Privacy Policy

Controller

Data Collected

When you visit this website, your browser transmits technical data to our server (IP address, browser type, pages visited, date and time). This data is processed on the basis of Art. 6 (1)(f) GDPR (legitimate interest in operating and securing the website). Data is not stored beyond server log retention periods.

Cookies and Analytics

In addition to technically necessary cookies, this website uses cookies and comparable technologies for reach and usage analysis (Google Analytics 4). These are set exclusively after your prior, explicit consent. Without your consent, no analytics or tracking cookies are used.

Google Analytics 4

This website uses Google Analytics 4 (GA4), a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics uses cookies and comparable technologies that enable an analysis of your use of our website.

Purpose: We use Google Analytics to statistically evaluate the reach and use of our website (reach and usage analysis) in order to optimise our offering and make it more user-friendly.

Data processed: In particular, the following data is processed: pages and interactions, date and time of access, approximate location (region), device and browser information, referrer, and your IP address. Before any storage or further processing, your IP address is shortened/anonymised by Google so that no direct reference to your IP address can be established. We do not merge this data with other data about you.

Legal basis: The use of Google Analytics, as well as the storage of and access to information on your device required for this purpose, is based exclusively on your consent pursuant to Art. 6 (1)(a) GDPR in conjunction with Section 25 (1) of the German Telecommunications Digital Services Data Protection Act (TDDDG).

Consent and withdrawal:Processing of your data by Google Analytics only takes place after you have actively and explicitly given your consent via our cookie banner. Before your consent, no analytics tag is loaded and no analytics cookies are set. Your consent is voluntary and can be withdrawn at any time with effect for the future via the “Cookie settings” link in the footer of our website. The lawfulness of processing carried out up to the point of withdrawal remains unaffected.

Recipient and data processing agreement: The recipient of the data is Google acting as a processor. We have concluded a data processing agreement with Google pursuant to Art. 28 GDPR.

Retention period: Data collected at user level via Google Analytics is automatically deleted after the retention period we have set of 14 months. The analytics cookies set on your device each have a limited storage duration and are deleted at the latest upon expiry of that period or upon withdrawal of your consent.

Transfer to the USA: When using Google Analytics, personal data may be transferred to Google LLC, based in the USA. An adequacy decision of the European Commission of 10 July 2023 exists for the USA on the basis of the EU-US Data Privacy Framework (DPF). Google LLC is certified under the EU-US Data Privacy Framework, so the transfer takes place on this basis pursuant to Art. 45 GDPR. We point out that, despite the adequacy decision, a residual risk remains with a transfer to the USA, in particular regarding possible access by US authorities. Should no adequacy decision apply, we additionally base the transfer on your explicit consent pursuant to Art. 49 (1)(a) GDPR.

Further information: For more details on how Google handles your data, please see Google’s privacy policy at https://policies.google.com/privacy.

Room booking via the Mews Booking Engine (direct booking)

To book rooms online, our website links to the booking engine (distributor) of Mews Systems B.V. (established in the Netherlands). When you click “Book” on our website, the booking engine operated by Mews opens at app.mews.com in a new browser tab. No booking window and no Mews program code is embedded in our website; merely visiting our website therefore transmits no data to Mews. You enter your booking data directly into the booking engine operated by Mews.

Purpose: Real-time display of available rooms and rates, acceptance and processing of your room booking, and the subsequent administration of the accommodation contract via our property management system provided by Mews.

Data processed: First and last name, contact details (email, phone, address where applicable), stay dates (arrival/departure), room and rate selection, number of guests, any special requests or remarks, and the information required for payment. In addition, technical data required to operate the booking engine are processed (e.g. IP address, time of access, browser/device information).

Legal basis: Processing of your booking data is carried out to perform pre-contractual measures and to fulfil the accommodation contract pursuant to Art. 6(1)(b) GDPR.

Recipients / processing on our behalf: Mews Systems B.V. processes the booking data on our behalf and on our instructions as a processor within the meaning of Art. 28 GDPR.

