1. Privacy at a Glance
Analytics Tools and Third-Party Tools
When visiting our website, your browsing behavior may be statistically analyzed. This is primarily done with cookies and so-called analytics programs. The analysis of your browsing behavior is usually anonymous; the browsing behavior cannot be traced back to you. You can object to this analysis or prevent it by not using certain tools. Detailed information can be found in the following privacy policy.
You can object to this analysis. We will inform you about the objection options in this privacy policy.
2. General Information and Mandatory Notices
Information About the Responsible Party
The responsible party for data processing on this website is:
Zeno Grundstücksverwaltungs-GmbH
Am Münster 3
D-83435 Bad Reichenhall
Phone: +49 8651 776-0
Email: reichenhall(at)amber-hotels.de
The responsible party is the natural or legal person who, alone or jointly with others, decides on the purposes and means of processing personal data (e.g., names, email addresses, etc.).
Data We Process
We process personal data that we receive from you in the course of our business relationship.
Additionally, we process personal data that we have lawfully received from other companies within the Zeno Grundstücksverwaltungs-GmbH, Amber Hotel Plaza Betriebsgesellschaft mbH, Econtel München Hotelbetriebsgesellschaft mbH, or other third parties (e.g., trade show and training event organizers, credit agencies, etc.), insofar as this is necessary for the provision of our services. Furthermore, we process personal data that we have lawfully obtained from publicly accessible sources (e.g., land registers, press, internet).
Relevant personal data includes, among others: customer and supplier master data (e.g., contacts, email addresses, addresses, other contact details), billing data, contract data, marketing and sales data, and other data comparable to the aforementioned categories.
Purpose and Legal Basis of Data Processing
We collect and process personal data for the following purposes:
- To fulfill a contract or carry out pre-contractual measures. The legal basis is Article 6(1)(b) GDPR.
- Direct marketing for our own products or services. The legal basis is Article 6(1)(f) GDPR, with our legitimate interest being to provide you with information about our products and services for direct marketing purposes.
- Customer data analysis to create tailored product offers. The legal basis is Article 6(1)(f) GDPR, with our legitimate interest being to continuously improve our services and products and offer you tailored products that meet your needs.
- Processing your personal data beyond the stated purposes only occurs if you have given us consent for processing. The legal basis is Article 6(1)(a) GDPR.
Recipients of Data
Within our company, those departments that need your data to fulfill our contractual and legal obligations receive access to it. Our service providers and vicarious agents (processors within the meaning of Art. 4 No. 8 GDPR) may also receive data for these purposes if they maintain confidentiality and comply with our data protection instructions. These are mainly companies from the following categories: credit agencies, debt collection agencies, telephone billing, printing, and IT service providers, network operators, meter operators, and specialist companies. A transfer of your personal data to third parties beyond this only occurs if it is necessary to achieve the aforementioned purposes.
Are Data Transferred to a Third Country or an International Organization?
Your personal data will not be transferred to recipients outside the European Union or the European Economic Area (so-called third countries) or to international organizations.
How Long Are My Data Stored?
We process and store your personal data for at least as long as necessary to achieve the purpose for which they were collected, usually for the duration of an existing contractual relationship. We will also store and process your postal address for up to 24 months after the end of the existing business relationship for the purpose of direct marketing for our own products. Your personal data will be deleted after the purpose has been achieved, provided that all mutual claims from the business relationship have been fulfilled and the temporary retention of the data is not required for the following purposes:
- Compliance with commercial and tax retention periods (these can be up to ten years after the end of the existing contractual relationship)
- Preservation of evidence within the framework of statutory limitation periods (these can be up to 30 years in individual cases, although the regular limitation period is three years)
Do I Have an Obligation to Provide Data?
In the context of our business relationship, you must provide the personal data that is necessary for the establishment and execution of a business relationship and the fulfillment of the associated contractual obligations. Without these data, we will usually have to refuse to enter into the contract or execute the order, or we may no longer be able to execute an existing contract and may have to terminate it.
To What Extent Is There Automated Decision-Making (Including Profiling)?
We generally do not use fully automated decision-making processes as defined in Article 22 GDPR to establish and execute the business relationship. If we use these procedures in individual cases, we will inform you separately.
Right to Object
You can object to the processing of your personal data for direct marketing and/or market research purposes at any time without providing reasons. After receiving your objection, we will no longer process your personal data for the purposes of direct marketing and/or market research and will delete the data unless processing is necessary for other purposes (e.g., to fulfill the contract).
