Privacy Notice

The protection of your personal data is our top priority. We treat your data confidentially and in accordance with the applicable data protection regulations. These include, in particular, the General Data Protection Regulation (GDPR) and the Telecommunications and Digital Services Act (TDDDG).
With this privacy policy, we aim to provide you with a transparent overview of what personal data we collect when you use our website, how we process it, and what rights you have as a data subject. It does not apply to other websites to which we merely provide hyperlinks. As we have no control over the confidential handling of your personal data on third-party websites, we cannot accept any responsibility for this.

Our aim is for you to feel secure when visiting our website. That is why we provide you with detailed information here about:

• what data we collect,
• for what purposes we use it,
• the legal basis on which the processing takes place,
• how long we store your data,
• and what options you have to control or restrict the processing of your data.

We implement technical and organisational measures to ensure a high level of protection for your data and to prevent misuse, loss or unauthorised access.

The data controller is:

Resort Das Achental
HGV GmbH & Co. KG
Mietenkamer Straße 65 | 83224 Grassau

Dr Karsten Kinast
External Data Protection Officer
Nordstraße 17a
50733 Cologne
Email: dsb-resortachental@kinast.eu

4.1 Scope of the processing of personal data

As a general rule, we process our users’ personal data only to the extent necessary to provide a fully functional website and to enable the use of the website’s content and our services. The processing of our users’ personal data generally takes place only with the user’s consent. An exception applies in cases where it is not possible, for practical reasons, to obtain consent in advance and where the processing of the data is permitted by statutory provisions.

4.2 Legal basis for the processing of personal data

Where we obtain the data subject’s consent for the processing of personal data, Article 6(1)(a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis.
Where the processing of personal data is necessary for the performance of a contract to which the data subject is a party, Article 6(1)(b) of the GDPR serves as the legal basis. This also applies to processing operations necessary for the implementation of pre-contractual measures.
Where the processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Article 6(1)(c) of the GDPR serves as the legal basis.
Where the vital interests of the data subject or of another natural person necessitate the processing of personal data, Article 6(1)(d) of the GDPR serves as the legal basis.
Where processing is necessary to safeguard a legitimate interest of our company or a third party, and the interests, fundamental rights and freedoms of the data subject do not override the former interest, Article 6(1)(f) of the GDPR serves as the legal basis for the processing.

4.3 Data erasure and retention period

The data subject’s personal data shall be erased or blocked as soon as the purpose for which it was stored no longer applies. Data may also be retained if this is provided for by European or national legislators in EU regulations, laws or other provisions to which the controller is subject. Data will also be blocked or erased when a retention period prescribed by the aforementioned standards expires, unless there is a need to continue storing the data for the conclusion or performance of a contract

5.1 Provision of the website and creation of log files

5.1.1 Description and scope of data processing

Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing device.
This includes:

• IP address of the end device
• Date and time of access
• Name and URL of the file accessed
• Referrer URL (the previously visited page)
• Browser type and version, and operating system

The data is also stored in our system’s log files. This data is not stored alongside any other personal data relating to the user.

5.1.2 Legal basis for data processing
The legal basis for the temporary storage of the data and the log files is Article 6(1)(f) of the GDPR.

5.1.3 Purpose of data processing

The temporary storage of the IP address by the system is necessary to enable the website to be delivered to the user’s computer. To this end, the user’s IP address must be stored for the duration of the session. The data is stored in log files to ensure the website functions properly. Furthermore, the data helps us to optimise the website and ensure the security of our IT systems. These purposes also constitute our legitimate interest in data processing pursuant to Article 6(1)(f) of the GDPR. The data is not analysed for marketing purposes in this context.

5.1.4 Duration of storage

The data is deleted as soon as it is no longer required to fulfil the purpose for which it was collected. In the case of data collected for the purpose of providing the website, this is the case once the relevant session has ended. In the case of data stored in log files, this occurs after seven days at the latest. Storage beyond this period is possible. In this case, users’ IP addresses are deleted or anonymised so that it is no longer possible to identify the client making the request.

