Privacy policy

The purpose of this privacy policy is to inform you about the nature, scope and purpose of processing (collection, storage, use) of personal data (information concerning the personal or material circumstances of an identified or identifiable natural person) within the meaning of the Federal Data Protection Act and the General Data Protection Regulation (GDPR) on the website www.bed-and-breakfast.de by the agency in the city of your selected destination as well as by the b&b Head Office.

I. Name and contact details of the controller

The data controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws of the member states as well as other data protection provisions is the agency in the city of your selected destination or the b&b Head Office. The person responsible is named in this data protection declaration in the respective data processing.

Please click here for contact details of the b&b head office and the agencies

II. Processing of personal data

We only process data (collect, store or disclose data to third parties),

• if you have given us your express consent to do so, or
• if it is legally permissible and necessary for the performance of a contract with you, or
• if we are required by law to do so, or
• the disclosure is necessary for the establishment, exercise or defence of legal claims and there is no reason to assume that you have an overriding legitimate interest in non-disclosure of your data.

1. Provision of the website and creation of log files:

When you visit our website, the browser on your device automatically sends information to the server on our website (host). This information is temporarily stored by the host in so-called log files.
The following information is collected without your intervention and stored until it is deleted:

• IP address of the requesting computer,
• Date and time of access,
• Name and URL of the accessed file,
• Website used to access our website (referrer URL),
• Websites accessed by the user's system via our website
• Browser used and, if applicable, the operating system of your computer as well as the name of your internet service provider.

The data is also stored in the log files of our system.This data is not stored together with other personal data of the user. The legal basis for the temporary storage of data is Article 6 (1) (f) GDPR.
The temporary storage of the aforementioned data is necessary to display the website on the user’s computer.

The data is stored in log files to ensure the website's functionality. This helps us to identify and eliminate technical errors on our website. Logging ultimately serves to improve the quality of our website from a technical point of view.

In accordance with Article 6 (1) (f), our legitimate interest lies in the processing of data for the above purposes.
There is a data processing agreement between the host and the b&b Head Office (b&b Zentrale). The data stored by the host will be deleted after 72 days. The collection of data for the purpose of providing the website and the temporary storage of data in log files is essential for the operation of the website. Users, therefore, do not have the option to object in this case.

2. Booking enquiry

When you use our website to make a booking enquiry, the agency of your destination will collect and store the data required to process the request and forward it to our agencies (franchise partners). Mandatory information is marked. Any other information you provide is voluntary.

The mandatory information includes:

• Salutation, name and surname
• Address
• Telephone and email:
• Arrival date/ departure date
• Number of guests (adults and children)
• Destination, accommodation, category

The data is processed based on your enquiry for the purposes specified under Article 6 (1) (b) GDPR, i.e. it is necessary for the implementation of pre-contractual measures.
The agency will erase the data as soon as it is no longer required for the purpose for which it was originally stored (after we have processed your inquiry, latest after expiry of your inquired travel dates) provided this does not conflict with any statutory retention or documentation requirements (under commercial or tax laws). As a user, you also have the right to request the erasure or rectification of the data we store on you at any time. If the data is required for performance of a contract or implementation of pre-contractual measures, advance data erasure is only possible if it does not conflict with statutory or contractual obligations or retention requirements.

3. Reservation

Upon your booking request, the agency will send you an email about the accommodation you requested or one or more proposals for available accommodation in the requested city. This e-mail is accompanied by a booking confirmation form. In case of acceptance of an offer, please return a completed booking confirmation to us. We save the data required for the booking.

