Privacy

1. Data protection at a glance

General information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data by which you can be personally identified. Detailed information can be found in the privacy policy below.

Data collection on this website

Who is responsible for data collection on this website?

Data on this website is processed by the website operator. Contact details are provided in the section “Information about the controller” in this privacy policy.

How do we collect your data?

Some data is collected when you provide it to us, for example by entering it into a contact form.

Other data is collected automatically or with your consent by our IT systems when you visit the website. This is mainly technical data, such as your browser, operating system or the time of the page visit. This data is collected automatically as soon as you enter the website.

What do we use your data for?

Some data is collected to ensure that the website is provided without errors. Other data may be used to analyse your user behaviour. Where contracts can be concluded or initiated through the website, transmitted data is also processed for contractual offers, orders or other enquiries about services.

What rights do you have regarding your data?

You have the right at any time to obtain information free of charge about the origin, recipients and purpose of your stored personal data. You also have the right to request its correction or deletion. If you have consented to data processing, you may withdraw that consent at any time with effect for the future. Under certain circumstances, you also have the right to request restriction of processing. You have the right to lodge a complaint with the competent supervisory authority.

You can contact us at any time about these or other data protection questions.

Analytics and third-party tools

When you visit this website, your browsing behaviour may be statistically analysed, primarily using analytics programs. Detailed information about these programs is provided below.

2. Hosting

Our website content is hosted by the following provider:

All-Inkl

The provider is ALL-INKL.COM – Neue Medien Münnich, proprietor René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany (“All-Inkl”). See the All-Inkl privacy information for details.

All-Inkl is used on the basis of Article 6(1)(f) GDPR. We have a legitimate interest in the most reliable presentation of our website. Where consent has been requested, processing takes place exclusively on the basis of Article 6(1)(a) GDPR and section 25(1) TDDDG, insofar as consent covers storing cookies or accessing information on the user’s device, such as device fingerprinting, within the meaning of the TDDDG. Consent may be withdrawn at any time.

Data processing agreement

We have concluded a data processing agreement for the service above. This agreement, required under data protection law, ensures that the provider processes our website visitors’ personal data only on our instructions and in compliance with the GDPR.

3. General information and mandatory disclosures

Data protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection provisions and this privacy policy.

Various personal data is collected when you use this website. Personal data is data by which you can be personally identified. This policy explains which data we collect, what we use it for, and how and why this happens.

Data transmission over the internet, such as communication by email, can have security vulnerabilities. Complete protection against access by third parties is not possible.

Information about the controller

The controller responsible for data processing on this website is:

Mr Josef Witte
Hauptstraße 32
59227 Ahlen-Vorhelm, Germany

Telephone: 02528 – 92 95 29 0
Email: info@hotel-witte.de

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of processing personal data, such as names and email addresses.

Storage period

Unless a more specific period is stated in this policy, your personal data remains with us until the purpose for processing ceases. If you make a justified deletion request or withdraw consent, we delete your data unless we have other legally permissible grounds for retaining it, such as tax or commercial retention periods; in that case, deletion follows when those grounds cease to apply.

General information about the legal bases for processing

Where you have consented to processing, we process personal data under Article 6(1)(a) GDPR or, for special categories under Article 9(1), Article 9(2)(a) GDPR. Explicit consent to transfer personal data to third countries also provides a basis under Article 49(1)(a) GDPR. Consent to storing cookies or accessing information on your device, such as device fingerprinting, additionally provides a basis under section 25(1) TDDDG. Consent may be withdrawn at any time. Data required to perform a contract or carry out pre-contractual measures is processed under Article 6(1)(b) GDPR. Data required to meet a legal obligation is processed under Article 6(1)(c) GDPR. Processing may also be based on our legitimate interest under Article 6(1)(f) GDPR. The applicable legal bases for individual cases are explained below.

Recipients of personal data

In the course of business we work with external parties, which may require personal data to be transferred. We transfer data only where necessary to perform a contract, required by law, such as disclosure to tax authorities, justified by a legitimate interest under Article 6(1)(f) GDPR, or permitted by another legal basis. When using processors, we transfer customer data only under a valid data processing agreement. In the case of joint processing, a joint processing agreement is concluded.

Withdrawal of consent

Many processing operations require your explicit consent. You may withdraw consent at any time. This does not affect the lawfulness of processing before withdrawal.

Right to object to data collection in special cases and to direct marketing (Article 21 GDPR)

WHERE PROCESSING IS BASED ON ARTICLE 6(1)(E) OR (F) GDPR, YOU MAY OBJECT AT ANY TIME ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, INCLUDING TO PROFILING BASED ON THOSE PROVISIONS. THE APPLICABLE LEGAL BASIS IS SET OUT IN THIS POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS THE RELEVANT DATA UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS OVERRIDING YOUR INTERESTS, RIGHTS AND FREEDOMS, OR PROCESSING SERVES TO ESTABLISH, EXERCISE OR DEFEND LEGAL CLAIMS (ARTICLE 21(1) GDPR).

