Privacy
Privacy Notice pursuant to Art. 13 GDPR
Name and Address of the Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection provisions is:
Hotel Bamberger Hof Bellevue OHG
Management: Alexandra Bruckner
Schönleinsplatz 4
96047 Bamberg
Germany
Phone: 0951-98550
Email: info(at)bambergerhof.de
General Information on Data Processing
Legal Basis for the Processing of Personal Data
In accordance with Art. 13 GDPR, we inform you of the legal bases for our data processing activities. Where the legal basis is not stated explicitly in this privacy notice, the following applies:
The legal basis for obtaining consent is Art. 6(1)(a) in conjunction with Art. 7 GDPR. The legal basis for processing to perform our services and carry out contractual measures, as well as to respond to inquiries, is Art. 6(1)(b) GDPR. The legal basis for processing to fulfil our legal obligations is Art. 6(1)(c) GDPR. Where processing of your data is necessary to safeguard a legitimate interest of our company or of a third party, and where your interests, fundamental rights and freedoms do not override that interest, Art. 6(1)(f) GDPR serves as the legal basis for the processing. Should the processing of personal data become necessary to protect the vital interests of the data subject or of another natural person, Art. 6(1)(d) GDPR serves as the legal basis.
Data Erasure and Storage Period
We adhere to the principles of data minimisation pursuant to Art. 5(1)(c) GDPR and storage limitation pursuant to Art. 5(1)(e) GDPR. We store your personal data only for as long as necessary to achieve the purposes stated here, or as required by statutory retention periods. Once the purpose no longer applies, or once these retention periods expire, the corresponding data is deleted as soon as possible.
Note on Data Transfer to Third Countries
Tools from companies based in third countries are also integrated into our website. If these tools are active, your personal data may be transmitted to the servers of the respective companies. The level of data protection in third countries generally does not correspond to that of EU data protection law. This means there is a risk that your data may be disclosed to authorities in those countries. We have no influence over these processing activities.
External Links
This website may contain links to third-party websites or to other websites for which we are not responsible. If you follow a link to a website outside our responsibility, please note that these websites have their own privacy notices. We accept no responsibility or liability for these external websites or their privacy notices. Before using these websites, please check whether you agree with the privacy policies provided there.
You can recognise external links either because they are displayed in a different colour from the rest of the text, or because they are underlined. Your cursor will indicate an external link when you hover over it. Only when you click on an external link is your personal data transmitted to the destination of the link. The operator of the other website receives, in particular, your IP address, the time at which you clicked the link, the page on which you clicked the link, as well as further information that you can find in the respective provider’s privacy notice.
Please also note that individual links may lead to data being transferred outside the European Economic Area. This could give foreign authorities access to your data. You may not have any legal remedies against such access. If you do not want your personal data to be transmitted to the link’s destination, or exposed to access by foreign authorities, please do not click on any links.
Rights of the Data Subject
As a data subject within the meaning of the GDPR, you have the option of asserting various rights. The rights granted to data subjects under the GDPR are the right of access (Article 15), the right to rectification (Article 16), the right to erasure (Article 17), the right to restriction of processing (Article 18), the right to object (Article 21), the right to lodge a complaint with a supervisory authority, and the right to data portability (Article 20).
Right of Withdrawal
Some data processing operations can only take place with your express consent. You may withdraw your consent at any time. The lawfulness of the processing carried out up to the point of withdrawal remains unaffected by the withdrawal.
Right to Object
Where processing is based on Art. 6(1)(e) or (f) GDPR, you as the data subject have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you. This right also applies to profiling based on these provisions within the meaning of Art. 4(4) GDPR. Unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims, we will cease processing your data following your objection.
Where personal data is processed for the purpose of direct marketing, you also have the right to object at any time. The same applies to profiling connected with such direct marketing. In this case too, we will no longer process personal data once you have objected.
Right to Lodge a Complaint with a Supervisory Authority
If you believe that the processing of personal data concerning you infringes the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work, or the place of the alleged infringement, without prejudice to any other administrative or judicial remedy.
Right to Data Portability
Where your data is processed by automated means on the basis of consent or the performance of a contract, you have the right to receive that data in a structured, commonly used and machine-readable format. You also have the right to request that the data be transmitted and provided to another controller, insofar as this is technically feasible.
