in handling enquiries addressed to us appropriately and efficiently and in maintaining our business contacts (Art. 6 Para. 1 lit. f GDPR).

Where the processing is necessary for compliance with a legal obligation, it is based on Art. 6 Para. 1 lit. c GDPR. Where we obtain your consent for a specific processing activity, the processing is based on Art. 6 Para. 1 lit. a GDPR.

Within our organisation, access to your personal data is restricted to those persons and departments that require it to handle your enquiry. Recipients may also include IT, telecommunications and communications service providers engaged by us. Personal data is disclosed to other recipients only where an appropriate legal basis applies and the disclosure is necessary for the respective purpose (Art. 6 Para. 1 GDPR).

We retain the personal data processed in connection with your contact only for as long as necessary to handle your enquiry and for any subsequent communication. Where the purpose of processing no longer applies and there is no statutory retention obligation or other legal basis for continued storage, the data will be erased (Art. 5 Para. 1 lit. e and Art. 17 Para. 1 lit. a GDPR).

Where the data is required for a contractual relationship, compliance with statutory retention obligations or the establishment, exercise or defence of legal claims, it may be retained for a correspondingly longer period. It will be erased once the respective reason for retention no longer applies (Art. 6 Para. 1 lit. b and c and Art. 17 Para. 3 lit. b and e GDPR).

Links to external websites

Our website may contain links to websites operated by other providers. When you follow an external link, you leave our website and are redirected to the website of the relevant provider.

We have no control over the content, availability or data protection practices of external websites. The respective operator is generally responsible for the processing of personal data that takes place when you access and use an external website (Art. 4 No. 7 GDPR).

Please refer to the privacy information provided on the external website for details of the nature, scope and purposes of the processing of personal data carried out there, as well as your rights (Art. 12 to 14 GDPR).

This information applies only to external links. Where content or services provided by third parties are embedded directly into our website, we provide separate information about this in this Privacy Policy.

Borlabs Cookie

We use ‘Borlabs Cookie’ on our website. The provider is Borlabs GmbH, Hamburger Str. 11, 22083 Hamburg, Germany (hereinafter referred to as ‘Borlabs’).

Borlabs Cookie is a consent management technology which enables us to obtain, manage and document consent for the use of cookies and comparable technologies. When you access our website, a technically necessary cookie named ‘borlabs-cookie’ may be stored in your browser. This cookie stores, in particular, the consent you have given, rejected services, individual cookie settings, a randomly generated identifier, the cookie duration and further technical information for managing your consent decision.

The processing serves to store your consent decisions, display the consent banner correctly, recognise your selection during later visits to the website, document consent given and withdrawn, and control the use of services requiring consent on our website in accordance with your selection. According to Borlabs, the visitor data stored in Borlabs Cookie are not transmitted to Borlabs but are stored on our server.

The processing of consent data is carried out for the fulfilment of our legal obligation to obtain and be able to demonstrate consent for the use of certain cookies and comparable technologies, on the basis of Art. 6 Para. 1 lit. c GDPR. The storage and access of the technically necessary Borlabs cookie are carried out on the basis of Section 25 Para. 2 No. 2 TDDDG, as the cookie is necessary to store the consent decision you have made and to provide the website in accordance with your selection.

The data stored in Borlabs Cookie are stored until you change your consent decision, delete the cookie in your browser or the purpose for the storage no longer applies. Statutory retention and documentation obligations remain unaffected.

Further information on the information stored by Borlabs Cookie can be found at https://borlabs.io/kb/what-information-does-borlabs-cookie-store/ . Further information on data protection at Borlabs can be found at https://borlabs.io/privacy/

Microsoft Clarity

We use ‘Microsoft Clarity’ on our website. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (hereinafter referred to as ‘Microsoft’).

Microsoft Clarity is an analytics tool which enables us to understand how visitors use our website and interact with individual areas of its pages. For this purpose, Clarity provides heatmaps, session recordings and statistical analyses in particular. Session recordings are not video recordings but technical reconstructions of the content displayed on a website and the interactions carried out during a session.

When Microsoft Clarity is used, your IP address and approximate location information derived from it, the date and time of access, pages and URLs accessed, referrer URL, pseudonymous user and session identifiers, browser and device information, operating system, screen size and resolution, language settings as well as technical connection, diagnostic, error and performance data may be processed in particular. Interaction data such as mouse movements, clicks, scrolling, selection and input events, changes to the size of the browser window, page changes, time spent on pages and navigation sequences may also be recorded. Depending on the configuration, content in individual areas of a page may be masked in order to limit the collection of sensitive information.

The processing serves to evaluate the use of our website, identify frequently or rarely used content and functions, detect usability problems and technical errors, improve user navigation and optimise our website from a technical, content and design perspective.

Microsoft Clarity may use first-party and third-party cookies as well as comparable technologies. These include, in particular, cookies which can be used to store pseudonymous user identifiers, assign individual page views to a session and combine interactions for session recordings and statistical analyses.

We activate Microsoft Clarity only after you have given your consent. The processing of personal data is carried out on the basis of your consent pursuant to Art. 6 Para. 1 lit. a GDPR. The storage of and access to information on your end device are carried out on the basis of Section 25 Para. 1 TDDDG. Consent is voluntary and can be withdrawn or changed at any time with effect for the future via the settings of our consent banner.

