Privacy Policy

Pursuant to Art. 13, 14 GDPR

Controller

Baltic iHub GmbH · Redderkoppel 13 · 24159 Kiel · Germany
E-Mail: hallo@vitalhotel-schulenberg.de

Data Collected

When you visit this website, your browser transmits technical data to our server (IP address, browser type, pages visited, date and time). This data is processed on the basis of Art. 6 (1)(f) GDPR (legitimate interest in operating and securing the website). Data is not stored beyond server log retention periods.

Cookies and Analytics

In addition to technically necessary cookies, this website uses cookies and comparable technologies for reach and usage analysis (Google Analytics 4). These are set exclusively after your prior, explicit consent. Without your consent, no analytics or tracking cookies are used.

Google Analytics 4

This website uses Google Analytics 4 (GA4), a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics uses cookies and comparable technologies that enable an analysis of your use of our website.

Purpose: We use Google Analytics to statistically evaluate the reach and use of our website (reach and usage analysis) in order to optimise our offering and make it more user-friendly.

Data processed: In particular, the following data is processed: pages and interactions, date and time of access, approximate location (region), device and browser information, referrer, and your IP address. Before any storage or further processing, your IP address is shortened/anonymised by Google so that no direct reference to your IP address can be established. We do not merge this data with other data about you.

Legal basis: The use of Google Analytics, as well as the storage of and access to information on your device required for this purpose, is based exclusively on your consent pursuant to Art. 6 (1)(a) GDPR in conjunction with Section 25 (1) of the German Telecommunications Digital Services Data Protection Act (TDDDG).

Consent and withdrawal:Processing of your data by Google Analytics only takes place after you have actively and explicitly given your consent via our cookie banner. Before your consent, no analytics tag is loaded and no analytics cookies are set. Your consent is voluntary and can be withdrawn at any time with effect for the future via the “Cookie settings” link in the footer of our website. The lawfulness of processing carried out up to the point of withdrawal remains unaffected.

Recipient and data processing agreement: The recipient of the data is Google acting as a processor. We have concluded a data processing agreement with Google pursuant to Art. 28 GDPR.

Retention period: Data collected at user level via Google Analytics is automatically deleted after the retention period we have set of 14 months. The analytics cookies set on your device each have a limited storage duration and are deleted at the latest upon expiry of that period or upon withdrawal of your consent.

Transfer to the USA: When using Google Analytics, personal data may be transferred to Google LLC, based in the USA. An adequacy decision of the European Commission of 10 July 2023 exists for the USA on the basis of the EU-US Data Privacy Framework (DPF). Google LLC is certified under the EU-US Data Privacy Framework, so the transfer takes place on this basis pursuant to Art. 45 GDPR. We point out that, despite the adequacy decision, a residual risk remains with a transfer to the USA, in particular regarding possible access by US authorities. Should no adequacy decision apply, we additionally base the transfer on your explicit consent pursuant to Art. 49 (1)(a) GDPR.

Further information: For more details on how Google handles your data, please see Google’s privacy policy at https://policies.google.com/privacy.

Room booking via the Mews Booking Engine (direct booking)

To book rooms online, our website links to the booking engine (distributor) of Mews Systems B.V. (established in the Netherlands). When you click “Book” on our website, the booking engine operated by Mews opens at app.mews.com in a new browser tab. No booking window and no Mews program code is embedded in our website; merely visiting our website therefore transmits no data to Mews. You enter your booking data directly into the booking engine operated by Mews.

Purpose: Real-time display of available rooms and rates, acceptance and processing of your room booking, and the subsequent administration of the accommodation contract via our property management system provided by Mews.

Data processed: First and last name, contact details (email, phone, address where applicable), stay dates (arrival/departure), room and rate selection, number of guests, any special requests or remarks, and the information required for payment. In addition, technical data required to operate the booking engine are processed (e.g. IP address, time of access, browser/device information).

Legal basis: Processing of your booking data is carried out to perform pre-contractual measures and to fulfil the accommodation contract pursuant to Art. 6(1)(b) GDPR.

Recipients / processing on our behalf: Mews Systems B.V. processes the booking data on our behalf and on our instructions as a processor within the meaning of Art. 28 GDPR.

Payment processing (Mews Payments):Payment for your booking is handled via “Mews Payments”. The payment service provider used here is Stripe, in the “payment facilitator” model. You enter your payment and card data directly into the secure payment page; it is processed by Stripe. For details on payment processing, data-protection responsibility and a possible transfer to the USA, see the section “Payment processing via Stripe”.

Protection by Google reCAPTCHA:The booking and payment page operated by Mews is protected by Google reCAPTCHA in order to distinguish human input from abusive automated access. reCAPTCHA is provided by Google (Google Ireland Limited / Google LLC, USA); in doing so, personal data may be processed, including in the USA. This processing takes place on the page operated by Mews; the privacy notices of Mews and of Google apply (https://policies.google.com/privacy). For transfers to Google LLC in the USA, the European Commission’s adequacy decision of 10 July 2023 (EU-US Data Privacy Framework) applies.

