Privacy Policy
Privacy Notice
With the following information, we would like to provide you with an overview of the processing of your personal data in connection with the use of our websites or our app, as well as during a stay at one of our hotels, and inform you about your rights under data protection law.
I. Information on the Processing of Personal Data
We would like to begin by drawing your attention to our extensive transparency information in accordance with Articles 13 and 14 GDPR.
1. Data Controller
The data controller for data processing on this website in accordance with Art. 4 No. 7 GDPR and the provider of the website (service provider) within the meaning of the German Telemedia Act (TMG) is
Christoph Trienen
Restaurant Hotel Zum Storchen
Lange Straße 24
79183 Waldkirch
Phone: +49 7681 474 95 90
Fax: +49 7681 474 95 99
Email: info@zum-storchen-waldkirch.de
Complete information in accordance with § 5 TMG can be found in our imprint
2. Contact Details of the Data Protection Officer
You can reach our Data Protection Officer at
Restaurant Hotel Zum Storchen
Astrid Trienen-Federspiel
Lange Straße 24
79183 Waldkirch
Email address: info@zum-strochen-waldkirch.de
3. Purposes and Legal Bases for the Processing of Personal Data
We process your personal data in accordance with the provisions of the EU General Data Protection Regulation (GDPR), the new German Federal Data Protection Act (BDSG-neu), and all other applicable laws for the following purposes and based on the following legal grounds:
(a) To process and manage reservation inquiries and reservations, as well as to provide our services under the accommodation contract, including the handling of your hotel stay and payment processing (in particular, to track your use of our services (telephone, bar, spa, pay-per-view TV programs, etc.), to carry out check-in and manage access to rooms) – the legal basis for this is Art. 6 para. 1 sentence 1 lit. b) GDPR.
(b) To fulfill a legal obligation to which our company is subject as a controller (e.g., under registration laws, tax laws, accounting obligations, etc.) – the legal basis for this is Art. 6 para. 1 sentence 1 lit. c) GDPR.
(c) Sending our email newsletter, including managing your newsletter subscription – the legal basis for this is your consent in accordance with Art. 6 para. 1 sentence 1 lit. a) GDPR.
(d) To maintain, ensure, and improve the quality of our products and services, in particular by conducting and analyzing satisfaction surveys and guest comments, by processing your personal data in our central guest database, which enables us to recognize you as a returning guest, better assess your expectations and wishes, improve the quality and individuality of our communication with you, and create tailored offers for you – the legal basis for this is Art. 6 para. 1 sentence 1 lit. f) GDPR. Our overriding legitimate interests arise from the accommodation contract we have with you, which constitutes a relevant and appropriate relationship within the meaning of Recital 47 of the GDPR, as well as from the fact that this type of data processing is standard practice in the international hotel industry and corresponds to the reasonable expectations of the vast majority of guests.
(e) For direct marketing of our offers and services – the legal basis for this is Art. 6 para. 1 sentence 1 lit. f) GDPR. Our overriding legitimate interest follows from Recital 47 of the GDPR.
(f) To exercise property rights, to prevent and investigate criminal offenses (in particular through video surveillance), to assert and defend legal claims and to protect interests in legal disputes, to ensure IT security and IT operations, to identify credit risks – the legal basis for this is Art. 6 para. 1 sentence 1 lit. f) GDPR. Our overriding legitimate interests follow from our obligation to ensure a safe stay for our guests at the hotel, as well as from our interest in enforcing our tangible and intangible claims and exercising our rights, and in defending against unjustified demands. Furthermore, the processing of personal data to the extent absolutely necessary to prevent fraud also constitutes a legitimate interest of our company in accordance with Recital 47 of the GDPR.
Minors
Minors may not transmit personal data to us without the consent of their legal guardians. As part of our website, we do not knowingly process personal data from minors.
Data Protection for Job Applications
We process data submitted by applicants only for the purpose of handling the application process.
