Data protection

In order to be able to offer you the services of Villa Bleichröder, we naturally also need some data about you. We take the protection of personal data very seriously and always process it in accordance with the applicable data protection regulations, in particular the EU General Data Protection Regulation. With this privacy policy, we would like to inform you about the type, scope and purpose of the personal data we process and your rights as a data subject.

1. Data Controller and General Information

Your data is processed by Hotel Bleichröder GmbH, c/o GLS Sprachenzentrum, Kastanienallee 82, 10435 Berlin, email: info@villa-bleichroeder.de, in accordance with the General Data Protection Regulation (GDPR). In this document, “Villa Bleichröder” refers to the website  www.villa-bleichroeder.de, including all subpages, content, and features available on those pages (e.g., the booking feature). Our services are intended for the general public.

2. Collection and Processing of Personal Data

As a rule, you can use online services for which no payment or registration is required without providing personal data. In certain cases, however, we process the personal data listed in section 3. This only happens to the extent necessary to provide a functional website and our content and services. Furthermore, we process personal data in connection with the use of Villa Bleichröder if you provide it voluntarily, e.g. as part of an inquiry or when booking a hotel room, or because there is another legal basis for this (see section 4.). If you do not wish to do so, you will unfortunately not be able to make full use of our services.

3. Categories of Processed Data

As soon as you use Villa Bleichröder, our system automatically collects information from the computer system of the calling computer. The following data may be collected in the process:

• Information about the browser type and version used
• Operating system of the user
• Date and time of access
• Web analysis data / pseudonymous user profiles (cookie ID, ad ID etc.)
• Websites from which the user accesses our website
• Websites that the user accesses via our website

In addition, we process the following personal data if there is a contractual relationship between you and us or if you have transmitted the data to us in some other way:

• Personal master data (name, address, date of birth)
• Communication data (telephone number, e-mail address)
• Contract master data (contractual relationship, product or contract interest, order history)
  
  

4. Legal Basis and Purposes of Processing

We process your data exclusively on the basis of one or more of the possible legal bases.

According to the GDPR, personal data may be processed in particular on the basis of a contract or for the implementation of pre-contractual measures, if consent has been given, on the basis of a legitimate interest or a law and for the protection of vital or public interests.

When you book accommodations or use other paid services, we use your contract master data—including your contact information—to execute and fulfill the contract, as is the case, for example, with processing operations necessary for the delivery of goods or the provision of other services or consideration, as well as for the enforcement of legal claims or demands (Art. 6(1)(b) GDPR). The same applies to processing operations necessary for the implementation of precontractual measures, such as in cases of inquiries regarding our products or services. In the case of paid services, we process certain data because we are subject to a legal obligation that requires the processing of personal data, such as to fulfill tax obligations (Art. 6(1)(c) GDPR).

We also use the email address you provided during registration or in connection with the performance of the contract to send you emails about our own similar products or services, as well as about existing reservations or general information regarding the Hotel Oderberger. In this case, the processing of your email address is based on our legitimate interest in promoting our products and services (Art. 6(1)(f) GDPR).

In addition, we use your email address to send you our newsletter if you have previously given us your express consent to receive a newsletter or promotional materials. In this case, we process your email address so that we can send you the newsletter as requested (Art. 6(1)(b) GDPR). You may object to the use of your email address for such purposes at any time in writing or in text form to  info@villa-bleichroeder.de or Kastanienallee 82, 10435 Berlin, with effect for the future, without incurring any costs other than the transmission costs according to the basic rates.

On the Internet, every device requires a unique address, the so-called IP address, to transmit data. The at least temporary storage of the IP address is technically necessary to enable the website to be delivered to the user’s computer. We shorten the IP addresses before any processing and only process them further in anonymized form. There is no storage or further processing of the unabridged IP addresses. Our servers also store your IP address for 14 days for our own security purposes.

In the case of processing operations not covered by any or all of the aforementioned legal bases, processing may take place if it is necessary to safeguard a legitimate interest and, based on a comprehensive balancing of interests, your interests, fundamental rights, and freedoms do not override them (Art. 6(1)(f) GDPR). A legitimate interest is presumed to exist if the data subject is a customer of the controller. If the processing of personal data is based on this, our legitimate interest is, in particular, the conduct of our business operations for the benefit of the well-being of all our employees and our shareholders.