Payment processing (Mews Payments):Payment for your booking is handled via “Mews Payments”. The payment service provider used here is Stripe, in the “payment facilitator” model. You enter your payment and card data directly into the secure payment page; it is processed by Stripe. For details on payment processing, data-protection responsibility and a possible transfer to the USA, see the section “Payment processing via Stripe”.

Protection by Google reCAPTCHA:The booking and payment page operated by Mews is protected by Google reCAPTCHA in order to distinguish human input from abusive automated access. reCAPTCHA is provided by Google (Google Ireland Limited / Google LLC, USA); in doing so, personal data may be processed, including in the USA. This processing takes place on the page operated by Mews; the privacy notices of Mews and of Google apply (https://policies.google.com/privacy). For transfers to Google LLC in the USA, the European Commission’s adequacy decision of 10 July 2023 (EU-US Data Privacy Framework) applies.

International data transfers:Mews Systems B.V. is established in the European Union (Netherlands). Whether and to what extent Mews uses sub-processors outside the EU/EEA, and the safeguards (Art. 44 et seq. GDPR) on which any such transfers are based, are governed by the data processing agreement concluded with Mews and by Mews’s privacy policy.

Retention period: Booking data are stored for the duration of the contractual relationship and beyond, within the scope of statutory retention obligations (in particular commercial and tax law, generally up to ten years), after which they are deleted.

Further information: For details on Mews’s data processing, please see the provider’s privacy policy at https://www.mews.com/en/legal/privacy-policy.

Payment processing via Stripe

For online payments we use the payment service provider Stripe. This concerns, on the one hand, the payment of breakfast and food pre-orders via our own website, and, on the other hand, the payment of room bookings, which is handled via “Mews Payments” in the “payment facilitator” model with Stripe (see the section “Room booking via the Mews Booking Engine”). The provider for customers within the European Economic Area is Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (“Stripe”). Stripe Payments Europe, Limited is part of Stripe, Inc., based in the USA.

Purpose: We use Stripe to process the online payment you have chosen for a breakfast booking, to allocate the payment, and to prevent payment defaults and fraud.

Data processed: In the course of payment processing, in particular the following data is processed: payment and card data (e.g. card number, expiry date, security code or the details of the payment method used), name, e-mail address, invoice amount and booking reference, as well as technical transaction data (e.g. timestamp, IP address and fraud-prevention data). The card and payment data are processed directly by Stripe; we ourselves do not receive this payment data in plain text, but only information on the status and allocation of the payment.

Legal basis: The legal basis for processing in order to carry out the payment is Art. 6(1)(b) GDPR (performance of the contract concluded with you or implementation of pre-contractual measures). Insofar as Stripe processes data for the purposes of fraud prevention and the security of payment transactions, this is based on the legitimate interest in secure and abuse-free payment processing pursuant to Art. 6(1)(f) GDPR.

Recipient and responsibility: The recipient of the payment data is Stripe. Stripe processes the data required to carry out the payment partly on our behalf and partly under its own data protection responsibility (in particular to comply with legal and regulatory obligations and for fraud prevention). Insofar as Stripe acts as a processor, a data processing agreement pursuant to Art. 28 GDPR is in place.

Transfer to the USA: In the course of payment processing, personal data may be transferred to Stripe, Inc., based in the USA. An adequacy decision of the European Commission of 10 July 2023 exists for the USA on the basis of the EU-US Data Privacy Framework (DPF); insofar as Stripe, Inc. is certified under the EU-US Data Privacy Framework, the transfer takes place on this basis pursuant to Art. 45 GDPR. In addition, Stripe bases transfers to third countries on standard contractual clauses adopted by the European Commission pursuant to Art. 46(2)(c) GDPR. We point out that, despite the adequacy decision, a residual risk remains with a transfer to the USA, in particular regarding possible access by US authorities.