Personal data may also be processed in the USA, a third country for which there is no adequacy decision by the European Commission. Where personal data are transferred to Microsoft in the USA or processed there, Microsoft bases the transfer of data to the USA on the EU-U.S. Data Privacy Framework of the European Commission. According to Microsoft, standard contractual clauses within the meaning of Art. 46 GDPR are also used for intra-group transfers between Microsoft Ireland Operations Limited and Microsoft Corporation.

According to Microsoft, data used for session recordings are generally stored for 30 days. Click and heatmap data as well as sessions which have been specifically labelled or marked as favourites may be stored for up to nine months. After the respective retention period has expired, the data, including any existing backup copies, are deleted.

Microsoft processes personal data in connection with Microsoft Clarity under its own responsibility.

Further information on Microsoft Clarity and data protection can be found at https://clarity.microsoft.com/privacy?lang=en-US and https://www.microsoft.com/en-gb/privacy/privacystatement

Google Fonts (locally hosted)

We use ‘Google Fonts’ on our website. The provider of the font collection is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter referred to as ‘Google’).

Google Fonts is a collection of different typefaces. The font files we use are stored locally on our own web server or on the servers of our hosting provider and are delivered to your browser from there. When you access our website, no connection to Google servers is established. Google therefore does not receive any personal data relating to visitors to our website in connection with the provision of the fonts.

The local integration of the fonts serves the uniform, technically stable and visually appealing display of our website on different end devices and in different browsers.

Where technical access data, in particular the IP address, date and time of access and the requested file, are processed when the locally stored font files are delivered, this processing takes place via our web server or our hosting provider. The processing is carried out on the basis of our legitimate interest pursuant to Art. 6 Para. 1 lit. f GDPR in presenting our website in a uniform, user-friendly and technically reliable manner.

Further information on Google Fonts can be found at https://fonts.google.com/faq?hl=en#privacy

Google Maps

We use ‘Google Maps’ on our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter referred to as ‘Google’).

Google Maps is a map service which enables us to display interactive maps, location information, directions and geographical content on our website. When you access a page on which Google Maps is embedded, a connection to Google servers is established. In this context, your IP address, date and time of access, the page accessed, location data insofar as you allow these or they are technically processed, browser and device information, operating system, referrer URL, usage and interaction data in connection with the embedded map as well as further technical access data may be processed in particular.

Google Maps serves the user-friendly display of our locations, the easier discoverability of the places specified by us and the provision of directions and orientation information. The content embedded via Google Maps is provided by Google. We do not have full influence over Google’s data processing in connection with the use of Google Maps.

Personal data may also be stored and processed in the USA, a third country for which there is no adequacy decision by the European Commission.

However, Google bases the transfer of data to the USA on the EU-U.S. Data Privacy Framework of the European Commission. Where Google transfers personal data to further third countries or has them processed there, Google states that it additionally bases such transfers on appropriate safeguards, in particular standard contractual clauses within the meaning of Art. 46 GDPR.

Where Google Maps is loaded only after your consent, or where cookies are set, information is stored on or accessed from the end device or comparable technologies are used in this context, Google Maps is used exclusively on the basis of your consent pursuant to Art. 6 Para. 1 lit. a GDPR and Section 25 Para. 1 TDDDG. Consent is voluntary and can be withdrawn at any time with effect for the future, for example via the settings in the consent banner.

Where Google Maps is embedded without prior consent and no cookies or comparable technologies requiring consent are used, the processing is carried out on the basis of our legitimate interest pursuant to Art. 6 Para. 1 lit. f GDPR in displaying our locations in a user-friendly manner, making it easier to find the places specified by us and providing a convenient directions and orientation function.

The data processed in connection with Google Maps are processed and stored by Google in accordance with Google’s own data protection provisions. Further information on data processing by Google can be found at https://policies.google.com/privacy?hl=en . Further information on the Google Controller-Controller Data Protection Terms can be found at https://business.safety.google/controllerterms/ . Further information on the Standard Contractual Clauses for Google Maps Platform can be found at https://mapsplatform.google.com/resources/trust-center/eu-standard-contractual-clauses/

YouTube

We use ‘YouTube’ on our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter referred to as ‘Google’).

YouTube is a video platform which enables us to embed and play videos and other audiovisual content on our website. The embedded videos are displayed directly via a video player provided by YouTube.

We load embedded YouTube videos only after you have given your consent. When a YouTube video is loaded or played, a connection to Google servers is established. In this context, your IP address, the date and time of access, the page accessed, the URL and identifier of the embedded video, referrer URL, browser and device information, operating system, screen resolution, language settings, technical connection data as well as usage and interaction data may be processed in particular. Interaction data may include, in particular, the start and duration of playback, pauses, seeking within the video and other interactions with the video player.

YouTube may use cookies and comparable technologies and store information on or access information from your end device in order to provide the video player, save settings, evaluate the use of the video, ensure the security of the service and, where applicable, personalise content or advertising. If you are signed in to your Google or YouTube account when accessing an embedded video, Google may associate your use of the video with your account. You can prevent this by signing out of your Google or YouTube account before accessing the video.

YouTube is used to present videos and other audiovisual content on our website in an illustrative and user-friendly manner.