Our legitimate interest in being able to offer you products that are tailored to your needs, to inform you about new products and to continuously improve our services and thereby also increase our sales is the legal basis for processing for usage-based online advertising and web analysis. For web analysis services in detail, see section 9.

Another legitimate interest is the functionality of company processes (e.g. address management / accounting).

You can object to processing on the basis of a legitimate interest at any time (see section 14.).

In the event that the data is processed for a purpose other than that stated when the data was collected, a compatibility check is carried out in accordance with Art. 6 (4) GDPR. Further processing is then only permitted if the original purpose is compatible with the new purpose or is permitted on the basis of a separate legal basis. Recognized compatible purposes include the assertion, exercise or defense of civil law claims, provided there is no overriding interest of the data subject. In this case, we will inform you of the change of purpose. If the new purpose is not compatible with the purpose stated at the time of collection, a new collection will be carried out on the basis of a new legal basis. We will also inform you of the change of purpose in this case.

5. Place of Processing

We ourselves do not transfer your personal data to countries outside the European Economic Area, except in cases where this is permitted under the GDPR.

6. Disclosure of Your Information to Third Parties

We only transfer your personal data to third parties if the transfer is necessary in order to fulfill our contractual obligations to you and this is evidently done with or together with another provider, if we are otherwise legally entitled or obliged to pass it on, or if you have given us your consent to do so.

In order to provide our services, selected personal data may be shared with certain departments within our company or with external service providers. These include reservations, accounting and marketing. If you have decided to book accommodation, we will forward your data to the relevant department for hotel and apartment accommodation.

External service providers or affiliated companies that are commissioned by us to process data for us in accordance with instructions are contractually bound by us as processors in accordance with the strict requirements of the GDPR and may not use your data for any other purposes. The processors we use provide us with the following services in particular Reservation services, registration services, hosting, newsletter dispatch, evaluation services, maintenance and support and web analysis.

The transfer of data to processors is based on Article 28(1) of the GDPR, or, alternatively, on our legitimate interest in the economic and technical benefits associated with the use of specialized processors, pursuant to Article 6(1)(f) of the GDPR.

If we are legally obliged to do so or if this is permitted under data protection law, we transmit personal data to authorities, for example the police or public prosecutor’s office (Art. 6 para. 1 lit. c GDPR). This data is passed on on the basis of our legitimate interest in combating misuse, prosecuting criminal offenses and securing, asserting and enforcing claims and that your rights and interests in the protection of your personal data do not outweigh this, Art. 6 para. 1 lit. f GDPR

In certain cases, we also use external service providers and their auxiliary persons or affiliated companies that offer cloud-based software and data processing solutions for the hotel and are commissioned by us to evaluate and process data for us in accordance with our instructions. Such service providers are contractually bound by us as processors in accordance with the strict requirements of the GDPR and may not use your data for any other purposes. The processors we use provide us with the following services in particular Registration services, hosting, newsletter dispatch, evaluation services, maintenance and support and web analysis.

7. Cookies and Similar Technologies

We use cookies. Cookies are small files that your browser stores on your device in a directory provided for this purpose. Among other things, they can be used to determine whether you have visited a website before. If you agree, login data for an online service can also be stored in cookies so that you do not have to enter this login data every time you visit the site. Many cookies contain a so-called cookie ID. A cookie ID is a unique identifier for the cookie. It consists of a string of characters that can be used to assign websites and servers to the specific Internet browser in which the cookie was stored. This enables the websites and servers visited to distinguish the individual browser of the data subject from other Internet browsers that contain other cookies. A specific Internet browser can be recognized and identified via the unique cookie ID.

We use two types of cookies. On the one hand, technically necessary cookies, without which the functionality of our website would be limited, and optional cookies to make our website more user-friendly. The user data collected by technically necessary cookies is not used to create user profiles. Analysis cookies are used for the purpose of improving the quality of our website and its content. Through the analysis cookies, we learn how the website is used and can thus constantly optimize our offer. Further information on the individual analysis services can be found in section 9 of this privacy policy. We also use a so-called tracking cookie if you access our website via a link from a partner. This is done in order to fulfill our contractual relationship with the partner.