These are:

• company
• First name and last name
• Address
• telephone and e-mail
• Arrival Departure
• Number of travelers (adults and children)
• destination and accommodation

The data processing is necessary for the accommodation contract and the processing of your booking. The data processing is based on your request and is required by Art.6 Section 1 S.1 b DSGVO for the purposes mentioned for the processing of your booking and for the mutual fulfillment of obligations under the contract.
The data will be deleted from the agency as soon as they are no longer required for the conclusion of the contract and the processing of your order and legal (commercial and tax) storage and documentation obligations have expired.
As a user, you also have the option of requesting deletion of the data at any time. You can change the data stored about you at any time. If the data are necessary for the fulfillment of a contract or for the execution of pre-contractual measures, a premature deletion of the data is only possible, as far as not contractual or legal obligations or storage obligations preclude a deletion.

4. Cookies

The website www.bed-and-breakfast.de and the respective sub-pages of the agencies (bed-and-breakfast.de/ORT) use cookies. Cookies are text files that are stored in the internet browser or by the internet browser on the end device (computer, laptop, smartphone, etc.) of the user. When a user calls up a website, a cookie can be stored on his operating system. This cookie contains a characteristic string of characters that enables the browser to be clearly identified when the website is called up again.
No personal data is stored in the cookies we use. The cookies we use can therefore not be assigned to a specific person, including you. When the cookie is activated, an identification number is assigned to it. An assignment of your personal data to this identification number is not possible at any time and will not be carried out. Based on cookie technology, we only receive pseudonymised information, for example about which pages of our website have been visited.
According to legal requirements, the storage of information on the user's end devices by setting cookies and retrieving information from end devices ("tracking") is only permitted with the prior consent of the user. Consent is not required if tracking is technically necessary for the website to be offered. This is the case for the “watch list” function on our site, as it cannot be offered without the use of cookies. Using the watch list function, you have the option of placing selected objects on the watch list while you are visiting our website. The search criteria are automatically transferred to the request form upon request. In order to guarantee this function, the b & b head office saves the selected objects for the duration of the page visit with the help of session cookies. The data specified under the provision of the website and the creation of log files are stored and transmitted in the cookies. The purpose of using cookies is therefore to simplify the use of the website for you and to offer the watch list function. For this it is necessary that the browser is recognized even after changing pages. This is where our legitimate interest lies in the processing of personal data. The legal basis for the processing of personal data is therefore Art. 6 Para. 1 lit.f GDPR.

When you visit our website, the user is informed about the use of cookies and his consent is obtained for the use of technically unnecessary cookies and for the processing of any personal data used in this context. In this context, there is also a reference to this data protection declaration. Consent is given by clicking on the "Accept" button.

You can view, adjust or revoke your current cookie settings at any time via this link.

5. Consent Management Tool

We use a consent management tool developed by Papoo Software & Media GmbH on our website. The tool enables you to give consent to data processing via the website, in particular the setting of cookies, and to make use of your right of withdrawal for consent that has already been given. The data processing serves the purpose of obtaining and documenting the necessary consents for data processing and thus complying with legal obligations. Cookies can be used.
Among other things, the following information is collected and transmitted to an external server operated by elbgraphen Werbeagentur GmbH:
- date and time of the page view,
- a random ID,
- Consent status.
The data is not processed by Papoo Software & Media and / or the elbgraphen advertising agency, the data is saved as a log file. Access to the log files is only possible with the prior agreement and consent of the customer. This data is not passed on to other third parties. The data processing takes place in order to fulfill a legal obligation on the basis of Art. 6 Para. 1 lit. c GDPR.

6. Contact form: Feedback

On our website, we offer a feedback form, which can be used to contact the b&b Head office. If you use this option, the data you enter into the form will be transmitted to us and stored.

