Data protection

Data protection policy

(Status 25 May 2018)

Thank you for visiting our website and your interest in our company. We attach great importance to the protection of your personal data. The information below is provided in accordance with Articles 12, 13 and 21 of the General Data Protection Regulation (GDPR) and addresses how we deal with your personal data when you use our website www.hi-city-nord.de.
Personal data are individual entries about personal or material circumstances of a certain, or identifiable, natural person. This includes information such as the civil name, address, telephone number and date of birth.

1. Controller
Controller within the meaning of the General Data Protection Regulation:

Realotel Hamburg Hotelbetriebs GmbH
c/o Holiday Inn Hamburg – City Nord
Bahnhofstraße 67
D-65185 Wiesbaden

E-mail address: info@hi-city-nord.de
Homepage: www.hi-city-nord.de

Telephone number: +49 (0) 40 99 99 9 0
Fax number: +49 (0)40 99999 2000

2. Data protection officer Contact data of our data protection officer

The company data protection officer of Realotel Hamburg Hotelbetriebs GmbH can be reached at the aforementioned address, Data Protection Department, or by e-mail at:
datenschutz@bierwirth-kluth.de.

3. Purposes and legal basis of the data processing Use of the website for information purposes

You can visit our website without providing your personal details. If you use our website merely for information purposes, and therefore do not forward any personal information to us, we do not process any personal data with the exception of data that your browser provides to facilitate your website visit and information that is forwarded to us as part of Cookies used for the statistical analysis of the use of our website.

Technical provision of the website
For the purpose of providing the website in a technical sense we need to process certain information that you automatically forward so that your browser can display our website and you can use the website. Whenever our website is visited, our website automatically records such information and stores it in our server log files. Such information refers to the computer system of the requesting computer. The following information is collected in that respect:

• IP address rendered anonymous/shortened;
• Browser type/version (e.g.: Firefox 59.0.2 (64 Bit));
• Browser language (e.g.: German);
• Used operating system (e.g.: Windows 10);
• Internal resolution of the browser window;
• Monitor resolution;
• Javascript activation;
• Java on / off;
• Cookies on / off;
• Colour depth;
• Time of access.

Cookie declaration

Furthermore, we use Cookies to enable you to use our website. Cookies are text files that are stored in the internet browser or by the internet browser on your computer system in the case of visiting a website. A Cookie contains a character string that facilitates a clear identification of the browser when the website is revisited. We use Cookies exclusively to make our website available with its technical functions. Some functions of our website cannot be made available without the use of Cookies. In that respect, the following data are saved in the Cookies and forwarded to us:

• Web server Cookie that identifies the current visitor (PHP Session Cookie)
• Google Analytics Cookie that identifies the current user (anonymously)
• Google AdWords Conversion Cookie
• Cookie that stores on an interim basis the current dwell time of the visitor for the pre-setting of the booking form
• Cookie that stores the confirmation of the Cookie notice

We do not use your information that we have collected via the above Cookies to create user profiles or evaluate your surf behaviour.

We process your personal data for the technical provision of our website on the following legal bases

• To honour a contract or to perform pre-contractual measures in accordance with Article 6(1), point b, GDPR, provided you visit our website to gain information via our website; and
• To safeguard our justified interests in accordance with Article 6(1), point f, GDPR, to make the website available to you in a technical sense. Our justified interest consists of making available to you a website that is appealing, is in good technical working order and is user-friendly and adopting measures to protect our website from cyber risks and prevent our website from causing cyber risks for third parties.

3.0.2 Statistical analysis of the use of the website and scope increase

For the purpose of a statistical analysis of the use of our website, we use Google Analytics, DoubleClick, Google AdWords, Google Tag Manager, GA Audience and therefore Cookies that facilitate an analysis of your surf behaviour. As a result we can improve the quality of our website and its content. We learn how the website is used and, therefore, are in a position to constantly optimise our service.
The information obtained as part of the statistical analysis of our website is not grouped together with your other data recorded as part of the website.

We process your personal data to statistically analyse the use of our website on the following legal bases:

• Your consent in accordance with Article 6(1), point a, GDPR.