You can prevent the setting of cookies by us at any time by means of a corresponding setting of the Internet browser used and thus permanently object to the setting of cookies. Furthermore, cookies that have already been set can be deleted at any time via an Internet browser or other software programs. This is possible in all common Internet browsers. If you deactivate the setting of cookies in the Internet browser you are using, you may not be able to use all the functions of our website to their full extent.

Cookies cannot identify you as a person. In any case, the use of cookies is justified on the basis of our legitimate interest in a needs-based design and the statistical evaluation of Hotel Oderberger (Art. 6 para. 1 lit. f GDPR).

8. Web Analytics Services

In order to constantly improve our content and adapt it to the interests of our users and to display usage-based online advertising, we use some analysis services that collect data on our website and evaluate it for us. These service providers process pseudonymized user data for this purpose in accordance with our instructions on the basis of an order processing agreement. The data is not stored together with other personal user data. You can deactivate the individual analysis services at any time for the future. You can find out more about the analysis services we use below:

Google AdWords

We have integrated Google AdWords on this website. Google AdWords is an internet advertising service that allows advertisers to place ads both in Google’s search engine results and in the Google advertising network. Google AdWords allows an advertiser to specify certain keywords in advance, which are used to display an ad in Google’s search engine results only when the user uses the search engine to retrieve a keyword-relevant search result. In the Google advertising network, the ads are distributed to relevant websites using an automatic algorithm and taking into account the previously defined keywords. The operating company of the Google AdWords services is Google Inc, 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA. The purpose of Google AdWords is to advertise our website by displaying interest-relevant advertising on the websites of third-party companies and in the search engine results of the Google search engine and by displaying third-party advertising on our website. If a data subject reaches our website via a Google ad, a so-called conversion cookie is stored on the data subject’s IT system by Google. What cookies are has already been explained above. A conversion cookie loses its validity after thirty days and is not used to identify the data subject. If the cookie has not yet expired, the conversion cookie is used to track whether certain sub-pages, such as the shopping cart from an online store system, have been accessed on our website. The conversion cookie enables both us and Google to track whether a data subject who has reached our website via an AdWords ad has generated sales, i.e. completed or canceled a purchase.

The data and information collected through the use of the conversion cookie is used by Google to compile visit statistics for our website. These visit statistics are in turn used by us to determine the total number of users who were referred to us via AdWords ads, i.e. to determine the success or failure of the respective AdWords ad and to optimize our AdWords ads for the future. Neither our company nor other Google AdWords advertisers receive information from Google that could be used to identify the data subject.

The conversion cookie is used to store personal information, such as the websites visited by the data subject. Each time our websites are visited, personal data, including the IP address of the Internet connection used by the data subject, is transmitted to Google in the United States of America. This personal data is stored by Google in the United States of America. Google may share this personal data collected through the technical process with third parties.
The data subject can prevent the setting of cookies by our website, as described above, at any time by means of a corresponding setting of the Internet browser used and thus permanently object to the setting of cookies. Such a setting of the Internet browser used would also prevent Google from placing a conversion cookie on the data subject’s IT system. In addition, a cookie already set by Google AdWords can be deleted at any time via the Internet browser or other software programs.

In addition, the data subject has the option to opt out of interest-based advertising by Google. To do so, the data subject must click the link  Go to https://www.google.de/settings/ads and configure the desired settings there. For more information and Google’s applicable privacy policy, visit  https://www.google.de/intl/de/policies/privacy/.