International data transfers:Mews Systems B.V. is established in the European Union (Netherlands). Whether and to what extent Mews uses sub-processors outside the EU/EEA, and the safeguards (Art. 44 et seq. GDPR) on which any such transfers are based, are governed by the data processing agreement concluded with Mews and by Mews’s privacy policy.

Retention period: Booking data are stored for the duration of the contractual relationship and beyond, within the scope of statutory retention obligations (in particular commercial and tax law, generally up to ten years), after which they are deleted.

Further information: For details on Mews’s data processing, please see the provider’s privacy policy at https://www.mews.com/en/legal/privacy-policy.

Payment processing via Stripe

For online payments we use the payment service provider Stripe. This concerns, on the one hand, the payment of breakfast and food pre-orders via our own website, and, on the other hand, the payment of room bookings, which is handled via “Mews Payments” in the “payment facilitator” model with Stripe (see the section “Room booking via the Mews Booking Engine”). The provider for customers within the European Economic Area is Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (“Stripe”). Stripe Payments Europe, Limited is part of Stripe, Inc., based in the USA.

Purpose: We use Stripe to process the online payment you have chosen for a breakfast booking, to allocate the payment, and to prevent payment defaults and fraud.

Data processed: In the course of payment processing, in particular the following data is processed: payment and card data (e.g. card number, expiry date, security code or the details of the payment method used), name, e-mail address, invoice amount and booking reference, as well as technical transaction data (e.g. timestamp, IP address and fraud-prevention data). The card and payment data are processed directly by Stripe; we ourselves do not receive this payment data in plain text, but only information on the status and allocation of the payment.

Legal basis: The legal basis for processing in order to carry out the payment is Art. 6(1)(b) GDPR (performance of the contract concluded with you or implementation of pre-contractual measures). Insofar as Stripe processes data for the purposes of fraud prevention and the security of payment transactions, this is based on the legitimate interest in secure and abuse-free payment processing pursuant to Art. 6(1)(f) GDPR.

Recipient and responsibility: The recipient of the payment data is Stripe. Stripe processes the data required to carry out the payment partly on our behalf and partly under its own data protection responsibility (in particular to comply with legal and regulatory obligations and for fraud prevention). Insofar as Stripe acts as a processor, a data processing agreement pursuant to Art. 28 GDPR is in place.

Transfer to the USA: In the course of payment processing, personal data may be transferred to Stripe, Inc., based in the USA. An adequacy decision of the European Commission of 10 July 2023 exists for the USA on the basis of the EU-US Data Privacy Framework (DPF); insofar as Stripe, Inc. is certified under the EU-US Data Privacy Framework, the transfer takes place on this basis pursuant to Art. 45 GDPR. In addition, Stripe bases transfers to third countries on standard contractual clauses adopted by the European Commission pursuant to Art. 46(2)(c) GDPR. We point out that, despite the adequacy decision, a residual risk remains with a transfer to the USA, in particular regarding possible access by US authorities.

Retention period:We store the payment-related data for as long as is necessary to process the booking and as long as statutory retention obligations (in particular commercial and tax retention periods) apply. The duration of processing at Stripe is governed by the provisions of Stripe’s privacy policy.

Further information: For more details on how Stripe handles your data, please see Stripe’s privacy policy at https://stripe.com/privacy.

Pre-ordering bread rolls and food

Guests and interested parties can pre-order baked goods (e.g. bread rolls) and comparable food for collection at our restaurant via a separate online form. The form is opened exclusively via a personal link that you previously receive in the message history of our WhatsApp contact (see the section “Communication via WhatsApp”).

Purpose: We process your details in order to accept and handle your pre-order, process the payment, prepare the order in our kitchen for the agreed collection time, and allocate it to you on collection.

Data processed: Your name, optionally your room number (only if you are staying with us; voluntary), your WhatsApp phone number (taken from the personal order link so that we can allocate your order to your enquiry), the details of your order (type and quantity of goods, desired collection day and time), the order and payment reference, and the payment status.

Legal basis: The legal basis for processing to accept, handle and settle your order is Art. 6(1)(b) GDPR (performance of a contract or implementation of pre-contractual measures). Insofar as we display your order internally for kitchen planning and mark it for handover, we base this on our legitimate interest in an orderly, mix-up-free process, Art. 6(1)(f) GDPR.