IF PERSONAL DATA IS PROCESSED FOR DIRECT MARKETING, YOU MAY OBJECT AT ANY TIME TO THAT PROCESSING, INCLUDING PROFILING RELATED TO DIRECT MARKETING. FOLLOWING YOUR OBJECTION, YOUR PERSONAL DATA WILL NO LONGER BE USED FOR DIRECT MARKETING (ARTICLE 21(2) GDPR).

Right to lodge a complaint with a supervisory authority

In the event of GDPR infringements, data subjects may complain to a supervisory authority, particularly in the Member State of their habitual residence, workplace or the place of the alleged infringement. This right is without prejudice to other administrative or judicial remedies.

Right to data portability

You may request that data we process automatically based on consent or performance of a contract be provided to you or a third party in a commonly used, machine-readable format. Direct transfer to another controller is made only where technically feasible.

Access, correction and deletion

Within applicable law, you have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of processing, and where applicable to correction or deletion. Contact us at any time about these or other personal data questions.

Right to restriction of processing

You may request restriction of processing at any time. This right applies in the following cases:

• If you contest the accuracy of stored data, you may request restriction while we verify it.
• If processing was or is unlawful, you may request restriction instead of deletion.
• If we no longer need the data but you need it to establish, exercise or defend legal claims, you may request restriction instead of deletion.
• If you object under Article 21(1) GDPR, you may request restriction until it is determined whose interests prevail.

Where processing has been restricted, apart from storage the data may be processed only with your consent, for establishing, exercising or defending legal claims, protecting another natural or legal person’s rights, or for important public-interest reasons of the EU or a Member State.

SSL or TLS encryption

This website uses SSL or TLS encryption for security and to protect confidential information, such as orders or enquiries sent to us. An encrypted connection can be recognised by the browser address changing from “http://” to “https://” and by the lock symbol in the browser bar.

When SSL or TLS encryption is active, data you transmit to us cannot be read by third parties.

4. Data collection on this website

Cookies

Our website uses cookies. Cookies are small data files that do not harm your device. They are stored temporarily for a session or permanently on your device. Session cookies are automatically deleted after your visit; permanent cookies remain until you delete them or your browser deletes them automatically.

Cookies may be set by us (first-party cookies) or by third parties (third-party cookies). Third-party cookies enable certain third-party services to be integrated into websites, such as payment processing.

Cookies have different functions. Many are technically necessary because certain website functions, such as shopping carts or videos, would otherwise not work. Others may be used to analyse user behaviour or for advertising.

Cookies needed for electronic communication, functions you request, such as a shopping cart, or website optimisation, such as audience measurement, are stored under Article 6(1)(f) GDPR unless another legal basis is stated. The operator has a legitimate interest in storing necessary cookies to provide its services without technical errors and in an optimised manner. If consent for cookies and comparable recognition technologies is requested, processing is based exclusively on that consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. Consent may be withdrawn at any time.

You can configure your browser to notify you about cookies, allow them case by case, refuse them in certain cases or generally, and delete them automatically when closing the browser. Disabling cookies may limit website functionality. Further cookies and services used on this website are described in this policy.

Consent with Complianz

Our website uses Complianz consent technology to obtain and document consent for storing certain cookies or using certain technologies. The provider is Complianz B.V., Kalmarweg 14-5, 9723 JG Groningen, Netherlands (“Complianz”).

Complianz is hosted on our servers, so no connection is made to the provider’s servers. It stores a cookie in your browser to associate your consent or withdrawal with you. Data is stored until you request deletion, delete the Complianz cookie or the storage purpose ceases. Mandatory legal retention obligations remain unaffected.

Complianz is used to obtain legally required cookie consent. The legal basis is Article 6(1)(c) GDPR.

Contact form

If you send enquiries via the contact form, your details, including contact information, are stored to process the enquiry and handle follow-up questions. We do not share this data without your consent.

Processing is based on Article 6(1)(b) GDPR if the enquiry relates to a contract or pre-contractual measures. Otherwise, it is based on our legitimate interest in effective handling of enquiries under Article 6(1)(f) GDPR or on your consent under Article 6(1)(a) GDPR where requested. Consent may be withdrawn at any time.

Form data remains with us until you request deletion, withdraw storage consent or the purpose ceases, such as after the enquiry is completed. Mandatory legal provisions, particularly retention periods, remain unaffected.

Enquiries by email, telephone or fax

If you contact us by email, telephone or fax, your enquiry and the personal data arising from it, such as your name and enquiry, are stored and processed to handle your request. We do not share this data without your consent.

