Privacy Policy
Below, we would like to inform you about the privacy policy on our websites, as well as about the nature, scope, and purpose of the personal data collected, used, and processed by us. Privacy is of high importance to us.
Personal data is all data with which you could be personally identified, such as name, IP address, telephone number, etc. This data is partly processed automatically when you visit the website (e.g., IP address, browser type, operating system, etc.), or when you give us your consent to processing, or when you voluntarily provide us with your data, e.g., by entering your data in a form on our website.
Furthermore, we would like to inform you about your rights under the GDPR.
You have the right at any time to obtain information free of charge about the origin, recipients and purpose of your personal data processed by us, as well as the right to correct or delete this data.
You continue to have the right to request the restriction of the processing of your personal data under certain circumstances. If you have given us consent to the processing of data, you may revoke this consent at any time in the future. Furthermore, you have the right to file a complaint with the competent data protection supervisory authority.
Responsible for data protection / processing entity is The company
Böhmerwald-Reisen & Betriebs GmbH
Siegmund-Adam-Straße 51-54
93458 Warzenried
Phone: 09947 2000
Email: info@hotel-boehmerwald.de
Managing Director: Andreas Schreindorfer
Processing of your data as part of the services we provide
For our guests, customers or business partners, or in the event that you are interested in our services, the nature, scope and purpose of the processing of your personal data will be determined by the contractual or pre-contractual relationships that exist between us. We process personal data that we request from you or that you provide to us in order to answer your request, to create an offer for you or to process your order. The persons concerned are interested parties, guests, business and contractual partners. The processing purpose is the execution of contractual services, communication, as well as the answering of contact requests and office and organizational procedures.
Unless otherwise stated in the further information in this privacy policy, the processing of your data, as well as its disclosure to third parties, is limited to the data necessary to answer your inquiries and/or to fulfill the contract, to safeguard our rights, and to fulfill legal obligations.
The affected data are
- Inventory data (e.g., names, addresses)
- Payment data (e.g., bank account details, invoices)
- Contact details (e.g. email address, phone number, postal address)
- Contract details (e.g. subject matter of the contract, duration of the contract)
The legal basis for data processing is Art. 6 I 1 lit. b GDPR, the performance of the contract or the fulfillment of pre-contractual inquiries.
Unless a specific retention period is specified in this privacy policy, we will store your personal data until the purpose for the data processing has ceased. We will delete your personal data when we no longer need it, i.e. after the termination of the contractual relationship between us, or after our legitimate interest in further processing of the data has ceased, or when you request us to delete it. Compulsory legal provisions – in particular statutory retention periods – remain unaffected. Likewise, processing your personal data may be necessary to assert, exercise or defend legal claims arising from contractual relationships, or to protect the rights of another natural or legal person. We will then delete the personal data required for this purpose only after the expiration of these periods. However, until the expiration of these deadlines, we limit the processing of this data to these purposes.
Cookies
We use technically necessary session cookies on our website. Cookies are small files that your browser automatically creates and are stored on your device (laptop, tablet, smartphone, etc.) when you visit our website. Cookies do not cause any damage to your device and do not contain viruses, Trojans, or other malicious software.
The cookie stores information that is specific to the specific device used. However, this does not mean that we directly obtain knowledge of your identity. Cookies do not contain any personal data and can therefore not be directly associated with any user.
The use of cookies serves to make the use of our offer more pleasant for you. For example, we use session cookies that are technically necessary to recognize that you have already visited individual pages of our website. These cookies are automatically deleted after closing your browser. The data processed by cookies is necessary for the aforementioned purposes in order to safeguard our legitimate interests and those of third parties in accordance with Art. 6(1)(f) GDPR.
Inquiries by email or phone
If you contact us by email or phone, your request, including all personal data derived from it (e.g., name, request), will be stored and processed by us for the purpose of processing your request. No data will be disclosed without your consent. There is no legal or contractual obligation to provide your data, however, processing your request is not possible without providing your data.
The processing of this data is carried out on the basis of Art. 6(1)(b) GDPR, provided that your request relates to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on your consent (Art. 6(1)(a) GDPR) and/or on our legitimate interest (Art. 6(1)(f) GDPR), since we have a legitimate interest in effectively processing the requests we receive from you.
The data (e-mail) sent to us via contact requests will be stored by us until you request us to delete it, revoke your consent to its storage, or the purpose for storing the data no longer applies (e.g., after your request has been processed). Compulsory statutory provisions – in particular statutory retention periods – remain unaffected.
