Privacy Policy
Protecting your personal data is important to us. This Privacy Policy explains how we collect, use and protect your information.
If you have any questions, please contact our Data Protection Officer at info@hotelbuergerstube.de.
Privacy Policy for Hotel & Restaurant Bürgerstube in Accordance with the GDPR
1. Name and Address of the Data Controller
The controller responsible within the meaning of the General Data Protection Regulation (GDPR), the national data protection laws of EU Member States and other applicable data protection regulations is:
Hotel-Restaurant Bürgerstube
Blazenka Biester
Kolpingstraße 11
42551 Velbert
Germany
Tel.: +49 2051 54081
Fax: +49 2051 606835
Email: info@hotelbuergerstube.de
Website: www.hotelbuergerstube.de
2. Name and Address of the Data Protection Officer
The appointment of a Data Protection Officer is not required under Article 37(6) of the General Data Protection Regulation (GDPR).
For any data protection enquiries, please contact the owner and data controller, Ms Blazenka Biester, using the contact details provided in Section 1.
3. General Information on Data Processing
3.1. Scope of Personal Data Processing
We only process our users' personal data to the extent necessary to provide a functional website and our content and services.
As a rule, personal data is processed only with the user's consent. Exceptions apply where obtaining prior consent is not possible for practical reasons and the processing is permitted by law.
3.2. Legal Basis for Processing Personal Data
Where we obtain the data subject's consent to process personal data, the legal basis is Article 6(1)(a) of the General Data Protection Regulation (GDPR).
Where processing is necessary for the performance of a contract to which the data subject is a party, the legal basis is Article 6(1)(b) GDPR. This also applies to processing necessary for taking steps prior to entering into a contract.
Where processing is necessary to comply with a legal obligation to which our company is subject, the legal basis is Article 6(1)(c) GDPR.
Where processing is necessary to protect the vital interests of the data subject or another natural person, the legal basis is Article 6(1)(d) GDPR.
Where processing is necessary for the legitimate interests of our company or a third party, and these interests are not overridden by the interests, fundamental rights or freedoms of the data subject, the legal basis is Article 6(1)(f) GDPR.
3.3. Data Deletion and Retention Periods
Personal data will be deleted or its processing restricted once it is no longer required for the purpose for which it was collected.
Data may be retained for longer where required by European or national legislation, regulations or other legal provisions applicable to the data controller.
Personal data will also be deleted or its processing restricted once the applicable statutory retention period expires, unless further retention is necessary for entering into or performing a contract.
4. Website Provision and Server Log Files
4.1. Description and Scope of Data Processing
Each time our website is accessed, our system automatically collects data and information from the device used to access it.
The following data is collected:
User's IP address (anonymised)
Date and time of access
HTTP request line (requested URL path without the domain)
HTTP response body size
HTTP status code
Websites accessed via our website
Web browser used
Remote user
This data is also stored in our system's log files. It is not stored together with any other personal data relating to the user.
4.2. Legal Basis for Data Processing
The legal basis for the temporary storage of data and log files is Article 6(1)(f) of the General Data Protection Regulation (GDPR).
4.3. Purpose of Data Processing
Temporary storage of the user's IP address is necessary to deliver the website to their device. The IP address must therefore be stored for the duration of the session.
Log files are stored to ensure the website functions correctly, improve its performance and maintain the security of our IT systems.
The data is not analysed for marketing purposes.
These purposes also constitute our legitimate interest in processing the data under Article 6(1)(f) GDPR.
4.4. Data Retention Period
Data is deleted as soon as it is no longer required for the purpose for which it was collected.
Data collected to provide the website is deleted when the relevant session ends.
Data stored in log files is deleted within seven days. Longer retention is possible, provided that users' IP addresses are deleted or anonymised so that they can no longer be linked to an individual device.
4.5. Right to Object and Request Deletion
The collection of data necessary to provide the website and its storage in log files are essential for the operation of the website.
Users therefore cannot object to this processing.
5. Use of Cookies and External Services
5.1. Description and Scope of Data Processing
Our website uses cookies that you have enabled through the cookie consent banner. Cookies are text files stored by your web browser on your device.
The data collected through cookies is pseudonymised using technical measures, preventing it from being directly linked to individual users. This data is not stored together with other personal data.
Privacy information relating to the cookies enabled through the cookie consent banner can be found in the relevant privacy notices.
5.2. Legal Basis for Data Processing
The legal basis for processing personal data through technically necessary cookies and the external services mentioned above is Article 6(1)(f) of the General Data Protection Regulation (GDPR).
Where users have given their consent, the legal basis for processing personal data through analytics cookies and external services is Article 6(1)(a) GDPR.
