Data Protection

Information on Data Processing pursuant to Articles 13 and 14 GDPR

This information on data processing applies to the online services of Classik Hotel Collection GmbH, available under the domain www.classik-hotel-collection.com and its various subdomains. We would also like to explain how we store and use personal data obtained through other channels.

Classik Hotel Collection GmbH is guided in particular by the EU General Data Protection Regulation and the current German Federal Data Protection Act (BDSG). When you use the internet, we protect your personal data in accordance with the German Telecommunications Digital Services Data Protection Act (TDDDG). Below, we explain what information we collect during your visit to our websites and how we use it.

Who is responsible and how can I contact you?

Controller

for the processing of personal data within the meaning of the EU General Data Protection Regulation (GDPR)

Classik Hotel Collection GmbH, Rosenstraße 1, D-10178 Berlin

Tel +49 (0)30 24 00 17 63

Email: info@classik-hotel-collection.de

Data Protection Officer

Data Solution LUD GmbH, Isarstraße 13, D-14974 Ludwigsfelde

Mr Kay Kühnel

Email: k.kuehnel@ds-lud.de

What is this about?

This privacy policy fulfils the statutory requirements for transparency in the processing of personal data. Personal data means any information relating to an identified or identifiable natural person. This includes, for example, your name, age, address, telephone number, date of birth, email address, IP address or browsing behaviour when visiting a website. Information that we cannot link to you, or can only link to you with disproportionate effort, for example because it has been anonymised, is not personal data. The processing of personal data (e.g. collection, consultation, use, storage or transmission) always requires a legal basis and a defined purpose.

Stored personal data is erased once the purpose of processing has been achieved and there are no lawful grounds for retaining it. We explain the specific retention periods or storage criteria for each processing activity. Irrespective of this, we retain your personal data in individual cases for the establishment, exercise or defence of legal claims and where statutory retention obligations apply.

General information on data processing

As a rule, we collect and use personal data only insofar as necessary to provide a functioning website and our content and services, or where we collect and process data for other purposes independently of the website.

Legal basis for processing personal data

We process personal data on the following legal bases:

Where we obtain the data subject’s consent to processing personal data, Article 6(1)(a) GDPR serves as the legal basis.
Where processing personal data is necessary for the performance of a contract to which the data subject is a party, Article 6(1)(b) GDPR serves as the legal basis. This also applies to processing necessary to take steps prior to entering into a contract.
Where processing personal data is necessary for compliance with a legal obligation (statutory provisions) to which our company is subject, Article 6(1)(c) GDPR serves as the legal basis.
Where processing is necessary for the purposes of a legitimate interest pursued by our company or a third party, and the data subject’s interests or fundamental rights and freedoms do not override that interest, Article 6(1)(f) GDPR serves as the legal basis for processing.

We refer to the relevant terms in connection with each processing activity so that you can understand the basis on which we process personal data.

Where your personal data is processed on the basis of consent you have given, you have the right to withdraw that consent at any time by notifying us, with effect for the future.

Where we process data on the basis of a balancing of interests, you, as the data subject, have the right to object to the processing of your personal data, subject to the requirements of Article 21 GDPR.

Data erasure and retention periods

The data subject’s personal data is erased or blocked once the purpose of storage no longer applies. Data may also be stored where this is provided for by European or national legislators in EU regulations, laws or other provisions to which the controller is subject. Data is also blocked or erased when a retention period prescribed by those provisions expires, unless continued storage is necessary for entering into or performing a contract.

Who receives your data?

We disclose the personal data we process on our website to third parties only where necessary to fulfil the relevant purposes and where covered by the applicable legal basis in the individual case (e.g. consent or the pursuit of legitimate interests). We also disclose personal data to third parties in individual cases where this serves the establishment, exercise or defence of legal claims. Potential recipients may include law enforcement authorities, lawyers, auditors, courts, etc.

Where we engage service providers to operate our website who process personal data on our behalf under Article 28 GDPR, they may receive your personal data. Further information on the use of processors and web services is provided in the overview of individual processing activities.

Collection, processing and use of personal data at Classik Hotel Collection

The hotel group’s business is the operation of several hotels in Germany under joint controllership. Data is collected, processed and used for this stated purpose.

Classik Hotel Collection, Rosenstraße 1, D-10178 Berlin is the controller responsible for handling central reservations. To improve our services, we manage all data received in our central hotel software within the hotel group. The controller is the hotel with which the booking is made. The relevant booking data can only be viewed by the controller. Access to a guest’s master data is shared, for example to make or change a reservation for another hotel at a later date or to carry out centralised marketing activities. Central services such as reservations and marketing access this data for these purposes. The legal basis for processing is our legitimate interest in processing data as part of the central administration and use of our customers’ and business partners’ data within the hotel group.

Guests’ contact details may be used for advertising purposes at a later date. Promotional activities primarily include mailings. Use of a guest’s email address requires their consent.

Your data will only be processed for purposes other than those stated where such processing is permissible under Article 6(4) GDPR and compatible with the original purposes of the contractual relationship. We will inform you of such processing before it takes place.

Legal basis for data processing

The legal basis for processing data is the conclusion of an accommodation contract with the guest. The data transmitted is stored in our hotel software and used to perform the contract.

Groups of data subjects, data and data categories:

To fulfil the stated purpose, the following categories of personal data are collected, processed and used:

Guest data (in particular first and last names, address details, contact details, reservation details, guest preferences and billing details)
Other customer data (in particular address details, billing and service details)
Prospective customer data (in particular accommodation interests and address details)

Recipients to whom data may be disclosed:

Data may be disclosed to the following recipients:

Internal departments involved in carrying out and completing the relevant business processes (e.g. hotels within the hotel group, central reservations, accounting, Sales & Marketing and IT organisation)
Public bodies receiving data under statutory provisions (e.g. law enforcement authorities and other public authorities)
External contractors under Article 28 GDPR (service providers)
Other external bodies (e.g. credit institutions and companies where data subjects have given written consent or disclosure is permissible on grounds of overriding legitimate interests)

Purpose of data processing

The main purpose of collecting, processing or using personal data is the administration, care and hospitality of guests under the accommodation contract.

Retention period

Legislation provides for numerous retention obligations and periods. Once these periods expire, the relevant data and records are routinely erased or anonymised if they are no longer required for contract performance. For example, commercial or financially relevant data for a completed financial year is erased after a further ten years in accordance with statutory provisions, unless longer retention periods are prescribed or necessary for legitimate reasons. Reservation documents may be destroyed after 6 years, and the special registration form at the end of the year following the expiry of one year.

Right to object

You may object to the processing of your data at any time. We have set up the email address widerruf@classik-hotel-collection.com for this purpose.

Processing of domestic guests’ personal data during online check-in

To perform the accommodation contract, we need to collect and store the following personal data from you as a domestic guest when you check in at the hotel:

Arrival date and expected departure date (to plan and organise your stay)
Last and first names (for identification and contact purposes)
Email address (to participate in the online check-in/check-out procedure to simplify and speed up check-in and check-out, confirm your booking, send relevant information about your reservation and send your invoice after your stay)
Address (for contact and invoicing purposes)
Identification data, unless you initiate a card-based payment transaction with Strong Customer Authentication (SCA), in which the purpose-specific reference number of the payment instrument used is collected. In this case, the purpose-specific reference number of the payment instrument is stored together with the data listed above.
State law may provide for additional data to be collected on the registration form for the collection of tourism and spa taxes (to meet the requirements of tourism and spa authorities).

Strong Customer Authentication is a requirement of the EU Payment Services Directive PSD2 designed to ensure the security of online payments and reduce fraud. It requires users making payments to confirm their identity using two of three factors: knowledge (something only the user knows, e.g. a password), possession (something only the user has, e.g. a smartphone) and inherence (something unique to the user, e.g. a fingerprint).

If you use online check-in, this takes place via the Guestline platform provided by Guestline GmbH, Agnes-Pockels-Bogen 1, 80992 München, Germany. Guestline has undertaken to handle the data you transmit in accordance with data protection requirements and takes all organisational and technical measures to protect your data. For further information on data protection, please see Guestline’s privacy policy: https://www.theaccessgroup.com/de-de/privacy-policy/.

