DATA PRIVACY STATEMENT
DATA PRIVACY STATEMENT
I. Information on the processing of personal data
With the following information, we aim to give you an overview of the processing of your personal data associated with the use of our website atwww.deutschehospitality.comand to inform you of your rights under data privacy law, in accordance with art. 13 and 14 of the GDPR.
You can find further information about the processing of personal data associated with a stay at one of Deutsche Hospitality’s hotels operating under the brands Steigenberger Hotels and Resorts (www.steigenberger.com), IntercityHotel (www.intercityhotel.com), Jaz (www.jaz-hotel.com) and Maxx by Steigenberger (www.maxxhotel.com) in the data privacy statements for the websites of the relevant hotels.
1. Responsibility for data processing
The party responsible for data processing on this website in accordance with art. 4, no. 7 GDPR and the provider of this website (service provider) pursuant to the German Teleservices Act (TMG) is
Steigenberger Hotels AG
Lyoner Straße 25
60528 Frankfurt am Main
Telephone: +49 69 66564-01
Fax: +49 69 66564-888
Full details pursuant to section 5 of the TMG (legal notice)
2. Contact details for the Data Privacy Officer
You can reach our Data Privacy Officer via
TÜV Informationstechnik GmbH
3. Objective and legal basis of the processing of personal data
We process your personal data in compliance with the provisions of the EU General Data Protection Regulation (GDPR), the new German Federal Data Protection Act (BDSG-neu), and all other applicable laws, for the following purposes and on the following legal basis:
(a) To send oure-mail newsletters, including administration of your subscription to the news-letter – the legal basis for this is your consent according to art. 6, para. 1, sentence 1, point a) GDPR.
With the e-mail newsletter, we provide you with regular information, in line with your preferences regarding the offerings and services of the hotels and businesses that belong to Deutsche Hospitality (Steigenberger Hotels and Resorts,IntercityHotel,Jaz in the City), about marketing campaigns for business customers and offerings from our partner companies such as Deutsche Bahn AG (for booking train tickets), SIXT (for booking rental cars and chauffeur services) and comparable providers of travel-related services.
If you wish to receive the e-mail newsletter, we need you to provide us with a valid e-mail address. We apply the so-called "double opt-in" process for registration for our newsletter. That means that once you have registered, we send an e-mail to the e-mail address you have entered, in which we ask for confirmation that you would like to receive the newsletter. If you do not confirm your registration within two weeks, your information will be blocked and will be automatically deleted after one month. In addition, we also store the IP addresses used and the times of registration and confirmation in each case. The aim of the process is to verify your registration and, where relevant, to be able to clarify any potential misuse of your personal data.
As a subscriber to the e-mail newsletter, you can withdraw your consent to the processing of your e-mail address for dispatch of the e-mail newsletter at any time. This withdrawal of consent can take place via the relevant link in each e-mail newsletter or by sending an e-mail with the subject "Unsubscribe" to firstname.lastname@example.org.
(b) To answer your questions and deal with concerns you have expressed to us via thecontact form on the websiteorby telephone.
(c) To process yourapplication– more detailed information on this can be found in the separate data privacy declaration in our application portal athttps://steigenberger-jobs.dvinci.de.
(d) For the assertion of and defence against legal claims and for the safeguarding of interests in legal disputes, to guarantee IT security and IT operations – the legal basis for this is art. 6, para. 1, clause 1, point f) of the GDPR. Our overriding valid interests stem from our in-terest in the enforcement of our material and immaterial claims and the exercising of our rights, as well as defence against unjustified demands.
Minors may not submit any personal data to us without permission from a parent or guardian. We do not knowingly process any personal data acquired from minors within the scope of our internet offering.
4. Categories of recipients of personal data
Where necessary for the purposes outlined above in point 3, we disclose your personal data to the following recipients or categories of recipients pursuant to art. 4, no. 9 of the GDPR:
Within our company, your data will only be viewed or accessed by those departments that require it (in the scope required in each case) to fulfil our contractual and statutory obligations.
Service providers (e.g. as part of our order processing in line with art. 28 GDPR) and performing agents commissioned by us can also receive access to personal data for these purposes. These are companies that provide recruitment services (currently dvinci HR-Systems GmbH).