5.3. Purpose of Data Processing
Analytics cookies help us improve the quality and content of our website. By understanding how visitors use our website, we can continuously improve our services.
These purposes also constitute our legitimate interest in processing personal data under Article 6(1)(f) GDPR.
5.4. Data Retention, Right to Object and Deletion
Cookies are stored on your device and transmit information to our website. You therefore have control over their use.
You can disable or restrict cookies through your browser settings and delete previously stored cookies at any time, including automatically.
Please note that disabling cookies may affect the functionality of certain features on our website.
6. Email Contact and Contact Form
6.1. Description and Scope of Data Processing
Our website provides email addresses that visitors can use to contact us. When you contact us by email, we store the personal data you provide.
You can also contact us directly through our website's contact form without using a separate email service. Personal data entered into the form is transmitted electronically to us.
We do not share this data with third parties. It is used solely to process and respond to your enquiry.
6.2. Legal Basis for Data Processing
The legal basis for processing personal data voluntarily submitted by email or through our contact form is consent under Article 6(1)(a) of the General Data Protection Regulation (GDPR).
The legal basis for processing data received by email is also Article 6(1)(f) GDPR.
Where email correspondence relates to entering into a contract, Article 6(1)(b) GDPR provides an additional legal basis.
6.3. Purpose of Data Processing
Personal data submitted through our contact form or by email is processed solely to handle your enquiry.
In the case of email correspondence, this also constitutes our legitimate interest in processing the data.
Any additional personal data collected during submission is used to prevent misuse of the contact form and maintain the security of our IT systems.
6.4. Data Retention Period
Personal data is deleted once it is no longer required for the purpose for which it was collected.
Data submitted by email or through our contact form is deleted when the correspondence has concluded and the matter has been fully resolved.
Additional personal data collected during submission is deleted within seven days.
6.5. Right to Withdraw Consent and Object to Processing
You may withdraw your consent to the processing of your personal data at any time.
If you contact us by email or through our contact form, you may also object to the storage of your personal data at any time. In this case, we will be unable to continue the correspondence.
You can submit your objection in writing to the person responsible for data protection.
All personal data stored in connection with your enquiry will then be deleted.
Werden personenbezogene Daten von Ihnen verarbeitet, sind Sie Betroffener i. S. d. DSGVO und es stehen Ihnen folgende Rechte geg
If your personal data is processed, you are considered a data subject under the General Data Protection Regulation (GDPR) and have the following rights in relation to the data controller.
7.1. Right of Access
You have the right to request confirmation from the data controller as to whether your personal data is being processed.
If your data is being processed, you may request information about:
The purposes for which your personal data is processed.
The categories of personal data being processed.
The recipients or categories of recipients to whom your personal data has been or will be disclosed.
The intended retention period or, where this cannot be specified, the criteria used to determine it.
Your rights to rectification, erasure, restriction of processing and objection to processing.
Your right to lodge a complaint with a supervisory authority.
Any available information about the source of your personal data, where it was not collected directly from you.
The existence of automated decision-making, including profiling, under Article 22(1) and (4) GDPR, together with meaningful information about the logic involved, its significance and its potential consequences for you.
You also have the right to know whether your personal data is transferred to a third country or international organisation. In such cases, you may request information about the appropriate safeguards under Article 46 GDPR.
The right of access may be restricted where exercising it would make scientific research or statistical purposes impossible or seriously impair them, provided that the restriction is necessary to achieve those purposes.
7.2. Right to Rectification
You have the right to request the correction of inaccurate personal data or the completion of incomplete personal data.
The data controller must make the necessary corrections without undue delay.
This right may be restricted where exercising it would make scientific research or statistical purposes impossible or seriously impair them, provided that the restriction is necessary to achieve those purposes.
7.3. Right to Restriction of Processing
You may request that the processing of your personal data be restricted in the following circumstances:
You contest the accuracy of your personal data, for a period allowing the data controller to verify its accuracy.
The processing is unlawful, but you oppose deletion and request restriction of use instead.
The data controller no longer requires your personal data, but you need it to establish, exercise or defend legal claims.
You have objected to processing under Article 21(1) GDPR, pending verification of whether the data controller's legitimate grounds override yours.
Where processing has been restricted, your personal data may only be processed, apart from storage:
With your consent.
To establish, exercise or defend legal claims.
To protect the rights of another individual or legal entity.
For reasons of important public interest under EU or Member State law.
The data controller will inform you before any restriction on processing is lifted.
7.4. Right to Erasure / Obligation to Erase
You have the right to request the erasure of your personal data without undue delay.
The data controller must erase your data without undue delay where any of the following applies:
Your personal data is no longer necessary for the purposes for which it was collected or otherwise processed.
