Privacy Policy

I. General Information on Data Protection

1. Information on the Processing of Personal Data

With the following data protection information, we inform you about which personal data is processed when using our website, for what purposes this is done, and on which legal basis the processing is based.
Personal data is all information relating to an identified or identifiable natural person. This includes, for example, name, address, email address, telephone number, or information on usage behavior on our website. The terms “processing”, “controller”, “processor”, and “consent” are based on the definitions in Art. 4 of the General Data Protection Regulation (GDPR).
Insofar as data processing activities affect persons in Switzerland, the provisions of the Swiss Federal Act on Data Protection (FADP) apply additionally. For better readability, we uniformly use the terminology of the GDPR in this privacy policy. Insofar as Swiss data protection law is applicable, the corresponding terms of the FADP are deemed to be included.

2. Scope and Legal Bases of Data Processing
We process personal data exclusively to the extent necessary to ensure the functionality of our website, to provide our services, and to fulfill legal obligations.
Processing is carried out in particular on the basis of: your consent pursuant to Art. 6 (1) lit. a GDPR, for the performance of a contract or to carry out pre-contractual measures pursuant to Art. 6 (1) lit. b GDPR, for compliance with a legal obligation pursuant to Art. 6 (1) lit. c GDPR, to protect vital interests pursuant to Art. 6 (1) lit. d GDPR, as well as to safeguard our legitimate interests pursuant to Art. 6 (1) lit. f GDPR, unless your interests or fundamental rights and freedoms which require protection override.

3. Storage Period and Erasure
Personal data is only stored for as long as is necessary to fulfill the respective processing purpose.
As soon as the purpose of the processing no longer applies, the data concerned will be deleted or its processing will be restricted. Storage beyond this will only take place if legal retention periods under national or European law provide for this or if further storage is required for the conclusion or performance of a contractual relationship.

4. Use of Service Providers
For individual services and technical functions of our website, we use carefully selected external service providers. Insofar as personal data is processed in this context, this is done exclusively on the basis of corresponding contractual agreements and in compliance with data protection regulations.
Detailed information on the respective processing activities can be found in the following sections of this privacy policy.

II. Controller

The controller for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR) and other data protection regulations is:
STADTHOTEL MÜNSTER GmbH
Managing Director: Reinhold Garthe
Aegidiistraße 21
48143 Münster
Telephone: +49 251 4812-0
Fax: +49 251 4812-123
Email: service@stadthotel-muenster.de

Registration Court: District Court of Münster
Commercial Register Number: HRB 3140

Further information about our company can be found in the legal notice (Impressum) of our website.

Data Protection Officer
Our external data protection officer is available to answer any questions you may have regarding data protection law:

Joachim Kramer
Datenschutz Kramer & Kramer GmbH
Email: info@datenschutz-kramer.de

If you have any questions regarding the processing of your personal data or the exercise of your rights, you can contact the data protection officer at any time.

III. Rights of Data Subjects

Insofar as we process personal data from you, you are entitled to various rights under the applicable data protection regulations.

1. Right of Access
You have the right, pursuant to Art. 15 GDPR, to request information as to whether and which personal data we process about you.

2. Right to Rectification
Should the data stored about you be incorrect or incomplete, you can request its rectification or completion pursuant to Art. 16 GDPR.

3. Right to Erasure
Under the conditions of Art. 17 GDPR, you have the right to request the erasure of your personal data.

4. Right to Restriction of Processing
Pursuant to Art. 18 GDPR, you can request the restriction of the processing of your personal data, provided that the legal prerequisites for this are met.

5. Right to Data Portability
Insofar as the requirements of Art. 20 GDPR are met, you have the right to receive personal data that you have provided to us, and which is processed automatically on the basis of your consent or a contract, in a structured, commonly used, and machine-readable format, or to have it transmitted to another controller.
Excluded from this is, in particular, processing required for the technical operation of the website, such as the processing of server log data.

6. Right to Lodge a Complaint with a Supervisory Authority
If you believe that the processing of your personal data violates data protection regulations, you have the right to lodge a complaint with a data protection supervisory authority pursuant to Art. 77 GDPR.
The competent supervisory authority for our company is:
Landesbeauftragte für Datenschutz and Informationsfreiheit Nordrhein-Westfalen, https://www.ldi.nrw.de/
However, you can also contact any other data protection supervisory authority within the European Union.