If the application subsequently leads to an employment relationship, the applicant data will be processed in accordance with § 26 BDSG for the purpose of managing the employment relationship. If no employment relationship is established, the applicant data will be deleted within 6 months after notification of rejection.
Categories of Recipients of Personal Data
To the extent necessary for the purposes stated under Section 3 above, we also disclose your personal data to the following recipients or categories of recipients in accordance with Art. 4 No. 9 GDPR:
Within our company, only those departments that need this data (to the extent required) to fulfill our contractual and legal obligations have access to your data.
Service providers we engage (e.g., as part of data processing in accordance with Art. 28 GDPR) and vicarious agents may also receive personal data for these purposes. These are companies in the categories of credit services and payment processing, IT services, cleaning services, logistics, printing services, telecommunications, debt collection, consulting, and sales and marketing. The respective service providers are listed following the privacy notice; this list is updated regularly.
To enable you to book a room via our homepage, an online booking system, Viato CBE, is integrated into our website. The provider of this system is Viato GmbH. The information you provide is processed exclusively for the provision of our contractual services and is of course treated confidentially.
Furthermore, data may be disclosed to public authorities and institutions if there is a legal obligation to do so (e.g., tax authorities, law enforcement agencies).
Other data recipients may be those entities for which you have given us your consent to transmit data.
5. Transfer of Personal Data to a Third Country
Personal data is transferred to entities in countries outside the European Union (so-called third countries) to the extent that
(a) it is necessary to process your reservations and handle your hotel stay,
(b) it is required by law, or
(c) you have given us your consent.
As can be seen in detail from the list of service providers, our company uses service providers for certain tasks that are based in a third country, belong to an international group with companies in third countries, or themselves work with service providers based in a third country. A transfer of personal data to such service providers is permissible if the European Commission has decided that an adequate level of protection exists in the third country in question (in accordance with Art. 45 GDPR). If the Commission has not made such a decision, our company or the service provider may only transfer personal data to a third country or to an international organization if appropriate safeguards are in place and enforceable rights and effective legal remedies are available (Art. 46 para. 1 GDPR).
Beyond the aforementioned cases, our company does not transfer any personal data to entities in third countries or to international organizations.
6. Duration of Storage of Personal Data and Criteria for Determining This Duration
We process and store your personal data for as long as necessary to fulfill our contractual and legal obligations. Once the data is no longer required to fulfill contractual obligations, it is regularly deleted, unless its temporary further processing is necessary due to commercial and tax retention periods (including the German Commercial Code (HGB) and the German Tax Code (AO)). The retention or documentation periods specified there range from two to ten years.
7. Your Rights as a Data Subject
Every data subject whose personal data is processed has the right to information from the controller regarding the personal data concerned in accordance with Art. 15 GDPR, the right to rectification in accordance with Art. 16 GDPR, the right to erasure in accordance with Art. 17 GDPR, the right to restriction of processing in accordance with Art. 18 GDPR, the right to object to processing in accordance with Art. 21 GDPR, and the right to data portability in accordance with Art. 20 GDPR. The right to information and the right to erasure are also subject to the restrictions set out in §§ 34 and 35 BDSG-neu.
Further information on your right to object to processing in accordance with Art. 21 GDPR.
If the processing of your personal data is based on consent given to us, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
Furthermore, there is a right to lodge a complaint with the competent data protection supervisory authority in accordance with Art. 77 GDPR in conjunction with § 19 BDSG-neu.
8. Obligation to Provide Data
As part of our contractual relationship, you must provide the personal data that is necessary for the establishment and performance of the accommodation contract or that we are legally obliged to collect. Without this data, we will generally not be able to enter into or perform the contract with you. In particular, we are obliged under § 30 para. 2 of the German Federal Registration Act to collect certain personal data about you on the registration form. If you do not provide us with the necessary information, we may not be able to provide the services you request, or may only be able to provide them incompletely.
9. Automated Decision-Making and Profiling
In establishing and performing our contractual relationship, you will not be subject to a decision based solely on automated processing—including profiling—in accordance with Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you.
