Privacy Policy – Website www.landhotel.de

This privacy policy informs you, pursuant to Art. 13 and 14 GDPR, about the personal data we process when you visit www.landhotel.de and during your stay. Separate privacy policies apply to online booking (onepagebooking.com) and to our online shop; you will find them in the respective application.

1. Controller

Landhotel Voshövel GmbH
Am Voshövel 1, 46514 Schermbeck, Germany
Phone: +49 2856 91400 · Email: post@landhotel.de
Managing directors: Christopher Klump, Katharina Klump
Commercial register: HRB 10680, Local Court Duisburg

2. Data protection officer

DataCo GmbH (DataGuard), Nymphenburger Str. 86, 80636 Munich, Germany
Phone: +49 89 7400 45840 · Email: datenschutz@dataguard.de

3. General principles

Legal bases. We only process personal data where a legal basis exists, in particular your consent (Art. 6(1)(a) GDPR), the performance of a contract or pre-contractual measures (Art. 6(1)(b)), a legal obligation (Art. 6(1)(c)) or our legitimate interests (Art. 6(1)(f)). Where we store or access information on your device, the legal basis is Section 25(1) TDDDG (consent) or Section 25(2) no. 2 TDDDG (strictly necessary).

Retention. We delete data once the purpose no longer applies and no statutory retention obligations prevent deletion. Under German tax and commercial law (Section 147 AO, Section 257 HGB) we keep accounting records and invoices for eight years, business correspondence for six years and annual financial statements for ten years.

Recipients and processors. We use service providers who process data on our behalf under agreements pursuant to Art. 28 GDPR. Beyond that, we only disclose data where this is necessary to perform a contract, you have consented, or we are legally obliged to do so.

Transfers to third countries. Some providers process data in the USA. We only transfer data where the provider is certified under the EU-US Data Privacy Framework (adequacy decision under Art. 45 GDPR) or EU Standard Contractual Clauses under Art. 46 GDPR have been agreed. Adequacy decisions exist for Switzerland and the United Kingdom.

Provision of data and automated decisions. Providing your data is voluntary. However, we cannot conclude a contract without the information required for it. We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

4. Operation of the website

4.1 Hosting and content management

Our website is operated and hosted by vioma GmbH, Scheerbünd 4, 77654 Offenburg, Germany (content management system Condeon). vioma processes all data arising when the website is accessed. The legal basis is our legitimate interest in a secure and reliable website (Art. 6(1)(f) GDPR). A data processing agreement is in place with vioma.

4.2 Server log files

When you access the website, your browser automatically transmits: IP address, date and time, page requested, referrer URL, browser type and version, and operating system. We use this data to deliver the website and ensure its security (Art. 6(1)(f) GDPR). Log files are deleted once they are no longer needed for these purposes; they may be kept longer to investigate a security incident.

4.3 SSL/TLS encryption

This website uses SSL/TLS encryption, recognisable by “https://” and the padlock symbol in your browser’s address bar.

4.4 Cookies and consent management

We use strictly necessary cookies, for example to store your language and cookie settings (Section 25(2) no. 2 TDDDG, Art. 6(1)(f) GDPR). We only use all other cookies and similar technologies (analytics, marketing, external content) with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).

We obtain your consent via the consent tool of vioma GmbH. It stores your choice in a cookie and logs it so that we can demonstrate consent (Art. 7(1), Art. 6(1)(c) GDPR). You can change or withdraw your choice at any time via the “Privacy settings” link in the website footer.

4.5 Contact by email, phone or form

When you contact us, we process your details (e.g. name, email address, phone number, request) to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract, otherwise our legitimate interest in handling enquiries (Art. 6(1)(f)). We delete the data once your enquiry has been dealt with and no retention obligations apply.

4.6 Offer requests and messenger (vioma OFFER / ReGuest)

For online requests, individual offers and online advice via messenger we use vioma OFFER (ReGuest) by vioma GmbH. We process your contact details, travel dates, number and age of travellers and the offer you are interested in. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures). A data processing agreement is in place with vioma.

4.7 Chat (DialogShift)

Our website chat is provided by DialogShift GmbH, Torstr. 201, 10115 Berlin, Germany. We process the chat content and any details you voluntarily provide, such as name, email address or phone number, to answer your questions and to analyse chat usage statistically. A cookie with a unique ID is set to recognise your device. The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). The cookie and chat history are deleted 90 days after last use. A data processing agreement is in place with DialogShift.

4.8 Table reservations (aleno)

Online table reservations for our restaurant and the Lindenstube are handled via aleno, a system of aleno AG, Technoparkstrasse 1, 8005 Zurich, Switzerland. We process your name, contact details, date, time, party size and comments (e.g. occasion). The legal basis is Art. 6(1)(b) GDPR. If you voluntarily tell us about allergies or intolerances, we process this information solely to prepare your food, based on your explicit consent (Art. 9(2)(a) GDPR). The European Commission has issued an adequacy decision for Switzerland. A data processing agreement is in place with aleno.