Right to Access, Rectification and Erasure
You have the right to obtain information about your processed personal data regarding the purpose of processing, the categories of data, the recipients, and the duration of storage. If you have any questions on this or any other topic relating to personal data, you are welcome to contact us using the contact details provided in the legal notice (Impressum).
Right to Restriction of Processing
You may request the restriction of the processing of your personal data at any time. To do so, one of the following conditions must be met:
- You dispute the accuracy of the personal data. For the duration of the verification of accuracy, you have the right to request restriction of processing.
- The processing is unlawful, and instead of erasure you request the restriction of the use of the data.
- We no longer need your personal data for the purposes of processing, but you require the data to establish, exercise or defend legal claims, and you request restriction instead of erasure.
- You have objected to the processing pursuant to Art. 21(1) GDPR, and a balancing of your interests against ours is being carried out. Until this assessment is complete, you have the right to request restriction of processing.
Where processing has been restricted, such personal data may, apart from being stored, only be processed with your consent or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a member state.
Provision of the Website (Web Host)
Our website is hosted by:
ALL-INKL.COM – Neue Medien Münnich
Hauptstraße 68, 02742 Friedersdorf
Germany
When you access our website, we automatically collect and store information in what are known as server log files. This information is automatically transmitted to our server, or to the server of our hosting provider, by your browser.
This includes:
- IP address of the website visitor’s device
- Device used
- Hostname of the accessing computer
- Visitor’s operating system
- Browser type and version
- Name of the file retrieved
- Time of the server request
- Amount of data transferred
- Information as to whether the retrieval was successful
This data is not combined with other data sources.
Instead of operating this website on our own server, we may also have it run on the server of an external service provider (hosting company), as named above. In this case, the personal data collected on this website is stored on the servers of the hosting company. In addition to the data listed above, the web host also stores, on our behalf, contact requests, contact details, names, website access data, meta and communication data, contract data, and other data generated via a website.
The legal basis for processing this data is Art. 6(1)(f) GDPR. Our legitimate interest lies in the technically error-free presentation and optimisation of this website. Should the website be accessed in order to enter into contract negotiations with us or to conclude a contract, an additional legal basis is Art. 6(1)(b) GDPR. Where we have engaged a hosting company, a data processing agreement exists with that provider.
Use of Local Storage Items, Session Storage Items and Cookies
Our website uses local storage items, session storage items and/or cookies. Local storage is a mechanism that allows data to be stored within the browser on your device. This data usually contains user preferences, such as the “day” or “night mode” of a website, and remains stored until you delete it manually. Session storage is very similar to local storage, except that its storage duration only lasts for the current session, i.e. until the current tab is closed. After that, the session storage items are deleted from your device. Cookies are pieces of information that a web server (a server that provides web content) stores on your device in order to be able to identify that device. They are either deleted temporarily for the duration of a session (session cookies) after the end of your visit to a website, or stored permanently (permanent cookies) on your device until you delete them yourself or they are automatically deleted by your web browser.
These objects may also be stored on your device by third-party companies when you access our site (third-party requests). This enables us, as the operator, and you, as a visitor to this website, to make use of certain services provided by third parties integrated into this website. Examples include the processing of payment services or the display of videos.
These mechanisms have a wide range of applications. They can improve the functionality of a website, control shopping cart functions, increase the security and convenience of using the website, as well as carry out analyses of visitor flows and behaviour. Depending on their specific function, these are classified differently under data protection law. Where they are necessary for the operation of the website and for providing certain functions (e.g. shopping cart function), or serve to optimise the website (e.g. cookies for measuring visitor behaviour), their use is based on Art. 6(1)(f) GDPR. As the website operator, we have a legitimate interest in the storage of local storage items, session storage items and cookies for the technically error-free and optimised provision of our services. In all other cases, the storage of local storage items, session storage items and cookies takes place only with your express consent (Art. 6(1)(a) GDPR).
Where local storage items, session storage or cookies are used by third-party companies or for analytical purposes, we inform you of this separately within this privacy notice. Your required consent is requested and can be withdrawn at any time.
Use of External Services
External services are used on our website. External services are services provided by third-party providers that are used on our website. This may occur for various reasons, for example to embed videos or for the security of the website. When these services are used, personal data is also passed on to the respective providers of these external services. Where we have no legitimate interest in using these services, we obtain your consent as a visitor to our website prior to their use, which can be withdrawn at any time (Art. 6(1)(a) GDPR).