5.1.5 Right to object

The collection of data for the purpose of providing the website and the storage of data in log files is absolutely essential for the operation of the website. Consequently, the user has no right to object.

5.2. Contact via email

5.2.1 Description and scope of data processing

If you contact us by email, we will process the data you provide (e.g. name, email address, message) to process your enquiry and for any follow-up questions.

5.2.2 Legal basis for data processing

The legal basis for processing the data transmitted when sending an email is Article 6(1)(f) of the GDPR. If the purpose of the email contact is to conclude a contract, the additional legal basis for the processing is Article 6(1)(b) of the GDPR.

5.2.3 Purpose of data processing

The processing of personal data when contact is made via email enables us to handle the enquiry. This also constitutes the necessary legitimate interest in the processing of the data. The other personal data processed during the submission process serves to prevent misuse of the contact form and to ensure the security of our IT systems.

5.2.4 Duration of storage

The data will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected. For personal data entered via the contact form and that sent by email, this is the case once the relevant conversation with the user has ended. The conversation is deemed to have ended when it is clear from the circumstances that the matter in question has been conclusively resolved.

5.2.5 Right to object

If the user contacts us by email, they may object to the storage of their personal data if the contact is not for the purpose of entering into a contract. In such a case, the conversation cannot be continued. To do so, please contact the address listed below under "Right to object". All personal data stored in the course of establishing contact will be deleted in this case.

5.3 Newsletter

5.3.1 Description and scope of data processing

You have the option to subscribe to our newsletter. To do so, we require your email address. You may optionally provide further data (e.g. name, interests) to personalise content. Your data will be processed for the purpose of sending the newsletter.
In addition, we use a tracking pixel to collect information on opening and clicking behaviour. Tracking pixels (also known as clear GIFs or web beacons) are small graphics (approximately 1×1 GIF files) which are used, amongst other things, on websites or in HTML emails to provide website operators with a better understanding of how visitors interact with the website. Interaction data is stored directly on the user’s device in the Marketing Cloud and may be used to personalise the newsletter content.

5.3.2 Legal basis for data processing

The legal basis for data processing is your consent in accordance with Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG.

5.3.3 Purpose of data processing

The processing of data serves to send, personalise and continuously improve the newsletter service.

5.3.4 Duration of storage

The data will be stored for the duration of your subscription to the newsletters. Once you have unsubscribed from the newsletters, the data will be deleted.

5.3.5 Right to object and withdraw consent

You may withdraw your consent to the sending of the newsletters at any time. Withdrawal may be effected via a link in the newsletters themselves or by contacting us using the details provided below.

5.4 Smart Host

5.4.1 Description and scope of data processing

We use the Smart Host service provided by Smart Host GmbH, Große Hamburger Straße 32, 10115 Berlin, Germany. Smart Host helps us to optimise our communication with guests and to send personalised offers and newsletters. To this end, personal data such as your name, email address, stay details and information on booked services are processed. This data is processed by Smart Host in order to provide you with information that is of particular interest to you regarding your stay or future travels.

5.4.2 Legal basis for data processing
The processing of your data is carried out either on the basis of our legitimate interest in targeted guest communication pursuant to Article 6(1)(f) of the GDPR or, provided you expressly give us your consent to do so, for example when subscribing to the newsletter, on the basis of Article 6(1)(a) of the GDPR.

5.4.3 Purpose of data processing
The aim of using Smart Host is to improve guest communication, provide relevant information and enhance the quality of our service.

5.4.4 Duration of storage
Your data will only be stored for as long as is necessary for the purposes stated, or until you object to further processing or withdraw any consent you have given. Where statutory retention obligations apply, the storage period is determined by these requirements.