7. Right to Object pursuant to Art. 21 GDPR
If personal data is processed on the basis of Art. 6 (1) lit. f GDPR, you have the right to object to this processing at any time for reasons arising from your particular situation.
In the event of a justified objection, we will stop processing your personal data unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or if the processing serves the establishment, exercise, or defense of legal claims.
This does not affect data processing that is strictly necessary for the technical operation of our website, in particular the collection of connection data and the storage of server log files.

IV. Purposes of Processing and Legal Bases

1. Processing when Visiting our Website
Every time you access our website, certain technical information is automatically collected and processed. This data is necessary to display the content of our website correctly and to ensure the stability and security of our systems.
In doing so, the following data in particular may be processed:

Date and time of access,
IP address of the requesting end device,
Hostname of the accessing computer,
Website from which the access is made,
Pages accessed within our website,
Messages about the success or failure of an retrieval,
Transferred data volumes,
Information about the browser used, including the version,
Information about the operating system used.

The processing of this data is carried out to provide the website, to ensure system security, for error analysis, and to ensure trouble-free operation.
The legal basis for this is Art. 6 (1) lit. f GDPR. Our legitimate interest lies in the secure, stable, and technically fault-free provision of our online services.

V. Processing of Personal Data when Using our Website

1. Informational Use
In principle, you can visit our website without actively providing personal data. In this case, only the information that your browser automatically transmits to our server will be processed.
The processed data includes in particular:

IP address,
Date and time of the request,
Time zone difference to Greenwich Mean Time (GMT),
Content of the requested page,
HTTP status code,
Transferred data volume,
Previously visited website (referrer),
Browser type and browser version,
Operating system used,
Language settings of your browser.

The processing of this data is technically necessary to deliver the content of our website correctly and to ensure its stability and security in the long term.

2. Server Log Files The aforementioned data is additionally stored in so-called server log files.
A combination of this data with other personal information does not take place.
The storage takes place in particular for the following purposes:

Ensuring technical functionality,
Error analysis and system monitoring,
Protection against abusive use,
Ensuring IT security.

An evaluation of the log data for marketing or advertising purposes does not take place.

3. Legal Basis
The processing of the stated data is carried out on the basis of Art. 6 (1) lit. f GDPR.
Our legitimate interest consists in the secure, reliable, and user-friendly provision of our website.

4. Storage Period
The data collected to provide the website will be deleted as soon as it is no longer necessary to fulfill its purpose.
Data processed during a session is generally deleted when the visit ends. Insofar as storage takes place in log files, this data is deleted after the expiry of the respective specified retention period.
5. Necessity of Processing
The processing of the above data is technically necessary for the operation of our website. Therefore, there is no possibility to object to the processing in this respect.

VI. Use of Cookies and Similar Technologies

1. General Information

Our website uses cookies and comparable technologies. Cookies are small text files that are stored on your end device and contain certain information. They serve to facilitate the use of our website, to provide functions, and to improve the security and performance of our offer.
Cookies do not cause any damage to your end device. They do not contain viruses, Trojans, or other malware.

2. Types of Cookies
Depending on their function and purpose, we use different types of cookies.

a) Session Cookies
Session cookies are only stored for the duration of your visit. They enable, for example, the assignment of multiple page views within a session.
These cookies are automatically deleted as soon as you close your browser.

b) Persistent Cookies
Persistent cookies remain on your end device for a specified period of time and enable, for example, settings or preferences to be recognized when you visit again.
The storage period depends on the respective cookie and can be ended at any time via the settings of your browser.

3. Purpose of Cookie Use
The use of technically necessary cookies serves in particular:

the provision of basic website functions,
ensuring secure operation,
improving user-friendliness,
the storage of individual settings.

Certain functions of our website cannot be provided, or can only be provided to a limited extent, without the use of such cookies.
Insofar as user accounts are offered, cookies can furthermore be used to recognize logged-in users during repeated visits.
The data processed by technically necessary cookies is not used to create personal user profiles.

4. Analysis and Statistics Cookies
If analysis or statistics services are used, the cookies used in this context serve to evaluate the use of our website and to continuously improve our offer.
The information obtained helps us to further develop content, functions, and user guidance in line with demand.
The use of these technologies takes place exclusively after your express consent.