Data when using our contact form / Inquiries
When you send us a message via our contact form, the mandatory information is provided in the form. Entering an email address is necessary to enable us to contact you via email. There is no legal or contractual obligation to provide your data, however, processing your request is not possible without providing your data.
The data entered by you in the contact form will be used by us exclusively to answer your inquiry within the framework of your request via the contact form. We will not disclose the data entered by you in the contact form to third parties or use it for any purpose other than responding to your inquiry. The data processing will be carried out either for the purpose of fulfilling a contract to which the data subject is a party, or for the implementation of pre-contractual measures (Art. 6 I S 1 lit b GDPR), or pursuant to Art. 6 I S. 1 lit. a GDPR on the basis of your freely given consent and / or on our legitimate interests (Art. 6 I S. 1 lit. f GDPR), since we have a legitimate interest in effectively processing the inquiries we receive.
Your data will be deleted after final processing of your request, unless there are legal retention obligations that prevent deletion.
For bookings, we also rely on the services of the tourist data management company toubiz of the company land in sicht AG, Wiesentalstr. 5, 79115 Freiburg, phone +49 (0) 761 887917-0, email info@land-in-sicht.de, www.land-in-sicht.de (hereinafter referred to as Toubiz) is one. Toubiz is a web-based tourist database solution for managing structured data such as POIs (Point of interest), gastronomy, events, tours, and accommodations.
Toubiz may use technically necessary cookies to temporarily store the data entered by users when searching for accommodation (cookie names: ROUTEID; tt). These cookies are deleted at the end of the session. The legal basis is Article 6 I S 1 lit f GDPR, our legitimate interest in ensuring the proper functioning of the booking tool.
You can find the privacy policy of Toubiz here. https://www.land-in-sicht.de/datenschutz
Email advertising and your right to object
If we have received your email address in connection with a completed booking or service and you have not objected, we reserve the right, based on § 7 III UWG, to regularly send you our offers for similar services. The legal basis is based on our legitimate interest in advertising to our customers and the processing of the data is permitted under Art. 6 I S1 lit f GDPR within the framework of an interest balancing.
You can object to the use of your email address at any time by sending a message to us or using the corresponding link in the promotional email. Upon the termination of the legal basis for data processing for promotional emails, your email address will be deleted unless statutory retention obligations (e.g., from tax or commercial law retention obligations) preclude this.
We would like to point out that you can object to the future processing of your personal data at any time in accordance with the legal requirements under Art. 21 GDPR. The objection can, in particular, be made against the processing for direct marketing purposes.
Postal advertising and your right to object
We reserve the right to use your first and last name as well as your postal address that you have provided to us in the context of bookings for our own advertising purposes, e.g. to send interesting offers by post. This serves to safeguard our predominantly legitimate interests, as determined in accordance with Art. 6(1)(f) GDPR, in advertising our customers.
You can object to the storage and use of your data for these purposes at any time by sending us a message. The objection can, in particular, be made against the processing for direct marketing purposes. After the legal basis for data processing for postal advertising has ceased to exist, your address data will be deleted unless statutory retention obligations preclude this.
Newsletter
We send our newsletter with advertising information (hereinafter „newsletter“) only with the express consent of the recipients pursuant to Art. 6(1)(1)(a) GDPR. Registration for our newsletter takes place in a so-called double-opt-in procedure, i.e., after registering for our newsletter you will receive an email in which you are asked to confirm your registration. This confirmation is necessary to prevent any third party from registering with your email address. There is no legal or contractual obligation to provide your data; however, sending a newsletter without providing your data is not possible.
The registrations for the newsletter are logged in order to be able to prove the registration process in accordance with legal requirements. This includes the storage of the registration and confirmation date, as well as the IP address.
To sign up for our newsletter, it is sufficient to provide your email address.
Your email address will remain stored with us until you unsubscribe from our newsletter again. You can unsubscribe from the newsletter at any time in the future by clicking on the link at the end of each newsletter or on the „unsubscribe from newsletter“ link on our website, and then following the steps described there.
The consent to the sending of the email addresses is based on Article 6(1)(a). Our interest lies in the use of a user-friendly and secure newsletter system that serves both our business interests and the users’ expectations regarding information about our products.
We point out that you can at any time revoke your consent to the future processing of your personal data. For more information about your right to withdraw consent, please see the section „Rights of data subjects“.
