Privacy Policy

Privacy Policy

We, Hotel Bayern Vital, take the protection of your personal data very seriously and strictly comply with the provisions of data protection laws. Personal data is collected on this website only to the extent technically necessary. Under no circumstances will the data collected be sold or passed on to third parties for any other reasons. The following statement provides you with an overview of how we ensure this protection and what type of data is collected for what purpose.

§1. General information

Your personal data (e.g. title, name, address, email address, telephone number) is processed by us only in accordance with the provisions of German data protection law and the data protection law of the European Union (EU). The provisions below inform you, in addition to the purposes of processing, recipients, legal bases and retention periods, also about your rights and the controller responsible for processing your data. This privacy policy applies only to our websites. If you are redirected to other websites via links on our pages, please inform yourself there about how your data is handled in each case.

§2 Contact

The controller pursuant to Article 4(7) GDPR is:

Elos Hospitality GmbH, Luitpoldstrasse 8, 83435 Bad Reichenhall

Data Protection Officer:

Claus Linhard

Luitpoldstrasse 8

83435 Bad Reichenhall

Contact: info@hotel-bayern-vital.de

(1) Purpose of processing

We process your personal data that you provide to us via email, contact form, etc. in order to respond to and handle your enquiries. You are not obliged to provide us with your personal data. However, without providing your email address, we cannot reply to you by email.

(2) Legal bases

1. a) If you have given us your explicit consent to process your data, Art. 6(1)(a) GDPR is the legal basis for this processing.

2. b) If we process your data to carry out pre-contractual measures, Art. 6(1)(b) GDPR is the legal basis.

3. c) In all other cases (in particular when using a contact form), Art. 6(1)(f) GDPR is the legal basis.

RIGHT TO OBJECT:
You have the right to object at any time, on grounds relating to your particular situation, to the processing of data based on Art. 6(1)(f) GDPR that is not carried out for direct marketing purposes.

In the case of direct marketing, however, you may object to the processing at any time without giving reasons.

(3) Legitimate interest

Our legitimate interest in processing is to communicate with you quickly and to respond to your enquiries cost-effectively. If you provide us with your address, we reserve the right to use it for direct postal marketing. You can safeguard your interest in data protection by disclosing data sparingly (e.g. using a pseudonym).

(4) Categories of recipients

Hosting provider, shipping service providers for direct marketing

(5) Storage period

Your data will be deleted if the circumstances indicate that your enquiry or the matter in question has been conclusively clarified. However, if a contract is concluded, we will retain the data required under commercial and tax law for the legally prescribed periods, i.e. generally ten years (cf. § 257 HGB, § 147 AO).

(6) Right of withdrawal

If processing is based on your consent, you have the right to withdraw your consent at any time.

§3 Use of etracker

The provider of this website uses services of etracker GmbH from Hamburg, Germany (www.etracker.com) to analyse usage data. Cookies are used for this purpose, enabling a statistical analysis of the use of this website by its visitors as well as the display of usage-related content or advertising. Cookies are small text files that are stored by the internet browser on the user’s device. etracker cookies do not contain any information that would allow a user to be identified. The data generated with etracker is processed and stored by etracker on behalf of the provider of this website exclusively in Germany and is therefore subject to strict German and European data protection laws and standards. etracker has been independently audited, certified and awarded the data protection seal ePrivacyseal. Data processing is carried out on the legal basis of Art. 6(1)(f) (legitimate interest) of the EU General Data Protection Regulation (EU GDPR). Our legitimate interest lies in optimising our online offering and our website. As the privacy of our visitors is particularly important to us, the IP address is anonymised by etracker at the earliest possible stage and login or device identifiers are converted by etracker into a unique key that is not assigned to a person. etracker does not use the data for any other purpose, combine it with other data or pass it on to third parties. You may object to the data processing described above at any time insofar as it involves personal data. Your objection will have no adverse consequences for you.

§4 Cookies

(1) Purpose of processing

Technically necessary cookies are used on this website. These are small text files that are stored in or by your internet browser on your computer system.

(2) Legal basis

The legal basis for this processing is Art. 6(1)(f) GDPR.