Personal data is processed when the software is used. This may include the following personal data:

Last name
Reservation number

Additional reservation details may also be provided in the personal check-in area:

Master and communication data (e.g. first and last names, email address)
Address data (e.g. street, house number, postcode, city, country)
Booking or travel data (e.g. arrival and departure dates, booking number, room number)
Usage data (e.g. start, duration and end of use, feature used, language used, browser and operating system used)
Geolocation data (e.g. GPS position)

Not all of the data categories listed above are collected or requested every time the software is used. This depends on the individual settings we have configured and the services we use. As a rule, the software can be used without user registration.

Legal basis for data processing

Your personal data is generally processed for the performance of the accommodation contract. If we have received your email address in advance or already stored it from a previous stay, an additional legal basis for processing it is our legitimate interest in data processing. Our legitimate interest is to improve our service offering by simplifying procedures and digital communication.

We would like to use the personal data collected during online check-in to supplement your data in our hotel software for contract performance. Where available, the data may also be used to open your hotel room door via an app. The system checks whether you are authorised to request or use a service provided.

Where we are legally obliged to collect and store personal data (e.g. under registration law), we base processing on compliance with a legal obligation.

Purpose of data processing

By contacting you, we aim to provide you, as our guest, with information before your upcoming stay and give you the opportunity to check in and complete the electronic registration form in advance.

Categories of recipients

Guestline as the software provider and its subprocessors for, for example, hosting, SMS, email distribution and, where applicable, chatbot provision.
Other service providers we engage, e.g. hotel reservation systems, door systems, chatbots, operations & communication software, etc.
Payment service providers
Other external bodies where the data subject has given consent or disclosure is permissible on grounds of overriding interests.
Public bodies where legal obligations apply.

Where legally obliged, we reserve the right to disclose information about you if requested by lawfully acting authorities or law enforcement agencies. The legal basis is Article 6(1)(c) GDPR (legal obligation).

Retention period

The data is automatically erased after 15 months.

Right to object

As a recipient, you may object to the processing of your data at any time. We have set up the email address widerruf@classik-hotel-collection.com for this purpose.

Processing of foreign guests’ personal data during online check-in

To perform the accommodation contract and comply with legal obligations under the German Federal Registration Act, we need to collect and store the following personal data from you as a foreign guest when you check in at the hotel:

Arrival date and expected departure date (to plan and organise your stay and fulfil the requirements of the German Federal Registration Act)
Last and first names (for identification and contact purposes and to fulfil the requirements of the German Federal Registration Act)
Date of birth (to fulfil the requirements of the German Federal Registration Act)
Nationalities (to fulfil the requirements of the German Federal Registration Act)
Address (for identification, invoicing and, where applicable, contact purposes, and to fulfil the requirements of the German Federal Registration Act)
Identification data, unless you initiate a card-based payment transaction with Strong Customer Authentication (SCA), in which the purpose-specific reference number of the payment instrument used is collected. In this case, the purpose-specific reference number of the payment instrument is stored together with the data listed above.
Number of accompanying foreign guests and their nationality (to fulfil the requirements of the German Federal Registration Act)
Serial number of the recognised and valid passport or replacement passport document (identity document) (to fulfil the requirements of the German Federal Registration Act)
State law may provide for additional data to be collected on the registration form for the collection of tourism and spa taxes (to meet the requirements of tourism and spa authorities)

The information on the registration form is compared with your identity document. Any discrepancies are noted on the registration form. If you do not present an identity document, or present an invalid one, this is also noted on the registration form.

Personal data is processed when the software is used. This may include the following personal data:

Last name
Reservation number

Additional reservation details may also be provided in the personal check-in area:

Master and communication data (e.g. first and last names, email address)
Address data (e.g. street, house number, postcode, city, country)
Booking or travel data (e.g. arrival and departure dates, booking number, room number)
Registration form data (e.g. nationality, date of birth, passport number, digital signature)
Invoice data (e.g. billing address, prices, booked services (e.g. parking, gym)
Usage data (e.g. start, duration and end of use, feature used, language used, browser and operating system used)
Geolocation data (e.g. GPS position)

Legal basis for data processing

Where we are legally obliged to collect and store personal data (e.g. under registration law), we base processing on compliance with a legal obligation.

Purpose of data processing

By contacting you, we aim to provide you, as our guest, with information before your upcoming stay and give you the opportunity to check in and complete the electronic registration form in advance.

Categories of recipients

Guestline as the software provider and its subprocessors for, for example, hosting, SMS, email distribution and, where applicable, chatbot provision.
Other service providers we engage, e.g. hotel reservation systems, door systems, chatbots, operations & communication software, etc.
Payment service providers
Other external bodies where the data subject has given consent or disclosure is permissible on grounds of overriding interests.
Public bodies where legal obligations apply.

Retention period

The data is automatically erased after 15 months.

Right to object

As a recipient, you may object to the processing of your data at any time. We have set up the email address widerruf@classik-hotel-collection.com for this purpose.

Your stay at the hotel

During your stay at our hotel, we collect and process guest information in our hotel software. Data relating to the following groups of people may be stored: guests, business partners, companies, prospective and potential customers (e.g. when requesting offers).

The stored data may include: first and last names, date of birth, contact details (telephone, email address), address, nationality, company, identity card and passport details, service details, billing details, payment processing data (e.g. credit card details) and video recordings.

If you made your booking through a hotel portal, tour operator or travel agency, these providers forward your data to us to perform the contract concluded.

Purposes and legal basis of data processing

We use the personal data you provide exclusively to perform the agreed contractual services, namely the administration, care and hospitality of guests under the accommodation contract.

We store your data in our hotel software and in reservation, billing and payment applications. In addition to your personal details, this may include billing data for food and drinks, telephone calls made from your room and/or other hotel-specific services.

Under registration regulations (Sections 29 et seq. of the German Federal Registration Act), hotels must require guests without German citizenship to complete a registration form on site or online on the day of arrival. The data required is defined by law and cannot be determined by the hotel. State law may additionally provide for further data to be collected on the registration form for the collection of tourism and spa taxes (to meet the requirements of tourism and spa authorities). The information on the registration form is compared with your identity document. Any discrepancies are noted on the registration form. If you do not present an identity document, or present an invalid one, this is also noted on the registration form. In addition to the mandatory information, guests may provide further data voluntarily.

Where services are used, we generally collect only the data needed to provide them. Any additional data collected is voluntary. Personal data is processed exclusively to provide the requested services and to safeguard our own legitimate business interests under Article 6(1)(f) GDPR.

Data is used for the following purposes:

Registration on arrival and departure, including completion of the registration form
Issuing room cards for you and your accompanying guests
Providing requested services
Handling payment arrangements
Storing preferences for future hotel stays

Our guests’ contact details may be used for advertising purposes at a later date. Use of your email address requires your consent.

Data will only be processed for purposes other than those stated where such processing is permissible under Article 6(4) GDPR and compatible with the original purposes of the contractual relationship. We will inform you of such processing before it takes place.

Recipients to whom data may be disclosed:

Public bodies receiving data under statutory provisions (e.g. law enforcement authorities and other public authorities)
Internal departments involved in carrying out and completing the relevant business processes (e.g. administration, accounting, Sales & Marketing and IT organisation)
Affiliated hotels (master data in the PMS)
External contractors under Article 28 GDPR (service providers)
Other external bodies (e.g. credit institutions)

Erasure of data

Legislation provides for numerous retention obligations and periods. Once these periods expire, the relevant data and records are routinely erased if they are no longer required for contract performance. For example, commercial or financially relevant data for a completed financial year is erased after a further ten years in accordance with statutory provisions, unless longer retention periods are prescribed or necessary for legitimate reasons. Reservation documents may be destroyed after 6 years, and the registration form at the end of the quarter following the expiry of one year. Data not covered by these rules is erased without a request once the stated purposes no longer apply.

Video recordings are stored for one week.

Right to object

You may object to the processing of your data at any time. We have set up the email address widerruf@classik-hotel-collection.com for this purpose.