5.4.5 Right to object and withdraw consent

You may object to the processing of your data at any time or withdraw any consent you have given with effect for the future. You may withdraw your consent at any time, for example via the unsubscribe link in our emails or by notifying us.

5.5 TrustYou

5.5.1 Description and scope of data processing

We use the TrustYou service provided by TrustYou GmbH, Steinerstraße 15, 81369 Munich, Germany. TrustYou serves as a comprehensive communication and review management tool for us. We use TrustYou to send newsletters, handle correspondence with our guests, integrate the system with our Property Management System (PMS, such as Opera) and use it to collect and publish guest reviews.
If you subscribe to our newsletter or consent to receiving it during your stay, your contact details – such as your name, email address and, where applicable, language or stay details – will be stored and used for the purpose of sending the newsletter.
We use the correspondence manager to process your enquiries or bookings, which involves processing contact details, booking information and the content of communications.
Through the integration with our PMS, data relating to stays, bookings, arrival and departure dates, and services booked may also be transferred to TrustYou in order to simplify and personalise our communication with you. Finally, after their stay, we invite our guests to submit a review. In doing so, the information you provide – such as the review text, star rating or contact details – is processed and, where applicable, published.

5.5.2 Legal basis for data processing

Depending on the context, TrustYou processes your data on the basis of your consent in accordance with Article 6(1)(a) of the GDPR, for example when sending newsletters or requesting reviews. Furthermore, processing may be necessary for the implementation of pre-contractual measures or for the performance of the contract in accordance with Article 6(1)(b) of the GDPR, for example in the context of guest correspondence or the PMS interface. Furthermore, we base the use of your data on our legitimate interest in accordance with Article 6(1)(f) of the GDPR when it comes to improving the quality of our service and ensuring an authentic public image through guest reviews.

5.5.3 Purpose of data processing

The use of TrustYou serves to carry out and optimise guest communication, send information and offers, process enquiries and bookings, and collect, manage and publish guest reviews. Furthermore, TrustYou enables us to organise our processes more efficiently and improve our services.

5.5.4 Duration of storage

Your data will only be stored for as long as is necessary for the purposes stated, or until you object to further processing or withdraw any consent you have given. Where statutory retention obligations apply, the storage period is determined by these requirements.

5.5.5 Right to object and withdraw consent

You may opt out of receiving newsletters or review requests at any time by using the unsubscribe link contained in the messages or by notifying us. You may also object to the processing of your data in the context of guest correspondence or the PMS interface, provided there are no compelling legal or contractual reasons to the contrary. You may withdraw any consent you have given at any time with effect for the future.

6.1 General

Our website may use cookies. Cookies are text files that are stored in the web browser or by the web browser on the user’s computer system. When a user visits a website, a cookie may be stored on the user’s operating system. This cookie contains a distinctive string of characters that enables the browser to be uniquely identified when the website is visited again. However, we only use cookies if the user consents to the use of the relevant services. An exception to this are technically necessary cookies.

• Necessary cookies: required for the operation of the website
• Functional cookies: improve user-friendliness
• Analytics and marketing cookies: help us to understand user behaviour and optimise our offering

You can restrict or refuse the storage of cookies via your browser settings. If you disable them, the functionality of the website may be limited.
You can access and change your cookie settings for this website at any time here: Cookie settings.

6.2 Web analytics with Google Analytics

Our website uses Google Analytics, a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland).
Google Analytics uses cookies that store information about your user behaviour and help us to improve the website. Your IP address is anonymised in the process, so that it cannot be directly linked to you personally.
The legal basis for data processing is your consent in accordance with Article 6(1)(a) of the GDPR.
You may withdraw your consent at any time:
by adjusting the relevant settings in your browser,
or by using Google’s opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de.
The data will be deleted as soon as it is no longer required for our record-keeping purposes.