Gurado GmbH – Voucher Ticket System
We work with the gurado voucher ticket system of the company Gurado GmbH, Wittbräucker Str. 32, 44287 Dortmund (Gurando GmbH) for the sale, administration and redemption of vouchers and tickets. When you purchase a voucher in our voucher shop, it is created using the software of Gurado GmbH. To this end, we transmit the data you provide in the input field when ordering a voucher (title, title, name, first name, date of birth, address, e-mail address, telephone number) to Gurado GmbH.
When the voucher button is pressed, their email address is transmitted to the service provider. You can find the privacy policy of Gurando here. https://cdn-int.gurado.de/ueber-uns/datenschutzerklaerung/
Data transmission to payment service providers when orderingen / Reservations
To fulfill the contract, we will pass on your data to the company commissioned with the payment, insofar as this is necessary for the payment of the ordered goods. Depending on which payment service provider you select in the ordering process, we will pass on the payment data collected for this purpose to the credit institution commissioned with the payment and, if applicable, to the payment service provider commissioned by us, or to the selected payment service. Some of the selected payment service providers also collect this data themselves, insofar as you create an account there. In this case, you must log in to the payment service provider using your login details in the ordering process. The privacy policy of the respective payment service provider applies in this case.
The legal basis for data processing is Art. 6(1)(a), b GDPR.
PayPal
On our website, we offer, among other things, payment via PayPal. The provider of this payment service is PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter “PayPal”).
If you choose to pay via PayPal, the payment details you enter will be sent to PayPal.
The transmission of your data to PayPal is based on Art. 6(1)(a) GDPR (consent) and Art. 6(1)(b) GDPR (processing to fulfill a contract). You have the option to revoke your consent to data processing at any time. A revocation does not affect the effectiveness of data processing operations that took place in the past.
Further data protection information can be found in the PayPal Privacy Policy at https://www.paypal.com/de/webapps/mpp/ua/privacy-full take away.
Data protection when submitting application documents
If you send us your application documents, we will use them exclusively to decide on your application and will not share your data with third parties. We point out that at present, we do not offer any encryption of your data when sending application documents via email. However, you can send your attachments, for example using the 7ZIP(http://www.7-zip.de/) program, to us via email and separately, for example by phone, provide your password to us. You will receive an email message from us regarding the receipt of your application at your email address. You can also send us your application by post at any time.
Application data is kept and managed separately from other datasets.
If we conclude an employment contract with an applicant, the data submitted will be stored for the purpose of processing the employment relationship in accordance with legal regulations. If no employment contract is concluded with the applicant, the application documents will be automatically deleted no later than 6 months after the notification of the rejection decision, unless there are no other legitimate interests of the controller against the deletion or the applicant has explicitly consented to a longer storage and retention of his/her application, e.g. for possible future contact regarding vacant positions. Other legitimate interests in this sense are, for example, a requirement to provide evidence in proceedings under the General Equal Treatment Act (AGG).
The data processing for the purpose of contacting you and processing your application data is carried out in accordance with Art. 6(1)(a), (b) of the GDPR on the basis of your voluntary consent, as well as for the implementation of pre-contractual measures.
Online presences in social networks
We operate online presences in social networks for advertising purposes.
We point out that you use the social services and their functions at your own risk. This applies in particular to the use of interactive features (e.g. sharing, rating).
When you visit our online presences on social media, personal data is collected and processed for advertising and market research purposes by the respective provider. In this case, usage profiles are usually also created. This is particularly the case if you are a member of the respective platform and logged in to it. The usage profiles can be used by the providers to display interest-based advertising to you. To prevent operators of social media from collecting information about you during your visit to our websites, you should log out of the respective social media before starting your visit to our websites and possibly delete any social media cookies from your browser.
Social Network Links
No social plugins from Facebook or other social networks are integrated on these websites. Therefore, no program code from a social network is active on our pages. The Facebook and other social network icons on our website are merely linked images.
Privacy Policy – Online presence on Facebook/Instagram (META)
Facebook Ireland (Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland – hereinafter referred to as Facebook) and the page administrator (we) are jointly responsible for the processing of personal data for the purposes set out in the Terms of Use for Comprehensive Products on the page administrator’s Facebook account, which are collected in connection with a visit to or interaction with a page (including its content).