5. Forwarding of personal data to a third country
Personal data will not be forwarded to offices in countries outside of the European Union (so-called third countries), except in those cases outlined under point 12 (use of Google Analytics).
6. Duration of personal data storage and criteria for establishing such duration
We adhere to the principles of data reduction and data economy. We therefore store your personal data only as long as it is necessary for the purposes stated here, or in line with the various storage deadlines stipulated by the legislator. Once the relevant purpose no longer applies or such deadlines expire, the relevant data is routinely blocked or deleted in line with the statutory provisions.
7. Your rights as an affected person
Every person affected whose personal data is processed has a right under art. 15 of the GDPR to information from those responsible about the relevant personal data, as well as a right to rectification of such data under art. 16 of the GDPR, a right to erasure under art. 17 of the GDPR, a right to restriction of its processing under art. 18 of the GDPR, a right to object to its processing under art. 21 of the GDPR, and a right to data portability under art. 20 of the GDPR. In terms of the right to information and the right to erasure, the limitations pursuant to sections 34 and 35 of the BDSG-neu also apply.
Where the processing of your personal data is based on consent given to us, you have the right to withdraw such consent at any time, whereby this will not affect the legitimacy of the processing carried out based on such consent up to the point of its withdrawal.
Furthermore, there is also a right to lodge a complaint with the relevant supervisory authority in line with art. 77 of the GDPR in conjunction with section 19 of the BDSG-neu.
8. Obligation to provide data
When using our website, you are under no obligation to provide personal data. If you want us to make contact with you, we will need (i) your name, and (ii) your telephone number or your e-mail address at the very least. If you wish to apply for a vacant position, we will need a certain amount of information as a minimum for the processing of your application; more information on this is provided in the separate data privacy statement of the application portal.
9. Automated decision-making and profiling
In the establishment and execution of our contractual relationship, you will not be subject to any automated individual decision-making, including profiling, which produces legal effects concerning you or similarly significantly affects you pursuant to art. 22 of the GDPR.
10. Additional information about your right to object pursuant to art. 21 of the GDPR
You have the right to object, for reasons arising from your specific situation, to the processing of personal data relating to you at any time based on art. 6, para. 1, clause 1, point e) of the GDPR (data processing in the public interest) or art. 6, para. 1, clause 1, point f) of the GDPR (processing necessary for the purposes of legitimate interests); this also applies to any profiling based on this provision according to art. 4, para. 4 of the GDPR.
If you lodge an objection, we will no longer process your personal data, unless we can prove it is absolutely necessary for protective reasons that outweigh your interests, rights and freedoms, or such processing serves the assertion, exercise or defence of legal claims.
If your personal data are processed by us in order to carry out direct advertising, you have the right to object to the processing of personal data relating to you for the purposes of such advertising at any time; this also applies for profiling where this is in connection with direct advertising.
Objection can be made in any form and should be directed to our data privacy officer using the contact details stated in point 2.
We specifically use the following kinds of cookies:
• Performance cookies:Performance cookies enable us to gather anonymous statistical data about how web pages are used and where faults occur. They are supplemented by anonymised general data, such as information on visitor demographics and scope. These cookies make a fundamental contribution to keeping the web pages as performance-oriented as possible and make it possible to identify any errors or weaknesses.
• Google AdWords:Our website makes use of Google conversion tracking. If you access our website via an advertisement displayed by Google, a cookie is placed on your computer by Google Adwords. The cookie for conversion tracking is created when a user clicks on an advertisement displayed by Google. These cookies lose their validity after 30 days and do not provide for personal identification. If the user visits specific pages of our website and the cookie has not yet expired, we and Google are able to recognise that the user has clicked on the advertisement and was redirected to this site. Each Google AdWords customer gets a new cookie. Cookies cannot therefore be traced via the websites of AdWords customers. The information gathered via the conversion cookies serves to create conversion statistics for AdWords customers who have opted for conversion tracking. The customers discover the total number of users who have clicked on their advert and were redirected to a page equipped with a conversion tracking tag. Nevertheless, they do not receive any information that could allow users to be identified personally.
If you do not wish to participate in tracking, you can choose to reject the creation of a cookie – for example through the browser setting that deactivates the automatic creation of cookies in general, or by setting your browser so that cookies from the domain “googleleadservices.com” are blocked.