5. Legal Bases
Technically necessary cookies are used on the basis of our legitimate interest pursuant to Art. 6 (1) lit. f GDPR.
Insofar as consent is required for cookies or comparable technologies, the processing is carried out on the basis of Section 25 (1) TDDDG as well as Art. 6 (1) lit. a GDPR.
Consent granted can be revoked at any time with effect for the future.

6. Management of Cookies
You can determine yourself whether and to what extent cookies may be stored.
Via the settings of your browser, you can:

completely deactivate cookies,
delete individual cookies,
allow only certain types of cookies,
specify automatic deletions when closing the browser.

Please note that deactivating cookies may lead to restrictions in the use of individual functions of our website.
We also recommend regularly deleting stored cookies and the browser history.

7. Cookie Services Used The following services in particular are currently used on our website:

Service	Purpose	Storage Period
Cookiebot	Management and documentation of consents	12 months
Google Analytics (_ga)	Analysis of user behavior	up to 2 years
Google Analytics (other analysis cookies)	Session and usage analysis	up to 2 years
Google Maps	Provision of interactive maps	up to 2 years
Google Signals	Cross-device usage analysis	up to 2 years

Detailed information on the individual services can be found in the following sections of this privacy policy.

VII. Other Functions and Services of our Website

1. Extended Offers on our Website
In addition to purely informational use, we provide you with further functions and services on our website. Availing of these services may require the processing of additional personal data.
The data collected in each case is processed exclusively for the provision of the requested service and the associated purposes. The principles of data processing described in this privacy policy apply.

2. Use of External Service Providers
To provide individual services and for the technical operation of our website, we sometimes use external service providers.
These service providers are carefully selected by us, contractually obligated, and act exclusively according to our instructions, insofar as they process personal data on our behalf.
If personal data is transferred to third parties or processed jointly in connection with certain services, we will inform you about this separately in the respective sections of this privacy policy.
If data is transferred to countries outside the European Economic Area (EEA), we will additionally inform you about the existing data protection guarantees for this.

VIII. Contacting Us

1. Contact by Email
When you contact us by email, we process the personal data you transmit to handle your request and to contact you. This includes in particular:

Name,
Email address,
Content of your message,
Further information voluntarily provided by you.

2. Use of the Contact Form On our website, we provide you with a contact form through which you can send inquiries directly to us. In doing so, the following data in particular may be processed:

First name,
Last name,
Email address,
Address,
Telephone number,
Content of your inquiry.

Furthermore, for technical reasons, the IP address of the sending device as well as the time and date of the transmission are stored.

3. Purpose of Processing
The processing is carried out exclusively for the purpose of handling your inquiry, communicating with you, and, if applicable, preparing or executing pre-contractual measures.
In addition, we process technical information to prevent abusive use of our systems and to ensure the security of our information technology infrastructure.

4. Legal Bases
Insofar as the processing is necessary to handle your inquiry, it is carried out on the basis of our legitimate interest pursuant to Art. 6 (1) lit. f GDPR.
If your inquiry aims at the conclusion or performance of a contract, the processing is additionally carried out on the basis of Art. 6 (1) lit. b GDPR.
Insofar as you have given us consent, the processing is based on Art. 6 (1) lit. a GDPR.

5. Storage Period
The data collected in the context of contacting us will be deleted as soon as your request has been conclusively processed and no legal retention obligations prevent deletion.

6. Revocation and Objection
You can object to the processing of your personal data or revoke a given consent at any time.
Please note that we may not be able to process your request further if the data required for this purpose may no longer be processed.
To exercise your right of revocation or objection, a notification to the contact address given in the legal notice (Impressum) is sufficient.

IX. Online Job Applications

1. Conducting Application Procedures
Via our website, we offer you the opportunity to apply for advertised positions as well as to submit speculative applications to our company.
As part of an application procedure, we process those personal data that you provide to us or that are necessary for conducting the application process.
This may include in particular:
Master data

First name and last name,
Address,
Date of birth.

Contact data

Telephone number,
Mobile phone number,
Email address.

Application documents

Cover letter,
CV,
References,
Certificates,
Proofs of qualification,
Application photo,
Information on education and career path,
Information on previous employers and activities.

Mandatory fields are marked accordingly in the respective application form.
In principle, your data will not be passed on to third parties unless a different notice is provided in this privacy policy.