The processing of personal data is carried out on the basis of your consent pursuant to Art. 6 Para. 1 lit. a GDPR. Where information is stored on or accessed from your end device when YouTube videos are loaded or played, this is carried out on the basis of Art. 6 Para. 1 lit. a GDPR and Section 25 Para. 1 TDDDG. Consent is voluntary and can be withdrawn or changed at any time with effect for the future via the settings of our consent banner.

Personal data may also be processed in the USA, a third country for which there is no adequacy decision by the European Commission. Where personal data are transferred to Google in the USA or processed there, Google bases the transfer of data to the USA on the EU-U.S. Data Privacy Framework of the European Commission. Where Google transfers personal data to further third countries or a transfer is not covered by the EU-U.S. Data Privacy Framework, Google states that it additionally bases such transfers on appropriate safeguards, in particular standard contractual clauses within the meaning of Art. 46 GDPR.

Google processes personal data in connection with YouTube under its own responsibility. The retention period depends on the type of data processed, the respective purpose of the processing, the settings of your Google account and Google’s data protection provisions. We have no influence over the specific period for which Google retains the data.

Further information on data processing by Google and YouTube can be found at https://policies.google.com/privacy?hl=en . Further information on embedding YouTube videos and the privacy-enhanced mode can be found at https://support.google.com/youtube/answer/171780?expand=PrivacyEnhancedMode&hl=en

feratel Webcam

We use the ‘feratel MediaPlayer’ on our website. The provider is feratel media technologies AG, Maria-Theresien-Straße 8, A-6020 Innsbruck, Austria (hereinafter referred to as ‘feratel’).

The feratel MediaPlayer is a service for providing and displaying webcam footage, live images and panoramic videos. The embedded MediaPlayer enables us to show you, in particular, current views of the surrounding area, weather conditions and other regional information.

When you access a page on which the feratel MediaPlayer is embedded, a connection to feratel’s servers is established. In this context, your IP address, the date and time of access, the webcam or resource accessed, technical connection data and log data may be processed in particular. According to feratel, the IP address is processed, among other purposes, to determine the country of origin, conduct technical functionality analyses, rectify errors, ensure security and prevent misuse. According to feratel, no profiling takes place.

The processing serves the technical provision and playback of webcam and panoramic content, the display of current local views and weather conditions, the safeguarding of the functionality and security of the MediaPlayer and the detection and rectification of technical errors.

Where the feratel MediaPlayer is loaded without prior consent and no cookies or comparable technologies requiring consent are used, the processing is carried out on the basis of our legitimate interest pursuant to Art. 6 Para. 1 lit. f GDPR in providing you with current webcam and panoramic images in a user-friendly manner and supplementing our tourist information offering with illustrative content.

Where the feratel MediaPlayer is loaded only after you have given your consent, the processing is carried out on the basis of your consent pursuant to Art. 6 Para. 1 lit. a GDPR. Where information that is not technically necessary is stored on or accessed from the end device when the MediaPlayer is loaded or used, this is carried out on the basis of Art. 6 Para. 1 lit. a GDPR and Section 25 Para. 1 TDDDG. Consent is voluntary and can be withdrawn at any time with effect for the future, for example via the settings in the consent banner.

According to feratel, the IP address processed when the MediaPlayer is accessed is deleted four days after access. According to feratel, log data processed in connection with the MediaPlayer are permanently deleted after 18 months, unless longer storage is required due to statutory obligations or for the establishment, exercise or defence of legal claims.

feratel processes personal data under its own responsibility in connection with access to and use of the MediaPlayer.

Further information on data processing by feratel and the feratel MediaPlayer can be found at https://www.feratel.com/en/privacy-policy

Booking system SynXis

We use ‘SynXis’ for online room reservations and booking enquiries on our website. The provider is Aven Hospitality Solutions GmbH, Main Airport Center, Unterschweinstiege 2–14, 60549 Frankfurt am Main, Germany (hereinafter referred to as ‘Aven Hospitality’).

SynXis is a hotel booking and reservation platform. The SynXis Booking Engine can be used to display availability, room categories, prices, offers, additional services and other booking-related information, and to technically receive, process and confirm booking enquiries and reservations. The booking process may be embedded on our website or accessed via a corresponding button, subpage or redirect.

If you make a room reservation or submit a booking enquiry via SynXis, the data required to process the booking or enquiry are processed. This may include, in particular, title, first name, surname, address, billing address, email address, telephone number, period of stay, arrival and departure dates, the number and names of accompanying guests, room category, selected rate, additional services booked, booking and reservation number, payment method, payment status, payment and billing data, communication data as well as special requests, comments and other information voluntarily provided by you. Where the creation of a user account is offered and used by you, login details and an encrypted password may also be processed.

Technical access data may also be processed, including in particular the IP address, date and time of access, pages and functions accessed, referrer URL, browser and device information, operating system, language settings, session identifiers, technical request data, server logs as well as security, error and performance data.

The processing serves the technical provision of the booking process, the display and checking of availability, prices and offers, the processing and confirmation of your booking or booking enquiry, communication with you, the preparation and performance of your stay, payment processing, the provision of additional services booked, the transmission of booking information to the hotel and connected systems, and the documentation of booking processes.