10. Supplementary Information on Your Right to Object in Accordance with Art. 21 GDPR
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6 para. 1 sentence 1 lit. e) GDPR (data processing in the public interest) or Art. 6 para. 1 sentence 1 lit. f) GDPR (data processing based on a balancing of interests); this also applies to profiling based on these provisions in accordance with Art. 4 para. 4 GDPR.
If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims.
If your personal data is processed by us for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing; this also applies to profiling to the extent that it is related to such direct marketing.
The objection can be made informally and should be directed to our Data Protection Officer at the contact details given in Section 2.
Security
Restaurant Hotel Storchen, Christoph Trienen, employs technical and organizational measures (TOM) to protect your data against accidental or intentional manipulation, loss, destruction, or unauthorized access. Our security measures are continuously improved in line with technological developments.
Nevertheless, internet-based data transmission methods can fundamentally have security gaps, so that complete protection cannot be guaranteed. Therefore, it is still possible for you to transmit personal data by other means, e.g., by post or telephone.
Supplementary Information on Data Processing on This Website
2. Email Newsletter
With our email newsletter, we regularly inform you, in accordance with the preferences you have indicated, about the offers and services of Restaurant Hotel zum Storchen.
If you would like to receive our email newsletter, we require a valid email address from you. For registration to our newsletter, we use the so-called double opt-in process. This means that after you register, we will send you an email to the email address you provided, in which we ask you to confirm that you wish to receive the newsletter. If you do not confirm your registration within 2 weeks, your information will be blocked and automatically deleted after one month. In addition, we store your IP addresses used and the times of registration and confirmation. The purpose of this procedure is to verify your registration and, if necessary, to investigate possible misuse of your personal data.
As a subscriber to our email newsletter, you can withdraw your consent to the processing of your email address for sending the email newsletter at any time. You can withdraw your consent via the relevant link in each email newsletter or by sending an email with the subject “Unsubscribe” to info@zum-storchen-waldkirch.de.
3. Cookies
We use cookies on our website. These are small files that your browser automatically creates and that are stored on your device (laptop, tablet, smartphone, etc.) when you visit our site. Cookies do not cause any damage to your device, do not contain viruses, Trojans, or other malware. Information is stored in the cookie that arises in connection with the specific device used. However, this does not mean that we thereby gain direct knowledge of your identity.
The use of cookies serves, on the one hand, to make the use of our offer more pleasant for you; on the other hand, we use cookies to statistically record the use of our website and to evaluate it for the purpose of optimizing our offer for you.
We use the following types of cookies in detail:
Necessary Cookies: These cookies contribute significantly to improving your browsing and booking experience on our website. Basic functionalities and applications such as shopping carts or electronic billing procedures are thereby optimized and their handling facilitated. These cookies do not collect any information about you that can be used for marketing actions or statistical analyses.
The data processed by cookies is necessary for the stated purposes to protect our legitimate interests and those of third parties in accordance with Art. 6 para. 1 sentence 1 lit. f GDPR.
In your browser, you can set that cookies are only stored if you consent to this. Most browsers accept cookies automatically. However, you can configure your browser so that no cookies are stored on your computer or a notice always appears before a new cookie is created. However, completely disabling cookies may result in you not being able to use all the features of our website. If you only want to accept Zum Storchen cookies but no cookies from partners, please select “Block third-party cookies” in your browser. The help function in the menu bar of your web browser will show you how to reject new cookies and disable cookies you have already received. We recommend that you always log out completely after finishing when using shared computers that accept cookies and so-called Flash cookies.
4. Analysis Tools
The tracking measures listed below and used by us are carried out on the basis of Art. 6 para. 1 sentence 1 lit. f GDPR. With the tracking measures used, we want to ensure a needs-based design and continuous optimization of our website. We also use the tracking measures to statistically record the use of our website and to evaluate it for the purpose of optimizing our offer for you. These interests are to be regarded as legitimate within the meaning of the aforementioned provision. The respective data processing purposes and data categories can be found in the explanations of the corresponding tracking tools.