Google Analytics

On our website we use Google Analytics, a web analysis service of Google Inc. Google Analytics uses so-called Cookies, text files that are stored on your computer and which facilitate an analysis of how you use the website. The information created by the Cookie about how you use our website is normally transferred to a Google server in the USA and stored there. However, in the event of archiving the IP address rendered anonymous on our website, Google shortens your IP address beforehand in member states of the European Union or in other contracting states to the Agreement on the European Economic Area. The complete IP address is only transferred to a Google server in the USA and stored there in exceptional cases. On our behalf, Google shall use this information to evaluate your use of the website, to put together reports on the website activities and to render additional services associated with the website and internet use for the website operator. The IP address forwarded as part of Google Analytics from your browser shall not be grouped together with other data from Google.

On our website we use Google Analytics with the extension "_anonymizeIp()". As a result, IP addresses are shortened before processing so that directly drawing a conclusion to a person based on a shortened IP address can be ruled out.

We use Google Analytics exclusively based on your consent. You may withdraw consent that you have granted by

• Preventing the storage of Cookies by way of a corresponding setting in your browser software; however, we draw attention to the fact that in such a case you may not be able to use all the functions of this website in full;
• Downloading and installing the browser plugin available via the following link: http://tools.google.com/dlpage/gaoptout?hl=de or
• Clicking on this link: Deactivate Google Analytics to prevent the recording by Google Analytics on our website in the future. In that respect an opt-out Cookie will be set in your browser. Please note that you will need to activate the opt-out Cookie in each of the browsers you use on all your devices, and where applicable you will need to re-activate these, if you delete all Cookies in a browser.

You can obtain more detailed information about the conditions of use and data protection on the part of or in place at Google Analytics at http://www.google.com/analytics/terms/de.html or at https://www.google.de/intl/de/policies/

DoubleClick by Google

Doubleclick by Google is a service of Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"). Doubleclick by Google uses Cookies to present the advertisements of relevance to you. In that respect, an identification number (ID) that has been rendered anonymous is allocated to your browser to review which advertisements have been displayed in your browser and review which advertisements have been viewed. The Cookies do not contain any personal information. Use of the DoubleClick Cookies enables Google and its partner websites to merely place advertisements based on prior visits to our and other websites on the internet. The information generated by the Cookies is forwarded by Google for evaluation to a server in the USA and stored there. Google only transfers the data to third parties on the basis of statutory requirements or as part of order data processing. Under no circumstances shall Google group together your data with other data recorded by Google.

We use DoubleClick exclusively based on your consent. You may withdraw consent that you have granted by

• Preventing the storage of Cookies by way of a corresponding setting in your browser software; however, we draw attention to the fact that in such a case you may not be able to use all the functions of this website in full;
• Downloading and installing the browser plugin available via the following link: https://adssettings.google.com/u/0/authenticated?hl=en-GB under the point DoubleClick Deactivation Extension. Alternatively, you can deactivate Doubleclick-Cookies on the page of the Digital Advertising Alliance via the following link http://optout.aboutads.info/?c=2#!/.

Google Adwords (remarketing / conversion tracking)

We use the online advertising programme Google AdWords and the Conversion-Tracking as part of Google AdWords. Google Conversion Tracking is an analysis service of Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; "Google"). If you click on an advertisement placed by Google, a Cookie is set for the Conversion Tracking on your computer. These Cookies are no longer valid after 30 days. They do not contain any personal data and are, therefore, not aimed at personal identification.

If you visit certain internet pages or our website and the Cookie has not yet expired, Google and we can identify that you have clicked on the advertisement and that you have been forwarded to that site. Each Google AdWords customer is provided with a different Cookie. Therefore, there is no option of Cookies being traced via the websites of AdWords customers.

Information obtained by way of the Conversion Cookies is aimed at drawing up conversion statistics for AdWords customers who have decided in favour of conversion tracking. In this respect, the customers are informed of the total number of users who have clicked on their advertisement and who were forwarded to a page equipped with a conversion tracking tag and, for example, took part in a competition there. However, they are not provided with any information with which they can personally identify users.