Retention period:We store the payment-related data for as long as is necessary to process the booking and as long as statutory retention obligations (in particular commercial and tax retention periods) apply. The duration of processing at Stripe is governed by the provisions of Stripe’s privacy policy.

Further information: For more details on how Stripe handles your data, please see Stripe’s privacy policy at https://stripe.com/privacy.

Telephone contact and AI phone assistant

When you contact us by telephone, your call is answered by an AI-based digital telephone assistant (“Mara”). At the beginning of the conversation we explicitly inform you that you are speaking with an AI (Art. 50 AI Act). Where your request requires individual handling, we take it down and a member of staff gets back to you; on request, we additionally refer you to our WhatsApp contact (see the section “Communication via WhatsApp”). No decision based solely on automated processing that produces legal effects or similarly significantly affects you within the meaning of Art. 22 GDPR takes place.

No call recording: We do not record the telephone call as an audio file. In order to handle your request, the conversation is processed by machine during the call and converted into text.

Recognition based on your phone number:On the basis of the phone number you transmit, we check when a call comes in whether you have already called us within the last 30 days and whether a reservation or guest profile for your phone number exists in our hotel management system (Mews, see the section “Room booking via the Mews Booking Engine (direct booking)”). This allows us to address you personally and handle your request more quickly, without you having to repeat information already known to us. In this process we handle your phone number, your name, your request, and the time of earlier calls as well as — where a reservation exists — the associated booking data. Before we disclose to you any information stored for your phone number, we make sure that we are speaking with the person concerned themselves.

Legal basis: Where your call concerns the initiation or performance of a booking, the legal basis is Art. 6(1)(b) GDPR. Otherwise, and in particular for recognition based on your phone number, we process your data on the basis of our legitimate interest in efficient and prompt call handling pursuant to Art. 6(1)(f) GDPR.

Recipients and processing on our behalf: For the operation of the telephone assistant and the processing of your calls we use the service Vapi (Vapi Inc., USA) as a processor within the meaning of Art. 28 GDPR. For individual sub-functions — in particular the underlying language model and speech synthesis — we use services that we have engaged directly through our own contractual accounts. Speech recognition as well as the automated evaluation and summary of the conversation after the call ends (including the structured capture of name and request) are carried out through further processors engaged by Vapi; the technical call switching is carried out through a provider based in Germany. Insofar as individual such service providers are based in the USA (in particular for the language model, speech synthesis, speech recognition, and conversation evaluation), personal data may be transferred to the USA. We base these transfers on the Standard Contractual Clauses adopted by the European Commission pursuant to Art. 46(2)(c) GDPR (Implementing Decision (EU) 2021/914) — depending on the service provider, either as part of the processing agreement concluded with Vapi (Module 3) or of the processing agreements we have concluded directly with the respective provider (Module 2); insofar as a service provider is certified under the EU-US Data Privacy Framework, the transfer is additionally based on the adequacy decision of the European Commission of 10 July 2023 (Art. 45 GDPR). We point out that, despite these safeguards, a residual risk remains with a transfer to the USA, in particular regarding possible access by US authorities.

Retention period:The conversation content processed for call recognition (transcript and structured evaluation such as name and request) is automatically deleted at our processor after 30 days. Connection data of the call — in particular your phone number, time, duration, and the call charges — are retained beyond this at our processor insofar as and for as long as this is necessary for billing and abuse-prevention purposes (Art. 6(1)(f) GDPR), and are deleted as soon as that purpose ceases to apply. Booking data from an existing reservation are governed by the retention periods for booking data (see the section “Room booking via the Mews Booking Engine (direct booking)”).

Your rights:You have the data subject rights set out in the “Your Rights” section (in particular access, rectification, erasure, restriction, data portability, objection, and the right to lodge a complaint with a supervisory authority).

Your Rights

You have the right to access, rectification, erasure, restriction of processing, data portability, and objection (Arts. 15–21 GDPR). To exercise these rights, contact us at the address above. You also have the right to lodge a complaint with a supervisory authority.