Products include all Facebook products, Facebook pages and page insights. Products include Facebook itself (including the mobile Facebook app and the browser in the app), Messenger, Instagram (including apps like Direct and Boomerang), devices from the Portal brand, Bonfire, Facebook Mentions, Facebook Shops, Spark AR Studio, Audience Network, NPE Team Apps, and all other features, apps, technologies, software products, products, or services offered by Facebook, Inc. or Facebook Ireland Limited. Additionally, the Facebook Business tools are also included among the Facebook products.
The scope of the joint processing and the addendum for controllers covers the collection of the personal data specified in the terms of use for packaged products and their transmission to Facebook. The subsequent processing of data by Facebook is not part of the joint processing. Likewise, it is not part of the joint processing when personal data is processed exclusively by us – in this case, we are the sole controller of the data processing.
The information required under Article 13(1)(a) and (b) of the GDPR can be found in the data protection policy of Facebook under https://www.facebook.com/about/privacy Get more information about the joint processing of data can be found in the respective terms of use of the products.
The use of certain Facebook products (so-called „Facebook Business Tools“) and the associated data processing are governed by the additional agreement between us and Facebook as joint controllers pursuant to Art. 26 GDPR, which you can find here. https://www.facebook.com/legal/controller_addendum can see.
The site administrator and Facebook have agreed on this addition to establish the respective responsibilities for fulfilling the obligations under the GDPR regarding the joint processing (as set out in the terms of use for integrated products).
Furthermore, we have agreed that Facebook is responsible for ensuring that the rights of the affected persons are respected in accordance with Articles 15-20 of the GDPR regarding the personal data stored by Facebook following the joint processing.
The data transfer is based on the standard contractual clauses of the European Commission.
Further information can be found under
https://de-de.facebook.com/help/566994660333381/?helpref=uf_share
https://www.facebook.com/legal/EU_data_transfer_addendum
https://help.instagram.com/519522125107875/?maybe_redirect_pol=0
Data processing terms at Facebook
We expressly point out that the use of certain Facebook products may involve the transmission of personal information to Facebook. Depending on the circumstances, it may also be the case that Facebook Ireland Limited transfers EU data for storage and further processing to Facebook Inc. in the USA. By using the Facebook products, the user agrees to the data processing terms of Facebook. These can be found here. https://www.facebook.com/legal/terms/dataprocessing/update.
You can find the Facebook EU data transfer addendum under https://www.facebook.com/legal/EU_data_transfer_addendum
The data policy of Facebook can be found at https://www.facebook.com/about/privacy/ – the data policy of Instagram can be found under https://help.instagram.com/519522125107875
Information about cookies and other storage technologies on Facebook can be found here. https://www.facebook.com/policies/cookies/
You can find the data security conditions of Facebook under https://www.facebook.com/legal/terms/data_security_terms view.
The terms of use for commercial use by Facebook can be found here. https://www.facebook.com/legal/commercial_terms/update
You can contact the Facebook Data Protection Officer at https://www.facebook.com/help/contact/540977946302970 contact.
Further information about page insights data
Facebook continues to provide us with so-called page insights for the Facebook page. Insights data are aggregated data that provide us with information about how users interact with the Facebook page. The legal basis for data processing is Art. 6(1)(f) GDPR, safeguarding our legitimate interests in an optimized presentation of the web offering and more effective communication with users.
The data processing is carried out on the basis of an agreement between the joint controllers in accordance with Article 26 GDPR, which you can find here. https://www.facebook.com/legal/terms/page_controller_addendum can see.
Further information about page insights data on Facebook can be found at https://www.facebook.com/legal/terms/information_about_page_insights_data as well as under https://de-de.facebook.com/help/instagram/155833707900388
Data processing when contacting us via Facebook Products
We collect personal data when you contact us, e.g. via the contact form or via Messenger. This data is stored and used exclusively for the purpose of responding to your inquiry or for contacting you and the associated technical administration. The legal basis for the processing of the data is our legitimate interest in responding to your inquiry in accordance with Art. 6(1)(f) GDPR. Your data will be deleted after the final processing of your request, unless there are statutory retention obligations.
Your rights
Facebook and we have agreed that Facebook is primarily responsible for providing you with information about the joint processing and enabling you to exercise your rights under the GDPR. According to the GDPR, you have the right to access, rectify, transfer and delete your data, as well as the right to object to the processing of your data and to restrict the processing. You can find out more about these rights in your Facebook settings. For further information about your rights, see also „Data subject rights“ in this privacy policy.