The processing is carried out, insofar as it is necessary for the initiation or performance of an accommodation contract, the processing of your booking enquiry, the execution of the reservation, payment processing or the provision of the services booked, on the basis of Art. 6 Para. 1 lit. b GDPR. Where we are legally obliged to retain certain booking, payment, billing or business documents, the processing is carried out on the basis of Art. 6 Para. 1 lit. c GDPR. Where the processing is necessary for the secure, stable and user-friendly provision of the booking process, error analysis, prevention of misuse and fraud or the establishment, exercise or defence of legal claims, it is carried out on the basis of our legitimate interest pursuant to Art. 6 Para. 1 lit. f GDPR. We process information voluntarily provided by you on the basis of Art. 6 Para. 1 lit. b GDPR insofar as it serves the processing or individualisation of your booking as requested by you; otherwise, it is processed on the basis of your consent pursuant to Art. 6 Para. 1 lit. a GDPR, unless another legal basis applies.

Where technically necessary cookies are set or information is stored on or accessed from the end device when the SynXis Booking Engine is used, this is carried out on the basis of Art. 6 Para. 1 lit. b GDPR or Art. 6 Para. 1 lit. f GDPR and Section 25 Para. 2 No. 2 TDDDG, provided that this is necessary for the provision of the booking process, the execution of the booking, payment processing, fraud prevention or the storage of technically necessary session and booking information. Where non-technically necessary cookies or comparable technologies are used, this is done only on the basis of your consent pursuant to Art. 6 Para. 1 lit. a GDPR and Section 25 Para. 1 TDDDG. Consent is voluntary and can be withdrawn at any time with effect for the future.

Personal data may also be processed outside the European Union or the European Economic Area, in particular in the USA. This may occur in connection with affiliated companies, infrastructure and cloud providers, support service providers and other sub-processors. Where Aven Hospitality transfers personal data to third countries or has them processed there, Aven Hospitality states that it bases such transfers in particular on appropriate safeguards in the form of the European Commission’s standard contractual clauses within the meaning of Art. 46 GDPR.

The data processed in connection with the booking or booking enquiry are stored for as long as this is necessary for processing your booking or enquiry, performing your stay, processing payments, billing, complying with statutory retention and documentation obligations or the establishment, exercise or defence of legal claims. Booking, payment and billing data may be stored for the statutory retention periods due to commercial and tax law requirements. The data are then deleted or restricted in processing unless further storage is required.

Aven Hospitality processes personal data of users of our website and booking guests as a processor within the meaning of Art. 4 No. 8 GDPR, insofar as this processing is carried out on our behalf for the provision and operation of the SynXis booking and reservation platform. We have concluded a data processing agreement with Aven Hospitality within the meaning of Art. 28 Para. 3 GDPR. In this agreement, Aven Hospitality undertakes in particular to process personal data only in accordance with our instructions and for the provision of the agreed services, to implement appropriate technical and organisational protective measures, and to use sub-processors only in accordance with the contractual provisions.

Further information on data processing by Aven Hospitality can be found at https://www.avenhospitality.com/privacy . Further information on Aven Hospitality’s Data Processing Addendum can be found at https://www.avenhospitality.com/data-processing-addendum

Friendly Captcha

We use ‘Friendly Captcha’ on our website. The provider is Friendly Captcha GmbH, Am Anger 3–5, 82237 Wörthsee, Germany (hereinafter referred to as ‘Friendly Captcha’).

Friendly Captcha is a security solution which enables us to protect certain areas and functions of our website, in particular contact, enquiry, registration and other input forms, against automated access, spam and misuse by programs and scripts.

When you access or use an area of our website protected by Friendly Captcha, your end device establishes a connection to Friendly Captcha’s servers. Your browser receives a computational challenge which is solved in the background using certain system resources of your end device. The result is then technically verified in order to assess whether the access is likely to have been made by a human or an automated program.

In this context, connection data, environment data, interaction data, functional data, technical browser and device information, and the result of the computational challenge may be processed in particular. According to Friendly Captcha, these data are used exclusively to identify and manage potentially automated access and security risks and to ensure the security and functionality of the protected areas. The data are not used for marketing purposes or to create advertising profiles.

According to Friendly Captcha, no personal data relating to website visitors are stored permanently. Data which could enable identification, in particular IP addresses, are anonymised using one-way hashing. Friendly Captcha does not use HTTP cookies for the security function and does not store any data in the browser’s persistent storage.

The processing is carried out on the basis of our legitimate interest pursuant to Art. 6 Para. 1 lit. f GDPR in protecting our website and the forms and functions provided through it against automated attacks, spam, misuse and other security risks and in ensuring the security and functionality of our online offering.

Where information is processed on or accessed from the end device as part of the technical execution of the computational challenge or the collection of environment and functional data, this is carried out on the basis of Section 25 Para. 2 No. 2 TDDDG, as these operations are necessary for the secure provision of the website function accessed or used by you. Consent is generally not required for this purpose.

Friendly Captcha processes personal data of visitors to our website as a processor within the meaning of Art. 4 No. 8 GDPR, insofar as this processing is carried out on our behalf for the provision of the security function. We have concluded a data processing agreement with Friendly Captcha within the meaning of Art. 28 Para. 3 GDPR. In this agreement, Friendly Captcha undertakes in particular to process personal data only in accordance with our instructions and for the provision of the agreed services, to implement appropriate technical and organisational protective measures, and to use sub-processors only in accordance with the contractual provisions.