You can also object to other processing that we base on a legitimate interest within the meaning of Art. 6(1)(f) GDPR at any time by providing reasons related to your particular situation. We will no longer process the personal data for the relevant purposes in the event of a justified objection and will delete the data unless we can demonstrate compelling reasons for the processing that outweigh your interests, rights, and freedoms, or the processing serves to assert, exercise, or defend legal claims.
The objection must be addressed directly to the respective company:
- Zeno Grundstücksverwaltungs-GmbH, Am Münster, 83435 Bad Reichenhall, Phone: +49 8651 776-0, Email: reichenhall@amber-hotels.de
- Econtel München Hotelbetriebsgesellschaft mbH, Bodenseestraße 227, 81243 München, Phone: +49 89 87189-0, Email: muenchen@econtel-hotels.de
Data Protection
The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.
When you use this website, various personal data are collected. Personal data are data that can be used to personally identify you. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this is done.
We would like to point out that data transmission on the Internet (e.g., communication via email) may have security vulnerabilities. A complete protection of data from access by third parties is not possible.
Revocation of Your Consent to Data Processing
Many data processing operations are only possible with your express consent. You can revoke consent that you have already given at any time. All you need to do is send us an informal email. The legality of the data processing carried out until the revocation remains unaffected by the revocation.
Right to Lodge a Complaint with the Competent Supervisory Authority
In the event of violations of data protection law, the data subject has the right to lodge a complaint with the competent supervisory authority. The competent supervisory authority for data protection matters is the data protection officer of the federal state in which our company is headquartered. A list of data protection officers and their contact details can be found at the following link: https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html.
Right to Data Portability
You have the right to have data that we process on the basis of your consent or in fulfillment of a contract automatically transferred to you or a third party in a common, machine-readable format. If you request the direct transfer of the data to another responsible party, this will only be done to the extent that it is technically feasible.
SSL or TLS Encryption
This site uses SSL or TLS encryption for security reasons and to protect the transmission of confidential content, such as orders or inquiries you send to us as the site operator. You can recognize an encrypted connection by the fact that the address line of the browser changes from “http://” to “https://” and by the lock symbol in your browser line.
If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.
Encrypted Payment Transactions on This Website
If, after the conclusion of a fee-based contract, there is an obligation to provide us with your payment data (e.g., account number for direct debit authorization), these data are required for payment processing.
The payment transactions via the common means of payment (Visa/MasterCard, direct debit) are carried out exclusively via an encrypted SSL or TLS connection. You can recognize an encrypted connection by the fact that the address line of the browser changes from “http://” to “https://” and by the lock symbol in your browser line.
With encrypted communication, your payment data, which you transmit to us, cannot be read by third parties.
Information, Blocking, Deletion
Within the framework of the applicable legal provisions, you have the right at any time to free information about your stored personal data, their origin and recipient, and the purpose of the data processing, and, if applicable, a right to correction, blocking, or deletion of these data. For this purpose, as well as for further questions on the subject of personal data, you can contact us at any time at the address given in the imprint.
Note Regarding External Links
This website contains links to external third-party websites over whose content we have no control. Therefore, we cannot assume any liability for these external contents. The content of external pages linked here does not reflect the opinion of the website operator but serves merely to provide information and to illustrate connections. The respective provider or operator of the pages is always responsible for the content of the linked pages. The linked pages were checked for possible legal violations at the time of linking. No illegal content was recognizable at the time of linking. However, permanent content control of the linked pages is not reasonable without concrete indications of a legal violation. Upon becoming aware of legal violations, we will remove such links immediately.
3. Data Protection Officer
Statutory Data Protection Officer
We have appointed an external data protection officer. For questions about data protection, please contact:
Sascha Hasselbach
c/o EDV-Fortress
Kronprinzstr. 47-49
40764 Langenfeld
www.datenschutz-extern-nrw.de
Phone: 021732041244
Email: datenschutz@amber-hotels.de
4. Data Collection on Our Website
Cookies
The website uses some so-called cookies. Cookies do not harm your computer and do not contain viruses. Cookies serve to make our offer more user-friendly, effective, and secure. Cookies are small text files that are stored on your computer and saved by your browser.
Most of the cookies we use are so-called “session cookies.” They are automatically deleted after your visit. Other cookies remain stored on your device until you delete them. These cookies allow us to recognize your browser the next time you visit.
You can set your browser to inform you about the setting of cookies and allow cookies only in individual cases, exclude the acceptance of cookies for certain cases or in general, and enable the automatic deletion of cookies when closing the browser. If cookies are disabled, the functionality of this website may be limited.