We use Google AdWords exclusively based on your consent. You may withdraw consent that you have granted by

• Preventing the saving of Cookies by way of a corresponding setting in your browser software; however, we draw attention to the fact that in such a case you may not be able to fully use all the functions on our website;

You can obtain more detailed information, including about the Google Data Protection Policy, at: http://www.google.com/policies/technologies/ads/

Google Tag Manager

On our website we use the Google Tag Manager by Google. The Google Tag Manager is a solution with which marketers can manage website tags via an interface. The Google Tag Manager service itself (which implements the tags) is a Cookie-free domain and does not record personal data. The Google Tag Manager service allows for the prompting of other tags which, for their part, record data under certain circumstances. Google Tag Manager does not gain access to such data. If deactivation has been implemented at domain or Cookie level, this remains in place for all Tracking Tags that are implemented with Google Tag Manager.

GA audience

In addition, our website uses GA Audience, a service of the company Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter: GA Audience). GA Audience uses, inter alia, Cookies, which are stored on your computer as well as other mobile devices (e.g. Smartphones and Tablets etc.) and which facilitate an analysis of the use of the corresponding devices. In that respect, the data are, in part, evaluated on a device-wide basis. In that respect Google Audience is granted access to the Cookies that are created as part of using Google AdWords and Google Analytics. As part of the use, data, in particular such as the IP address, and activities of the user can be forwarded to a server of the company Google Inc. and stored there. Google Inc. will, where applicable, forward such information to third parties where such action is specified by law or insofar as such data are processed by third parties.

Following your consent, you can prevent the recording and forwarding of personal data (in particular your IP address), as well as the processing of such data, by deactivating the implementation of Java Script in your browser or by installing a tool such as "NoScript". Furthermore, you can prevent the recording of the data created by the Google Cookie and data related to your use of the website (including your IP address) and forwarding to Google, as well as the processing of such data by Google, by downloading and installing the browser plug-in available via the following link: http://tools.google.com/dlpage/gaoptout?hl=de.

You can obtain further data protection information in the case of using GA Audience via the following link: https://support.google.com/analytics/answer/2700409?hl=en&ref_topic=2611283

Google Maps

Google Maps, a service of Google, Inc., is incorporated in our website. To increase the protection of your data when visiting the website, Google Maps is restricted and is merely incorporated in the site by way of use of an HTML page. This guarantees that when visiting our site, a link with Google's servers cannot be established and your data cannot be forwarded to Google. Your browser establishes a direct link to Google's servers so that you can plan your route to us only if you click on the link and therefore grant your approval to the data forwarding. In terms of the function, the incorporation of Google Maps is therefore equated with a Hyperlink such that neither we nor Google can collect data about you via our website.
Please see the data protection notices of Google in respect of the purpose and scope of the data collection and the additional processing and use of the data by Google as well as your rights in this respect and setting options with regard to protecting your privacy, at https://www.google.com/policies/privacy/partners/?hl=de

Social links

On our website we have put in place links to services such as links to our Facebook and Instagram page. By clicking on the links, you shall be forwarded to the page of the respective supplier, i.e. only then will user information be forwarded to the respective supplier. For information about how your data are handled in the case of using websites of other suppliers, please see the respective data protection notices of such suppliers.

Active use of the website

In addition to using our website to gain information only, you can also actively use our website. In addition to the processing of your personal data set out above in the case of using the website to gain information only, we shall then also process additional personal data that apply to you.

3.2.0 Room bookings

In the case of booking a room, we process the personal data that you make available to us in this respect. This includes, in particular, your name, your home address, contact details and the means of payment. We use InterContinental Hotels Group PLC as a service provider for the booking of rooms.
We process your personal data in the case of room bookings on the following legal bases
• To honour a contract or to perform pre-contractual measures in accordance with Article 6(1), point b, GDPR..

3.2.2 User enquiries

To process, and reply to, your enquiries directed to us, e.g. via the contact form or those sent to our e-mail address, we process your personal data you have made available in this context. This includes in any case your name and your e-mail address to provide you with a reply and the other information that you send to us as part of your notification.
We process your personal data to reply to user enquiries on the following legal bases:

• To safeguard our justified interests in accordance with Article 6(1), point f, GDPR; our justified interest consists of appropriately replying to customer enquiries.

3.2.3 Sending an application

We process your personal data as part of your application provided you make such data available to us. The application data may contain special categories of personal data.

Processing personal data

Normally, the following applicant data are recorded: first name and surname, where applicable your academic title, date and place of birth, contact details (address, e-mail, landline telephone and/or handy number), application documents (motivation letter, curriculum vitae, certificates), language skills and capabilities. In addition, we process the data that you send to us as part of establishing contact with us by e-mail.
We take the personal data you make available, as part of the statutory requirements, as the basis for our decisions in the application procedures. For example, we use your professional qualification for making a decision on whether or not we intend to consider you in the advance selection process or if we wish to gain a personal impression during an interview to decide whether or not to offer you the position for which you have applied.