Web Tracking
This website also uses Google Analytics, a web analytics service provided by Google Inc., based in Mountain View, USA (“Google”). Google Analytics uses so-called “cookies”, which are text files stored on your computer that enable an analysis of your use of the website. The information generated by the cookie about your use of this website is usually transferred to a Google server in the USA and stored there.
Since IP anonymization provided by Google (so-called IP masking) is activated on this website (by extending Google Analytics with the code “gat._anonymizeIp();”), your IP address is shortened by Google within the European Union or in other contracting states of the Agreement on the European Economic Area beforehand and thus anonymized. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and shortened there.
On behalf of the operator of this website, Google will use the information collected by Google Analytics to evaluate your use of the website, to compile reports on website activity, and to provide other services related to website usage and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics will not be merged with other data from Google.
You can prevent the storage of Google Analytics cookies by setting your browser software accordingly; however, we would like to point out that in this case you may not be able to use all the features of this website to their full extent. You can also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) to Google, as well as the processing of this data by Google, by downloading and installing the browser plugin available at the following link (http://tools.google.com/dlpage/gaoptout?hl=de).
Furthermore, you can prevent Google Analytics from recording your use of the website by setting a so-called opt-out cookie, which prevents the future collection of your data when you visit this website. The opt-out cookie is set when you click on the following link: To complete the objection, please click here.
The operator of this website also uses Google Analytics to evaluate data from AdWords and the DoubleClick cookie for statistical purposes. If you do not wish this, you can deactivate it via the Ads Preferences Manager (http://www.google.com/settings/ads?hl=de).
Further information on the terms of use and data protection at Google Analytics can be found at http://www.google.com/analytics/terms/de.html or at https://www.google.de/intl/de/policies/
5. Integration of Services and Content from Third-Party Providers (e.g., YouTube and Google Maps)
Content from third parties, such as videos from YouTube and map material from Google Maps (hereinafter referred to as “third-party providers”), is embedded within the website. The use of such content technically requires the transmission of the user’s IP address to the respective third-party provider. Without the IP address, the third-party providers could not send the content embedded in the website to the respective user’s browser. We have no influence on whether a third-party provider stores the IP address, e.g., for statistical purposes or uses it otherwise.
6. Social Media Plugins
The plugin provider stores the data collected about you as usage profiles and uses them for purposes of advertising, market research, and/or needs-based design of its website. Such an evaluation takes place in particular (also for users who are not logged in) to display needs-based advertising and to inform other users of the social network about your activities on our website. You have a right to object to the creation of these user profiles, whereby you must contact the respective plugin provider as set out below to exercise this right. Through the plugins, we offer you the opportunity to interact with social networks and other users, so that we can improve our offer and make it more interesting for you as a user. The legal basis for the use of the plugins is Art. 6 para. 1 sentence 1 lit. f GDPR.
The data transfer takes place regardless of whether you have an account with the plugin provider and are logged in there. If you are logged in with the plugin provider, the data we collect about you is directly assigned to your existing account with the plugin provider. If you activate the button and, for example, link the page, the plugin provider also stores this information in your user account and shares it publicly with your contacts. We recommend that you log out regularly after using a social network, especially before activating the button, as this allows you to avoid assignment to your profile with the plugin provider.
Facebook
The website uses social plugins (hereinafter referred to as “plugins”) of the social network facebook.com, which is operated by Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA (hereinafter referred to as “Facebook”). The plugins can be recognized by one of the Facebook logos (white “f” on a blue tile or a “thumbs up” sign) or are marked with the addition “Facebook Social Plugin”. The list and appearance of Facebook social plugins can be viewed here https://developers.facebook.com/docs/plugins/.