Cookies that are necessary to carry out the electronic communication process or to provide certain functions you desire (e.g., shopping cart function) are stored on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in storing cookies to ensure the technically error-free and optimized provision of its services. If other cookies (e.g., cookies for analyzing your browsing behavior) are stored, they are treated separately in this privacy policy.
Cookie Consent with Borlabs Cookie
Our website uses the Borlabs Cookie Consent technology to obtain your consent for storing certain cookies in your browser and to document them in a data protection-compliant manner. The provider of this technology is Borlabs – Benjamin A. Bornschein, Georg-Wilhelm-Str. 17, 21107 Hamburg (hereinafter Borlabs).
When you enter our website, a Borlabs cookie is stored in your browser, in which the consents you have given or the revocation of these consents are stored. These data are not passed on to the Borlabs cookie provider.
The collected data will be stored until you ask us to delete it, delete the Borlabs cookie yourself, or the purpose for storing the data no longer applies. Mandatory statutory retention periods remain unaffected. Details on Borlabs cookie data processing can be found at https://de.borlabs.io/kb/welche-daten-speichert-borlabs-cookie/.
The use of the Borlabs cookie consent technology is carried out to obtain the legally required consents for the use of cookies. The legal basis for this is Art. 6(1)(c) GDPR.
Server Log Files
The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:
- Browser type and version
- Operating system used
- Referrer URL
- Hostname of the accessing computer
- Time of the server request
- IP address
A combination of these data with other data sources is not carried out.
The legal basis for processing the data is Art. 6(1)(f) GDPR. Our legitimate interest follows from the purposes of data collection listed below: system security and stability.
Contact Form
If you send us inquiries via the contact form, your details from the inquiry form, including the contact data you provide there, will be stored by us for the purpose of processing the inquiry and in case of follow-up questions. We do not pass on this data without your consent.
The processing of the data entered into the contact form is therefore exclusively based on your consent (Art. 6(1)(a) GDPR). You can revoke this consent at any time. An informal notification by email to us is sufficient for this. The legality of the data processing operations carried out until the revocation remains unaffected by the revocation.
The data you enter in the contact form will remain with us until you request us to delete it, revoke your consent to storage, or the purpose for data storage no longer applies (e.g., after your request has been processed). Mandatory statutory provisions – in particular retention periods – remain unaffected.
Applications
We process the data you send to us in connection with your applications to the following responsible body:
- AMBER HOTEL BAVARIA Bad Reichenhall (Zeno Grundstücksverwaltungs-GmbH, Am Münster 3, 83435 Bad Reichenhall)
- AMBER ECONTEL München (Econtel München Hotelbetriebsgesellschaft mbH, Bodenseestraße 227, 81243 München)
Purpose of Data Collection, Processing, or Use and Legal Basis
We process the data you send us in connection with your application in order to assess your suitability for the position (or any other open positions within our company) and to carry out the application process. The legal basis is Section 26 BDSG (new version).
Recipients or Categories of Recipients
Internal employees responsible for the applicant selection process.
Regular Deadlines for Deleting Data
Data of applicants will be deleted after 6 months in case of a rejection. If you enter into an employment relationship with the responsible body as part of the application process, the application documents will be added to your personnel file.
Processing of Data (Customer and Contract Data)
We collect, process, and use personal data only to the extent necessary to establish, define, or change the legal relationship (inventory data). This is done on the basis of Art. 6(1)(b) GDPR, which allows the processing of data to fulfill a contract or pre-contractual measures. We collect, process, and use personal data about the use of our internet pages (usage data) only to the extent necessary to enable the user to use the service or to bill for it.
To process our online bookings, we use a service provided by Hotelnetsolutions GmbH (HNS), Genthiner Str. 8, 10785 Berlin.
If you book or reserve a room online, your personal data will be transmitted to “HNS”. 14 days after your departure, these personal data will be deleted from the servers of Hotelnetsolutions GmbH.
The processing of the booking is based on Art. 6(1)(b) GDPR, which allows the processing of data to fulfill a contract or pre-contractual measures.
Furthermore, you have the option to register during the booking process. The data entered there will also be stored by HNS and allow you to use your entered data for future bookings.
For important changes, such as changes to the scope of offers or technically necessary changes, we use the email address provided during registration to inform you.