(3) Legitimate interest

Our legitimate interest is the functionality of our website. The usage data collected through technically necessary cookies is not used to create user profiles. This safeguards your interest in data protection.

(4) Storage period

Technically necessary cookies are generally deleted when you close your browser. Permanently stored cookies have a varying lifespan ranging from a few minutes to several years.

(5) RIGHT TO OBJECT

If you do not wish these cookies to be stored, please disable the acceptance of these cookies in your internet browser. However, this may result in limited functionality of our website. You can also delete permanently stored cookies at any time via your browser.

§5 Newsletter

(1) Purpose of processing

When you subscribe to the newsletter, your email address is used for advertising purposes, i.e. as part of the newsletter we will inform you in particular about products from our range. For statistical purposes, we may evaluate which links in the newsletter are clicked. It is not possible for us to identify which specific person clicked. You have given the consent below separately or, if applicable, expressly during the ordering process: Thank you for your interest! To subscribe to the monthly newsletter, please complete the newsletter form.

Enabling and carrying out the guest’s booking; providing the guest’s stay; coordinating the stay with the guest’s wishes and interests; the possibility of offering services in the future in line with the guest’s interests; marketing in connection with the hotel’s services and improving the hotel’s services

(2) Legal basis

The legal basis for this processing is Art. 6(1)(a) GDPR.

(3) Categories of recipients

If applicable, newsletter dispatch provider

(4) Storage period

Your email address will be stored for newsletter dispatch only for the duration of the subscription you have requested.

(5) Right of withdrawal

You may withdraw your consent at any time with effect for the future. If you no longer wish to receive the newsletter, you can unsubscribe as follows: You can unsubscribe at any time via an unsubscribe link in the newsletter. We will then delete your data immediately.

§6 Rights of the data subject

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller:

1. Right of access

You may request confirmation from the controller as to whether personal data concerning you is being processed by us. If such processing is taking place, you may request information from the controller about the following:

(1) the purposes for which the personal data is processed;

(2) the categories of personal data being processed;

(3) the recipients or categories of recipients to whom the personal data concerning you has been disclosed or will be disclosed;

(4) the planned duration for which the personal data concerning you will be stored or, if specific information is not possible, the criteria used to determine the storage period;

(5) the existence of a right to rectification or erasure of the personal data concerning you, a right to restriction of processing by the controller, or a right to object to such processing;

(6) the existence of a right to lodge a complaint with a supervisory authority;

(7) all available information about the source of the data if the personal data is not collected from the data subject;

(8) the existence of automated decision-making, including profiling, pursuant to Art. 22(1) and (4) GDPR and—at least in those cases—meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

You have the right to request information as to whether the personal data concerning you is transferred to a third country or to an international organisation. In this context, you may request to be informed about the appropriate safeguards pursuant to Art. 46 GDPR in connection with the transfer.

2. Right to rectification

You have the right to rectification and/or completion vis-à-vis the controller if the processed personal data concerning you is inaccurate or incomplete. The controller must carry out the rectification without undue delay.

3. Right to restriction of processing

You may request the restriction of processing of the personal data concerning you under the following conditions:

(1) if you contest the accuracy of the personal data concerning you for a period enabling the controller to verify the accuracy of the personal data;

(2) if the processing is unlawful and you oppose the erasure of the personal data and request the restriction of the use of the personal data instead;

(3) if the controller no longer needs the personal data for the purposes of processing, but you require it for the establishment, exercise or defence of legal claims; or

(4) if you have objected to processing pursuant to Art. 21(1) GDPR and it has not yet been determined whether the controller’s legitimate grounds override your grounds. If the processing of the personal data concerning you has been restricted, such data may—apart from being stored—be processed only with your consent or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a Member State. If the restriction of processing has been restricted under the conditions stated above, you will be informed by the controller before the restriction is lifted.

4. Right to erasure

a) Obligation to erase

You may request that the controller erase the personal data concerning you without undue delay, and the controller is obliged to erase this data without undue delay if one of the following reasons applies:

(1) The personal data concerning you is no longer necessary for the purposes for which it was collected or otherwise processed.