You withdraw your consent under Article 6(1)(a) or Article 9(2)(a) GDPR, and there is no other legal basis for processing.
You object to processing under Article 21(1) GDPR and there are no overriding legitimate grounds, or you object under Article 21(2) GDPR.
Your personal data has been processed unlawfully.
Erasure is necessary to comply with a legal obligation under EU or Member State law applicable to the data controller.
Your personal data was collected in connection with the offer of information society services under Article 8(1) GDPR.
7.5. Notification of Third Parties
Where the data controller has made your personal data public and is required to erase it under Article 17(1) GDPR, reasonable steps will be taken, taking account of available technology and implementation costs, to inform other controllers processing the data of your request.
This includes informing them that you have requested the deletion of links to your personal data, as well as copies or reproductions of that data.
7.5.1. Exceptions
The right to erasure does not apply where processing is necessary:
To exercise the right to freedom of expression and information.
To comply with a legal obligation under EU or Member State law, or to perform a task carried out in the public interest or in the exercise of official authority vested in the data controller.
For reasons of public interest in the area of public health under Article 9(2)(h) and (i) and Article 9(3) GDPR.
For archiving purposes in the public interest, scientific or historical research, or statistical purposes under Article 89(1) GDPR, where erasure would make these purposes impossible or seriously impair them.
To establish, exercise or defend legal claims.
7.6. Right to Notification
If you exercise your rights to rectification, erasure or restriction of processing, the data controller must inform all recipients to whom your personal data has been disclosed, unless doing so is impossible or involves disproportionate effort.
You have the right to be informed about these recipients.
7.7. Right to Data Portability
You have the right to receive personal data that you have provided to the data controller in a structured, commonly used and machine-readable format.
You also have the right to transmit this data to another controller without hindrance, provided that:
Processing is based on consent under Article 6(1)(a) or Article 9(2)(a) GDPR, or on a contract under Article 6(1)(b) GDPR.
Processing is carried out by automated means.
Where technically feasible, you may request that your personal data be transferred directly from one controller to another.
This right must not adversely affect the rights and freedoms of others.
The right to data portability does not apply where processing is necessary to perform a task carried out in the public interest or in the exercise of official authority vested in the data controller.
7.8. Right to Object
You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Article 6(1)(e) or (f) GDPR. This also applies to profiling based on these provisions.
Following an objection, the data controller will cease processing your personal data unless compelling legitimate grounds can be demonstrated that override your interests, rights and freedoms, or processing is necessary to establish, exercise or defend legal claims.
Where your personal data is processed for direct marketing purposes, you have the right to object at any time. This also applies to profiling related to direct marketing.
If you object to processing for direct marketing purposes, your personal data will no longer be used for those purposes.
When using information society services, you may exercise your right to object through automated means using technical specifications, notwithstanding Directive 2002/58/EC.
You also have the right to object, on grounds relating to your particular situation, to the processing of personal data for scientific or historical research or statistical purposes under Article 89(1) GDPR.
This right may be restricted where exercising it would make research or statistical purposes impossible or seriously impair them, provided that the restriction is necessary to achieve those purposes.
7.9. Right to Withdraw Consent
You have the right to withdraw your consent to the processing of your personal data at any time.
Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of your consent before its withdrawal.
8. Automated Individual Decision-Making, Including Profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.
This does not apply where the decision:
Is necessary for entering into or performing a contract between you and the data controller.
Is authorised by EU or Member State law applicable to the data controller, provided that the law includes appropriate measures to safeguard your rights, freedoms and legitimate interests.
Is based on your explicit consent.
Such decisions must not be based on special categories of personal data under Article 9(1) of the General Data Protection Regulation (GDPR), unless Article 9(2)(a) or (g) GDPR applies and appropriate measures are in place to protect your rights, freedoms and legitimate interests.
In cases (1) and (3), the data controller must implement appropriate safeguards to protect your rights, freedoms and legitimate interests.
These safeguards must include, at a minimum, your right to:
Obtain human intervention from the data controller.
Express your point of view.
Contest the decision.
9. Right to Lodge a Complaint with a Supervisory Authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, particularly in the EU Member State of your habitual residence, place of work or the location of the alleged infringement, if you believe that the processing of your personal data violates the General Data Protection Regulation (GDPR).
The supervisory authority with which the complaint is lodged will inform you of its progress and outcome, including your right to a judicial remedy under Article 78 GDPR.
Responsible Data Protection Supervisory Authority:
State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia
(Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen)
Kavalleriestraße 2–4
40213 Düsseldorf
Germany
Tel.: +49 211 38424-0
Fax: +49 211 38424-10
Email: poststelle@ldi.nrw.de