Facebook and we have agreed that the Irish Data Protection Commission is the authority that will exercise oversight over the processing under joint responsibility. It has the right to make a complaint with the Irish Data Protection Commission (see www.dataprotection.ie ) or submit them to your local supervisory authority.
Right of objection to advertising
You can object to the processing of your data for advertising purposes on Facebook at any time by changing your ad settings in your Facebook user account under https://www.facebook.com/settings?tab=ads change accordingly.
Legal basis for operating the Facebook page / Instagram and processing of personal data when accessed
We operate the Facebook page / Instagram page for advertising purposes for our goods and services. The processing of personal data is carried out on the basis of Art. 6 I S 1 lit f GDPR.
Data security – SSL encryption
We use the SSL (Secure Socket Layer) procedure on our website for encryption and to protect the transmission of confidential content. When SSL encryption is activated, the data you transmit to us cannot be
read by third parties. You can recognize whether a single page of our website is transmitted encrypted by the closed representation of the key or lock symbol in the status bar of your browser – the address bar of your browser shows „https://“ an” when SSL encryption is in effect.
Processing/Disclosure of Data
Your personal data will not be transmitted to third parties for purposes other than those listed above or below.
We only pass on your personal data to third parties if:
- You have given your explicit consent to this, as per Art. 6(1)(1)(a) GDPR,
- this is legally permissible and in accordance with Art. 6(1)(1)(b) GDPR for the fulfillment of contractual relationships that are necessary for the implementation of pre-contractual measures with you,
- in the event that there is a legal obligation for us to disclose the data pursuant to Art. 6(1)(c) GDPR,
- the processing is necessary for the protection of our legitimate interests or those of a third party pursuant to Art. 6(1)(1)(f) GDPR, unless the interests or fundamental rights and freedoms of the data subject requiring the protection of personal data prevail, in particular if the data subject is a child.
Rights of those affected
You have the right:
- Pursuant to Article 15 of the GDPR, you have the right to request information about the personal data processed by us;
- in accordance with Article 16 GDPR, to demand the immediate correction of incorrect or completion of your personal data stored with us;
- in accordance with Article 17 of the GDPR, to request the deletion of your personal data stored with us, unless the processing is necessary for the exercise of the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the assertion, exercise or defense of legal claims;
- in accordance with Article 18 GDPR, to request the restriction of the processing of your personal data, insofar as the accuracy of the data is contested by you, the processing is unlawful but you refuse its deletion and we no longer need the data, but you require it to establish, exercise or defend legal claims or you have lodged an objection to the processing pursuant to Article 21 GDPR;
- in accordance with Article 20 of the GDPR, to obtain your personal data that you have provided to us in a structured, commonly used and machine-readable format or to request that it be transmitted to another controller;
- In accordance with Article 7(3) of the GDPR, you may revoke your consent given to us at any time. This means that we are no longer allowed to continue data processing based on this consent in the future;
- Pursuant to Art. 77 GDPR, you may lodge a complaint with a supervisory authority if you believe that the processing of your personal data infringes the GDPR. As a rule, you can contact the supervisory authority of your usual place of residence or work or our headquarters for this purpose. A list of data protection officers in Germany and their contact details can be found under the following link: https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html.
Right of objection to data collection in special cases as well as to direct advertising (Art. 21 GDPR)
To the extent that we process your personal data in accordance with Art. 6(1)(1)(f) GDPR in order to safeguard our overriding legitimate interests, as determined in the context of an interest balancing exercise, you have the right to object to the processing of your personal data with effect for the future, in accordance with Art. 21 GDPR. If the processing is carried out for the purposes of direct marketing, you may exercise this right at any time. This also applies to profiling insofar as it is related to such direct marketing. Where the processing takes place for other purposes, you have the right to object only if there are reasons arising from your particular situation.
If you wish to exercise your right of objection, all you need to do is send us an email.
After exercising your right of objection, we will not process your personal data further, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or if the processing serves the assertion, exercise or defense of legal claims.
In the event of your objection to the processing of your personal data for direct marketing purposes, the personal data will no longer be processed for these purposes.
As a responsible company, we do not resort to automatic decision-making or profiling.
Changes to this privacy policy – as of now
As our website and its offerings continue to evolve or due to changes in legal or regulatory requirements, it may become necessary to modify this privacy policy in accordance with applicable data protection regulations. The most current privacy policy can be accessed and printed from our website at any time under “Privacy”.
Status: September 2022 created by RA Markus v. Hohenhau – www.e-anwalt.de