4.9 Newsletter (vioma NEWSLETTER)

To send our newsletter we need your email address. After signing up you receive a confirmation email (double opt-in). We log sign-up and confirmation with time and IP address as proof. Sending and analysis are carried out with vioma NEWSLETTER by vioma GmbH. We measure whether and when a newsletter is opened and which links are clicked, in order to tailor future newsletters to your interests. We can also see whether a booking was made after a link in the newsletter was clicked.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time via the unsubscribe link in the newsletter or by email to post@landhotel.de. After you unsubscribe, we keep your email address on a block list so that you receive no further newsletters (Art. 6(1)(f) GDPR). A data processing agreement is in place with vioma.

4.10 Links to booking, shop, social networks and WhatsApp

Our website links to online booking (onepagebooking.com), our online shop for vouchers, products and event tickets, our profiles on Facebook, Instagram, Pinterest and YouTube, and our WhatsApp channel. These are simple links: no data is transferred until you click them. From then on, the privacy policy of the respective provider applies. For Facebook, Instagram and WhatsApp this is Meta Platforms Ireland Ltd. or WhatsApp Ireland Ltd., Merrion Road, Dublin 4, Ireland.

5. Embedded content

5.1 YouTube

We embed YouTube videos in privacy-enhanced mode. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Videos are only loaded after you consent. When a video plays, data such as your IP address and the page visited are transmitted to YouTube; YouTube may set cookies and link the data to your Google account if you are logged in. The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). Once a video has loaded, YouTube may connect to Google’s DoubleClick advertising network even if the video is not played. Google is certified under the EU-US Data Privacy Framework. More information: https://policies.google.com/privacy

5.2 OpenStreetMap

For our directions map we use OpenStreetMap by the OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom. When the map loads, your IP address is transmitted to OSMF servers. The map is only loaded after you consent (Art. 6(1)(a) GDPR). An adequacy decision exists for the United Kingdom. More information: https://wiki.osmfoundation.org/wiki/Privacy_Policy

6. Analytics and marketing

We only use the services in this section if you have consented in the cookie banner (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw your consent at any time via “Privacy settings” in the footer. The US providers Google, Meta, Microsoft and Pinterest are certified under the EU-US Data Privacy Framework.

6.1 Google Analytics 4 with Google Signals

We use Google Analytics 4 by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to analyse how our website is used, e.g. page views, time on site, device, approximate location, clicks and scroll depth. The “demographics” feature provides aggregated reports on age, gender and interests that cannot be attributed to any individual. E-commerce measurement lets us analyse bookings and purchases (e.g. revenue, product, time). With Google Signals, Google can link this data to your Google account if you are logged in and have allowed personalised advertising; this enables cross-device reports and advertising audiences. IP addresses are truncated within the EU. User-level data is deleted after 14 months. A data processing agreement is in place with Google.

6.2 Google Ads and conversion tracking

We run ads via Google Ads (Google Ireland Limited). Conversion tracking tells us whether someone completed, for example, a booking or enquiry after clicking an ad. Remarketing allows us to show ads on other websites to people who have visited ours. Google uses cookies and similar identifiers for this.

6.3 Meta Pixel

We use the Meta Pixel by Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland. It measures the actions visitors take after clicking a Facebook or Instagram ad and allows us to show ads on Facebook and Instagram to visitors of our website. We are joint controllers with Meta for collecting and transmitting the data (Art. 26 GDPR); the agreement is available at https://www.facebook.com/legal/controller_addendum. Meta is solely responsible for any further processing.

6.4 Microsoft Advertising (UET)

We use Microsoft Advertising with Universal Event Tracking (UET). The EU contact is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. UET collects data such as a truncated IP address, device information, pages visited and the Microsoft Click ID, to measure the success of our ads in Bing search and to enable remarketing.

6.5 Pinterest Tag

We use the Pinterest Tag by Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland. It measures the actions users take on our website after clicking a Pinterest ad and enables ads on Pinterest for visitors of our website.

6.6 ReGuest Remarketing

We use the remarketing function of ReGuest GmbH, Kuperionstr. 34, 39012 Merano, Italy. Using a cookie, it recognises which offers you have viewed on our website so that we can show you suitable offers. A data processing agreement is in place with ReGuest.

6.7 Further information and opt-out options

Provider privacy policies: Google (https://policies.google.com/privacy), Meta (https://www.facebook.com/privacy/policy), Microsoft (https://privacy.microsoft.com/en-gb/privacystatement), Pinterest (https://policy.pinterest.com/en/privacy-policy). Regardless of your cookie choice, you can turn off personalised advertising in your Google account (https://myadcenter.google.com), in the ad settings of Meta and Pinterest, and via https://www.youronlinechoices.com.

