Privacy

Controller

The controller for the processing of your data on this website within the meaning of the General Data Protection Regulation (GDPR) and other data protection laws is:

Hotel am Schloßpark “Zum Kurfürst” GmbH
Kapellenweg 5
85764 Oberschleißheim
Germany
Telephone: +49 (0) 89 / 315 79 – 0
Email: rezeption@kurfuerst-hotel.de
Website: www.kurfuerst-hotel.de

Represented by Gerhard Kunstwadl, see the legal notice.

Data protection officer

Our data protection officer is:

akwiso Datenschutz & Audit
Dieter Grohmann
Beethovenstraße 23
87435 Kempten, Germany
Telephone: +49 831 / 5124-7030
Email: info@akwiso.de
Website: www.akwiso.de

Legal bases

The protection of your personal data is important to us. We process it only in accordance with the applicable European and national rules. This policy shows which data we collect, how we use and pass it on, how we protect it and how you can obtain information about your data.

You can withdraw your consents at any time with effect for the future. Please contact us (see “Controller”) or change your choice under “Cookie settings” in the footer of the page.

Our legal bases are:

• Consent: Art. 6(1)(a) GDPR. For storing information on your device and reading it, Section 25(1) TDDDG (German Telecommunications Digital Services Data Protection Act) also applies.
• Contract and pre-contractual measures: Art. 6(1)(b) GDPR, for example for enquiries and bookings.
• Legal obligation: Art. 6(1)(c) GDPR.
• Legitimate interest: Art. 6(1)(f) GDPR, where we need data for a secure, fast and stable operation of the website and your interests do not override ours. For storing information that is strictly necessary to display the page, Section 25(2) no. 2 TDDDG applies.

Erasure and storage period

We erase or block your personal data as soon as the purpose of storage no longer applies. We also store data where a law provides for it, for example retention periods. When such a period expires, we erase or block the data, unless we still need it for concluding or performing a contract.

Hosting and delivery

This website is operated and delivered by external service providers. When you visit it, they receive above all IP addresses, times, pages requested and other technical connection data. We use these providers to make our online offer available in a secure, fast and efficient way (Art. 6(1)(f) GDPR) and to make enquiries and bookings possible (Art. 6(1)(b) GDPR). The providers process your data only as far as necessary for their service and on our instructions.

Host: Out Plane

Our website runs on the platform of Out Plane LLC, 131 Continental Dr, Suite 305, Newark, DE 19713, USA. According to its own statement, Out Plane operates its platform primarily on infrastructure in the European Union. You can find more information in Out Plane’s privacy policy at https://outplane.com/privacy.

Protection and forwarding: Cloudflare

Requests to our website run through the network of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare accepts the connection, forwards it to our server and protects against attacks. In doing so, Cloudflare processes your IP address and other technical connection data. Cloudflare is certified under the EU-US Data Privacy Framework. More information: https://www.cloudflare.com/privacypolicy/

Content delivery network: Bunny CDN

Certain parts of our website are delivered by the network of BunnyWay d.o.o. (bunny.net), Dunajska cesta 165, 1000 Ljubljana, Slovenia. These include the map tiles at tiles.kurfuerst-hotel.de and the function at consent.kurfuerst-hotel.de, which receives your cookie decision as a receipt (see “Consent and measurement”). According to its own statement, Bunny stores access data such as a shortened IP address, the address requested, country code and browser identifier for analysis, testing and security. More information: https://bunny.net/privacy/ and https://bunny.net/gdpr/

Data processing agreement

With our service providers we conclude data processing agreements under Art. 28 GDPR. Where data is transferred to the USA, the providers rely on the EU-US Data Privacy Framework or on the European Commission’s standard contractual clauses.

Visiting the website and log files

If you only view our website and do not register or send us information in any other way, we automatically collect the following data from the device you use to access it every time you visit:

• the IP address
• browser type and version
• the operating system
• the pages visited
• the amount of data transferred
• the names of downloaded files

What we need the data for

The IP address has to be stored for the duration of the visit so that we can deliver the page to your device. We also need the data to improve the content of our website, to keep the technology of our systems working and secure, and to give law enforcement authorities the necessary information in the event of a cyberattack. The data is not evaluated for advertising. This is also our legitimate interest under Art. 6(1)(f) GDPR.