2. Purpose of Processing
The processing of your personal data serves exclusively to conduct the application procedure and to check your suitability for the advertised or desired position.

3. Legal Bases
Depending on the individual case, processing is carried out on the following legal bases:

Art. 6 (1) lit. a GDPR (Consent),
Art. 6 (1) lit. b GDPR (Pre-contractual measures),
Section 26 (1) BDSG (Decision on the establishment of an employment relationship).

Insofar as special categories of personal data within the meaning of Art. 9 GDPR are processed, this is done on the basis of Art. 9 (2) lit. b GDPR in conjunction with Section 26 (3) BDSG.

4. Storage Period
Your application documents will only be stored for as long as is necessary to conduct the application procedure.
If an employment, training, internship, or other service relationship is established, the necessary application documents will be transferred to the personnel file and further processed in accordance with the applicable statutory provisions.
If the application procedure is ended without an employment relationship being established, your data will generally be deleted four weeks after completion of the procedure.
Longer storage will only take place:

if statutory retention obligations exist,
for the establishment, exercise, or defense of legal claims,
or if you have expressly consented to longer storage.

The legal basis for storage beyond this is Art. 6 (1) lit. f GDPR.

5. Voluntary Provision of Data
The provision of your application data is voluntary.
But without the information required for the application procedure, we cannot process your application or consider it in the selection decision.

6. Revocation and Withdrawal of the Application
You can revoke a given consent at any time with effect for the future.
Furthermore, you have the option at any time to withdraw your application or to object to further processing of your personal data.
Please note that in this case, a continuation of the application procedure is regularly not possible.

7. Application Pool
With your express consent, we can include your application documents in our application pool so that we can also consider you for future job offers.
The storage takes place exclusively on the basis of your consent pursuant to Art. 6 (1) lit. a GDPR.
Your data will be stored in the application pool for a period of six months and then deleted, unless renewed consent is provided.
The consent granted can be revoked at any time with effect for the future.

8. Storage by External Service Providers
To conduct the application procedure, personal data may be processed and stored on servers of a service provider commissioned by us within the European Union.
In doing so, we ensure through appropriate contractual agreements that all requirements of the GDPR and applicable European data protection standards are complied with.

X. Processing of Inquiries via MEETOVO

To process and manage inquiries, we use the software solution from MEETOVO Software GmbH, Robert-Koch-Straße 8, 21423 Winsen (Luhe), Germany.
The processing of personal data takes place within the framework of a data processing agreement pursuant to Art. 28 GDPR. The provider processes the data exclusively according to our instructions and in compliance with applicable data protection regulations.

1. Data Processing when Accessing the Inquiry Page
When accessing an inquiry page provided via MEETOVO, a connection to the provider’s servers is established. Technical information is processed in the process, in particular the IP address of your end device.
The IP address is anonymized by the provider and deleted after seven days.

2. Processing of Inquiry Data
When you submit an inquiry via the provided form, the data you enter will be processed. This may include in particular:

First and last name,
Email address,
Telephone number or mobile phone number,
Further details required to process your inquiry.

Insofar as you have expressly consented to this, further form entries can already be processed during input for analysis and optimization purposes.

3. Purposes and Legal Bases
The processing is carried out to handle your inquiry, to implement pre-contractual measures, and to provide our services.
The legal basis for this is Art. 6 (1) lit. b GDPR.
In addition, processing is carried out on the basis of our legitimate interest in an efficient, user-friendly, and rapid processing of inquiries pursuant to Art. 6 (1) lit. f GDPR.

4. Storage Period
The stored data will be deleted as soon as it is no longer necessary for the respective purposes.
The provider checks the necessity of storage regularly. Irrespective of this, deletion takes place at the latest five years after the last inquiry, unless statutory retention obligations or other legitimate reasons prevent deletion.
Further information on data processing by MEETOVO can be found at: https://meetovo.de/datenschutz

XI. Google Analytics and Google Signals

1. Use of Google Analytics
Insofar as you have given your consent, we use the web analysis service Google Analytics on our website.
The provider within Europe is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Google Analytics uses cookies and similar technologies that enable an analysis of your usage behavior on our website.
The information collected in the process may include, among other things:

visited pages,
duration of visit,
interactions on the website,
technical device information,
browser data,
approximate location information,
IP address.