Please note that you may not delete the opt-out cookies while your preferences are set to prevent recording of measuring data. If you have deleted all your cookies in the browser then you will have to reinstate the relevant opt-out cookie.
The data processed through cookies are required for the aforementioned purposes linked to our legitimate interests and those of third parties according to art. 6, para. 1, point f) GDPR.
You can adjust your browser settings to ensure cookies are only stored when you agree to it. Most browsers accept cookies automatically. Nevertheless, you can adjust your browser so that no cookies are stored on your computer or a notification always appears before a new cookie is saved. Complete deactivation of cookies may mean you are not able to use all the functions of our website, however. If you only wish to accept Deutsche Hospitality cookies, but no cookies from partners, then please select “Block cookies from third-party providers” in your browser. Via the help function, the menu list of your web browser shows you how you can reject new cookies and switch off those that have already been saved. We recommend that on shared computers you accept the cookies and so-called flash cookies, but log off fully once you have finished.
12. Analysis tools
The tracking measures outlined in the following and applied by us are executed based on art. 6, para. 1, clause 1, point f) of the GDPR. By using future tracking measures, we aim to ensure our website is designed and continually optimised in line with the users’ requirements. In addition, we also use the tracking measures to compile statistics on the use of our website and for the purposes of evaluating our offering for you. These interests can be considered justified pursuant to the aforementioned legal provision. The relevant data-processing objectives and data categories are outlined in the explanations of the corresponding tracking tools.
This website also uses Google Analytics, a web analysis service from Google Inc. based in Mountain View, USA ("Google"). Google Analytics uses so-called "cookies" – these are text files that are stored on your computer and which facilitate analysis of your use of the website. The information generated through the cookie about your use of this website is generally transferred to a Google server in the USA and is stored there.
Since the IP anonymisation provided by Google on this website (so-called IP masking) is activated (through the expansion of Google Analytics using the code "gat._anonymizelp;"), your IP address is nevertheless abbreviated and thus anonymised by Google within the European Union or in another state party to the agreement. Only in exceptional cases is the full IP address transferred to a Google server in the USA and abbreviated there.
On behalf of the operator of this website, Google will use the information acquired through Google Analytics to evaluate your use of the website, compile reports about the website activities, and provide further services linked to use of the website and internet usage on behalf of the website operator. Google will not merge the IP address conveyed by means of Google Analytics from your browser with any other data.
You can prevent the storage of cookies by Google Analytics by adjusting the settings of your browser software accordingly; however, we would like to point out that if you do so, you may not be able to use all the functions of this website in their entirety. In addition to this, you can also prevent the transfer of data generated by the cookie in relation to your use of the website (including your IP address) to Google and the processing of this data by Google by downloading and installing the browser plugin available at the following link (http://tools.google.com/dlpage/gaoptout?hl=de).
Furthermore, you can also prevent Google Analytics from detecting your use of the website by applying a so-called opt-out cookie, which prevents data capture when you visit this website in future. The opt-out cookie is used when you click on the following link:To lodge your objection, please click here.
The operator of this website also uses Google Analytics to evaluate data from AdWords and the double-click cookie for statistical purposes. If you do not want this to happen, you can deactivate the process via the ad preferences manager (http://www.google.com/settings/ads?hl=de).
13. Incorporation of services and content of third-party providers (e.g. YouTube and Google Maps)
The internet offer incorporates content from third parties, e.g. videos from YouTube and map resources from Google Maps (hereinafter referred to as “third-party providers”). Use of such content makes transfer of the user’s IP address to the relevant third-party provider necessary for technical reasons. After all, without the IP address the third-party providers would not be able to send the content incorporated into the website to the browser of the relevant user. We have no influence over whether or not a third-party provider stores the IP address or uses it in any other way, e.g. for statistical purposes.
If you make use of the offer from third-party provider CompanyMatch (www.companymatch.me) as incorporated into our application portal, the data privacy provisions of this third-party provider apply to the processing of the personal data you enter here.
Status and updating of the data privacy statement
This data privacy statement is valid from 13 June 2019.
We will update this data privacy statement from time to time in the event of relevant changes to our website, the processing of personal data or statutory provisions. The revised version will then be valid from the published date on which it comes into force. Where there are fundamental changes to this data privacy statement, we will inform you promptly before the changes come into force with a notification on our website. We will also inform our guests, where relevant, about the changes via e-mail or in another way.