7.2 Google Maps

On our websites, we use services provided by Google Ireland Limited. (Gordon House, Barrow Street, Dublin 4, Ireland; contact details for the Data Protection Officer: see https://support.google.com/policies/contact/general_privacy_form) for the purpose of displaying maps.
These services collect data using an API.
The following data is collected:

• Date and time of the visit
• Location information
• IP address
• URL
• Usage data
• Search terms
• Geographical location

The legal basis for data processing is your consent in accordance with Article 6(1)(a) of the GDPR.
Your data may be transferred to Alphabet Inc. and Google LLC in the following countries: the United States of America, Singapore, Taiwan and Chile.
Your data will be deleted as soon as it is no longer required for the purposes of processing.

7.3 YouTube

On our websites, we use services provided by Google Ireland Limited (Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland, contact details of the data protection officer: see https://support.google.com/policies/contact/general_privacy_form) for the purposes of video display.
These services collect data using cookies (provided the “Privacy-Enhanced” mode is not enabled).
The following data is collected:

• Device information
• IP address
• Referrer URL
• videos viewed.

The legal basis for data processing is your consent in accordance with Article 6(1)(a) of the GDPR.
Your data in this regard may be transferred worldwide to Alphabet Inc. and Google LLC.
Your data will be deleted as soon as it is no longer required for the purposes of processing.

7.4 Facebook plugins

Plugins from the social network Facebook, provided by Facebook Inc., 1 Hacker Way, Menlo Park, California 94025, USA, are integrated into our website. You can recognise the Facebook plugins by the Facebook logo or the “Like” button on our website. You can find an overview of the Facebook plugins here: https://developers.facebook.com/docs/plugins/. When you visit our website, the plugin establishes a direct connection between your browser and the Facebook server. Facebook thereby receives the information that you have visited our website using your IP address.
The processing of your personal data is carried out on the basis of your consent in accordance with Article 6(1)(a) of the GDPR, which you provide voluntarily and may withdraw at any time without giving reasons.
If you click the Facebook “Like” button whilst logged into your Facebook account, you can link the content of our pages to your Facebook profile. This enables Facebook to associate your visit to our pages with your user account. Please note that, as the provider of these pages, we have no knowledge of the content of the data transmitted or how it is used by Facebook. Further information on this can be found in Facebook’s privacy policy at https://de-de.facebook.com/policy.php. If you do not wish Facebook to be able to associate your visit to our pages with your Facebook user account, please log out of your Facebook user account.

We only store personal data for as long as is necessary to fulfil the relevant purposes or as required by statutory retention obligations. After that, the data is deleted or anonymised.

9.1 General

Under the GDPR, you have the following rights in particular:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR):

Where the processing is based on Article 6(1)(e) or (f) of the GDPR, you have the right to object at any time on grounds relating to your particular situation.
We will then no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.
Please note: For certain technically necessary processing operations (e.g. the creation of server log files for the provision and security of the website), there is an overriding legitimate interest, meaning that data processing may continue despite an objection.
You have a separate right to object at any time, without giving reasons, if your data is processed for the purposes of direct marketing.

The objection may be made in any form and should, where possible, be addressed to:

Resort Das Achental
HGV GmbH & Co. KG
Mietenkamer Straße 65 | 83224 Grassau

+49 8641-4010
dsb-resortachental@kinast.eu
Right to withdraw consent (Article 7(3) of the GDPR)

You may withdraw any express or implied consent you have given us at any time with future effect in accordance with Article 7(3) of the GDPR.
Right to lodge a complaint with a supervisory authority (Article 77 of the GDPR)
You have the right to lodge a complaint with a supervisory authority at any time. The competent authority is, in principle, the Bavarian State Office for Data Protection Supervision, https://www.lda.bayern.de/de/index.html.

If you have any questions or concerns regarding data protection (in particular regarding objections and withdrawal of consent), please contact us at:

Resort Das Achental
HGV GmbH & Co. KG
Mietenkamer Straße 65 | 83224 Grassau

+49 8641-4010
dsb-resortachental@kinast.eu