Further information on data processing by Friendly Captcha can be found at https://friendlycaptcha.com/legal/privacy-end-users/

hCaptcha

We use ‘hCaptcha’ on our website. The provider is Intuition Machines, Inc., 1065 SW 8th St #704, Miami, FL 33130, USA (hereinafter referred to as ‘IMI’).

hCaptcha is a security service which enables us to protect certain areas and functions of our website, in particular contact, enquiry, login, registration and other input forms, against automated access, spam, fraudulent activities and other forms of misuse.

As soon as a function protected by hCaptcha is loaded or triggered, your end device establishes a connection to IMI’s servers. Based on various technical and behaviour-related characteristics, hCaptcha analyses whether the relevant action is likely to have been performed by a human or by an automated program. Depending on the result of this assessment, you may be presented with a task which you are required to complete. Following successful verification, hCaptcha generates a verification token which is transmitted to our website and validated on the server side.

In this context, your IP address, the date and time of access, the website or function accessed, referrer information, browser type, operating system, internet service provider, device type, device and platform information, language settings, technical connection data and information about the use of the protected function may be processed in particular. The interaction data processed may include mouse movements, scroll positions, keystroke events, touch events, the duration of the interaction, responses to displayed tasks and the result of the security and risk assessment. Where you complete a displayed task, your responses may also be processed. According to IMI, these responses are not linked to an identified individual.

We use hCaptcha in invisible mode. This means that no permanently visible checkbox is displayed. The security check may be performed in the background, for example when you submit a protected form. A visible task is displayed only where hCaptcha considers an additional check necessary.

The processing serves to identify and prevent automated access, spam messages, abusive form submissions, fraudulent activities and other attacks, and to ensure the availability, integrity and functionality of our website and the functions provided through it.

The processing is carried out on the basis of our legitimate interest pursuant to Art. 6 Para. 1 lit. f GDPR in protecting our website, the forms and functions provided through it and our users’ data against automated attacks, spam, fraud and other forms of misuse. Where hCaptcha protects a function which you use for the initiation or performance of a contract, the processing is additionally carried out on the basis of Art. 6 Para. 1 lit. b GDPR.

hCaptcha may use cookies and comparable technologies and may store information on or access information from the end device. Where these operations are technically necessary to provide the function accessed or used by you securely, identify automated or abusive access, perform the security check, assign a session or ensure technical load balancing and routing, they are carried out on the basis of Section 25 Para. 2 No. 2 TDDDG. Where non-technically necessary cookies, optional cross-device security functions, non-essential storage technologies or other technologies requiring consent are used, the processing is carried out only on the basis of your consent pursuant to Art. 6 Para. 1 lit. a GDPR and Section 25 Para. 1 TDDDG. Consent is voluntary and can be withdrawn or changed at any time with effect for the future via the settings of our consent banner.

Personal data may be processed in the USA or in other countries outside the European Union or the European Economic Area. IMI is certified under the EU-U.S. Data Privacy Framework. Where personal data are transferred to IMI in the USA and the relevant processing is covered by this certification, the transfer is based on the European Commission’s adequacy decision concerning the EU-U.S. Data Privacy Framework. Where a transfer is not covered by the EU-U.S. Data Privacy Framework or data are transferred to further third countries, IMI states that the European Commission’s standard contractual clauses within the meaning of Art. 46 GDPR are additionally used.

IMI states that it does not retain end users’ personal data on a long-term basis. Where the processing of personal data cannot be avoided, the data are intended to be promptly discarded or anonymised. Limited and selectively collected log and error data may be processed for a restricted period where this is necessary for operation, security, error analysis and the prevention of misuse. The specific retention period depends in particular on the hCaptcha version used, the configuration, the relevant security event and the contractual arrangements.

IMI processes personal data of visitors to our website as a processor within the meaning of Art. 4 No. 8 GDPR, insofar as this processing is carried out on our behalf for the provision of the hCaptcha security function. A data processing agreement within the meaning of Art. 28 Para. 3 GDPR is incorporated into the contractual terms governing the use of hCaptcha. Under this agreement, IMI undertakes in particular to process personal data generally only in accordance with our documented instructions and for the provision of the agreed services, to implement appropriate technical and organisational protective measures, and to engage sub-processors in accordance with the contractual provisions.

Further information on data processing by IMI and hCaptcha can be found at https://www.hcaptcha.com/privacy . The Terms of Service are available at https://www.hcaptcha.com/terms . The Data Processing Addendum is available at https://newassets.hcaptcha.com/dpa/IMI_Data_Processing_Addendum_4.20.2023.pdf

Stripe

We use ‘Stripe’ to process electronic payments. The provider is Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland (hereinafter referred to as ‘Stripe’). Depending on the specific payment service used and the processing involved, further companies within the Stripe group may participate in the processing.

Stripe is a payment service provider through which various electronic payment methods can be offered and processed. These may include, in particular, credit and debit card payments, payments via digital payment services, local payment methods, recurring payments and, where used, on-site payments via Stripe Terminal. If you select or use a payment method offered via Stripe, the data required for payment processing are transmitted to Stripe or collected directly by Stripe.