The data includes:

• Name, surname
• Email address
• Message

The following data is also stored at the time the message is sent:

• IP address of the user
• Date and time of the enquiry
• For the processing of the data, your consent is obtained as part of the sending process and reference is made to this data protection declaration. Note on the website:
  [I consent to the data processing for the purpose of establishing contact. I can revoke this consent at any time for the future. I can find further information on this in the data protection declaration].
  The legal basis for the processing of the data is Art. 6 Para. 1 a GDPR with the consent of the user. Alternatively, you can contact us using the email address provided. In this case, the user's personal data transmitted with the email will be saved. In this context, the data will not be passed on to third parties. The data will only be used to process the conversation. The legal basis for the processing of the data that is transmitted in the course of sending an email is Article 6 Paragraph 1 f GDPR. If the aim of the email contact is to conclude a contract, the additional legal basis for processing is Art. 6 Para. 1b GDPR. The processing of the personal data from the input mask serves us only to process the contact. If you contact us by e-mail, there is also the necessary legitimate interest in processing the data. The data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected. For the personal data from the input mask of the feedback form and those that were sent by e-mail, this is the case when the respective conversation with the user has ended or the request has been processed. You have the option to withdraw your consent to the processing of your personal data at any time. If the user contacts us by email, he can object to the storage of his personal data at any time by email. In such a case, however, the conversation cannot continue. In these cases, all personal data stored in the course of contacting us will be deleted.

7. Contact form: Contact and Becoming a host

If you are interested in becoming a host or if you have a general inquiry, you can contact the agency in charge or, if your destination is not represented, the b&b Head Office by using the contact forms.
If you do this, the data entered in the input mask will be transmitted to us and saved.

These data are:

• First name Name
• E-mail address
• message

At the time of sending the message, the following data will also be temporarily stored:

• The IP address of the user
• Date and time of the request

For the processing of the data, your consent is obtained as part of the sending process and reference is made to this data protection declaration. The legal basis for the processing of the data is Art. 6 Para. 1 a GDPR with the consent of the user. If the purpose of making contact is to conclude a contract, the additional legal basis for processing is Art. 6 Para. 1b GDPR. The data will be deleted at the agency or the b & b head office as soon as the purpose for data storage no longer applies (after your request has been processed) and any statutory (commercial and tax law) retention and documentation obligations do not conflict with this.
As a user, you also have the option of requesting the deletion of the data at any time. You can have the data stored about you changed at any time. If the data is required to fulfill a contract or to carry out pre-contractual measures, premature deletion of the data is only possible if there are no contractual or legal obligations or retention requirements that prevent deletion.

8. Google Analytics

The b & b head office has integrated the Google Analytics component (with anonymization function) on this website. Google Analytics is a web analysis service. Web analysis is the collection, collection and evaluation of data on the behavior of visitors to Internet pages. A web analysis service collects, among other things, data on the website from which a person concerned came to a website (so-called referrer), which sub-pages of the website were accessed or how often and for how long a sub-page was viewed.
The operating company of the Google Analytics component is Google Ireland Limited Gordon House, Barrow Street, Dublin 4, Ireland and, in the United States of America, Google LL.C., 1600 Amphitheater Parkway, Mountain View, CA 94043, USA (“Google ”).

The b & b head office has activated the IP anonymization function on this website. As a result, your IP address will be shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area before it is transmitted to the USA. The full IP address will only be sent to a Google server in the USA and shortened there in exceptional cases. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide the website operator with other services relating to website activity and internet usage. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.

Google Analytics places a cookie on your information technology system. With the setting of the cookie, Google is enabled to analyze the use of our website. Each time you visit one of the individual pages of this website on which a Google Analytics component has been integrated, your Internet browser is automatically prompted by the respective Google Analytics component to transmit data to Google for the purpose of online analysis. The cookie is used to store personal information, such as the access time, the location from which access was made, the IP address and the frequency of your visits to our website. Each time you visit our website, this personal data, including the IP address, is transmitted to Google in the United States of America. These personal data are stored by Google in the United States of America. Google may pass this personal data collected through the technical process on to third parties.