Online booking via the website

Our website offers the option of booking hotel rooms and packages. If a user takes up this option, the data entered in the form is transmitted to us and stored. This data comprises: first name, last name, email address, telephone number, address, number of accompanying guests, expected arrival time, requests, payment details (credit card), date and time.

When you make an online booking through our websites, this takes place via the online reservation system provided by Guestline GmbH, Agnes-Pockels-Bogen 1, 80992 München, Germany. All booking data you enter is transmitted in encrypted form. The service provider has undertaken to handle your transmitted data in accordance with data protection requirements. It takes all organisational and technical measures to protect your data.

No further disclosure of data to third parties takes place in this context. The data is used exclusively to process the booking and for communication.

Legal basis for data processing

The legal basis for processing the data is the conclusion of an accommodation contract with the user.

Purpose of data processing

We process the personal data entered in the form solely to handle the booking request and process payments.

Retention period

The data is erased once it is no longer necessary for the purpose for which it was collected. Where a contractual relationship exists, we erase the data received once national, commercial, statutory or contractual retention requirements have been fulfilled.

Right to object

You may object to the processing of your data at any time. We have set up the email address widerruf@classik-hotel-collection.com for this purpose. Please note that if you object, the booking cannot be completed or the conversation continued.

Online booking via other websites

We offer prospective guests the option of booking hotel rooms and packages through hotel reservation portals (third-party providers). If a user takes up this option, the data entered in the form is transmitted to us and stored to the extent permitted by the relevant hotel reservation portal under its own privacy policy. This data may include: first name, last name, email address, telephone number, address, number of accompanying guests, expected arrival time, requests and payment details (credit card).

The data provided is imported into our hotel software via a channel manager. All booking data received is transmitted in encrypted form. For this purpose, we use the channel manager provided by HotelNetSolutions GmbH, Genthiner Str. 8, 10785 Berlin, Germany. This provider has undertaken to handle the personal data transmitted in accordance with data protection requirements. It takes all organisational and technical measures to protect your data.

No further disclosure of data to third parties takes place in this context. The data is used exclusively to process the booking and, where applicable, for communication.

Legal basis for data processing

The legal basis for processing the data is the conclusion of an accommodation contract with the user.

Purpose of data processing

We process the personal data entered in the form solely to handle the booking request and process payments.

Retention period

We have no influence over retention periods at the relevant hotel reservation portal.

Right to object

Online reviews

Former guests may review our hotel after checking out. For this purpose, we would like to send you an email within 14 days of departure asking you to submit a hotel review. Any review may be published anonymously upon request. If you were not comfortable during your stay at our hotel, we would like the opportunity to contact you.

These emails are sent via our service provider TrustYou GmbH, Agnes-Pockels-Bogen 1, 80992 München, Germany. The service provider has undertaken to handle your transmitted data in accordance with data protection requirements. It takes all organisational and technical measures to protect your data.

If a former guest submits an online review, the data entered in the review form is stored. This comprises the email address and voluntary information such as first name, last name, language and the review details.

No further disclosure of data to third parties takes place in this context. The data is used exclusively to publish the review and resolve issues raised in negative reviews.

Legal basis for data processing

Otherwise, the legal basis for processing the data is our legitimate interest in data processing.

Purpose of data processing

The purpose of hotel reviews is to communicate and summarise hotel guests’ opinions through our website so that prospective guests can form their own impression of our services and facilities. The results also support our internal quality management.

Retention period

The data is not erased.

Right to object

You may request removal of a published review at any time (right to be forgotten). We have set up the email address widerruf@classik-hotel-collection.com for this purpose. Please tell us which review your request concerns.

Email contact

You can contact our employees using the email addresses provided. If you do so, the personal data transmitted with your email is stored in our email system.

Legal basis for data processing

The initial legal basis for processing the data is our legitimate interest in processing data when an enquirer contacts us. If the contact is intended to lead to a contract, processing within the contractual relationship provides an additional legal basis.

Purpose of data processing

Personal data is processed solely to handle the contact and conversation.

Retention period

The data is erased once it is no longer necessary for the purpose for which it was collected. For personal data sent by email, this is the case once the relevant conversation has ended. A conversation is deemed to have ended when the circumstances indicate that the matter concerned has been conclusively resolved.

Right to object

You may object to the processing of your data at any time. We have set up the email address widerruf@classik-hotel-collection.com for this purpose. Please note that if you object, the conversation cannot be continued and we cannot prepare offers, etc. In this case, all personal data stored in the course of the contact is erased.

Business customers

To support, advise and market to corporate customers, we collect and use the contact person’s details, telephone number and postal address in addition to the details of the business partner or potential business partner. We obtain this information from various sources, including enquiries (by email or telephone), events, trade fairs, business cards received by our sales staff, etc.

Purpose and legal basis for data processing

We use these contact details exclusively for our own purposes and to tailor our own sales activities to demand. The legal basis for processing is our legitimate interest in data processing. If contact is intended to lead to a contract, the pre-contractual or contractual relationship provides an additional legal basis. To improve our services, we manage all data received in the CRM module of our central hotel software. No disclosure of data to third parties takes place in this context.

Retention period

As a rule, no erasure period is specified. However, if our sales team has had no contact with a corporate contact within 3 years, the sales team decides whether to erase the corporate contact person’s details.

If the contact concerns a pre-contractual relationship (a request for an offer, booking or reservation), the transmitted data is also stored in our hotel software and used for contract performance. If no contractual relationship results, we erase the data at the end of the year following the expiry of one year.

Right to object

As a corporate contact, you may object to the processing of your data at any time. We have set up the email address widerruf@classik-hotel-collection.com for this purpose. In this case, all personal data about the contact person stored in connection with the business partner is erased.

Reactivation of existing customers

The processing described below takes place exclusively at Classik Hotel Magdeburg. Unlike the other sections of this privacy policy, the controller responsible for this processing is the operator of that hotel: CHM Investition GmbH & Co. KG, Bayenthalgürtel 26, 50968 Köln.

As part of reactivating existing customers, we process personal data relating to former or inactive business customers and their business contacts to resume previous business relationships and identify current requirements, for example for meeting rooms, rooms during trade fairs and event venues. Before making contact, we check contacts against a suppression/exclusion list to ensure that previous objections are respected. Contact is primarily by telephone, supplemented by email where appropriate. The results of conversations (interest status, requirements, contact history, follow-up reminders and objection/suppression flags) are recorded and maintained in a CRM/sales system. Only professional business data is processed in a B2B context; special categories of personal data and private contact details are not processed.

Categories of data concerned

The data processed comprises: title, first and last names, company, position/role, business contact details (in particular telephone number and email address) and business contact/requirements history.

Legal basis for data processing

The legal basis is our legitimate interest (Article 6(1)(f) GDPR) in maintaining and resuming existing business relationships that have become inactive; processing for direct marketing purposes is recognised as a legitimate interest under Recital 47 GDPR. Where processing serves to initiate or perform a contract, we additionally rely on Article 6(1)(b) GDPR. The permissibility of telephone contact in a business context is also governed by Section 7 of the German Act against Unfair Competition (UWG).

Purpose of data processing

The data is processed to approach and reactivate former or inactive business customers in a targeted way, identify and reach the current contact person or decision-maker, determine and qualify current requirements, document the results of renewed contact and prepare them for further handling, and manage and evaluate the reactivation and sales process.

Recipients to whom data may be disclosed

Internal departments involved in carrying out the activity (hotel management, sales).
An external service provider acting as a processor under Article 28 GDPR, which conducts telephone reactivation on our behalf and in accordance with our documented instructions: Merzenich Consulting GmbH & Co. KG. Data is stored/processed in the service provider’s data centre. No transfer to a third country (outside the EU/EEA) takes place.

Retention period

Business address and contact data from customer reactivation is stored for three years and then reviewed and erased unless statutory retention obligations or legitimate grounds require longer storage. If you object or processing is restricted (Article 18 GDPR), the address and contact data concerned is erased or blocked without delay; a corresponding suppression flag is maintained to prevent further contact.