The data processed may include, in particular, first name, surname, billing and delivery address, email address, telephone number, payment and payment method data, credit or debit card details, bank account details, order, booking or service data, payment amount, currency, date and time of the transaction, transaction number, payment status, information relating to refunds or payment disputes, IP address, approximate location information, device identifiers, browser and device information, and further data required for payment processing, authentication, fraud prevention, risk assessment, prevention of misuse or compliance with statutory and regulatory obligations. Depending on the technical integration, payment data may be collected directly via an input form provided by Stripe, Stripe Checkout, Stripe Elements, a payment link or a payment terminal.

The processing serves the selection and execution of the desired payment method, the technical authorisation and processing of the payment, the transmission of the payment status, the allocation of the payment to your order, booking or other service used, the processing of refunds and payment disputes, authentication, fraud and loss prevention, prevention of misuse, and compliance with statutory and regulatory requirements relating to payment services.

The processing is carried out, insofar as it is necessary for the initiation or performance of a contract, the processing of your order or booking, the provision of the service used and the processing of the payment method selected by you, on the basis of Art. 6 Para. 1 lit. b GDPR. Where the processing is necessary for compliance with statutory or regulatory obligations, in particular commercial, tax, payment services, anti-money laundering or supervisory obligations, it is carried out on the basis of Art. 6 Para. 1 lit. c GDPR. Where the processing is necessary for secure and efficient payment processing, authentication, prevention of misuse and fraud, prevention of financial loss or the establishment, exercise or defence of legal claims, it is carried out on the basis of our legitimate interest pursuant to Art. 6 Para. 1 lit. f GDPR.

When Stripe is used online, cookies and comparable technologies may be used, in particular for the technical provision of the payment function, authentication, fraud prevention and the secure allocation of payment transactions. Where technically necessary information is stored on or accessed from the end device, this is carried out on the basis of Art. 6 Para. 1 lit. b GDPR or Art. 6 Para. 1 lit. f GDPR and Section 25 Para. 2 No. 2 TDDDG. Where non-technically necessary cookies or comparable technologies are used, this is done only on the basis of your consent pursuant to Art. 6 Para. 1 lit. a GDPR and Section 25 Para. 1 TDDDG. Consent is voluntary and can be withdrawn at any time with effect for the future.

Personal data may also be processed outside the European Union or the European Economic Area, in particular in the USA. Where personal data are transferred to Stripe, LLC in the USA or processed there, Stripe bases the transfer of data to the USA on the EU-U.S. Data Privacy Framework of the European Commission. Where a transfer is not covered by the EU-U.S. Data Privacy Framework or personal data are transferred to further third countries, Stripe states that it additionally bases such transfers on appropriate safeguards, in particular standard contractual clauses within the meaning of Art. 46 GDPR.

The data processed in connection with payment processing are stored for as long as this is necessary for the execution and documentation of the payment, the processing of the order, booking or other service, billing, fraud prevention, the processing of refunds or payment disputes, compliance with statutory retention and documentation obligations or the establishment, exercise or defence of legal claims. The data are then deleted or restricted in processing unless further storage is required.

Stripe processes personal data of customers as a processor within the meaning of Art. 4 No. 8 GDPR insofar as this processing is carried out on our behalf for the provision and performance of the payment services. For certain processing activities, in particular the selection and involvement of banks and payment method providers, fraud and loss prevention, compliance with statutory and regulatory obligations, and the analysis, security and development of its own services, Stripe processes personal data under its own responsibility.

We have concluded a data processing agreement with Stripe within the meaning of Art. 28 Para. 3 GDPR. In this agreement, insofar as Stripe acts as a processor, Stripe undertakes in particular to process personal data only in accordance with our instructions and for the provision of the agreed services, to implement appropriate technical and organisational protective measures, and to use sub-processors only in accordance with the contractual provisions.

Further information on data processing by Stripe can be found at https://stripe.com/gb/privacy . Further information on Stripe’s Data Processing Agreement can be found at https://stripe.com/gb/legal/dpa

4. Other processing activities

Data protection in relation to applications and the recruitment process

We process applicants’ personal data for the purpose of conducting the recruitment process and deciding whether to establish an employment relationship.

Purposes of processing

The processing is carried out in particular for the following purposes:

• Receiving, reviewing and assessing your application
• Communicating with you, in particular to arrange appointments, clarify queries and exchange documents
• Planning and conducting interviews, selection procedures and selection decisions
• Assessing your suitability for the advertised position or a comparable position
• Preparing and initiating an employment relationship
• Complying with legal obligations
• Establishing, exercising or defending legal claims
• Including you in a talent pool for future vacancies, where you have given us your consent to do so
  
  

Categories of personal data

Depending on the nature and scope of your application, we process the following categories of personal data in particular:

• Identification data: First name, surname, title and, where applicable, date of birth
• Contact details: Address, email address and telephone number
• Application data: Covering letter, curriculum vitae, application photograph, certificates, evidence of qualifications, employment history and references
• Information relating to the position sought: Preferred area of work, working hours, salary expectations, availability and earliest possible starting date
• Communication data: Content of messages, emails, telephone calls and conversations, as well as interview notes and appointment arrangements
• Assessment and selection data: Assessments, evaluations and decisions made during the recruitment process
• Other information: Any further information that you voluntarily provide as part of your application
  
  

Source of the data

We generally collect your personal data directly from you. This applies in particular to data that you provide as part of your application, during an interview or in subsequent communications (Art. 13 GDPR).

Where you apply through a recruitment portal, recruitment agency or other service provider, we may also receive your data from that organisation. In individual cases, we may also process information obtained from publicly accessible professional sources where this is necessary for the recruitment process and legally permissible (Art. 14 GDPR).