Analytics
We process personal data of website visitors to analyse user behaviour. Through the evaluation of the data obtained, we are able to compile information on the use of the individual components of our website. This allows us to improve the usability of our website. The analytics tools used could, for example, create user profiles for the delivery of targeted or interest-based advertising, recognise our website visitors on their next visit, measure their click/scroll behaviour and downloads, create heatmaps, track page views, measure visit duration or bounce rates, and trace the origin of website visitors (city, country, referring page). Analytics tools help us improve our market research and marketing activities.
Processing only takes place if you consent to this data processing (via our consent banner on the website). The legal basis for this processing is consent (Art. 6(1)(a) GDPR). Without your consent, data processing does not take place in the manner described above. If you withdraw your consent (e.g. via the consent banner or other means provided on this website), we will end this data processing. The lawfulness of the processing carried out up until the withdrawal remains unaffected.
Google Analytics
We use the Google Analytics service on our website. The provider of this service is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Use of this service may result in data being transferred to a third country (USA). The provider is certified under the EU-U.S. Data Privacy Framework and therefore offers an adequate level of data protection.
Further information can be found in the provider’s privacy notice at the following URL: https://business.safety.google/privacy.
This service sets the following cookies on our website:
| Name | Storage period | Type | Purpose |
|---|---|---|---|
| _ga | 400 days | 1st-party cookie | Contains a randomly generated user ID. This ID allows Google Analytics to recognise returning users on this website and merge data from previous visits. |
| _ga_0T550F8J7F | 400 days | 1st-party cookie | Collects data on how often a user has visited a website, as well as data on the first and last visit. |
LaunchDarkly
We use the LaunchDarkly service on our website. The provider of this service is Catamorphic, Co., 350 Frank H. Ogawa Plz Ste 100, Oakland, California, 94612, USA.
Use of this service may result in data being transferred to a third country (USA).
Further information can be found in the provider’s privacy notice at the following URL: https://launchdarkly.com/policies/privacy/.
This service stores the following data in the browser’s local or session storage:
| Name | Storage period | Type | Purpose |
|---|---|---|---|
| ld:5f8b56352d9b950abc83f76c:$diagnostics | Permanent | 1st-party local storage | Stored by LaunchDarkly on the local device. |
Microsoft Clarity
We use the Microsoft Clarity service on our website. The provider of this service is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland.
Use of this service may result in data being transferred to a third country (USA). The provider is certified under the EU-U.S. Data Privacy Framework and therefore offers an adequate level of data protection.
Further information can be found in the provider’s privacy notice at the following URL: https://privacy.microsoft.com/de-de/privacystatement.
This service sets cookies on our website and stores data in the browser’s local or session storage:
| Name | Storage period | Type | Purpose |
|---|---|---|---|
| _clck | 365 days | 1st-party cookie | Used to store a unique user ID. |
| _clsk | 24 hours | 1st-party cookie | Used to store a user’s page views and combine them into a single session recording. |
Sentry
We use the Sentry service on our website. The provider of this service is Functional Software, Inc., 45 Fremont Street, 8th Floor, CA 94105, San Francisco, USA.
Use of this service may result in data being transferred to a third country (USA). The provider is certified under the EU-U.S. Data Privacy Framework and therefore offers an adequate level of data protection.
Further information can be found in the provider’s privacy notice at the following URL: https://sentry.io/privacy/.
This service stores the following data in the browser’s local or session storage:
| Name | Storage period | Type | Purpose |
|---|---|---|---|
| sentryReplaySession | Session | 1st-party session storage | Records data on visitors’ website behaviour. This is used for internal analysis and website optimisation. |
Chat Tool
You can send us messages via our website using an online chat tool. This function is provided to us by an external provider. If you actively use this chat, your IP address is recorded by us and by the provider we have engaged. The use of this system on our website enables us to respond to your inquiries more quickly.
Processing only takes place if you consent to this data processing (via our consent banner on the website). The legal basis for this processing is consent (Art. 6(1)(a) GDPR). Without your consent, data processing does not take place in the manner described above. If you withdraw your consent (e.g. via the consent banner or other means provided on this website), we will end this data processing. The lawfulness of the processing carried out up until the withdrawal remains unaffected.