Right to object

You have the right to object at any time to the processing of your data for direct marketing and the reactivation described here (Article 21 GDPR). After an objection, no further marketing contact takes place. We have set up the email address widerruf@classik-hotel-collection.com for your objection.

Video surveillance at the hotels

Video surveillance captures personal data in the form of images of employees, guests, visitors, suppliers, service providers and, where applicable, passers-by. Recording takes place exclusively in security-relevant hotel areas, such as entrances, corridors, building façades, storage areas and other areas that are difficult to oversee.

The cameras record images only, without sound. Public areas not belonging to the hotel are masked out. Live images can only be viewed by authorised personnel.

Data is accessed exclusively for the specified purposes by authorised persons or authorities, for example to investigate incidents or comply with legal obligations. Every access is logged (time, reason and name of the person accessing the data).

Purpose and legal basis of data processing

Video surveillance at the hotels serves the legitimate interests of the hotel operator as controller within the meaning of the GDPR. It is used to protect people, property and buildings against theft, damage and unauthorised entry. It also enables the investigation and preservation of evidence in security-related incidents, documentation of operational procedures, for example in goods receiving or loading areas, enforcement of the hotel’s right to control access to its premises and prevention of hazards. Video surveillance also supports the hotel in legal disputes and cooperation with law enforcement authorities.

Image data is processed on the basis of Article 6(1)(f) GDPR, as the hotel has a legitimate interest in ensuring security, order and protection throughout the hotel complex. Where recordings must be stored or disclosed to comply with legal obligations, in particular duties to ensure safety or disclosure to law enforcement authorities, processing is additionally based on Article 6(1)(c) GDPR.

According to the case law of the Court of Justice of the European Union (CJEU), wearing glasses may be regarded as an indication of a health condition and may therefore fall within the special categories of personal data under Article 9(1) GDPR. Where such sensitive data is incidentally captured by video surveillance, for example images of people wearing glasses or using walking aids or other medical aids, it is processed only where necessary for the establishment, exercise or defence of legal claims under Article 9(2)(f) GDPR.

Retention period

As a rule, video surveillance recordings are stored for one week and then automatically erased, provided no security-related incident has been identified. In exceptional cases, such as increased security requirements, for example during events with higher attendance, the retention period may be extended.

If a security-related incident occurs or legal obligations require evidence to be preserved, the relevant recordings are secured separately and may be stored for up to one month. Once the applicable period expires, the data is permanently erased or overwritten. Longer storage takes place only where required by law or necessary for the establishment, exercise or defence of legal claims.

Your application for an advertised position

You can apply for advertised positions through online portals such as HotelCareer or directly. If you apply using these options, the data transmitted to us may be processed electronically. This data includes: first name, last name, contact details (email address, telephone number), cover letter and file attachment containing the detailed application.

Initially, no further disclosure of data to third parties takes place in this context. However, if an applicant fits the profile of another vacancy advertised by an affiliated company, we would be happy to forward the application documents. We will obtain the applicant’s consent beforehand. Otherwise, the data is used exclusively by the relevant department to process the application and for communication.

Purpose and legal basis for data processing

The data transmitted to us is used exclusively by the relevant department to process the application and for communication. The legal basis for processing is the pre-contractual relationship or the conclusion of a contract. We will obtain consent before forwarding application documents.

Retention period

The data is erased once it is no longer necessary for the purpose for which it was collected, and no later than 6 months after rejection. Where a contractual relationship exists, we erase the data received once national, commercial, statutory or contractual retention requirements have been fulfilled.

Right to object

You may object to the processing of your data at any time. To do so, please email the office to which you sent your application (the recruiting office).

Data processing outside the European Union

Where personal data is processed outside the European Union, this is indicated in the preceding explanations.

German Whistleblower Protection Act (HinSchG) – provisions protecting whistleblowers

The German Whistleblower Protection Act provides comprehensive protection against disadvantages resulting from reporting or disclosing breaches to the bodies responsible for receiving such reports. We have set up an online reporting form at https://hinweisgeber-lotse.de/ for this purpose. Further information on data protection is available at that link.

Protection of minors

This service is primarily aimed at adults. We do not currently market any specific areas for children. Consequently, we do not knowingly collect information to determine age or knowingly collect personal data from children under 16. However, we ask all visitors to our website under the age of 16 not to disclose or provide personal data through our service. If we discover that a child under 16 has provided us with personal data, we will erase the child’s personal data from our files insofar as technically possible.

What rights do you have?

If your personal data is processed, you are a data subject within the meaning of the GDPR and have the following rights against the controller:

You have a right of access to the personal data stored about you, the purposes of processing, any transfers to other bodies and the retention period.

If data is inaccurate or no longer necessary for the purposes for which it was collected, you may request rectification, erasure or restriction of processing. Where the processing procedures allow it, you may also view your data yourself and correct it where necessary.

If grounds arising from your particular personal situation weigh against processing your personal data, you may object where the processing is based on a legitimate interest. The controller will no longer process your personal data unless it can demonstrate compelling legitimate grounds for processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Where your personal data is processed for direct marketing, you have the right to object at any time to the processing of your personal data for such marketing; this also applies to profiling insofar as it is related to such direct marketing. If you object to processing for direct marketing or profiling purposes, your personal data will no longer be processed for those purposes.

You have the right to withdraw your consent to data processing at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

If you have any questions about your rights or how to exercise them, please contact management or the Data Protection Officer.

Your right to lodge a complaint with a supervisory authority

As a data subject, without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your residence or the place of the alleged infringement, if you consider that the processing of your personal data infringes data protection requirements.

The supervisory authority with which the complaint is lodged will inform you of its progress and outcome, including the possibility of a judicial remedy.

Further information is available on the website of the German Federal Commissioner for Data Protection and Freedom of Information. Please follow this link: https://www.bfdi.bund.de/DE/Service/Kontakt/Beschwerdeformular/Info_OnlineBeschwerde.html.

Security

We use technical and organisational security measures under Article 32 GDPR to protect the data we manage against accidental or intentional manipulation, loss, destruction or access by unauthorised persons. Our security measures are continually improved in line with technological developments. Access is limited to a small number of authorised persons bound by specific data protection obligations who are responsible for the technical, administrative or editorial management of data.

For security reasons and to protect the transmission of confidential content you send to us as the website operator, our website uses SSL or TLS encryption. This prevents third parties from reading the data you transmit via this website. You can recognise an encrypted connection by https:// in your browser’s address bar and the padlock symbol in the browser bar.

How is your data processed on the website in detail?

Below, we explain the individual processing activities, the scope and purpose of data processing, the legal basis, the obligation to provide your data and the applicable retention period. No automated individual decision-making, including profiling, takes place.

Provision of the website

When you access and use our website, we collect the personal data that your browser automatically transmits to our server. The following information is temporarily stored in a log file:

IP address of the requesting computer
Date and time of access
Name and URL of the file accessed
Website from which access originates (referrer URL)
Browser used and, where applicable, your computer’s operating system and the name of your internet access provider

We do not host our website ourselves; it is hosted by a service provider that processes the data listed above on our behalf for this purpose under Article 28 GDPR.

Purpose and legal basis

Processing serves our overriding legitimate interest in displaying our website and ensuring its security and stability, on the basis of Article 6(1)(f) GDPR. Collecting the data and storing it in log files is essential for operating the website. There is no right to object to processing because of the exception under Article 21(1) GDPR. Where further retention of log files is required by law, processing is based on Article 6(1)(c) GDPR. There is no statutory or contractual obligation to provide the data; however, accessing our website is technically impossible without providing it.

Retention period

The data listed above is stored for the duration of the website display and, for technical reasons, for a maximum of 7 days thereafter.

Web hosting provider

Our website is hosted by the following provider: HOSTINGER operations, UAB, Švitrigailos str. 34, Vilnius 03230, Lithuania. No data transfer outside the EU/EEA takes place.

Consent management

We use the Consentmanager consent management platform to obtain and manage your consent to the use of cookies and similar technologies. The provider is Consentmanager AB, Haltegelvägen 1b, 72348 Vasteras, Sweden. When you access our website, your consent decision and technical information (e.g. IP address, time and browser data) are processed and stored so that your choice can be respected on future visits and we can fulfil our obligation to demonstrate consent.