The processing of the data entered during registration is based on your consent (Art. 6(1)(a) GDPR). You can revoke the consent you have given at any time. An informal notification by email to us is sufficient for this. The legality of the data processing already carried out remains unaffected by the revocation.
The data collected during registration will be stored by us as long as you are registered on our website and will then be deleted. Statutory retention periods remain unaffected.
We have concluded a data processing agreement with HNS.
The customer data collected will be deleted after completion of the order or termination of the business relationship. Statutory retention periods remain unaffected.
5. Analytics Tools and Advertising
Google Tag Manager
We use “Google Tag Manager” on our website, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter referred to as “Google”). Google Tag Manager allows us as marketers to manage website tags via an interface. The Google Tag Manager tool that implements the tags is a cookie-free domain and does not collect any personal data itself. Google Tag Manager triggers other tags that may collect data. Google Tag Manager does not access this data. If deactivation has been made at the domain or cookie level, it remains in effect for all tracking tags implemented with Google Tag Manager.
Google has submitted to the EU-US Privacy Shield agreement and is certified. This obliges Google to comply with European data protection standards and regulations. You can find more information in the following linked entry: https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active
Information from the third-party provider: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001.
Further information on data protection can be found on the following Google websites:
- Privacy Policy: http://www.google.de/intl/de/policies/privacy
- Google Tag Manager FAQ: https://www.google.com/intl/de/tagmanager/faq.html
- Google Tag Manager Terms of Use: https://www.google.com/intl/de/tagmanager/use-policy.html
etracker
Our website uses the analysis service etracker. The provider is etracker GmbH, Erste Brunnenstraße 1, 20459 Hamburg, Germany. From the data, usage profiles can be created under a pseudonym. Cookies may be used for this purpose. Cookies are small text files that are stored locally in the cache of your internet browser. The cookies allow your browser to be recognized. The data collected with etracker technologies will not be used without the explicit consent of the data subject to identify visitors to our website personally and will not be merged with personal data about the bearer of the pseudonym.
etracker cookies remain on your device until you delete them.
The storage of etracker cookies is based on Art. 6(1)(f) GDPR. The website operator has a legitimate interest in the anonymized analysis of user behavior to optimize both its website and its advertising.
You can object to the collection and storage of data at any time with effect for the future. To object to the collection and storage of your visitor data for the future, you can obtain an opt-out cookie from etracker at the following link, which will ensure that no visitor data from your browser will be collected and stored by etracker in the future: https://www.etracker.de/privacy?et=V23Jbb.
An opt-out cookie with the name “cntcookie” will then be set by etracker. Please do not delete this cookie as long as you wish to maintain your objection. Further information can be found in the etracker privacy policy: https://www.etracker.com/de/datenschutz.html.
Browser Notifications
If browser notifications are activated for this website by the “Signalize” service, a function of your internet browser is used to provide notifications for you. For the delivery of messages, only anonymous or pseudonymous data is transmitted. Depending on the configuration of the website, this may include:
- Pseudonymous user ID: a randomly generated value (example: 108bf9a85547edb1108bf9a85547edb1), stored in a tracking cookie ID
- Pseudonymous digital fingerprints, pseudonymous mobile device IDs, and, where applicable, pseudonymous cross-device identifiers
These data are only processed to deliver the notifications you have subscribed to and to make notification-related settings. We ask for your consent to store this data. The legal basis for data processing in this case is Art. 6(1)(a) GDPR. You can object to receiving notifications at any time through your browser settings. Information about unsubscribing from web push notifications for the respective browsers can be found here. Unsubscribing on your mobile device is done directly in your device settings for the app or Wallet Card.
To make browser notifications content-wise meaningful for you, we use the preferences collected via a pseudonymous user profile using a tracking pixel and combine them with the notification ID for personalized message delivery. The tracking technology is also used for statistical evaluation of the notifications on our behalf. This allows us to determine whether a notification was delivered and whether it was possibly clicked. The data generated in this way is processed and stored exclusively in Germany by etracker GmbH on our behalf and is therefore subject to strict German and European data protection laws and standards. etracker has been independently audited and certified in this regard and is entitled to carry the ePrivacyseal data protection seal of approval.
The data processing for the statistical analysis of notifications and to better tailor future notifications to the interests of the recipients is based on our legitimate interest in personalized direct marketing in accordance with Art. 6(1)(f) GDPR. Since the privacy of our visitors is very important to us, any data that could allow an individual reference to a person, such as IP addresses, login IDs, or device IDs, are anonymized or pseudonymized as soon as possible. A direct reference to a person is therefore excluded. No other use or transfer to third parties takes place.