GoogleAnalytics

We have integrated Google Analytics (with the anonymization feature). Google Analytics is a web analytics service. Web analytics refers to the collection, gathering, and analysis of data regarding the behavior of website visitors. Among other things, a web analytics service records data on which website a user came from (known as a “referrer”), which subpages of the website were accessed, and how often and for how long a subpage was viewed. Web analytics is primarily used to optimize a website and to conduct cost-benefit analyses of online advertising. The operator of the Google Analytics component is Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA. We use the “_gat._anonymizeIp” extension for web analytics via Google Analytics. This parameter causes Google to truncate and anonymize the IP address of the data subject’s Internet connection when accessing our websites from a member state of the European Union or from another signatory state to the Agreement on the European Economic Area. The purpose of the Google Analytics component is to analyze visitor traffic on our website. Google uses the data and information collected, among other things, to evaluate the use of our website, to compile online reports for us that show activity on our websites, and to provide other services related to the use of our website. Google Analytics places a cookie on the data subject’s information technology system. What cookies are has already been explained above. Placing the cookie enables Google to analyze the use of our website. Each time a user visits one of the individual pages of this website—which is operated by us and on which a Google Analytics component has been integrated—the web browser on the data subject’s computer system is automatically prompted by the respective Google Analytics component to to transmit data to Google for the purpose of online analysis. As part of this technical process, Google obtains personal data, such as the data subject’s IP address, which Google uses, among other things, to track the origin of visitors and clicks and, consequently, to facilitate commission settlements. The cookie is used to store personal information, such as the time of access, the location from which access originated, and the frequency of the data subject’s visits to our website. Each time our websites are visited, this personal data—including the IP address of the Internet connection used by the data subject—is transmitted to Google in the United States of America. This personal data is stored by Google in the United States of America. Google may, under certain circumstances, disclose this personal data collected through the technical process to third parties. As described above, the data subject may prevent our website from setting cookies at any time by adjusting the settings of the internet browser being used, thereby permanently objecting to the setting of cookies. Such a setting in the internet browser used would also prevent Google from setting a cookie on the data subject’s computer system. In addition, a cookie already set by Google Analytics can be deleted at any time via the internet browser or other software programs. Furthermore, the data subject has the option to object to and prevent the collection of data generated by Google Analytics relating to the use of this website, as well as the processing of such data by Google. To do so, the data subject must install a browser add-on available at the link Download and install http://tools.google.com/dlpage/gaoptout?hl=de. This browser add-on uses JavaScript to instruct Google Analytics not to transmit any data or information regarding website visits to Google Analytics. Google considers the installation of the browser add-on to be an objection. If the data subject’s computer system is later deleted, formatted, or reinstalled, the data subject must reinstall the browser add-on to deactivate Google Analytics. If the browser add-on is uninstalled or deactivated by the data subject or another person within their control, it is possible to reinstall or reactivate the browser add-on. Further information and Google’s applicable privacy policy can be found at  https://www.google.de/intl/de/policies/privacy/ and at http://www.google.com/analytics/terms/de.html. Google Analytics is available at this link  Explained in more detail at https://www.google.com/intl/de_de/analytics/.

9. Social Networks

You can also find us on third-party social networks, such as Meta. In addition, we have integrated certain features of these networks into our online services (e.g., Facebook, Instagram, WhatsApp). However, you can only use these features if you are registered with and logged into the respective social network. Please note that the terms of use and privacy policy of the respective social network operator apply to your use of that network, over which we have no control.

10. Payment Service Providers

If you use a paid service or make a purchase through our website or app, we offer various payment methods through third-party providers (e.g., booking pool tickets via Pretix, booking hotel rooms through our Mews booking system, and purchasing gift certificates through Voucherchart). If you decide to use one of these services or their payment service providers, you will leave our site. All data is then collected and processed by the respective payment service provider or our online booking system, Mews. We do not receive any bank or credit card information; we only receive confirmation that the payment was successfully processed.

11. Other Services

Other services that we use are

Google Maps

We use Google Maps to display maps. The integration requires that Google can detect the IP address of the user. The IP address is required to be able to send the content to the user’s browser. We would like to point out that Google has its own data protection guidelines that are independent of ours. Please read Google’s privacy policy at www.google.de/intl/de/policies/privacy/ before using our website. Google Maps is based on Java Script code, so you can prevent it from running altogether by deactivating Java Script in your browser settings or installing a Java Script blocker. Please note that our website may then not be displayed correctly.

Newsletter2go  

We use the Newsletter2go service, a technical service provider that sends the newsletter for us. Newsletter2go uses the so-called double opt-in procedure to ensure that the newsletter is sent by mutual agreement. This involves the potential recipient being added to a mailing list. The user then receives a confirmation e-mail to confirm the registration in a legally secure manner. The address is only actively added to the mailing list if confirmation is given. Newsletter2go uses this data exclusively for sending the requested information and offers.

As newsletter software, Newsletter2Go is used. Your data is transmitted to Newsletter2Go GmbH. Newsletter2Go is prohibited from selling your data or using it for any purpose other than sending newsletters. Newsletter2Go is a German, certified provider that was selected in accordance with the requirements of the General Data Protection Regulation and the Federal Data Protection Act.

For more information, click here: https://www.newsletter2go.de/informationen-newsletter-empfaenger/

You can revoke your consent to the storage of the data, the e-mail address and its use for sending the newsletter at any time, for example via the “Unsubscribe” link in the newsletter.