You can prevent the setting of cookies by our website at any time by means of a corresponding setting in your Internet browser and thus permanently object to the setting of cookies. However, we would like to point out that in this case you may not be able to use all functions of this website to their full extent. In addition, a cookie already set by Google Analytics can be deleted at any time via the Internet browser or other software programs.
You also have the option of objecting to the collection of the data generated by Google Analytics relating to the use of this website and the processing of this data by Google and to prevent this. To do this, you need to download and install a browser add-on from the link https://tools.google.com/dlpage/gaoptout.
This browser add-on informs Google Analytics via JavaScript that no data or information on visits to websites may be transmitted to Google Analytics. The installation of the browser add-on is considered an objection by Google. Opt-out cookies prevent the future collection of your data when you visit this website. If you click here, the opt-out cookie will be set: Deactivate Google Analytics
Further information and the applicable data protection regulations from Google can be found at https://www.google.de/intl/de/policies/privacy/ and at http://www.google.com/analytics/terms/de.html.

When you visit our website, the user is informed about the use of cookies in connection with Google Analytics and his consent to the use of technically unnecessary cookies and the processing of the personal data used in this context is obtained. In this context, there is also a reference to this data protection declaration. Consent is given by clicking on the "Accept" button.

You can view, adjust or revoke your current cookie settings at any time via this link.

The storage of Google Analytics cookies takes place on the basis of your consent in accordance with Art. 6 Para. 1 a GDPR.

The data sent by us and linked to cookies, user IDs (e.g. user ID) or advertising IDs are automatically deleted after 24 months. The deletion of data whose retention period has expired takes place automatically once a month.

The b & b head office has concluded a contract data processing agreement with Google and fully implements the strict requirements of the German data protection authorities when using Google Analytics.

9. Google Ads

The b & b head office uses Google Ads on its website. Google Ads is an internet advertising service. Google Ads enables an advertiser to define certain keywords in advance by means of which an advertisement is only displayed in Google's search engine results if the user calls up a keyword-relevant search result with the search engine. In the Google advertising network, the advertisements are distributed to topic-related websites using an automatic algorithm and taking into account the previously defined keywords.
The company operating the Google AdWords services is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.
The purpose of Google Ads is to advertise our website by displaying interest-relevant advertising on the websites of third-party companies and in the search engine results of the Google search engine and by displaying third-party advertising on our website.
If you access our website via a Google ad, a so-called conversion cookie is set by Google. A conversion cookie loses its validity after thirty days and is not used to identify the person concerned. If the cookie has not yet expired, the conversion cookie is used to determine whether certain sub-pages have been accessed on our website. The conversion cookie enables both we and Google to understand whether a person who came to our website via an ads ad has completed or canceled a transaction. The data and information collected through the use of the conversion cookie are used by Google to create visit statistics for our website. These visit statistics are in turn used by us to determine the total number of users who were referred to us via ads, i.e. to determine the success or failure of the respective ads and to optimize our ads for the future . Neither our company nor other Google Ads advertisers receive any information from Google that could be used to identify you.
You can prevent the setting of cookies by our website at any time by means of a corresponding setting in your Internet browser and thus permanently object to the setting of cookies. Such a setting of the internet browser used would also prevent Google from setting a conversion cookie. In addition, a cookie already set by Google AdWords can be deleted at any time via the Internet browser or other software programs.
You also have the option of objecting to interest-based advertising by Google. To do this, you have to call up the link www.google.de/settings/ads from each of the internet browsers you use and make the desired settings there.
When you visit our website, the user is informed about the use of cookies in connection with Google Ads and his consent is obtained for the use of technically unnecessary cookies and for the processing of the personal data used in this context. In this context, there is also a reference to this data protection declaration. Consent is given by clicking on the "Accept" button.

You can view, adjust or revoke your current cookie settings at any time via this link.

The legal basis for the use of cookies is Art. 6 Para. 1 a) GDPR in connection with your consent.
You can find more information on Google Ads and Google Conversion Tracking in Google's data protection provisions: https://www.google.de/policies/privacy/.

The b & b head office has concluded a contract data processing contract with Google and fully implements the strict requirements of the German data protection authorities when using Google Ads.