You can object to the described data processing at any time. If web push notifications are activated by you, a service of the respective browser is used to provide this function.
Conclusion of a Data Processing Agreement
We have entered into a data processing agreement with etracker and fully implement the strict requirements of the German data protection authorities when using etracker.
7. Plugins and Tools
YouTube
Our website uses plugins from the YouTube site operated by Google. The operator of the pages is YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA.
When you visit one of our pages equipped with a YouTube plugin, a connection is established to the YouTube servers. The YouTube server is informed about which of our pages you have visited.
If you are logged into your YouTube account, you enable YouTube to assign your browsing behavior directly to your personal profile. You can prevent this by logging out of your YouTube account.
The use of YouTube is in the interest of an appealing presentation of our online offers. This constitutes a legitimate interest under Art. 6(1)(f) GDPR.
Further information on the handling of user data can be found in YouTube’s privacy policy at: https://www.google.de/intl/de/policies/privacy.
Google Web Fonts (local hosting)
This site uses so-called web fonts provided by Google for the uniform display of fonts. The Google Fonts are installed locally. No connection to Google servers takes place.
Further information on Google Web Fonts can be found at
https://developers.google.com/fonts/faq and in Google’s privacy policy: https://policies.google.com/privacy?hl=en.
8. Social Networks
Data Processing by Social Networks
We maintain publicly accessible profiles in social networks. The social networks we use in detail can be found further below.
Social networks like Facebook, Google+, etc., can usually comprehensively analyze your user behavior when you visit their website or a website with integrated social media content (e.g., like buttons or advertising banners). Visiting our social media presence triggers numerous data protection-related processing operations. Specifically:
If you are logged into your social media account and visit our social media presence, the operator of the social media portal can assign this visit to your user account. Your personal data may also be collected even if you are not logged in or do not have an account with the respective social media portal. This data collection takes place in this case, for example, through cookies stored on your device or by recording your IP address.
With the help of the data collected in this way, the operators of the social media portals can create user profiles in which your preferences and interests are stored. In this way, you can be shown interest-based advertising inside and outside the respective social media presence. If you have an account with the respective social network, interest-based advertising can be displayed on all devices you are logged in or have been logged in to.
Please also note that we cannot track all processing operations on the social media portals. Depending on the provider, additional processing operations may therefore be carried out by the operators of the social media portals. Details can be found in the terms of use and privacy policy of the respective social media portals.
Legal Basis
Our social media appearances aim to ensure the most comprehensive presence possible on the internet. This is a legitimate interest within the meaning of Art. 6(1)(f) GDPR. The analysis processes initiated by the social networks may be based on different legal bases, which the operators of the social networks must specify (e.g., consent within the meaning of Art. 6(1)(a) GDPR).
Controller and Assertion of Rights
When you visit one of our social media presences (e.g., Facebook), we are jointly responsible with the operator of the social media platform for the data processing operations triggered during this visit. You can generally assert your rights (access, rectification, deletion, restriction of processing, data portability, and complaint) both against us and against the operator of the respective social media portal (e.g., against Facebook).
Please note that despite the joint responsibility with the social media portal operators, we do not have full control over the data processing operations of the social media portals. Our options are largely determined by the corporate policy of the respective provider.
Retention Period
The data collected directly by us via the social media presence will be deleted from our systems as soon as the purpose for their storage no longer applies, you request us to delete them, revoke your consent for storage, or the purpose for data storage no longer applies. Stored cookies remain on your device until you delete them. Mandatory statutory provisions – in particular, retention periods – remain unaffected.
We have no influence on the storage duration of your data, which the operators of the social networks store for their own purposes. For details, please refer directly to the privacy policies of the operators of the social networks (e.g., in their privacy policy, see below).
Social Networks in Detail
Facebook
We have a profile on Facebook. The provider is Facebook Inc., 1 Hacker Way, Menlo Park, California 94025, USA. Facebook is certified under the EU-US Privacy Shield.
We have entered into an agreement with Facebook regarding joint responsibility for the processing of data (Controller Addendum). This agreement specifies for which data processing operations we or Facebook are responsible when you visit our Facebook fan page.
This agreement can be viewed at the following link:
https://www.facebook.com/legal/terms/page_controller_addendum
You can adjust your advertising settings independently in your user account.
Click on the following link and log in:
https://www.facebook.com/settings?tab=ads
For details, please refer to Facebook’s privacy policy:
https://www.facebook.com/about/privacy/