Recipients:

Kitchen / service: Your order data is forwarded internally to our kitchen (order e-mail to our in-house mailbox and display on a screen in the kitchen area that is not publicly visible) and marked for handover. No disclosure to uninvolved third parties takes place.
Payment processing: Payment is made via the payment service provider Stripe; for details, in particular on responsibility and a possible transfer to the USA on the basis of the EU-U.S. Data Privacy Framework or standard contractual clauses, see the section “Payment processing via Stripe”.
Contact channel: The pre-order is initiated via the WhatsApp messaging service; for the associated data exchange and the role of the Meta group (WhatsApp Ireland Limited), see the section “Communication via WhatsApp”.
Hosting / storage: The order data is stored on a server operated by ourselves (self-hosting) within Germany. The data remains on our own infrastructure and is not transferred to an external database or cloud service for the operation of the pre-order.

Retention period: We delete or anonymise the details of your order in our order overview no later than 14 days after the collection day. This does not affect records that serve the settlement of the payment: invoice and payment records are retained within the statutory retention obligations (in particular Section 147 AO, Section 257 HGB, generally up to ten years) at our payment service provider or in our accounting and are deleted only after these have expired.

Provision: Providing the stated data is required to handle your pre-order. Without this data we cannot accept your order and prepare it for collection. Providing the room number is voluntary.

Your rights as a data subject (access, rectification, erasure, restriction, objection, data portability, and the right to lodge a complaint with a supervisory authority) are set out in the “Your Rights” section of this privacy policy.

Communication via WhatsApp

We offer you the option of contacting us via the WhatsApp messaging service. For this purpose, our website provides a button and links that point to WhatsApp as a simple link (wa.me). No chat window and no WhatsApp/Meta program code is embedded in our website; merely visiting our website therefore sets no cookies and transmits no data to Meta. Only when you click the button does WhatsApp open on your device and you start the conversation yourself. Our WhatsApp number for enquiries to the hotel is +49 5323 7333211.

Purpose: Via WhatsApp we answer general guest enquiries, provide booking and check-in information, and, on request, send you links to our booking process.

Data processed: Your WhatsApp phone number, the profile name stored in your WhatsApp account, the content of your messages, and message metadata (e.g. time of receipt). We do not store voice messages.

Use of an AI-based assistant:Incoming messages are first answered by an AI-based digital assistant (“Mara”). At the beginning of every conversation we explicitly inform you that you are communicating with an AI (Art. 50 AI Act). Where your request requires individual handling, we hand the matter over to a member of staff. No decision based solely on automated processing that produces legal effects or similarly significantly affects you within the meaning of Art. 22 GDPR takes place.

Recipients and processing on our behalf:The exchange of messages runs technically via the WhatsApp Business Platform (Cloud API), which for users in the European Economic Area is provided by WhatsApp Ireland Limited, a company of the Meta group based in Dublin, Ireland. WhatsApp processes the content of your messages as a processor on our behalf and on our instructions; the processing agreement pursuant to Art. 28 GDPR forms part of the platform terms via the “WhatsApp Business Data Processing Terms”. The message content is subsequently processed on our own server and stored there and in an internal archive mailbox for documentation and record-keeping purposes. In addition, Meta processes certain data (in particular technical and usage data) as an independent controller for its own purposes; we have no influence over this.

Legal basis:Where your message concerns the initiation or performance of a booking, the legal basis is Art. 6(1)(b) GDPR. Otherwise, we process your data on the basis of our legitimate interest in efficient communication via the channel you have chosen pursuant to Art. 6(1)(f) GDPR. By contacting us via WhatsApp, you deliberately choose this channel; Meta’s own privacy terms additionally apply to your use of WhatsApp.

International data transfers:In the course of operating the WhatsApp Business Platform, personal data may be transferred to WhatsApp LLC and Meta Platforms, Inc., based in the USA. This transfer is based on the European Commission’s Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR (Implementing Decision (EU) 2021/914), which form part of the WhatsApp contractual terms; in addition, Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework, so that the transfer may additionally be based on the European Commission’s adequacy decision pursuant to Art. 45 GDPR. We point out that, despite these safeguards, a residual risk remains with a transfer to the USA, in particular regarding possible access by US authorities.

Retention period: We delete conversations without a booking reference no later than 90 days after the last message. We delete conversations with a booking reference no later than twelve months after the last message; if the history exceptionally contains billing- or contract-relevant records, we retain these within the statutory retention periods (Sections 257 HGB, 147 AO) and delete them thereafter.

Your rights:You have the data subject rights set out in the “Your Rights” section (in particular access, rectification, erasure, restriction, data portability, objection, and the right to lodge a complaint with a supervisory authority). For matters concerning this processing, you can reach us at the e-mail address above.

Further information: For more details on how Meta handles your data, please see WhatsApp’s privacy policy at https://www.whatsapp.com/legal/privacy-policy-eea.

Your Rights

You have the right to access, rectification, erasure, restriction of processing, data portability, and objection (Arts. 15–21 GDPR). To exercise these rights, contact us at the address above. You also have the right to lodge a complaint with a supervisory authority.