10. Open Street Map

The b & b head office uses the map service of OpenStreetMap (OSM). The provider is the Open Street Map Foundation (OSMF), 132 Maney Hill Road, Sutton Coldfield, West Midlands, B72 1JU, United Kingdom.
When you visit a website on which OpenStreetMap is integrated, among other things, Your IP address and further information about your behavior on this website are forwarded to the OSMF. OpenStreetMap may save cookies in your browser or use comparable recognition technologies.
Your location can also be recorded if you do this in your device settings - e.g. B. on your mobile phone. The b & b head office has no influence on this data transfer. Details can be found in the data protection declaration of OpenStreetMap under the following link: https://wiki.osmfoundation.org/wiki/Privacy_Policy.
The use of OpenStreetMap takes place in the interest of an appealing presentation of our online offers and an easy findability of the places indicated by us on the website. This represents a legitimate interest within the meaning of Art. 6 Para. 1 lit.f GDPR.

11. YouTube

The b & b head office and the respective sub-pages of the agencies (bed-and-breakfast.de/ORT) use plugins from the Google-operated YouTube site. The operator of the website is YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA.
If you visit one of our pages equipped with a YouTube plug-in, a connection to the YouTube servers will be established. The YouTube server is informed which of our pages you have visited.
If you are logged into your YouTube account, you enable YouTube to assign your surfing behavior directly to your personal profile. You can prevent this by logging out of your YouTube account.
YouTube is used in the interest of an appealing presentation of our online offers. This represents a legitimate interest within the meaning of Art. 6 Para. 1 lit.f GDPR.
You can find more information on handling user data in YouTube's data protection declaration at: https://www.google.de/intl/de/policies/privacy.
When you visit our website, the user is informed about the use of cookies in connection with YouTube and his consent is obtained for the use of these technically unnecessary cookies and for the processing of the personal data used in this context. In this context, there is also a reference to this data protection declaration. Consent is given by clicking on the "Accept" button. If the consent was not already given when the website was accessed, it cannot be given there, it can be given later on the respective subpage that contains the YouTube plug-in.

You can view, adjust or revoke your current cookie settings at any time via this link.

The legal basis for the use of cookies is Art. 6 Para. 1 a) GDPR in connection with your consent.

III. Rights of data subjects

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights in relation to the data Controller.

1. Right of access

In accordance with Article 15 of the GDPR, you have the right to receive Information about the personal data we process and in particular the following information

• the purposes of the processing,
• the categories of personal data concerned,
• categories of recipients to whom your personal data has been or will be disclosed,
• the envisaged period for which the personal data will be stored,
• the existence of the right to request from the Controller rectification or erasure of personal data or restriction of processing of personal data or to object to such processing,
• the right to lodge a complaint with a supervisory authority,
• where the personal data was not collected by us, any available information as to its source,
• the existence of automated decision-making, including profiling and meaningful information about the logic involved.

2. Right to rectification

In accordance with Article 16 of the GDPR, you have the right to demand from us without undue delay the rectification of inaccurate personal data or completion of incomplete data concerning you, if the personal data we process is inaccurate or incomplete.

3. Right of erasure

In accordance with Article 17 of the GDPR, you have the right to demand from us the erasure of your personal data without undue delay and we have the obligation to erase personal data without undue delay, where one of the following grounds applies

- the relevant personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;
- you are withdrawing your consent to the processing and there is no other legal ground for the processing;
- you object to the processing pursuant to Article 21 (1) of the GDPR and there are no overriding legitimate grounds for the processing, or your objection to the processing is based on Article 21 (2) of the GDPR;
- the personal data has been unlawfully processed;
- the personal data has to be erased for the fulfilment of a legal obligation in compliance with the EU regulations or the regulations of Member States, to which we are subject;
- your personal data was collected in relation to the services of the information society offered, in accordance with Article 8 (1) of the GDPR.
The right to erasure does not apply as long as the need for processing exists
- for purposes of exercising the right of freedom of expression and information, - for the performance of a task carried out in the public interest or for the assertion, exercise or defence of legal claims