Mews

We use the Mews online booking system on our website.  Your data will be transmitted to Mews. Mews is prohibited from selling your data or using it for any purpose other than the booking process. Your data is transmitted via an encrypted SSL connection.

Dialog Shift Chatbot 

Our website uses the chat application provided by DialogShift GmbH, Rheinsberger Str. 76/77, 10115 Berlin. This application processes and stores data for the purposes of web analytics, operating the chat application, and responding to inquiries. To operate the chat function, chat texts are stored and a cookie with a unique ID is set—this is used to recognize you as a customer. A cookie is a small text file that is stored locally in the cache on your device. With the help of this cookie, our application recognizes the device and can retrieve past chat logs. This cookie is stored for 90 days from the last use. You can disable the storage of cookies in your browser settings. However, the chat function cannot be used without cookies. The disclosure of information such as your name, email address, or phone number is voluntary and implies your consent to the temporary use and storage of this data for the purpose of establishing contact until the end of that interaction. This personal data is deleted after 90 days.   The legal basis for data processing is Article 6(1)(f) of the GDPR, based on our legitimate interest in providing effective customer service, conducting statistical analyses of user behavior, and optimizing our offerings.   DialogShift provides additional information at https://www.dialogshift.com/datenschutz regarding the collection and use of data, as well as your rights and options for protecting your privacy. 

Online Booking Through Other Websites

You have the option to book rooms and packages through hotel booking portals (third-party providers, such as Booking.com, Expedia, Holidaycheck, etc.). If you choose this option, the data you enter in the form will be transmitted to us and stored to the extent permitted by the respective hotel booking portal in accordance with its own privacy policy. Data may include: first name, last name, email address, phone number, mailing address, number of traveling companions, estimated arrival time, requests, and payment information (e.g., credit card).  

The data provided is imported into our hotel software, Mews, via a channel manager called SiteMinder. All booking data received is transmitted in encrypted form. If payment data is transmitted, it is stored exclusively in encrypted form within Mews and is not visible to us.

The data will be used exclusively for processing the reservation and for communication purposes.

12. Retention Period

We only store personal data for as long as we are authorized to do so and the purpose of processing has not ceased to apply. The respective statutory retention period applies to the duration of the storage of personal data. After this period has expired, the corresponding data is routinely deleted, provided that it is no longer required for contract fulfillment or contract initiation.

Contact details and your rights as a data subject

If you have any questions about data protection, please contact our data protection officer:

Mr. Dieter Klapproth
Mail address: d.klapproth@ains-a.de

13. Access to Information and Correction

You can obtain information from us at any time and free of charge as to whether personal data relating to you is being processed by us and also specifically which data about you is being stored, as well as requesting a copy of the stored data. You can also have incorrect data corrected and completed.

14. Erasure, Restriction, and the Right to Be Forgotten

You can request the deletion and restriction of your personal data. Please note that there are legal obligations to retain data, e.g. for paid contracts such as course bookings, and that we are therefore not always permitted to delete your data completely. In this case, your data will be marked with the aim of restricting its future processing.

15. Data Portability

Where applicable, you also have the right to have the personal data concerning you transmitted to you or to another controller in a structured, commonly used and machine-readable format, provided that the processing is based on consent or on a contract and is carried out by automated means. However, this does not apply if the processing is not necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. You also have the right to have the personal data transmitted directly from one controller to another, where technically feasible and provided that this does not adversely affect the rights and freedoms of others.

16. Revocation / Objection

You can revoke your consent at any time with effect for the future at the above-mentioned contact address.
In particular, you can object to the use of your e-mail address for the purpose of sending newsletters at any time in writing or in text form to newsletter@hotel-oderberger.de or Hotel Oderberger c/o GLS Sprachenzentrum, Kastanienallee 82, 10435 Berlin with effect for the future, without incurring any costs other than the transmission costs according to the basic tariffs. You also have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on a legitimate interest or a public interest. This also applies to profiling based on these provisions. In the event of an objection, we will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims.

17. Right to File a Complaint

You also have the right to lodge a complaint with the competent supervisory authority and to seek legal remedies. The supervisory authority to which the complaint has been submitted will inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy.

Existence of automated decision-making

We do not use automated decision-making or profiling.