Privacy policy

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

We have not appointed a data protection officer as there is no legal obligation to do so. Please use the contact details above for any data protection questions.

2. Summary

• No cookies, no web tracking, no analytics or marketing services. At most, we store whether you have paused the background video (see section 9).
• Fonts, images, video and the map are loaded exclusively from our own web server. Visiting the website does not create a connection to Google, OpenStreetMap or any other third party.
• The contact form does not transmit any data via the website. It simply opens your own email app.
• For online bookings, we forward you to our booking system Casona.

As we do not store or access any information on your device that is not strictly necessary, no consent banner (“cookie banner”) is required (Section 25 TDDDG).

3. Hosting and server log files

This website is hosted by an external service provider: [CHECK: enter name and address of hosting provider]. The provider processes data on our behalf under a data processing agreement pursuant to Art. 28 GDPR.

Each time you access the website, your browser automatically transmits technical information that is stored in server log files:

• IP address of the requesting device
• date and time of access
• page or file requested and amount of data transferred
• website from which the request originated (referrer URL)
• browser and operating system used
• HTTP status code

We need this data to deliver the website, ensure its stability and security, and defend against attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in operating the website securely and without errors. Log files are deleted after [CHECK: retention period at hosting provider, e.g. 7 or 14 days] unless needed to investigate a specific security incident. This data is not combined with other data sources.

4. Encryption

For security reasons, this website uses TLS encryption. You can recognise an encrypted connection by “https://” and the padlock symbol in your browser’s address bar.

5. Fonts, video and map

The fonts used (Jost, Atkinson Hyperlegible Next, Fraunces) are stored on and loaded from our server. The background video is also delivered from our server, plays without sound and can be paused at any time.

The map is based on OpenStreetMap data (© OpenStreetMap contributors, ODbL licence). The map tiles were downloaded once and are stored on our own server, so no data is transmitted to the OpenStreetMap Foundation or other third parties when the map is displayed.

6. Contact by email, phone and contact form

If you contact us by email or phone, we process your details (such as name, email address, phone number and the content of your enquiry) in order to respond. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract or pre-contractual measures, and otherwise Art. 6(1)(f) GDPR (legitimate interest in handling enquiries).

The contact form on our home page does not send any data to our server. When submitted, it simply opens your own email app with a pre-filled message. We only receive your details once you send that email yourself.

We use the email service [CHECK: enter email provider] as a processor to receive emails. We delete your enquiry once it has been fully dealt with, unless statutory retention obligations apply (e.g. for bookings under German commercial and tax law).

7. Online booking via Casona

For room bookings, we use the hotel booking system of Casona GmbH & Co. KG, Stadthausbrücke 8, 20355 Hamburg, Germany. If you select dates on our website and click “Check availability” or use a “Book direct” link, you will be taken to the booking page book.casona.com. Your selected arrival and departure dates are passed on as part of the web address. No further data is collected on our website in this process.

On the booking page, you enter the data needed for the booking (e.g. name, address, email address, phone number, travel dates, room preference and, where applicable, payment information). We process this data to perform the accommodation contract (Art. 6(1)(b) GDPR) and to comply with legal obligations such as the registration requirement under Section 30 of the German Federal Registration Act and retention obligations under tax and commercial law (Art. 6(1)(c) GDPR).

Casona processes this data on our behalf as a processor under Art. 28 GDPR, on the basis of a data processing agreement referred to in Section 14(2) of Casona’s general terms and conditions. According to the provider, data is stored in Germany. Any sub-processors used by Casona (e.g. for hosting, email delivery or payment processing) are listed in that agreement. [CHECK: confirm or sign DPA with Casona; add list of sub-processors and any payment providers here.]

For more information, see Casona’s privacy policy (opens external website in a new window).

8. Links to other websites

Our website contains links to external services, such as Google Maps (route planning), Booking.com (guest reviews), Facebook, Instagram, public transport providers and local attractions. This content is not embedded in our website. A connection to the respective provider is only established when you click such a link. From then on, that provider’s privacy policy applies. We have no influence over their data processing.

9. Browser storage

This website sets no cookies. If you pause the background video using the pause button, we store this setting in your browser’s local storage (entry “hg-video-paused”) so that the video does not start again on the next pages. Under "hg-lang" we additionally store your chosen language (de, en, fr, es or nl) so that the site opens in your language on future visits. The setting never leaves your device and is not transmitted to us or third parties. The legal basis is Section 25(2) no. 2 TDDDG (strictly necessary for a function you have explicitly requested). It is removed when you restart the video or clear your browser’s site data.

10. Your rights

Under the GDPR, you have the following rights regarding your personal data:

• right of access (Art. 15 GDPR)
• right to rectification (Art. 16 GDPR)
• right to erasure (Art. 17 GDPR)
• right to restriction of processing (Art. 18 GDPR)
• right to data portability (Art. 20 GDPR)
• right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR)

Right to object under Art. 21 GDPR: Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation.

To exercise your rights, simply send an informal message to service@hotel-grille.de.

11. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

12. Automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

13. Changes

We update this privacy policy when the website or the legal situation changes. The version published here applies.