(2) You withdraw your consent on which the processing was based pursuant to Art. 6(1)(a) or Art. 9(2)(a) GDPR, and there is no other legal basis for the processing.

(3) You object to the processing pursuant to Art. 21(1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21(2) GDPR.

(4) The personal data concerning you has been processed unlawfully.

(5) The erasure of the personal data concerning you is necessary for compliance with a legal obligation under Union law or the law of the Member States to which the controller is subject.

(6) The personal data concerning you was collected in relation to the offer of information society services pursuant to Art. 8(1) GDPR.

b) Information to third parties

If the controller has made the personal data concerning you public and is obliged pursuant to Art. 17(1) GDPR to erase it, the controller shall, taking account of available technology and the cost of implementation, take reasonable measures, including technical measures, to inform controllers processing the personal data that you, as the data subject, have requested the erasure by such controllers of any links to, or copy or replication of, that personal data.

to service providers and their assistants who provide cloud-based software and data processing solutions for the hotel and, on behalf of the hotel, evaluate and process the guest’s data (for the purposes stated above)

c) Exceptions

The right to erasure does not apply insofar as processing is necessary

(1) for exercising the right of freedom of expression and information;

(2) for compliance with a legal obligation that requires processing under Union law or the law of the Member States to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

(3) for reasons of public interest in the area of public health pursuant to Art. 9(2)(h) and (i) as well as Art. 9(3) GDPR;

(4) for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes pursuant to Art. 89(1) GDPR, insofar as the right referred to in section a) is likely to render impossible or seriously impair the achievement of the objectives of that processing; or

(5) for the establishment, exercise or defence of legal claims.

5. Right to be informed

If you have asserted your right to rectification, erasure or restriction of processing vis-à-vis the controller, the controller is obliged to notify all recipients to whom the personal data concerning you has been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves disproportionate effort. You have the right vis-à-vis the controller to be informed about these recipients.

6. Right to data portability

You have the right to receive the personal data concerning you that you have provided to the controller in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller to whom the personal data has been provided, provided that

(1) the processing is based on consent pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR or on a contract pursuant to Art. 6(1)(b) GDPR, and

(2) the processing is carried out by automated means.

In exercising this right, you also have the right to have the personal data concerning you transmitted directly from one controller to another controller, where technically feasible. The freedoms and rights of other persons must not be adversely affected thereby. The right to data portability does not apply to processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

7. Right to object

You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you that is carried out on the basis of Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions. The controller will no longer process the personal data concerning you unless the controller demonstrates compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. If the personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing; this also applies to profiling insofar as it is related to such direct marketing. If you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for these purposes. You have the option, in connection with the use of information society services—regardless of Directive 2002/58/EC—to exercise your right to object by automated means using technical specifications.

8. Right to withdraw consent under data protection law

You have the right to withdraw your declaration of consent under data protection law at any time. The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

9. Automated individual decision-making, including profiling

You have the right not to be subject to a decision based solely on automated processing—including profiling—that produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision

(1) is necessary for entering into, or performance of, a contract between you and the controller,

(2) is authorised by Union or Member State law to which the controller is subject and that law contains suitable measures to safeguard your rights and freedoms and your legitimate interests, or

(3) is based on your explicit consent.

However, such decisions must not be based on special categories of personal data pursuant to Art. 9(1) GDPR, unless Art. 9(2)(a) or (g) applies and suitable measures to protect your rights and freedoms and your legitimate interests have been taken.

With regard to the cases referred to in (1) and (3), the controller shall implement suitable measures to safeguard your rights and freedoms and your legitimate interests, including at least the right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision.

10. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.

The supervisory authority with which the complaint has been lodged shall inform the complainant of the status and the outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.

Controller responsible for data processing:

Elos Hospitality GmbH

Contact details of our Data Protection Officer:

Luitpoldstrasse 8

83435 Bad Reichenhall

Competent supervisory authority:

Bavarian State Office for Data Protection Supervision

P.O. Box 606

91511 Ansbach

Telephone: +49 (0) 981 53 1300