Privacy Policy

1. Data protection at a glance

General information

The following information provides a simple overview of what happens to your personal data when you visit our website. Personal data is all data that can be used to identify you personally. Detailed information on data protection can be found in our privacy policy listed below this text.

Data collection on our website

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator. You can find their contact details in the website's imprint.

How do we collect your data?

Your data is collected, on the one hand, when you provide it to us. This may, for example, be data you enter in a contact form.

Other data is automatically collected by our IT systems when you visit the website. This primarily involves technical data (e.g., internet browser, operating system, or time of page access). This data is collected automatically as soon as you enter our website.

What do we use your data for?

Some of the data is collected to ensure the website functions correctly. Other data may be used to analyze your user behavior.

What rights do you have regarding your data?

You have the right to obtain information about the origin, recipient, and purpose of your stored personal data free of charge at any time. You also have the right to request the correction, blocking, or deletion of this data. You can contact us at any time at the address provided in the imprint for this purpose and for other questions regarding data protection. Furthermore, you have the right to lodge a complaint with the responsible supervisory authority.

2. General information and mandatory information

Data protection

The operators of these websites take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.

When you use this website, various personal data is collected. Personal data is data that can be used to identify you personally. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose.

We would like to point out that data transmission over the Internet (e.g., when communicating via email) may be subject to security gaps. Complete protection of data from access by third parties is not possible.

Note on the responsible body

The responsible body for data processing on this website is:

HOTEL FRESENA Claudia Günnewig im Dammtorpalais Moorweidenstrasse 34 20146 Hamburg

Telephone: 0049 (0)40/410 48 92 Email: hamburg@hotelfresena.de

The responsible body is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data (e.g. names, e-mail addresses, etc.).

Revocation of your consent to data processing

Many data processing operations are only possible with your express consent. You can revoke your previously granted consent at any time. To do so, simply send us an informal email. The legality of the data processing carried out up to the time of revocation remains unaffected.

Right to lodge a complaint with the competent supervisory authority

In the event of violations of data protection law, the data subject has the right to lodge a complaint with the competent supervisory authority. The competent supervisory authority for data protection issues is the state data protection officer of the federal state in which our company is headquartered. A list of data protection officers and their contact details can be found at the following link: https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html.

Information, blocking, deletion

Within the scope of applicable legal provisions, you have the right at any time to obtain free information about your stored personal data, its origin and recipient, and the purpose of data processing, as well as the right to correct, block, or delete this data. You can contact us at any time at the address provided in the legal notice for this purpose and for other questions regarding personal data.

Information about hellohotel hosting:

Amazon Web Services (AWS) Germany GmbH

Krausenstr. 38

10117 Berlin

Germany

The Amazon Web Services servers used to store data are located in Frankfurt/Main, Germany, and are subject to national and European data protection laws. Amazon Web Services also handles your data in accordance with the relevant legal provisions. The Amazon Web Services privacy policy can be accessed at the following link: https://aws.amazon.com/de/privacy/

3. Data collection on our website

Cookies

Some of our websites use so-called cookies. Cookies do not harm your computer and do not contain viruses. Cookies serve to make our services more user-friendly, effective, and secure. Cookies are small text files that are stored on your computer and saved by your browser.

Most of the cookies we use are so-called "session cookies." They are automatically deleted after your visit. Other cookies remain stored on your device until you delete them. These cookies allow us to recognize your browser the next time you visit.

You can configure your browser to inform you about the use of cookies and to only accept cookies on a case-by-case basis, to exclude cookies for specific cases or in general, and to automatically delete cookies when you close your browser. Disabling cookies may limit the functionality of this website.

Cookies that are necessary to carry out electronic communication or to provide certain functions you have requested (e.g., shopping cart function) are stored on the basis of Art. 6 (1) (f) GDPR. The website operator has a legitimate interest in storing cookies to ensure the technically error-free and optimized provision of its services. If other cookies (e.g., cookies for analyzing your surfing behavior) are stored, these are treated separately in this privacy policy.

Server log files

The website provider automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These include:

• Browser type and version
• operating system used
• Referrer URL
• Hostname of the accessing computer
• Time of server request
• IP Address

This data will not be merged with other data sources.

The basis for data processing is Art. 6 (1) (f) GDPR, which permits the processing of data to fulfill a contract or for pre-contractual measures.

Contact form

If you send us inquiries via the contact form, your information from the form, including the contact details you provided there, will be stored by us for the purpose of processing your inquiry and in case of follow-up questions. We will not share this data without your consent.

The data entered into the contact form will therefore be processed exclusively on the basis of your consent (Art. 6 (1) (a) GDPR). You can revoke this consent at any time. To do so, simply send us an informal email. The legality of the data processing operations carried out up to the time of revocation remains unaffected by the revocation.