Purpose and legal basis

Processing is technically necessary to store and demonstrate your consent decision. The legal basis is our legitimate interest in legally compliant consent management under Article 6(1)(f) GDPR in conjunction with the legal obligation under Article 7(1) GDPR. Storing consent information is permissible without consent under Section 25(2), No. 2 TDDDG because it is strictly necessary for the function you request.

Retention period

Consent data is stored until you request its erasure or the purpose of storage no longer applies; otherwise, the data is erased once statutory obligations to provide evidence expire. Further information is available in Consentmanager’s privacy policy: https://www.consentmanager.de/datenschutz/.

Do we use cookies?

Cookies are small text files that we send to your device’s browser during your visit to our websites and that are stored there. As an alternative to cookies, information may also be stored in your browser’s local storage. Some website functions cannot be provided without cookies or local storage (technically necessary cookies). Other cookies enable various analyses, allowing us, for example, to recognise the browser you use when you return to our website and transmit various information to us (non-essential cookies). Cookies help us make our online services more user-friendly and effective, for example by understanding how you use our website and identifying your preferred settings (such as country and language settings). Where third parties process information using cookies, they collect it directly through your browser. Cookies do not damage your device. They cannot run programs or contain viruses.

We describe the services for which we use cookies under the individual processing activities. Detailed information about the cookies used can be found in the cookie settings or consent manager.

Contact form

Our website offers a form you can use to contact us. Information collected through mandatory fields is necessary to handle your enquiry. If you use this option, the data entered in the form is transmitted to us and stored. This comprises: first and last names, company, email address, telephone number, selected hotel and the nature of your enquiry. You may also voluntarily provide further information you consider necessary for handling your enquiry.

Your personal data is not disclosed to third parties when you use the contact form.

Purpose and legal basis

Data provided through our contact form is processed for communication and handling your enquiry on the basis of your consent under Article 6(1)(a) GDPR. If your enquiry relates to an existing contractual relationship with us, processing serves contract performance on the basis of Article 6(1)(b) GDPR. There is no statutory or contractual obligation to provide your data, but your enquiry cannot be handled without the information in the mandatory fields. If you do not wish to provide this data, please contact us by other means.

Retention period

If you use the contact form on the basis of consent, we store the data collected for each enquiry for three years from completion of your enquiry or until you withdraw your consent.

If you use the contact form within a contractual relationship, we store the data collected for each enquiry for the statutory retention periods, in particular under Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO).

Right to object

You may object to the processing of your data at any time. We have set up the following email address for this purpose: widerruf@classik-hotel-collection.com. Please note that if you object, the conversation cannot be continued and we cannot prepare offers, etc. In this case, all personal data stored in the course of the contact is erased.

Presence on social media platforms

We maintain fan pages, accounts or channels on the networks listed below to provide information and offers within social networks and give you additional ways to contact us and learn about our services. Below, we explain what data we and the respective social network process about you when you access and use our fan pages/accounts.

Data we process about you

If you contact us through Messenger or direct message on the relevant social network, we generally process the username you use to contact us and may store further data you provide where necessary to handle or answer your enquiry.

The legal basis is Article 6(1), first sentence, point (f) GDPR.

(Static) usage data we receive from social networks

Insights functions provide us with automatically generated statistics about our accounts. These include total page views, likes, information on page activity and post interactions, reach, video views and information on the proportion of men and women among our fans/followers.

The statistics contain only aggregated data that cannot be linked to individual people. We cannot identify you from this data.

What data social networks process about you

You do not need to be a member of the relevant social network to view the content of our fan pages or accounts, and no user account with that social network is required for this purpose.

Please note, however, that when the relevant social network is accessed, social networks also collect and store data about website visitors without user accounts (e.g. technical data needed to display the website) and use cookies and similar technologies, over which we have no influence. Details are available in the privacy policy of the relevant social network (see the corresponding links above).

If you wish to interact with content on our fan pages/accounts, for example by commenting on, sharing or liking our posts, and/or contact us through messaging functions, you must first register with the relevant social network and provide personal data.

We have no influence over data processing by social networks when you use them. To our knowledge, your data is stored and processed in particular in connection with providing the services of the relevant social network and analysing usage behaviour (using cookies, pixels/web beacons and similar technologies), on the basis of which interest-based advertising is displayed both within and outside the relevant social network. We cannot rule out social networks also storing your data outside the EU/EEA and disclosing it to third parties.

Information about the precise scope and purposes of processing your personal data, retention/erasure and guidelines on the use of cookies and similar technologies during registration and use of social networks is available in the social networks’ privacy policies/cookie policies. These also contain information about your rights and options to object.

Facebook

When you visit our Facebook page, Facebook (Meta) collects your IP address and other information stored on your PC in cookies, among other things. This information is used to provide us, as the operator of the Facebook pages, with statistical information about use of the Facebook page. Facebook provides further information at: https://facebook.com/help/pages/insights.

The statistical information provided does not allow us to draw conclusions about individual users. We use it solely to respond to our users’ interests, continually improve our online presence and ensure its quality.

We collect your data through our fan page solely to enable communication and interaction with us. This generally includes your name, message content, comment content and the profile information you make publicly available.

Your personal data is processed for the purposes stated above on the basis of our legitimate business and communication interest in offering an information and communication channel under Article 6(1)(f) GDPR. If you, as a user, have given the relevant social network provider consent to data processing, Articles 6(1)(a) and 7 GDPR also provide the legal basis for processing.

Because the actual data processing is performed by the social network provider, our access to your data is limited. Only the social network provider is authorised to have full access to your data. Consequently, only that provider can directly take and implement appropriate measures to fulfil your user rights (requests for access, erasure, objections, etc.). It is therefore most effective to exercise these rights directly with the relevant provider.

We are jointly responsible with Facebook for the personal content of the fan page. Data subject rights may be exercised with Meta Platforms Ireland Limited or with us.

Under the GDPR, Facebook has primary responsibility for processing Insights data and fulfils all GDPR obligations regarding the processing of Insights data. Meta Platforms Ireland Limited makes the essence of the Page Insights Addendum available to data subjects.

We do not make decisions about the processing of Insights data or the storage period of cookies on users’ devices.

Further information is available directly from Facebook (supplementary agreement with Facebook): https://www.facebook.com/legal/terms/page_controller_addendum.

Further information on the precise scope and purposes of processing your personal data, retention/erasure and guidelines on the use of cookies and similar technologies during registration and use is available in Facebook’s privacy policy/cookie policy:
https://www.facebook.com/privacy/policy/?entry_point=data_policy_redirect&entry=0
https://www.facebook.com/policies/cookies

Instagram

When you visit our Instagram page, Instagram collects your IP address and other information stored on your PC in cookies, among other things. This information is used to provide us, as the operator of the Instagram pages, with statistical information about use of the Instagram page. Instagram provides further information at: https://facebook.com/help/pages/insights.

We are jointly responsible with Instagram for the personal content of the fan page. Data subject rights may be exercised with Meta Platforms Ireland Limited or with us.

Under the GDPR, Instagram has primary responsibility for processing Insights data and fulfils all GDPR obligations regarding the processing of Insights data. Meta Platforms Ireland Limited makes the essence of the Page Insights Addendum available to data subjects.

We do not make decisions about the processing of Insights data or any further information required under Article 13 GDPR, including the legal basis, identity of the controller and storage period of cookies on users’ devices.

Further information is available directly from Instagram (supplementary agreement with Facebook): https://www.facebook.com/legal/terms/page_controller_addendum.

LinkedIn is a social network operated by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (parent company: LinkedIn Corporation, Sunnyvale, California, USA), which enables the creation of private and professional profiles for individuals and company profiles. Users can maintain existing contacts and make new ones within the social network. Companies and other organisations can create profiles where photos and other company information are uploaded to present themselves as employers and recruit staff. Other LinkedIn users can access this information, write their own articles and share this content with others. The network focuses on professional exchange about specialist topics with people who share the same professional interests.

