1. Information about the Data Controller

The controller under the GDPR for the processing of your data is:

Stephan Bode Hotelbetriebs- und Verwaltungs-GmbH
Rehteichweg 22
76332 Bad Herrenalb
Germany

Email:
Telephone: +49 7083 9270
Telefax: +49 7083 927555

2. Data Protection Officer

If you have questions about the processing of your data or would like to exercise your rights as a data subject, please contact us using the contact details mentioned above.

You may also contact our Data Protection Officer directly. You can reach her by e-mail at or using the following contact details:

To the Data Protection Officer of Stephan Bode Hotelbetriebs- und Verwaltungs-GmbH
c/o V-formation GmbH
Stephanienstr. 18
76133 Karlsruhe
Germany

Telephone: +49 721 17029034

3. General Notes

We process personal data in accordance with the GDPR and the BDSG only to the extent that is necessary to provide a functional website as well as our content and services.

A transfer to third parties only takes place if

• you have given your consent (Art. 6 para. 1 lit. a GDPR),
• the processing is necessary for the performance of a contract (Art. 6 para. 1 lit. b GDPR),
• there is a legal obligation (Art. 6 para. 1 lit. c GDPR), or
• legitimate interests prevail (Art. 6 para. 1 lit. f GDPR).

The website is fully encrypted via HTTPS/SSL.

4. Hosting

Our website is hosted by an external service provider based in Germany.

In the context of hosting, IP address, date/time of access, accessed content, browser and operating system data, as well as the referrer URL, are processed.

• Purpose: Delivery of the website, stability, security, prevention of misuse
• Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest)
• Storage period: usually 7 days (then deletion or anonymisation)

A data processing agreement in accordance with Art. 28 GDPR exists with the service provider..

5. SSL/TLS Encryption

This website uses SSL/TLS encryption to protect transmitted data from unauthorised access.

6. Newsletter

6.1 Registration & Sending

We use the double opt-in procedure for the newsletter. Mandatory information: e-mail address.

Voluntary information: topic interests (Hotel, Campus, Selfness).

• Legal basis: Art. 6 para. 1 lit. a GDPR (consent)
• Withdrawal: possible at any time via the unsubscribe link in the newsletter or by e-mail to
  

6.2 Mailchimp

The sending is carried out via Mailchimp (The Rocket Science Group LLC, 675 Ponce de Leon Ave NE, Atlanta, GA 30308, USA). Mailchimp processes data on our behalf..

• Legal basis: Art. 6 para. 1 lit. a GDPR (consent)
• Data transfer: USA; safeguarded by Standard Contractual Clauses (SCC) or the EU-US Data Privacy Framework (if applicable)
• Storage period: until withdrawal of consent

7. Cookies & Consent Management

We use cookies and similar technologies (e.g. pixels, tags). Your consents are managed with
Real Cookie Banner (devowl.io).

• Legal bases: Art. 6 para. 1 lit. c GDPR (obligation to provide evidence), Art. 6 para. 1 lit. f GDPR (legitimate interest)
• Storage period: documentation of consents for up to 3 years

Further information: Details about the data processing of Real Cookie Banner

8. Web Analysis & Marketing

8.1 Google Analytics 4

We use Google Analytics 4 (Google Ireland Limited, Dublin, Ireland). The data collected includes, among others: shortened IP address, device type, browser, interactions.

• Legal basis: Art. 6 para. 1 lit. a GDPR (consent)
• Transfer: if applicable, to Google LLC (USA), safeguarded via SCC or EU-US DPF (if applicable)
• Storage period: usually 14 months (depending on configuration)
• Withdrawal: via the cookie banner or the Browser Add-on

8.2 Google Tag Manager

The Google Tag Manager manages tags. According to Google, the service does not set its own cookies and does not process personal data for its own purposes.

8.3 Google Ads (Conversion Tracking)

To measure the success of our advertisements, we use Google Ads.

• Legal basis: Art. 6 para. 1 lit. a GDPR (consent)
• Transfer: if applicable, USA; safeguarded via SCC or EU-US DPF (if applicable)

8.4 LinkedIn Insight Tag

We use the LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company, Dublin, Ireland) for statistical evaluations and audience building.

• Legal basis: Art. 6 para. 1 lit. a GDPR (consent)
• Transfer: if applicable, USA; safeguarded via SCC or EU-US DPF (if applicable)

8.5 Triptease

We use Triptease (Triptease Ltd., London, UK) to optimise the booking experience.

• Legal basis: Art. 6 para. 1 lit. a GDPR (consent)
• Transfer: UK (adequate level of protection according to EU adequacy decision)

9. Booking System & Payment Processing

For online bookings, we use the system of HotelNetSolutions GmbH (Berlin, Germany).

The following data, among others, are processed: name, address, contact details, booking details, as well as payment information.

• Purpose: execution of reservations/bookings
• Legal basis: Art. 6 para. 1 lit. b GDPR (performance of contract)
• Recipient: payment service providers within the processing via the booking system

A data processing agreement in accordance with Art. 28 GDPR exists with HotelNetSolutions.

Further information about the provider: https://hotelnetsolutions.de/

10. Chat Application (Alveni AI)

Our website offers a chat function by Alveni AG, Balbweg 7, 8832 Wollerau, Switzerland.

We only process the data you voluntarily provide (e.g. name, e-mail, message), as well as technically necessary information (IP address, session cookie).

• Cookie storage duration: up to 3 months
• Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in direct communication)
• Note: use generally also possible anonymously; no advertising use/profile building

Further information: Alveni AI privacy policy

11. Social Media Plugins

We use social plugins from Facebook (Meta Platforms Ireland Ltd., Dublin, Ireland).

When activated/interacted with, data (e.g. IP address, visit time) may be transmitted to Meta and processed there.

• Legal basis: Art. 6 para. 1 lit. a GDPR (consent)
• Transfer: if applicable, USA; safeguarded via SCC or EU-US DPF (if applicable)

12. Rights of Data Subjects

You have the following rights at any time:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Objection (Art. 21 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawal of given consents (Art. 7 para. 3 GDPR)

Complaints can be addressed to the
Landesbeauftragten für Datenschutz und Informationsfreiheit Baden-Württemberg
Königstraße 10a, 70173 Stuttgart, Germany
www.baden-wuerttemberg.datenschutz.de

13. Storage Period

Personal data are stored only as long as necessary for the purposes stated or as required by law. After the purposes cease to apply or statutory retention periods expire, the data are deleted or anonymised.

14. Data Security

We take appropriate technical and organisational measures to protect personal data against loss, manipulation, and unauthorised access. Please note that data transmission over the Internet (e.g. communication by e-mail) may have security vulnerabilities.