Processing is based on Article 6(1)(b) GDPR if the enquiry relates to a contract or pre-contractual measures. Otherwise, it is based on our legitimate interest in effective handling of enquiries under Article 6(1)(f) GDPR or on consent under Article 6(1)(a) GDPR where requested. Consent may be withdrawn at any time.

Data sent in contact enquiries remains with us until you request deletion, withdraw storage consent or the purpose ceases. Mandatory legal provisions, particularly retention periods, remain unaffected.

Communication via WhatsApp

We use WhatsApp, among other means, to communicate with customers and other third parties. The provider is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

Communication uses end-to-end encryption (peer-to-peer), preventing WhatsApp and other third parties from accessing message content. WhatsApp can, however, access metadata generated during communication, such as sender, recipient and time. WhatsApp also states that it shares users’ personal data with its US-based parent company Meta. Details are available in the WhatsApp privacy policy.

WhatsApp is used based on our legitimate interest in fast and effective communication with customers, interested parties and other business and contractual partners under Article 6(1)(f) GDPR. Where consent is requested, processing is based exclusively on consent, which may be withdrawn at any time with future effect.

WhatsApp communication content remains with us until you request deletion, withdraw storage consent or the purpose ceases, for example after an enquiry is completed. Mandatory statutory provisions, particularly retention periods, remain unaffected.

The company is certified under the EU–US Data Privacy Framework (DPF), an agreement intended to ensure European data protection standards for processing in the USA. Certified companies undertake to comply with those standards. Further details are available at the DPF participant page.

We use WhatsApp Business.

Transfers to the USA are based on the European Commission’s standard contractual clauses. Details are available in the WhatsApp business data transfer addendum.

We have concluded a data processing agreement with the provider named above.

5. Analytics and advertising

Matomo

This website uses the open-source web analytics service Matomo.

Matomo enables us to collect and analyse data about visitors’ use of the website. This can show, for example, when pages were viewed and the region from which views originated. We also collect log files, such as IP address, referrer, browser and operating system, and can measure actions such as clicks or purchases.

This analytics tool is used under Article 6(1)(f) GDPR. The website operator has a legitimate interest in analysing user behaviour to optimise its website and advertising. Where consent is requested, processing is based exclusively on Article 6(1)(a) GDPR and section 25(1) TDDDG insofar as consent covers storing cookies or accessing information on the user’s device, such as device fingerprinting, within the meaning of the TDDDG. Consent may be withdrawn at any time.

IP anonymisation

We use IP anonymisation with Matomo. Your IP address is shortened before analysis so that it can no longer be clearly assigned to you.

Hosting

We host Matomo exclusively on our own servers, so analytics data remains with us and is not passed on.

6. Plugins and tools

Google Fonts (local hosting)

This website uses Google Fonts supplied by Google for consistent typography. They are installed locally; no connection is made to Google servers.

See the Google Fonts FAQ and Google’s privacy policy.

7. Our own services

Handling applicant data

You may apply to us by email, post or online application form. Below we explain the scope, purpose and use of personal data collected during recruitment. We assure you that collection, processing and use comply with applicable data protection law and other statutory provisions and that your data is treated as strictly confidential.

Scope and purpose of collection

When you submit an application, we process associated personal data, such as contact and communication details, application documents and interview notes, where necessary to decide whether to establish an employment relationship. The legal bases are section 26 BDSG under German law, Article 6(1)(b) GDPR and, where you have consented, Article 6(1)(a) GDPR. Consent may be withdrawn at any time. Within our company, data is shared only with people involved in handling your application.

If your application is successful, the data submitted is stored in our systems under section 26 BDSG and Article 6(1)(b) GDPR to carry out the employment relationship.

During recruitment, we may also research you online, particularly using Google search, LinkedIn and Xing. The legal basis is our legitimate interest under Article 6(1)(f) GDPR in obtaining an overall impression from publicly available information.

Retention period

If we cannot offer you a position, you decline an offer or withdraw your application, we reserve the right to retain the submitted data on the basis of legitimate interests under Article 6(1)(f) GDPR for up to six months after the recruitment process ends. The data is then deleted and physical application documents destroyed. Retention serves particularly as evidence in the event of a legal dispute. If it is apparent that data will be needed after six months, for example because of threatened or pending litigation, deletion takes place only once the purpose for further retention ceases.

Longer retention may also occur where you have consented under Article 6(1)(a) GDPR or statutory retention obligations prevent deletion.

Inclusion in the applicant pool

If we do not offer you a position, you may be included in our applicant pool. Your application documents and details are then transferred to the pool so that we can contact you about suitable vacancies.

Inclusion requires your explicit consent under Article 6(1)(a) GDPR. Consent is voluntary and unrelated to the current application process. You may withdraw consent at any time. The data will then be irreversibly deleted unless statutory retention grounds apply.

Applicant-pool data is irreversibly deleted no later than two years after consent is given.