Chatbase
We use the Chatbase service on our website. The provider of this service is Chatbase.co, USA.
Use of this service may result in data being transferred to a third country (USA).
Further information can be found in the provider’s privacy notice at the following URL: https://www.chatbase.co/privacy.
This service sets the following cookies on our website:
| Name | Storage period | Type | Purpose |
|---|---|---|---|
| chatbase_anon_id | Session | 1st-party cookie | Used to track anonymous user interactions with a chatbot operated by Chatbase and to enable analytics, without requiring personal identification. |
Consent Management
To comply with data protection requirements, we use a consent management tool on our website. With this tool, we obtain the necessary consent for setting cookies or using external services.
Consent given is stored.
This processing is necessary to fulfil a legal obligation to which the controller (the website operator) is subject. The legal basis for this processing is therefore Art. 6(1)(c) GDPR.
Complianz GDPR/CCPA Cookie Consent
We use the Complianz GDPR/CCPA Cookie Consent service on our website. The provider of this service is Complianz B.V., Kalmarweg 14-5, 9723 JG Groningen, Netherlands.
As this service is hosted locally on the web server, no data is transferred to third parties.
This service sets the following cookies on our website:
| Name | Storage period | Type | Purpose |
|---|---|---|---|
| _cltk | Session | 1st-party session storage | Stored by Microsoft Clarity on the local device. |
| cmplz_banner-status | 365 days | 1st-party cookie | Used to store whether the cookie banner has been declined. |
| cmplz_consented_services | 365 days | 1st-party cookie | Used to store cookie settings. |
| cmplz_functional | 365 days | 1st-party cookie | Used to store cookie settings. |
| cmplz_marketing | 365 days | 1st-party cookie | Used to store cookie settings. |
| cmplz_policy_id | 365 days | 1st-party cookie | Used to store an accepted cookie policy ID. |
| cmplz_preferences | 365 days | 1st-party cookie | Used to store cookie settings. |
| cmplz_statistics | 365 days | 1st-party cookie | Used to store cookie settings. |
CRM Systems
To better manage our customer relationships, we use a customer relationship management system. This makes it possible to present and organise customer relationship processes clearly. This covers both existing and potential customers. Personal data, such as name and address, is processed as part of this.
Processing only takes place if you consent to this data processing (via our consent banner on the website). The legal basis for this processing is consent (Art. 6(1)(a) GDPR). Without your consent, data processing does not take place in the manner described above. If you withdraw your consent (e.g. via the consent banner or other means provided on this website), we will end this data processing. The lawfulness of the processing carried out up until the withdrawal remains unaffected.
Mews
We use the Mews service on our website. The provider of this service is Mews Systems B.V., Wibautstraat 137 D, Scalehub 2nd floor, 1097DN Amsterdam, Netherlands.
Use of this service may result in data being transferred to a third country (USA). The provider is certified under the EU-U.S. Data Privacy Framework and therefore offers an adequate level of data protection.
Further information can be found in the provider’s privacy notice at the following URL: https://app.mews.com/Platform/Document/PrivacyPolicy?language=en-GB.
This service sets the following cookies on our website:
| Name | Storage period | Type | Purpose |
|---|---|---|---|
| __cf_bm | 30 minutes | 3rd-party cookie, .app.mews.com | Stored by Mews on the local device. |
Display Optimisation
We use tools that serve to optimise the presentation of our website. Among other things, these tools help display the website in other languages or in a more accessible way.
Processing only takes place if you consent to this data processing (via our consent banner on the website). The legal basis for this processing is consent (Art. 6(1)(a) GDPR). Without your consent, data processing does not take place in the manner described above. If you withdraw your consent (e.g. via the consent banner or other means provided on this website), we will end this data processing. The lawfulness of the processing carried out up until the withdrawal remains unaffected.
UserWay
We use the UserWay service on our website. The provider of this service is UserWay Inc., 1007 N. Orange St., 10th Floor, Wilmington, DE 19801, USA.
Use of this service may result in data being transferred to a third country (USA).
Further information can be found in the provider’s privacy notice at the following URL: https://userway.org/privacy/.
We base this processing on a legitimate interest (Art. 6(1)(f) GDPR).
This application is used to provide digital accessibility on our website.