The data is deleted as soon as we no longer need it for its purpose, in log files after seven days at the latest. We only store it longer if the IP addresses are deleted beforehand or altered so that your device can no longer be identified. The data is not combined with other personal data.

The collection is absolutely necessary for the operation of the website. It is therefore not possible to object.

Other services on this website

This table describes how the other parts of our website work technically.

Cookies and local storage

Cookies are small text files that a web server sends to your browser and that are stored on your device. Besides cookies, a website can store information in your browser’s memory (“local storage” and “session storage”). Neither does any harm to your device or contains viruses.

Our website itself sets no cookies. It stores in the browser only what is needed for it to work, and anything else only with your consent. You will find the individual entries, their purpose and their duration under “Consent and measurement”.

You are in full control: you can set your browser to inform you about storage, to exclude it altogether or to delete entries individually. The functionality of our website may then be limited.

Consent and measurement

On your first visit we ask whether we may measure how our website is used. Until you have decided, we load no third-party script and send nothing to third parties. “Reject all” and “Accept all” are equal choices. Via “Cookie settings” in the footer you can view and change your decision at any time. If your browser sends the “Global Privacy Control” signal, we treat it as a rejection of marketing.

The services are sorted into three categories: Necessary, Analytics and Marketing. Analytics and Marketing only run if you have given your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

Necessary: your decision

We store your choice for 180 days in your browser’s local storage (entry “kf_einwilligung”) so that we do not ask you on every visit. This data stays on your device.

We also send every decision as a receipt to our consent function (consent.kurfuerst-hotel.de, operated on Bunny CDN, Slovenia) so that we can prove when you made which choice. The receipt contains a random number for the decision, timestamps, the chosen categories and services, the language and the version of this policy, but no name and no IP address. We keep it for 1095 days (three years). The legal basis is our legal obligation to be able to demonstrate consent (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR).

Analytics: our own journey analysis and measurement

With your consent we count clicks on “Book”, on our suggestions and notices, and for this we remember a random number for this visit (session storage, entry “kf_journey_v1”, deleted when you close the tab). The events go to the Tag Manager (see below) and to our own server (address /api/messung). There we store, for each event, the time, the type of event, the random visit number and short additional details about the event (for example the reason you chose) in a file. We store no IP address, no cookies and no browser identifier, and no names or form entries are transmitted.

If you tell us, in response to our prompt, why you did not book, we store your choice. We check an optional free text for names, telephone numbers, addresses and account details before sending, and do not send it if it looks like it contains them. Please do not write such details in it.

How long the measurement file is kept on our server will be set once the evaluation is in place. We do not keep it longer than we need it to improve the website.

Analytics: remembered search and spacing of suggestions

With your consent we remember your last search (travel dates and number of guests) for 14 days in local storage, so that you can continue where you left off on your next visit. We also remember for 7 days that we have shown you a suggestion, so that it does not appear on every page change. Without your consent this only lasts until you close the tab. Both stay on your device.

Analytics and Marketing: Google Tag Manager

With your consent to Analytics or Marketing we load the Google Tag Manager. It loads the services you have allowed and passes your choice on to them (Google Consent Mode). Google receives technical data such as your IP address. The provider for users in the European Economic Area is Google Ireland Ltd., Gordon House, 4 Barrow Street, Dublin, Ireland. Data may be transferred to the USA. Google’s privacy policy: https://policies.google.com/privacy

Analytics: Google Analytics 4

With your consent to Analytics, Google Analytics 4 measures how visitors use our website and which paths lead to a booking. Among other things, this data is processed: pages visited, entry and exit pages, time spent, frequency of visits, country and region of origin, language, browser, operating system, screen resolution, and search engines and search terms used. The IP address is not stored in full. Google uses the information on our behalf to evaluate the use of the website and to compile reports. We delete the data as soon as we no longer need it for our records, after 18 months at the latest.

You can additionally prevent the collection by installing the browser add-on for deactivating Google Analytics: https://tools.google.com/dlpage/gaoptout?hl=en

Analytics: Microsoft Clarity

With your consent to Analytics, Microsoft Clarity records how visitors scroll and click, so that we can find weak points on our website. Entries in form fields are masked. Microsoft processes technical data such as your IP address in the process. Microsoft’s terms apply: https://privacy.microsoft.com/en-us/privacystatement

Marketing: Google Ads

With your consent to Marketing, Google Ads measures whether a booking comes from an ad on Google (conversion measurement). Google receives technical data and an identifier of your browser for this. We pass your choice on to Google (Consent Mode: ad_storage, ad_user_data, ad_personalization).