7. Guest services and your stay

7.1 Booking, stay and hotel software (Shiji Daylight)

For reservations, your stay, billing and accounting we process your contact and booking details, services used during your stay and payment data. The legal basis is Art. 6(1)(b) GDPR, and Art. 6(1)(c) GDPR for retention under tax and commercial law. We use the property management system Shiji Daylight by Shiji Deutschland GmbH, Tempelhofer Ufer 1, 10961 Berlin, Germany. It is connected to our point-of-sale system Shiji Infrasys (restaurant, bar and room charges) and to card payments via PAYONE and Shiji Payments. Until the migration is complete, we also keep existing guest data in our previous system protel and then delete it there in line with statutory retention periods. A data processing agreement is in place with Shiji.

7.2 Registration form

Under Sections 29 and 30 of the German Federal Registration Act (BMG), guests who are not German nationals must complete a registration form on arrival (including name, date of birth, nationality, address and travel document). The legal basis is Art. 6(1)(c) GDPR. We keep the form for one year from arrival and destroy it within three months thereafter. We transmit it to the competent authorities on request.

7.3 Guest feedback (vioma BAROMETER)

After your stay we invite you by email to take part in a satisfaction survey. For this we transmit your name, email address and stay details to vioma GmbH. The legal basis is our legitimate interest in improving our services (Art. 6(1)(f) GDPR). You can object at any time, e.g. at check-in or via the link in the invitation. If we publish your free-text comment in the quality seal on our website, we only do so with your consent (Art. 6(1)(a) GDPR). Merely viewing the seal or the page with the comments does not involve any processing of personal data by vioma BAROMETER. A data processing agreement is in place with vioma.

7.4 Video surveillance

We use video surveillance in outdoor areas (car parks, entrances, delivery area, emergency exits) to protect guests, staff and property and to prevent and investigate criminal offences. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). Monitored areas are signposted. Recordings are automatically deleted after 72 hours unless an incident requires longer storage. Only authorised persons have access; we only pass recordings to authorities where legally required or to prosecute criminal offences.

7.5 Digital guest folder (Guestnet)

Before and during your stay we provide a digital guest folder as a web app by Guestnet GmbH, Dantestraße 24, 39042 Brixen, Italy. You receive the link by email about three days before arrival. For this, Guestnet takes your name, room number and stay details from our hotel software. In the guest folder you can view the weekly programme, request room service, spa services or shop items and give feedback. We process these requests to fulfil them (Art. 6(1)(b) GDPR). You only receive push notifications if you allow them on your device (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).

7.6 Spa and wellness treatments

For appointments in the Livingroom SPA and Day Spa we process your name, contact details, appointments, treatments booked, cancellations and billing data (Art. 6(1)(b) GDPR). Treatments for hotel guests are charged to the room via our hotel software.

If we ask about health matters before a treatment (e.g. pregnancy, allergies, skin conditions, medication), this is for your safety. We only process this information with your explicit consent (Art. 9(2)(a) GDPR) and solely for the treatment. You can withdraw your consent at any time; we may then be unable to carry out the treatment concerned. We delete health information once it is no longer needed for the treatment.

7.7 Guest Wi-Fi

When you use our Wi-Fi, our network equipment processes your device’s IP and MAC address, connection times and data volume. This is necessary to provide access, prevent misuse and fix faults (Art. 6(1)(b) and (f) GDPR). We do not analyse the content of your communications. Connection logs are deleted once they are no longer needed for these purposes.

7.8 Bookings via booking portals

If you book via a portal such as Booking.com (Booking.com B.V., Herengracht 597, 1017 CE Amsterdam, Netherlands), we receive your contact and booking details from the portal to carry out the booking (Art. 6(1)(b) GDPR). The portal is responsible for processing on its own platform; its privacy policy applies.

7.9 Guest communication and CRM (ReGuest)

We create and send offers, booking confirmations and messages before and after your stay with ReGuest (ReGuest GmbH, Kuperionstr. 34, 39012 Merano, Italy). For this, your name, contact details, booking and stay details and requests are taken from our hotel software (Art. 6(1)(b) GDPR). We do not use ReGuest for marketing emails.

7.10 Other recipients

In addition, the following recipients receive guest data where necessary for their task:

Recipient	Purpose	Place of processing
Electronic locking system	Room keys and access	on site at the hotel
Microsoft 365 (Microsoft Ireland Operations Ltd.)	Email, documents, collaboration	EU; access from the USA possible, Microsoft is certified under the EU-US Data Privacy Framework
IT service provider	Maintenance, support, backups	Germany
Tax adviser	Accounting and annual accounts	Germany
Payment service providers and banks	Card payments at the hotel	EU
Authorities	Registration form, statutory disclosure obligations	Germany

We have concluded data processing agreements with service providers who process data on our behalf.

8. Your rights

You have the right at any time to:

• access the data we hold about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• withdraw consent with effect for the future (Art. 7(3) GDPR)

Please contact post@landhotel.de or our data protection officer.

Right to object (Art. 21 GDPR). Where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims. You may object to processing for direct marketing purposes at any time without giving reasons.

Right to lodge a complaint. You may lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.

9. Changes

We update this privacy policy when our services or the legal situation change. The version published on this page applies.

Last updated: October 2026