When a user accesses a page of this website that contains such a plugin, their browser establishes a direct connection to Facebook’s servers. The content of the plugin is transmitted by Facebook directly to the user’s browser and integrated into the website by it. The provider therefore has no influence on the scope of data that Facebook collects with the help of this plugin. According to the provider’s current knowledge, Facebook proceeds as follows:
By integrating the plugins, Facebook receives the information that a user has accessed the corresponding page of the provider’s website. If the user is logged in to Facebook, Facebook can assign the visit to their Facebook account. If users interact with the plugins, e.g., press the so-called Like button or leave a comment, the corresponding information is transmitted directly from the user’s browser to Facebook and stored there. If a user is not a member of Facebook, there is still the possibility that Facebook finds out and stores their IP address. According to Facebook, only an anonymized IP address is stored in Germany.
Users can find out the purpose and scope of data collection and the further processing and use of data by Facebook, as well as their related rights and setting options to protect their privacy, in Facebook’s privacy policy https://www.facebook.com/about/privacy/.
If a user is a member of Facebook and does not want Facebook to collect data about them via the provider’s website and link it to their member data stored on Facebook, they must log out of Facebook before visiting the website.
It is also possible to block Facebook social plugins with add-ons for the user’s browser, e.g., with the “Facebook Blocker”.
Instagram
The website uses plugins from Instagram, which is operated by Instagram LLC., 1601 Willow Road, Menlo Park, CA 94025, USA (“Instagram”). The plugins are marked with an Instagram logo, for example in the form of an “Instagram camera”.
If you access a page of this website that contains such a plugin, your browser establishes a direct connection to Instagram’s servers. The content of the plugin is transmitted by Instagram directly to your browser and integrated into the page. Through this integration, Instagram receives the information that your browser has accessed the corresponding page of our website, even if you do not have an Instagram profile or are not currently logged in to Instagram. This information (including your IP address) is transmitted directly from your browser to an Instagram server in the USA and stored there.
If you are logged in to Instagram, Instagram can directly assign your visit to our website to your Instagram account. If you interact with the plugins, for example by pressing the “Instagram” button, this information is also transmitted directly to an Instagram server and stored there. The information is also published on your Instagram account and displayed to your contacts there.
Please refer to Instagram’s privacy policy for the purpose and scope of data collection and the further processing and use of data by Instagram, as well as your rights as a user and setting options to protect your privacy: https://help.instagram.com/155833707900388/
If you do not want Instagram to directly assign the data collected via our website to your Instagram account, you must log out of Instagram before visiting our website. You can also completely prevent the loading of Instagram plugins with add-ons for your browser, e.g., with the script blocker “NoScript” (http://noscript.net/).
III. Notice Regarding External Links
“This website contains links to external third-party websites over whose content we have no control. Therefore, no guarantee can be assumed for this external content. The content of external pages to which links are provided here does not reflect the opinion of the website operator, but serves solely for information and to illustrate connections. The respective provider or operator of the pages is always responsible for the content of the linked pages. The linked pages were checked for possible legal violations at the time of linking. At the time of linking, no illegal content was identifiable. However, permanent monitoring of the content of the linked pages is not reasonable without concrete evidence of a legal violation. If we become aware of legal violations, we will remove such links immediately.”
Status and Update of the Privacy Notice
This privacy notice is effective as of May 1, 2018.
We will update this privacy notice from time to time in the event of relevant changes to our website, the processing of personal data, or changes to legal provisions. The revised version is effective from the published date of entry into force. In the event of significant changes to this privacy notice, we will inform you in good time before the changes take effect by means of a notice on our website. We will also inform our guests about the changes by email or in other ways if necessary.
Below you will find a list of our service providers / data processors
ibelsa GmbH
Software for capturing data, creating and processing reservations for hotel stays
GP Payments Acquiring International GmbH
Processing of credit card/debit card payments
Neubauer – EDV
Software solutions, data backup, anti-virus program
siteminder GmbH
Booking engine, channel manager
CHT GmbH & Co. KG
Creation of data backups
AVS Allg. Verwaltungs- u. Service GmbH
Customer Alliance GmbH
Germany
Monitoring, evaluation, and analysis of online guest reviews of hotel stays and restaurant visits