Special categories of personal data

Please provide us only with personal data that is necessary for the recruitment process.

Your application documents may contain special categories of personal data. These include, for example, health data and information concerning a disability, religious beliefs or trade union membership (Art. 9 Para. 1 GDPR).

We process such data only where this is necessary for exercising rights or complying with legal obligations under employment law, social security law or social protection law and the applicable statutory requirements are met (Art. 9 Para. 2 lit. b GDPR and Section 26 Para. 3 S. 1 BDSG).

Where the processing is based on your explicit consent, it will be carried out only for the purposes specified in that consent (Art. 9 Para. 2 lit. a GDPR and Section 26 Para. 2 and Para. 3 S. 2 BDSG). You may withdraw your consent at any time with effect for the future (Art. 7 Para. 3 GDPR).

Legal bases for processing

Depending on the purpose and circumstances, we process your personal data on the following legal bases:

• Conducting the recruitment process: The processing is necessary for deciding whether to establish an employment relationship and for taking pre-contractual measures (Section 26 Para. 1 S. 1 BDSG and Art. 6 Para. 1 lit. b GDPR).
• Compliance with legal obligations: The processing is necessary for compliance with a legal obligation to which we are subject (Art. 6 Para. 1 lit. c GDPR in conjunction with the applicable statutory provision).
• Legitimate interests: The processing is necessary for the purposes of our legitimate interests or those of a third party. These include, in particular, ensuring IT security and establishing, exercising or defending legal claims (Art. 6 Para. 1 lit. f GDPR).
• Consent: The processing is based on your freely given consent. This applies in particular to inclusion in a talent pool or to other processing activities expressly covered by your consent (Art. 6 Para. 1 lit. a and Art. 7 GDPR and Section 26 Para. 2 BDSG).
• Special categories of personal data: Such data is processed only under the conditions set out in Art. 9 Para. 2 GDPR and Section 26 Para. 3 BDSG.
  
  

Recipients and categories of recipients

Within our organisation, access to your personal data is restricted to those persons and departments that require it to conduct the recruitment process or comply with legal obligations. These may include in particular:

• Human resources personnel
• Management
• Managers and the relevant departments
• Employees involved in the selection process
• The works council or other employee representative bodies, where their involvement is required or provided for by law

External recipients may include in particular:

• IT, hosting and communications service providers
• Providers of recruitment and human resources management systems
• Recruitment agencies and recruitment consultancies
• Legal and tax advisers
• Courts, authorities and other public bodies

Where external service providers process personal data exclusively on our behalf, they are engaged as processors under a contract that complies with the applicable statutory requirements (Art. 28 GDPR).

Transfers to third countries

Where service providers process your application data outside the European Union or the European Economic Area, the transfer takes place only in compliance with the statutory requirements governing transfers to third countries (Art. 44 et seq. GDPR).

A transfer may be based in particular on an adequacy decision adopted by the European Commission or on appropriate safeguards such as the European Commission’s standard contractual clauses (Art. 45 and Art. 46 GDPR).

Requirement to provide personal data

Providing the personal data required to assess your application and conduct the recruitment process is necessary for us to process your application. Without this data, we may be unable to assess your suitability for the relevant position or conduct the recruitment process (Art. 13 Para. 2 lit. e GDPR).

Retention period and erasure

We retain your personal data only for as long as is necessary to conduct the recruitment process and fulfil the other purposes described above (Art. 5 Para. 1 lit. e GDPR).

Where an employment relationship is established, the application data required for establishing and administering the employment relationship will be transferred to your personnel file. Any further processing will be governed by the data protection and statutory provisions applicable to the employment relationship (Section 26 Para. 1 S. 1 BDSG).

Where no employment relationship is established, we generally erase your application data no later than six months after you receive notification that your application was unsuccessful or after you withdraw your application. The temporary retention of the data serves in particular to establish, exercise or defend potential legal claims (Art. 6 Para. 1 lit. f and Art. 17 Para. 3 lit. e GDPR).

Data may be retained for a longer period where specific legal claims have been asserted or judicial or administrative proceedings are pending. In such cases, we retain the necessary data until the proceedings have been finally concluded or the reason for retention no longer applies.

Where you have consented to the inclusion of your data in a talent pool, we retain your data until you withdraw your consent, but for no longer than twelve months. At the end of this period, the data will be erased unless you consent again to its continued retention (Art. 6 Para. 1 lit. a and Art. 7 GDPR and Section 26 Para. 2 BDSG).

Our social media profiles

Data processing by social networks and platforms

We maintain publicly accessible profiles and presences on social networks and other platforms. The providers we use are listed below.

When you visit one of our social media profiles, the respective platform operator may process personal data relating to you. This may include, in particular, your IP address, device and browser information, details relating to your user account and information about your interactions with our profile.

Where you are logged into your user account, the platform operator may associate your visit to our social media profile with that account. Personal data may also be collected where you are not logged in or do not have an account with the relevant platform. This information may be collected, for example, through cookies, similar technologies, device identifiers or your IP address.

The platform operators may use the data collected to create usage and interest profiles. On this basis, personalised content and advertising may be displayed to you both within and outside the respective platform. Where you have a user account, personalised content and advertising may also be displayed across different devices.