When the network is used or visited, LinkedIn automatically collects data from users or visitors, such as username, job title and IP address. It does so using various tracking technologies. LinkedIn uses the data collected in this way, among other things, to provide users with information, offers and recommendations.

We collect your data through our company profile solely to enable communication and interaction with us. This generally includes your name, message content, comment content and the profile information you make publicly available.

We are jointly responsible with LinkedIn for the personal content of our company profile. Data subject rights may be exercised with LinkedIn Ireland Unlimited Company or with us.

We do not make decisions about data collected on LinkedIn’s website using tracking technologies.

Further information about LinkedIn is available at: https://about.linkedin.com.

Further information on data protection at LinkedIn is available at: https://www.linkedin.com/legal/privacy-policy.

Further information on retention/erasure and guidelines on the use of cookies and similar technologies during registration and use of LinkedIn is available at: https://de.linkedin.com/legal/cookie-policy?trk=homepage-basic_footer-cookie-policy.

Use of analytics, advertising and tracking tools and other services on our website

To make our website as pleasant and convenient as possible for you, we use selected services from external providers. Below, you can find information about the data protection policies governing the services and functions used, so that you can also exercise your rights with these providers where appropriate.

Google Maps

We use the Google Maps mapping service to provide directions. Google Maps is a service provided by Google Ireland Limited that displays a map on our website.

When you access this content on our website, you establish a connection to servers of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, transmitting your IP address and, where applicable, browser data such as your user agent. This data is processed exclusively for the purposes stated above and to maintain the security and functionality of Google Maps.

Purpose and legal basis

The purpose is to display maps and directions. Google Maps is used on the basis of your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. Your consent is voluntary and may be withdrawn at any time with effect for the future, for example through the cookie settings.

Transfers to third countries

When the service is used, personal data is transferred to third countries outside the European Economic Area, in particular the USA. Data is transferred to the USA under Article 45(1) GDPR on the basis of the European Commission’s adequacy decision. The US companies involved and/or their US subcontractors are certified under the EU-U.S. Data Privacy Framework (EU-U.S. DPF).

Where no European Commission adequacy decision exists (including for US companies not certified under the EU-U.S. DPF), we have agreed other appropriate safeguards with data recipients within the meaning of Articles 44 et seq. GDPR. Unless stated otherwise, these are the European Commission’s Standard Contractual Clauses under Implementing Decision (EU) 2021/914 of 4 June 2021. A copy of these Standard Contractual Clauses can be viewed at https://eur-lex.europa.eu/legal-content/DE/TXT/HTML/?uri=CELEX:32021D0914&from=DE.

Please note that transfers to third countries may involve risks that are unknown in detail (e.g. data processing by security authorities in the third country, the precise scope and consequences of which we do not know, over which we have no influence and of which you may not become aware).

Retention period

We have no influence over the specific retention period of the processed data; this is determined by Google Ireland Limited. Further information is available in the privacy policy for Google Maps: https://policies.google.com/privacy.

Bidr (Beeswax Inc.)

We have integrated Bidr into our website. The provider is Beeswax Inc., New York City, USA (EU representative: Comcast International France SAS). Bidr displays targeted advertising to users and uses cookies and other browser technologies to analyse user behaviour and recognise returning users. Pseudonymised user profiles are created (including for advertising segmentation); in particular, your IP address and other identifiers such as your user agent are transmitted to the provider.

Purpose and legal basis

The purpose is to deliver and optimise interest-based advertising (programmatic advertising). Bidr is used on the basis of your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. Your consent is voluntary and may be withdrawn at any time.

Transfers to third countries

Retention period

We have no influence over the specific retention period of the processed data; this is determined by Bidr. Further information is available in Bidr’s privacy policy: https://beeswax.com/privacy.

Dialogshift

We use Dialogshift on our website, a service provided by DialogShift GmbH, Rheinsberger Straße 76/77, 10115 Berlin, Germany. As a digital assistant (chatbot), Dialogshift enables automated communication. If you use the chatbot, your IP address, the content you enter and, where applicable, browser data such as your user agent are processed.

Purpose and legal basis

The purpose is to provide the chat function and answer your enquiries. Use is based on your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. You may withdraw your consent at any time with effect for the future through the consent manager.

Retention period

We have no influence over the specific retention period of the processed data; this is determined by DialogShift GmbH. Further information is available in Dialogshift’s privacy policy: https://www.dialogshift.com/datenschutz.

Google Ads (including remarketing)

We have integrated Google Ads, including its remarketing function, into our website. Google Ads is a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Ads uses cookies and other browser technologies (including through the domain doubleclick.net) to analyse user behaviour, recognise returning users, measure advertising effectiveness (conversion tracking) and display interest-based advertising on other websites (remarketing, ga-audiences). In particular, your IP address, browser and device details (user agent) and the websites you visit are transmitted to the provider.

Purpose and legal basis

The purpose is marketing (targeted online advertising, remarketing and performance and conversion measurement). Google Ads is used on the basis of your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. Your consent is voluntary and may be withdrawn at any time.

Transfers to third countries

Retention period

Google Analytics

Our website uses Google Analytics 4, a web analytics service provided by Google LLC. The controller for users in the EU/EEA and Switzerland is Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (Google).

Google Analytics uses cookies that enable analysis of your use of our websites. Information generated by cookies about your use of this website is generally transferred to a Google server in the USA and stored there.

We use the User-ID function. User-ID allows us to assign a unique, persistent ID to one or more sessions (and the activities within those sessions) and analyse user behaviour across devices.

We also use Google signals. This allows Google Analytics to collect additional information about users who have enabled personalised ads (interests and demographic data), and ads can be delivered to these users in cross-device remarketing campaigns.

IP address anonymisation is enabled by default in Google Analytics 4. As a result, Google truncates your IP address within Member States of the European Union or other states party to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transferred to a Google server in the USA and truncated there. According to Google, the IP address transmitted by your browser through Google Analytics is not combined with other Google data.

During your website visit, your behaviour is recorded in the form of events. Events may include:

Page views
First visit to the website
Session start
Your click path and interactions with the website
Scrolls (whenever a user scrolls to the bottom of the page (90%))
Clicks on external links
Internal searches
Interactions with videos
File downloads
Ads viewed/clicked
Language setting

The following is also recorded:

Your approximate location (region)
Your IP address (in truncated form)
Technical information about your browser and the devices you use (e.g. language setting, screen resolution)
Your internet service provider
The referrer URL (the website or advertising through which you reached this website)

Purpose and legal basis

The purpose is to evaluate website usage and create reports to analyse website performance. Use is based on your consent under Article 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG, which you provide through the consent manager and may withdraw at any time with effect for the future (Article 7(3) GDPR).

Recipients

Recipients of the data are/may be

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (as a processor under Article 28 GDPR)
Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
Alphabet Inc., 1600 Amphitheatre Parkway Mountain View, CA 94043, USA

We cannot rule out US authorities accessing data stored by Google.

Transfers to third countries

Retention period

Data we send that is linked to cookies is automatically erased after 14 months. Data whose retention period has expired is automatically erased once a month.

Withdrawal of consent

You can also prevent cookies from being stored from the outset by adjusting your browser settings. However, configuring your browser to reject all cookies may limit functionality on this and other websites. You can also prevent the transmission to Google of data generated by the cookie relating to your use of the website (including your IP address) and Google’s processing of this data by (I) not consenting to the cookie being set or (II) downloading and installing the Google Analytics opt-out browser add-on here: https://tools.google.com/dlpage/gaoptout?hl=de.

Further information is available in Google’s Terms of Service at https://marketingplatform.google.com/about/analytics/terms/de/ and privacy policy at https://policies.google.com/?hl=de.

Google Fonts

We use Google Fonts provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to display fonts consistently. As a rule, fonts are served locally from our own servers in Germany; your IP address is transmitted to our server, and no transfer to Google takes place in this case.

Purpose and legal basis

The purpose is a consistent and optimised presentation of our online services. Where fonts are served locally from our own servers, processing is based on our legitimate interest under Article 6(1)(f) GDPR; no consent is required. If fonts are instead loaded from Google Ireland Limited’s servers, this takes place on the basis of your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG; in this case, your IP address is transmitted to Google.