4. Right to restriction of processing

In accordance with Article 18 of the GDPR, you have the right to demand from the Controller restriction of processing where one of the following reasons applies:
- the accuracy of the personal data is contested by you
- the processing is unlawful, but you oppose the erasure of personal data and we no longer need the personal data but you require the data for the assertion, exercise or defence of legal claims or
- you have objected to the processing of your data pursuant to Article 21 (1), but it has not yet been determined whether our legitimate grounds override yours.

5 Right to receive notifications

If you have exercised your rights with respect to rectification or erasure of personal data or restriction of processing, we shall communicate any rectification or erasure of personal data or restriction of processing to each recipient to whom your personal data has been disclosed, unless this proves impossible or involves disproportionate expense and effort. You have the right to demand information from us about these recipients.

6. Right to data portability

In accordance with Article 20 of the GDPR, you have the right to receive your personal data, which you have provided to us, in a structured, standard and machine-readable format.
In addition, you have the right to transmit this data to another Controller without hindrance from us, where the processing is based on your consent or is for the fulfilment of a contract, and the processing is carried out by automated means. In exercising this right, you also have the right to have the personal data transmitted directly from us to another Controller, where technically feasible. This process should not, however, adversely affect the rights and freedoms of others.

7. Right to withdraw consent to data processing

In accordance with Article 7 (3) of the GDPR, you have the right to withdraw your consent at any time. As a result, we shall no longer be allowed to process data based on this consent going forward.

8. Right to lodge a complaint

Without prejudice to any other administrative or judicial remedy, you have the right under Article 77 of the GDPR to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes on the GDPR. The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78 of the GDPR.

9. Right to object

If your personal data are processed based on legitimate interests pursuant to Article 6 (1) point (f) of the GDPR, you have the right to raise objection against the processing of your personal data in accordance with Article 21 of the GDPR on grounds relating to your particular situation; this also applies to profiling based on these provisions. After your objection, we shall no longer process your personal data, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or if the processing is for purposes of asserting, exercising or defending legal claims. Where personal data is processed for direct marketing purposes, you will have the right to object at any time to the processing of your personal data for such marketing purposes; this also applies to profiling, as long as it is related to such direct marketing. If you object to processing for direct marketing purposes, your personal data will no longer be processed for such purposes.

If you wish to object to the use of your personal data or if you wish to withdraw your consent, please send an email to the agency in the city of your selected destination [city]@bed-and-breakfast.de

10. Automated individual decision-making, including profiling

You have the right not to be subjected to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision

(1) is necessary for the conclusion or performance of a contract between you and the data Controller,

(2) is based on the legal provisions of the EU or a Member State to which the Controller is subject and which also lays down suitable measures for safeguarding your rights and freedoms, as well as your legitimate interests, or

(3) is based on your explicit consent.

However, these decisions may not be based on special categories of personal data referred to in Article 9 (1) of the GDPR, unless point (a) or (g) of Article 9 (2) applies and suitable measures to safeguard the data subject's rights and freedoms and legitimate interests are in place. In the cases referred to in points (1) and (3), the data Controller shall implement suitable measures to safeguard your rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the Controller, to express your point of view and to contest the decision. We do not use automatic decision-making or profiling.

11. Data security

In the course of your visit to the website, we use the most common SSL (Secure Socket Layer) or TLS method in connection with the highest level of encryption supported by your browser. In most cases, this is 256-bit encryption. If your browser does not support 256-bit encryption, we use 128-bit v3 technology instead. You can recognise an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line.

We also use technical and organisational measures to protect your data against accidental or intentional manipulation, full or partial loss, destruction or unauthorised third-party access. Our security measures are revised on a continual basis and brought into line with the latest technology standards.

Privacy policy version: January 2022