The data you enter in the contact form will remain with us until you request its deletion, revoke your consent to storage, or the purpose for storing the data no longer applies (e.g., after your request has been processed). Mandatory legal provisions—in particular, retention periods—remain unaffected.

Processing of data (customer and contract data)

We collect, process, and use personal data only to the extent necessary to establish, define, or modify the legal relationship (master data). This is done on the basis of Art. 6 (1) (b) GDPR, which permits the processing of data to fulfill a contract or for pre-contractual measures. We collect, process, and use personal data about the use of our website (usage data) only to the extent necessary to enable the user to use the service or to bill them.

The collected customer data will be deleted after completion of the order or termination of the business relationship. Statutory retention periods remain unaffected.

Data transfer when concluding a contract for services and digital content

We only transmit personal data to third parties if this is necessary for the execution of the contract, for example to the credit institution responsible for processing payments.

Further transmission of data will not occur, or only if you have expressly consented to such transmission. Your data will not be passed on to third parties without your express consent, for example, for advertising purposes.

The basis for data processing is Art. 6 (1) (b) GDPR, which permits the processing of data to fulfill a contract or for pre-contractual measures.

4. Plugins and tools

 Technical provision of the website For the purpose of the technical provision of the website, it is necessary for us, as the website operator or the page provider, to process certain automatically transmitted information from you so that your browser can display our website and you can use it. This information is automatically collected each time you visit our website. This information relates to the computer system of the accessing computer.

The following information is collected: • IP address, anonymized • Browser type/version (e.g. Safari version 12.1.1 (12607.2.6.1.2) • Browser language (e.g. German) • Operating system used (e.g. Windows 10) • Resolution of the browser window; • Screen resolution • Javascript activation • Java on / off • Cookies on / off • Color depth • Time of access.?

We also use cookies to make our website available to you for use. Cookies are text files that are stored in the internet browser or by the internet browser on your computer system when you visit a website. A cookie contains a characteristic string of characters that enables unique identification of the browser when you visit the website again. We use these cookies solely to make our website and its technical functions available to you. Some functions of our website cannot be offered without the use of cookies. The following information is stored in the cookies and sent to us: • Web server cookie that identifies the current visitor (PHP session cookie) • Google Analytics cookie that identifies the current visitor • Cookie that saves the selected travel date We do not use the information we have collected through the above cookies to create user profiles or to evaluate your surfing behavior.

We process your personal data for the technical provision of our website on the following legal basis:?• To fulfill a contract or to take pre-contractual measures in accordance with Art. 6 (1) (b) GDPR, if you visit our website to find out about our services; and??• to protect our legitimate interests in accordance with Art. 6 (1) (f) GDPR, in order to be able to make the website technically available to you. Our legitimate interest lies in being able to provide you with an attractive, technically functioning and user-friendly website, as well as in taking measures to protect our website from cyber risks and to prevent our website from posing cyber risks to third parties.

 Statistical analysis of website usage and increased reachFor the purpose of statistical analysis of the usage of our website, we use Google Analytics and the Facebook Pixel and thus cookies, which enable an analysis of your surfing behavior. This enables us to improve the quality of our website and its content. We learn how the website is used and can therefore continuously optimize our offering. The information obtained as part of the statistical analysis of our website is not merged with your other data collected as part of the website. We process your personal data for the statistical analysis of the usage of our website on the basis of the following legal bases: • Your consent in accordance with Art. 6 (1) (a) GDPR.

Google Analytics

We use Google Analytics, a web analysis service provided by Google Inc., on our website. Google Analytics uses “cookies”, which are text files placed on your computer, to help the website analyze how users use the site. The information generated by the cookie about your use of the website is generally transferred to and stored by Google on servers in the United States. However, if IP anonymization is activated on our website, Google will shorten your IP address beforehand within member states of the European Union or other parties to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. Google will use this information on our behalf to evaluate your use of the website, to compile reports on website activity and to provide the website operator with other services relating to website activity and internet usage. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.

We use Google Analytics with the extension "_anonymizeIp()" on our website. This means that IP addresses are shortened and processed, thus preventing any direct personal reference.

 We only use Google Analytics with your consent. You can revoke your consent once you have given it by: • preventing cookies from being saved by setting your browser software accordingly; however, we would like to point out that if you do this you may not be able to use all of the functions of our website to their full extent; • downloading and installing the browser plug-in available under the following link: http://tools.google.com/dlpage/gaoptout?hl=de or • clicking this link to prevent Google Analytics from recording data on our website in the future. This will store an opt-out cookie in your browser. Please note that you must activate the opt-out cookie in every browser you use on all your devices and may also have to reactivate it if you delete all cookies in a browser.