We have activated IP anonymization. As a result, your IP address is shortened within the European Union or the European Economic Area before further processing. Only in exceptional cases will the full IP address be transmitted to a Google server and shortened there.

2. Purpose of Processing
The processing is carried out for the analysis of user behavior and for the statistical evaluation of the use of our website.
The insights gained help us to continuously improve the content, functions, and user-friendliness of our online offers.

3. Google Signals
Insofar as you have consented, we additionally use the function Google Signals.
Google Signals enables the cross-device analysis of usage data. This affects in particular users who:

are logged into a Google account and
have activated the personalization of ads in their Google account.

Through Google Signals, summarized statistical information about the use of our website on different end devices can be provided.
We receive exclusively aggregated and anonymized evaluations in this context. An identification of individual persons by us is not possible.
Even when using target-group-related advertising functions, we do not receive any information about which specific persons have been assigned to a specific target group.
If you do not wish cross-device analysis by Google Signals, you can deactivate the “Personalized advertising” function in your Google account.

4. Legal Bases
The storage and reading of information on your end device take place exclusively on the basis of your consent pursuant to Section 25 (1) TDDDG.
The subsequent processing of personal data is carried out on the basis of Art. 6 (1) lit. a GDPR.
Consent granted can be revoked at any time with effect for the future.

5. Data Transfer to Third Countries
In the context of using Google services, a transfer of personal data to Google servers outside the European Union cannot be completely ruled out.
For data transfers to the United States, Google relies on the adequacy decision of the European Commission on the EU-US Data Privacy Framework. In addition, the Standard Contractual Clauses (SCC) approved by the European Commission have been agreed upon.

6. Storage Period
The data transmitted to Google Analytics is automatically deleted after 14 months.
The maximum storage period of the analysis cookies used is up to two years.
Further information can be found at: https://policies.google.com/privacy, https://marketingplatform.google.com/about/analytics/terms/de

XII. Cookiebot (Consent-Management Platform)

To manage and document your consents, we use the Cookiebot service from Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark.
Cookiebot enables us to obtain, store, and verifiably document the legally required consents for cookies and comparable technologies.

Processed Data
In this context, the following information in particular may be processed:

anonymized IP address,
date and time of consent,
browser information,
device information,
URL of the visited page,
consents granted or denied.

Legal Basis
The processing is carried out to fulfill our legal obligations in connection with providing proof of granted consents pursuant to Art. 6 (1) lit. c GDPR and Art. 7 GDPR.
Further information can be found at: https://www.cookiebot.com/en/privacy-policy/

XIII. Online Bookings via Hotel-Spider

On our website, we offer you the opportunity to make room reservations via the external booking and reservation system Hotel-Spider.
When you access the booking area, you will be redirected to the provider’s platform. The processing of your personal data as part of the booking process is generally carried out by the respective provider.

Processed Data
Depending on the type of booking, the following data in particular may be processed:

name,
address,
contact details,
booking and stay information,
payment data,
technical connection data such as the IP address.

Purposes of Processing
The processing is carried out for the execution of reservations, for contract initiation, and for the processing of existing booking relationships.

Legal Bases
The processing is carried out on the basis of:

Art. 6 (1) lit. b GDPR (performance of pre-contractual measures and contract performance),
Art. 6 (1) lit. f GDPR (legitimate interest in efficient online booking processing).

Further information on the processing of personal data by Hotel-Spider can be found at: https://meetovo.de/datenschutz

XIV. Integration of Google Maps

On our website, we use the map service Google Maps to show you our location and to make travel planning easier.
The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Scope of Processing
To use Google Maps, it is necessary to transmit your IP address to Google servers.
In addition, further technical information may be processed that is necessary for the provision of the map service.
We have no influence on the type and scope of data processing carried out by Google.

Legal Basis
Google Maps is only loaded after your express consent.
The legal basis for this is Art. 6 (1) lit. a GDPR in conjunction with Section 25 (1) TDDDG.
You can revoke your consent at any time with effect for the future.

Data Transfer to Third Countries
In the context of using Google Maps, a transfer of personal data to servers outside the European Union may take place.
For data transfers to the United States, there is an adequacy decision of the European Commission based on the EU-US Data Privacy Framework. In addition, standard contractual clauses are used to ensure an adequate level of data protection.
Further information can be found at: https://policies.google.com/privacy