Marketing: OpenAI Ads

With your consent to Marketing we measure whether a booking comes from an ad on OpenAI. For this we load a script from OpenAI. We store the identifier of the ad click in session storage until you close the tab (entry “kf_oai_oppref_v1”) and attach it to our booking link.

Storage period at the providers

How long Google (except for Google Analytics 4, see above), Microsoft and OpenAI store data and which cookies they set for it is determined by these providers. You will find the details in their privacy policies.

Booking

Booking is handled by the booking system of an external provider (onepagebooking.com) on its own website. When you click “Book a room”, you leave this website. The provider’s privacy terms apply there.

So that the booking system does not ask you again for your cookie decision, we attach to the booking link a signed token containing your choice (categories, version of this policy). It is valid for 15 minutes and can only be redeemed once. If you have consented to Analytics, the random visit number and a note that you come from our website are added. If you have consented to Marketing, the identifier of the OpenAI ad click is added if you came through such an ad.

Contact

When you write to us or call us, we process your details in order to answer your enquiry (Art. 6(1)(b) or (f) GDPR). We delete them as soon as the enquiry has been dealt with and no retention period applies.

Your rights

If we process personal data about you, you have the following rights against us. To exercise them, please use the contact details under “Controller”.

Access

You can obtain confirmation at any time, free of charge, as to whether we process data about you, and request information about it: the purposes, the categories of data, the recipients, the planned storage period, your rights, the source of the data if we did not collect it from you and, in the case of automated decisions, the logic involved. You can also find out whether data is transferred to a third country or an international organisation, and which safeguards under Art. 46 GDPR apply.

Rectification

If your data is inaccurate or incomplete, you can ask us to rectify or complete it without undue delay.

Restriction of processing

You can ask us to restrict processing if:

• you contest the accuracy of the data, for as long as we verify it,
• the processing is unlawful and you want restriction instead of erasure,
• we no longer need the data, but you need it for the establishment, exercise or defence of legal claims, or
• you have objected and it has not yet been decided whether our grounds override yours.

Erasure

You can ask us to erase your data without undue delay if it is no longer necessary for its purpose, you withdraw your consent and there is no other legal basis, you validly object, the data was processed unlawfully, erasure is necessary to comply with a legal obligation, or the data was collected in connection with information society services offered to children. If we have made data public, we take reasonable steps to inform other controllers of your request for erasure.

The right to erasure does not apply where processing is necessary for exercising freedom of expression and information, for complying with a legal obligation, for reasons of public interest in the area of public health, for archiving, research or statistical purposes, or for the establishment, exercise or defence of legal claims.

Notification

If you have asked for rectification, erasure or restriction, we notify all recipients of your data, unless this proves impossible or involves disproportionate effort. You can ask to be informed about these recipients.

Data portability

You can receive the data you have provided to us in a structured, commonly used and machine-readable format and transmit it to another controller or, where technically feasible, have us transmit it directly. This applies where processing is based on consent or a contract and is carried out by automated means.

Objection

You can object at any time, on grounds relating to your particular situation, to the processing of your data where it is based on Art. 6(1)(e) or (f) GDPR. We will then stop processing the data, unless we demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

If we process your data for direct marketing, you can object at any time. We will then no longer use the data for this purpose. In connection with information society services, you can also exercise your right to object by automated means using technical specifications.

Withdrawal of consent

You can withdraw a consent at any time with effect for the future. Processing carried out until then remains lawful. You can declare the withdrawal to us or via “Cookie settings” in the footer.

No automated individual decision-making

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision is necessary for a contract between you and us, is authorised by law that lays down suitable safeguards, or is based on your explicit consent. We do not make such decisions.

Complaint to a supervisory authority

Without prejudice to any other remedy, you can lodge a complaint with a supervisory authority, in particular in the Member State of your residence, your place of work or the place of the alleged infringement, if you believe that the processing of your data infringes the GDPR. The authority informs you of the progress and outcome of the complaint and of the possibility of a judicial remedy under Art. 78 GDPR.

Changes

We reserve the right to change this policy, for example if laws change or we extend our website. We publish changes at this point.