Further information on the terms of use and data protection of Google Analytics can be found at http://www.google.com/analytics/terms/de.html or at https://www.google.de/intl/de/policies/

Google Tag Manager

We use Google Tag Manager on our website. Google Tag Manager is a solution that allows marketers to manage website tags via a single interface. The Google Tag Manager service itself (which implements the tags) is a cookieless domain and does not collect any personal data. The Google Tag Manager service triggers other tags, which in turn may collect data. Google Tag Manager does not access this data. If deactivation has been made at the domain or cookie level, this remains in place for all tracking tags implemented with Google Tag Manager.

Google Maps

This site uses the Google Maps service via an API. The provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

To use the features of Google Maps, it is necessary to save your IP address. This information is usually transmitted to a Google server in the USA and stored there. The provider of this site has no influence on this data transmission.

We use Google Maps in the interest of providing an attractive presentation of our online offerings and making the locations we list on our website easy to find. This represents a legitimate interest within the meaning of Art. 6 (1) (f) GDPR.

You can find more information about how user data is handled in Google’s privacy policy: https://www.google.de/intl/de/policies/privacy/.

Active use of the website

In addition to using our website for purely informational purposes, you can also actively use our website. In addition to the processing of your personal data described above for purely informational purposes, we will also process other personal data from you.

Room booking

When you book a room, we process the personal data you provide us with. This includes, in particular, your name, home address, contact details, and payment method.

We process your personal data when you book a room on the following legal basis:?• to fulfill a contract or to take steps prior to entering into a contract in accordance with Art. 6 (1) (b) GDPR.

Guest inquiries

In order to process and respond to your inquiries, e.g., via the contact form or to our email address, we process the personal data you provide in this context. This includes your name and email address in order to send you a response, as well as any other information you send us as part of your message.

We process your personal data to respond to guest inquiries on the following legal basis:?• to protect our legitimate interests pursuant to Art. 6 (1) (f) GDPR; our legitimate interest lies in the appropriate response to guest inquiries.

payment

We use a payment service provider to process your reservation payment. We process your personal data to process orders on our website on the basis of the following legal bases: • to fulfill a contract or to take pre-contractual steps in accordance with Art. 6 (1) (b) GDPR.

Compliance with legal regulations

We also process your personal data to fulfill other legal obligations that apply to us in connection with the processing of your order. These include, in particular, retention periods under commercial, trade, or tax law.

We process your personal data on the basis of the following legal bases:?• to fulfill a legal obligation to which we are subject according to Art. 6 (1) (c) GDPR in connection with commercial, trade or tax law, insofar as we are obliged to record and store your data.

Processing of special personal data

Special categories of personal data according to Art. 9 GDPR are personal data revealing racial or ethnic origin, political opinions, religious (e.g. information on religious affiliation/denomination) or ideological beliefs or trade union membership, as well as the processing of biometric data for unique identification (e.g. photos), health data (e.g. information on the degree of severe disability) or data on sex life or sexual orientation. If your CV contains special categories of personal data, we do not intentionally collect it. We expressly ask you not to send us such data. If you voluntarily and against our express request send us special categories of personal data according to Art. 9 Para. 1 GDPR as part of your application documents (e.g. your photo or information on your religious affiliation/denomination), we will store this on the basis of your consent in accordance with Art. 88 Para. 1 GDPR in conjunction with Section 26 Para. 3 Sentence 2 of the new BDSG. This also applies if you provide us with additional special personal data during the application process. By voluntarily submitting this data, you consent to the storage of this special personal data as part of the application process.

We generally do not consider this special personal data when making a selection decision, unless it is required by law to do so. For example, in some job advertisements, it is possible that people with disabilities may be given preferential treatment in accordance with applicable law. In these cases, the information is always voluntary and is provided with your express consent, which you give by voluntarily submitting this data.

We process your special personal data on the basis of the following legal bases:• according to Art. 9 Para. 1 GDPR based on your consent according to Art. 88 Para. 1 GDPR in conjunction with Section 26 Para. 3 Sentence 2 BDSG-new.

Third country transfer

We transfer your data to entities located in countries outside the European Union (EU) or the European Economic Area (EEA) (so-called third countries) that act as processors for us (e.g., IT service providers or data centers). When using Google Analytics, we transfer your abbreviated IP address to the USA. Unless the EU Commission has issued a decision regarding an adequate level of data protection for the country in question, we conclude contracts in accordance with EU data protection regulations that ensure that your rights and freedoms are adequately protected and guaranteed. Alternatively, the data transfer is based on Commission Implementing Decision (EU) 2016/1250 of July 12, 2016, pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the EU-US Privacy Shield. We will be happy to provide you with detailed information upon request. Furthermore, we do not transfer your personal data to countries outside the EU or the EEA or to international organizations.