We cannot fully trace or influence all processing activities carried out by the platform operators. The scope, purposes and legal bases of the processing, as well as the applicable retention periods, are largely determined by the respective provider. Further information is available in the privacy policies linked below.

Purposes and legal bases of our processing

We process personal data that you provide to us through our social media profiles or that becomes available to us in connection with your use of our profiles, in particular for the following purposes:

• Public relations and presentation of our organisation
• Providing information about our services, offers and events
• Communicating with interested parties, customers, guests, applicants and business partners
• Handling enquiries, messages, comments and other interactions
• Maintaining customer and business relationships
• Marketing and promoting our services
• Recruiting and approaching potential applicants
• Analysing the reach and use of our social media profiles
• Moderating our profiles and protecting them against abusive or unlawful content

We generally maintain our social media profiles and carry out the associated processing for the purposes of our legitimate interests in modern public relations, communicating with users, maintaining our business relationships and promoting our services (Art. 6 Para. 1 lit. f GDPR).

Where your contact relates to a contract to which you are a party or to pre-contractual measures taken at your request, the processing is based on Art. 6 Para. 1 lit. b GDPR.

Where we obtain your consent for a particular processing activity, the processing is based on Art. 6 Para. 1 lit. a and Art. 7 GDPR. Where processing is necessary for compliance with a legal obligation, it is based on Art. 6 Para. 1 lit. c GDPR.

The legal bases for processing carried out independently by the platform operators are explained in their respective privacy policies.

Controllers and the exercise of your rights

We are the controller for processing activities for which we determine the purposes and means of processing. This applies in particular to content published by us and to the processing of messages, comments and other interactions addressed directly to us (Art. 4 No. 7 GDPR).

The respective platform operator is generally an independent controller for the processing of personal data carried out for its own purposes in connection with operating the platform, providing user accounts, analysing user behaviour or displaying advertising.

Where we jointly determine the purposes and means of particular processing activities with a platform operator, we and the platform operator are joint controllers. This may apply in particular to the preparation and provision of aggregated usage statistics or so-called insights data. In such cases, the respective responsibilities are determined in an arrangement concerning joint controllership (Art. 26 Para. 1 and 2 GDPR).

Where joint controllership exists, you may generally exercise your rights against either us or the respective platform operator (Art. 26 Para. 3 GDPR). Please note that the platform operator generally has sole or more comprehensive access to the user, device and usage data processed by it. The platform operator can therefore often respond directly to corresponding requests.

Further information about your rights is available in the section entitled “Rights of the data subject” in this Privacy Policy.

Recipients and public visibility

Within our organisation, access to personal data processed through our social media profiles is restricted to those persons and departments that require it for the purposes described above.

Recipients of the data also include the respective platform operators and any service providers engaged by them. Depending on your settings and the nature of your interaction, posts, comments, reactions or other content published by you may be visible to other users or to the public.

Personal data is disclosed to other recipients only where an appropriate legal basis applies and the disclosure is necessary for the respective purpose (Art. 6 Para. 1 GDPR).

Transfers to third countries

Some platform operators or their affiliated companies also process personal data in countries outside the European Union or the European Economic Area.

Where personal data is transferred to a third country, the transfer must be based on one of the mechanisms provided for in Art. 44 et seq. GDPR. These may include an adequacy decision adopted by the European Commission or appropriate safeguards such as the European Commission’s standard contractual clauses (Art. 45 and Art. 46 GDPR).

Further information about international data transfers and the safeguards used is available in the privacy policy of the respective platform operator.

Retention periods and erasure

We retain personal data that we process directly through our social media profiles only for as long as necessary for the purposes described above.

Where the purpose of processing no longer applies and there is no statutory retention obligation or other legal basis for continued storage, the data will be erased. Data may be retained for a longer period where this is necessary for compliance with legal obligations or for the establishment, exercise or defence of legal claims (Art. 5 Para. 1 lit. e and Art. 17 Para. 1 lit. a and Para. 3 lit. b and e GDPR).

Depending on the respective platform, posts, comments and other content published by you may remain publicly visible or visible to other users until you, we or the platform operator delete that content. We generally have no influence over how long the platform operator retains data for its own purposes. Details are available in the respective provider’s privacy policy.

Facebook

We maintain a profile on Facebook. The provider for users in the European Economic Area is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5 Ireland.

For certain processing activities relating to Page Insights, we and Meta Platforms Ireland Limited may be joint controllers (Art. 26 GDPR).

The Page Controller Addendum is available here: https://www.facebook.com/legal/terms/page_controller_addendum?locale=en_GB

Meta’s English-language Privacy Policy for Facebook and Instagram is available here: https://www.facebook.com/privacy/policy/?locale=en_GB

Instagram

We maintain a profile on Instagram. The provider for users in the European Economic Area is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

Meta’s English-language Privacy Policy for Facebook and Instagram is available here: https://www.facebook.com/privacy/policy/?locale=en_GB

5. Final provisions

Dresden, August 2026

Amendments to this Privacy Policy

We reserve the right to amend this Privacy Policy where this becomes necessary due to changes in the law, regulatory or judicial requirements, technological developments or changes to our services and processing activities.

The current version published on this website applies. The version date of this Privacy Policy can be found in the place and date information provided above.

Where required by law, we will inform you of material amendments to this Privacy Policy in an appropriate manner.