Transfers to third countries

Where fonts are served locally, no transfer to a third country takes place. If, exceptionally, fonts are loaded from Google Ireland Limited’s servers, a transfer to the USA may take place; this is covered by the adequacy decision (EU-U.S. Data Privacy Framework) under Article 45(1) GDPR or, otherwise, by Standard Contractual Clauses under Implementing Decision (EU) 2021/914.

Retention period

The specific retention period is determined by Google Ireland Limited. Further information is available in Google’s privacy policy: https://policies.google.com/privacy

Google Tag Manager

We use Google Tag Manager provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to manage website tags through a single interface and control the integration of services. Technical data (including IP address) may be transmitted to Google in this process.

Purpose and legal basis

The purpose is the technical management and control of the tags/services used on our website. Use is based on your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. Your consent is voluntary and may be withdrawn at any time.

Transfers to third countries

Retention period

Google AdSense

We have integrated Google AdSense provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, into our website to display advertisements. Google AdSense uses cookies and similar technologies (including the IDE cookie through the domain doubleclick.net) to deliver interest-based advertising and measure its effectiveness. Your IP address and other identifiers are transmitted in this process.

Purpose and legal basis

The purpose is the delivery and performance measurement of interest-based advertising. Google AdSense is used on the basis of your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. Your consent is voluntary and may be withdrawn at any time.

Transfers to third countries

Retention period

The specific retention period of the processed data is determined by Google Ireland Limited. Further information is available in Google’s privacy policy: https://policies.google.com/privacy.

Friendly Captcha

We have integrated Friendly Captcha components into our website. Friendly Captcha is a service provided by Friendly Captcha GmbH, Am Anger 3–5, 82237 Wörthsee, Germany. The service allows us to distinguish whether a request, for example through our contact form, comes from a natural person or is sent automatically by a program (bot).

When you use an area of our website protected by Friendly Captcha (e.g. our contact form), your device establishes a connection to Friendly Captcha GmbH’s servers. Your IP address is transmitted in this process. Your browser also transmits connection data, environment data, interaction data and functional data to Friendly Captcha. Your browser receives a computational task (a cryptographic puzzle based on a proof-of-work mechanism). This is solved fully automatically in the background as soon as you start filling in the form. The complexity of the task depends on various risk factors. Friendly Captcha evaluates this data and determines how likely it is that the user is a human or a bot.

Purpose and legal basis

Friendly Captcha is used on the basis of your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. You provide consent through the consent manager (cookie banner). You may withdraw it there at any time with effect for the future (Article 7(3) GDPR).

Transfers to third countries

No international data transfer takes place when the service is used. All data remains in the European Union (EU). The provider uses only EU subprocessors.

Retention period

We have no influence over the specific retention period of the processed data; this is determined by Friendly Captcha GmbH. IP addresses are anonymised using a one-way hash function before being stored in Friendly Captcha’s database. Further information is available in Friendly Captcha’s privacy policy for end users: https://friendlycaptcha.com/de/legal/privacy-end-users/ and at https://friendlycaptcha.com/de/privacy/gdpr/.

Microsoft Advertising (Bing Ads)

We do not integrate Microsoft Advertising (formerly Bing Ads) into our website independently; it is used for ad delivery through our service provider Sojern (see the Sojern section). Microsoft Advertising is a service provided by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. Microsoft Advertising is used to measure the effectiveness of our advertising activities (conversion tracking).

Microsoft Advertising uses cookies and other browser technologies to analyse user behaviour and recognise returning users. In particular, the following data may be transmitted to the provider: your IP address, browser and device details (user agent), the website visited, your click path, ad clicks and conversion data, timestamps, language and time zone.

Purpose and legal basis

The purpose of processing is marketing (targeted online advertising including performance and conversion measurement). Microsoft Advertising is used on the basis of your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. Your consent is voluntary and may be withdrawn at any time with effect for the future, for example through the cookie settings on our website.

Transfers to third countries

Retention period

We have no influence over the specific retention period of the processed data; this is determined by Microsoft Corporation. Further information is available in Microsoft’s privacy statement at https://privacy.microsoft.com/de-de/privacystatement.

Microsoft Clarity

We have integrated Microsoft Clarity into our website. Microsoft Clarity is a service provided by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. We use Microsoft Clarity as an analytics tool to evaluate user behaviour, in particular through session recordings and heatmaps (click, scroll and area maps), to understand use of our website and improve our offering.

Microsoft Clarity uses cookies and other browser technologies to analyse user behaviour and recognise returning users. In particular, the following data may be transmitted to the provider: your IP address, browser and device details (user agent), the website visited, your click path, mouse movements and clicks, timestamps, language and time zone. According to Microsoft, data processed through Clarity may be used by Microsoft for its own purposes in accordance with Microsoft’s privacy statement, including improving and providing Microsoft Advertising.

Purpose and legal basis

The purpose of processing is to analyse usage behaviour (analytics) to optimise our website. Microsoft Clarity is used on the basis of your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. Your consent is voluntary and may be withdrawn at any time with effect for the future, for example through the cookie settings on our website.

Transfers to third countries

Retention period

The Trade Desk

We do not integrate The Trade Desk into our website independently; it is used for ad delivery through our service provider Sojern (see the Sojern section). The Trade Desk is a demand-side platform (DSP) for programmatic advertising. The contracting entity responsible for the EEA, the United Kingdom and Switzerland is The UK Trade Desk Limited, 1 Bartholomew Close, 10th Floor, London EC1A 7BL, United Kingdom. The Trade Desk is used to deliver and optimise advertising across channels, reach target audiences and measure the success of advertising activities.

The Trade Desk uses cookies and other browser technologies to analyse user behaviour and recognise returning users. In particular, the following data may be transmitted to the provider: pseudonymous identifiers (e.g. cookie and device IDs, mobile advertising IDs and identifiers derived from email addresses or telephone numbers), your IP address, browser and device details (user agent), the website visited and ad impressions displayed, inferred interests, location data, timestamps, language and time zone. Data may also be matched and combined with offline data.

Purpose and legal basis

The purpose of processing is marketing (targeted programmatic online advertising including performance measurement). The Trade Desk is used on the basis of your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. Your consent is voluntary and may be withdrawn at any time with effect for the future, for example through the cookie settings on our website. You may also opt out of interest-based advertising at https://www.thetradedesk.com/us/privacy and through the industry services https://www.youronlinechoices.eu and https://optout.aboutads.info.

Transfers to third countries

Retention period

According to the provider, data is stored for up to 18 months and then retained in de-identified or aggregated form for up to three additional years; interest group data is stored for seven days. Further information is available in The Trade Desk’s privacy policy at https://www.thetradedesk.com/us/privacy.

Xandr

We do not integrate Xandr (formerly AppNexus) into our website independently; it is used for ad delivery through our service provider Sojern (see the Sojern section). Xandr is a technology platform for programmatic advertising and operates a marketplace for buying advertising inventory in real time (real-time bidding). The provider is Xandr, Inc. (formerly AppNexus), 1 Rockefeller Plaza, New York, NY 10020, USA; Xandr is part of the Microsoft group. Xandr is used to deliver and optimise advertising and measure its visibility and success.

Xandr uses cookies and other browser technologies to analyse user behaviour and recognise returning users. In particular, the following data may be transmitted to the provider: your IP address, browser and device details (user agent), the website visited, ad clicks, location data, your browsing behaviour, timestamps, language and time zone.

Purpose and legal basis

The purpose of processing is marketing (targeted programmatic online advertising including performance measurement). Xandr is used on the basis of your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. Your consent is voluntary and may be withdrawn at any time with effect for the future, for example through the cookie settings on our website.

Transfers to third countries

Retention period

We have no influence over the specific retention period of the processed data; this is determined by the provider. Further information is available in Xandr’s privacy policy at https://about.ads.microsoft.com/solutions/xandr/platform-privacy-policy.

LinkedIn Ads

We have integrated LinkedIn Ads, a service for displaying targeted advertising. The provider for users in the EEA is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (parent company: LinkedIn Corporation, USA). LinkedIn Ads uses cookies and other browser technologies and creates pseudonymised user profiles; in particular, your IP address and other identifiers such as your user agent are transmitted.