Duration of storage

 Informational use of the website: When you use our website for purely informational purposes, we store your personal data on our servers exclusively for the duration of your visit. After you leave our website, your personal data is deleted immediately. Cookies installed by us are generally also deleted after you leave our website. However, this does not apply to the cookie that stores the selected travel date. This remains stored for a period of 30 days. The Google Analytics cookie is also stored for 26 months. You also have the option of deleting installed cookies yourself at any time.

Active use of the website

When you actively use our website, we initially store your personal data for the duration of responding to your inquiry or for the duration of our business relationship. This also includes the initiation of a contract (pre-contractual legal relationship) and the execution of a contract. In addition, we then store your personal data until any legal claims arising from the relationship with you become time-barred, in order to use it as evidence if necessary. The limitation period is generally between 12 and 36 months, but can also be up to 30 years. Upon expiration of the limitation period, we delete your personal data unless there is a statutory retention period, for example, under the German Commercial Code (§§ 238, 257 para. 4 HGB) or the German Tax Code (§ 147 paras. 3 and 4 AO). These retention periods can range from two to ten years.

Your rights as a data subject

Under the statutory requirements, you are entitled to the following rights as a data subject, which you can assert against us: Right to information: You are entitled at any time, within the scope of Art. 15 GDPR, to request confirmation from us as to whether we process personal data concerning you; if this is the case, you are also entitled within the scope of Art. 15 GDPR to receive information about this personal data and certain other information (including processing purposes, categories of personal data, categories of recipients, planned storage period, the origin of the data, the use of automated decision-making and, in the case of transfer to a third country, the appropriate guarantees) and a copy of your data. Right to rectification: You are entitled, under Art. 16 GDPR, to request that we correct the personal data stored about you if it is inaccurate or incorrect. Right to erasure: You are entitled, under the conditions of Art. 17 GDPR, to request that we immediately delete personal data concerning you. The right to erasure does not exist, among other things, if the processing of personal data is necessary for (i) exercising the right to freedom of expression and information, (ii) to fulfill a legal obligation to which we are subject (e.g. statutory retention periods) or (iii) to assert, exercise or defend legal claims.Right to restriction of processing: You have the right, under the conditions of Art. 18 GDPR, to request that we restrict the processing of your personal data.Right to data portability: You have the right, under the conditions of Art. 20 GDPR, to request that we provide you with the personal data concerning you that you have provided to us in a structured, common and machine-readable format.Right of withdrawal: You have the right to withdraw your consent to the processing of personal data at any time with effect for the future.Right of objection: You have the right, under the conditions of Art. 21 GDPR, to object to the processing of your personal data, which means that we must stop processing your personal data. The right of objection exists only within the limits provided for in Art. 21 GDPR. Furthermore, our interests may conflict with the termination of processing, meaning that we are entitled to process your personal data despite your objection. However, we recommend that you always first address any complaint to our data protection officer. Your requests to exercise your rights should, if possible, be submitted in writing to the address provided above or directly to our data protection officer.

Scope of your obligations to provide data

In principle, you are not obligated to provide us with your personal data. However, if you do not do so, we will not be able to provide you with our website, respond to your inquiries, or enter into a contract with you. Personal data that we do not strictly require for the processing purposes listed above is marked as voluntary information with "if necessary" or another symbol.

Automated decision-making / profiling

We do not use automated decision-making or profiling (an automated analysis of your personal circumstances).Information about your right of objection Art. 21 GDPR

1. You have the right to object at any time to the processing of your data based on Art. 6 (1) (f) GDPR (data processing based on a balance of interests) or Art. 6 (1) (e) GDPR (data processing in the public interest) if there are reasons for doing so that arise from your particular situation. This also applies to profiling based on this provision within the meaning of Art. 4 (4) GDPR.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which outweigh your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

2. In individual cases, we also process your personal data for direct marketing purposes. If you do not wish to receive advertising, you have the right to object at any time; this also applies to profiling insofar as it is related to such direct marketing. We will respect this objection in the future.

We will no longer process your data for direct marketing purposes if you object to processing for these purposes. The objection can be made informally and should, if possible, be sent to the address stated under section I.

Changes

We reserve the right to change this Privacy Policy at any time. Any changes will be notified by posting the revised Privacy Policy on our website. Unless otherwise stated, such changes will be effective immediately. Please check this Privacy Policy regularly to see the most current version.

Status July 2019