Web tracking technologies are used to create pseudonymised user profiles. These profiles cannot be linked to you as a natural person but serve, for example, to segment audiences when displaying advertisements.

Purpose and legal basis

The purpose is to deliver and optimise interest-based advertising. Use is based on your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. Your consent is voluntary and may be withdrawn at any time.

Transfers to third countries

Retention period

We have no influence over the specific retention period of the processed data; this is determined by LinkedIn Ireland Unlimited Company. Further information is available in the privacy policy for LinkedIn Ads: https://www.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy.

LinkedIn Insight Tag

We use the LinkedIn Insight Tag to create target audiences, segment visitor groups, determine and optimise conversion rates and carry out retargeting. The provider for users in the EEA is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (parent company: LinkedIn Corporation, USA). Data collected includes the URL, referrer URL, IP address, device and browser characteristics (user agent) and timestamps.

Purpose and legal basis

The purpose is reach and conversion analysis and the optimisation of advertising activities. Use is based on your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. Your consent is voluntary and may be withdrawn at any time.

Transfers to third countries

Retention period

We have no influence over the specific retention period of the processed data; this is determined by LinkedIn Ireland Unlimited Company. Further information is available in the privacy policy for LinkedIn Insight Tag: https://www.linkedin.com/legal/privacy-policy.

Sojern

We have integrated Sojern into our website. Sojern is a service provided by Sojern, Inc., 545 Market Street, Floor 4, San Francisco, CA 94105, USA (its EU representative is Sojern International Limited, 34–37 Clarendon Street, Dublin 2, Ireland). We use Sojern as a travel marketing platform to reach users planning to travel online, deliver and optimise advertising across different channels and devices, and measure the success of these advertising activities.

To deliver and optimise advertising and measure performance, Sojern integrates other advertising platforms as partners, in particular Microsoft Advertising, The Trade Desk and Xandr; further details on these partners are provided in the relevant sections.

Sojern uses cookies and web storage technologies (local storage and session storage) to recognise returning users and display advertising tailored to their interests. This information is used to measure ad visibility and compile reports on advertising activities.

In particular, the following data may be transmitted to the provider: your IP address, browser and device details (user agent), websites visited, browsing behaviour, timestamps, language and time zone. Data may also be processed by matching it with offline data.

Purpose and legal basis

The purpose of processing is marketing (travel-related targeted online advertising including performance measurement). Sojern is used on the basis of your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. Your consent is voluntary and may be withdrawn at any time with effect for the future, for example through the cookie settings on our website. You may also opt out of Sojern’s interest-based advertising through the Sojern Privacy Center (https://www.sojern.com/privacy/opt-out-data); Sojern is a member of the European Interactive Digital Advertising Alliance (EDAA).

Transfers to third countries

Retention period

We have no influence over the specific retention period of the processed data; this is determined by Sojern, Inc. Further information is available in Sojern’s privacy policy at https://www.sojern.com/privacy/privacy-policy and information on cookies and opting out at https://www.sojern.com/privacy/online-tracking.

Triptease

We use Triptease, a service provided by Triptease Limited, Devonshire House, 60 Goswell Road, London EC1M 7AD, United Kingdom, to analyse user behaviour. A limited portion of your information (e.g. room searches, email address and name, if you provide them) and usage data may be processed through cookies and similar technologies.

Purpose and legal basis

The purpose is to analyse user behaviour to improve our offering. Use is based on your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. Your consent is voluntary and may be withdrawn at any time.

Transfers to third countries

Triptease Limited is based in the United Kingdom. The European Commission has issued an adequacy decision for the United Kingdom under Article 45 GDPR; transfers covered by that decision are permissible without additional safeguards. Where processing also takes place in a third country without an adequacy decision, we rely on Standard Contractual Clauses under Implementing Decision (EU) 2021/914.

Retention period

We have no influence over the specific retention period of the processed data; this is determined by Triptease Limited. Further information is available in Triptease’s privacy policy: https://triptease.com/en/privacy-policy/.

Vimeo Video

We have integrated Vimeo videos. Vimeo is a component of the video platform operated by Vimeo, LLC, 555 W 18th St, New York, New York 10011, USA. Vimeo uses cookies and other browser technologies; when content is accessed, your IP address and, where applicable, browser data (user agent) are transmitted. Video content is loaded only after you have given consent.

Purpose and legal basis

The purpose is the integration and playback of video content. Use is based on your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. Your consent is voluntary and may be withdrawn at any time.

Transfers to third countries

Retention period

We have no influence over the specific retention period of the processed data; this is determined by Vimeo, LLC. Further information is available in the privacy policy for Vimeo Video: https://vimeo.com/privacy.

Cloudflare

We use services provided by Cloudflare Germany GmbH, Rosental 7, c/o Mindspace, 80331 München (parent company: Cloudflare, Inc., USA), in particular to protect against abusive access and automated requests (bots, including Cloudflare Turnstile) and ensure the security and availability of our website. Your IP address and technical information about your browser are processed in this context.

Purpose and legal basis

The purpose is the security and proper provision of our website and protection against bot/spam attacks. Where Cloudflare serves security and provision, its use is based on our legitimate interest under Article 6(1)(f) GDPR. Where access to information on your device is not strictly necessary, this takes place on the basis of your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG.

Transfers to third countries

Retention period

The specific retention period of the processed data is determined by Cloudflare. Further information is available in Cloudflare’s privacy policy: https://www.cloudflare.com/de-de/privacypolicy/.

Bending Spoons

We integrate content provided by Bending Spoons S.p.A., Corso Como 15, 20154 Milan, Italy, into our website. When you access this content, a connection is established to the provider’s servers, transmitting your IP address and, where applicable, other technical browser data.

Purpose and legal basis

The purpose is to integrate the relevant content. Use is based on your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. You may withdraw your consent at any time with effect for the future through the consent manager.

Retention period

The specific retention period of the processed data is determined by the provider. Further information is available in Bending Spoons’ privacy policy: https://bendingspoons.com/privacy.

Changes to this privacy notice

We revise this privacy notice when changes are made to this website or whenever other circumstances make this necessary. The current version is always available on this website.

Last updated on 22 October 2026, replacing the version dated 4 December 2025

Book your room here:

Book your room here:

Information on Data Processing pursuant to Articles 13 and 14 GDPR

Controller

Data Protection Officer

What is this about?

General information on data processing

Legal basis for processing personal data

Data erasure and retention periods

Who receives your data?

Collection, processing and use of personal data at Classik Hotel Collection

Legal basis for data processing

Groups of data subjects, data and data categories:

Recipients to whom data may be disclosed:

Purpose of data processing

Retention period

Right to object

Processing of domestic guests’ personal data during online check-in

Legal basis for data processing

Purpose of data processing

Categories of recipients

Retention period

Right to object

Processing of foreign guests’ personal data during online check-in

Legal basis for data processing

Purpose of data processing

Categories of recipients

Retention period

Right to object

Your stay at the hotel

Purposes and legal basis of data processing

Recipients to whom data may be disclosed:

Erasure of data

Right to object

Online booking via the website

Legal basis for data processing

Purpose of data processing

Retention period

Right to object

Online booking via other websites

Legal basis for data processing

Purpose of data processing

Retention period

Right to object

Online reviews

Legal basis for data processing

Purpose of data processing

Retention period

Right to object

Email contact

Legal basis for data processing

Purpose of data processing

Retention period

Right to object

Business customers

Purpose and legal basis for data processing

Retention period

Right to object

Reactivation of existing customers

Categories of data concerned

Legal basis for data processing

Purpose of data processing

Recipients to whom data may be disclosed

Retention period

Right to object

Video surveillance at the hotels

Purpose and legal basis of data processing

Retention period

Your application for an advertised position

Purpose and legal basis for data processing

Retention period

Right to object

Data processing outside the European Union

German Whistleblower Protection Act (HinSchG) – provisions protecting whistleblowers

Protection of minors

What rights do you have?

Your right to lodge a complaint with a supervisory authority

Security

How is your data processed on the website in detail?