In that respect, we process your personal data on the following legal bases:

• Data processing for the decision on establishing an employment relationship, Article 88(1) GDPR in conjunction with Section 26(1), sentence 1, German Data Protection Act, new version

Processing of special personal data

In accordance with Article 9, GDPR, special categories of personal data are those stating the racial and ethnic origin, political opinion, religious (e.g. details about religious affiliation/confession) or ideological convictions or union affiliation, as well as the processing of biometric data for clear identification (e.g. photographs), health data (e.g. details about the level of severe disability) or data about sex life or sexual orientation. If your curriculum vitae contains special categories of personal data, we deliberately choose not to collect these.

We expressly ask you not to send such data to us.
If you send us special categories of personal data in accordance with Article 9(1) GDPR voluntarily and contrary to our express request (e.g. your photograph or details about your religious affiliation/confession), we shall store these on the basis of your consent in accordance with Article 88(1), GDPR, in conjunction with Section 26(3), sentence 2, German Data Protection Act, new version. This also applies if you forward to us additional special personal data during the further course of the application procedure. By way of voluntarily forwarding such data, you consent to the storage of such special personal data as part of the application process.

As a matter of principle, we do not take such special personal data into consideration in the case of a selection decision unless such special personal data are to be taken into consideration on the basis of a statutory obligation. In some advertisements for job vacancies it may be the case that people with disabilities are given preferential treatment in line with the valid laws. In such cases, the details are at all times voluntary and provided with your express consent that you grant by way of the voluntary forwarding of such data.
We process your special personal data on the following legal bases:

• In accordance with Article 9(1) GDPR on the basis of your consent in accordance with Article 88(1) GDPR in conjunction with Section 26(3), sentence 2, German Data Protection Act, new version

4. Links

Some sections of our web pages contain links to websites of third party suppliers. These websites are subject to their own data protection principles. We are not responsible for their operation, including the handling of data. If you send information to or via such sites of third party suppliers, you should review the data protection policies of such sites before sending them information that can be attributed to your person.

5. Categories of recipients

First of all, only our employees gain knowledge of your personal data. In addition, we share your personal data, where this is legally permissible or specified, with other recipients who render services on our behalf in conjunction with our website. In that respect, we restrict the forwarding of your personal data to what is necessary. In part, our service providers receive your personal data as order processors and are then strictly bound by our instructions in dealing with your personal data. In part the recipients act independently in respect of dealing with your data that we forward to them.

Below we provide you with the categories of recipients of your personal data:

• InterContinental Hotels Group PLC in the case of reserving rooms
• IT service providers in the case of the administration and hosting of our website

6. Third party licenses

As part of the use of the tools of Google, we transfer your shortened IP address to the USA. The transfer of data is based on the Implementing Decision (EU) 2016/1250 of the EU Commission dated 12 July 2016 in accordance with Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the EU-U.S. Privacy Shield.
In other respects, we do not transfer your personal data to countries outside the EU or the EEA or to international organisations.

7. Storage period

Use of the website for information purposes

In the case of using our website only to gain information, we shall store your personal data on our servers exclusively for the period of your visit to our website. Once you have left the website, your personal data shall be deleted without delay.
Similarly, Cookies that we set are normally deleted from our website once you have logged out of the website. However, this does not apply to Google Analytics Cookies. These remain stored for a period of up to two years. In addition, you have the option of deleting installed Cookies at any time.

Active use of the website

In the case of active use of our website, we shall initially store your personal data for the period of replying to your enquiry or for the period of our business relationship. That also includes initiating a contract (pre-contractual legal relationship) and processing a contract.

In addition, we shall store your personal data up until the occurrence of the period of limitations of potential legal claims resulting from a relationship with you where applicable to use such data as proof. The limitation period is normally between 12 and 36 months but can also run to 30 years.

Upon occurrence of the statute of limitations, we shall delete your personal data unless a statutory storage obligation applies, for example resulting from the German Commercial Code (Sections 238, 257(4), HGB), or resulting from the German Tax Code (Section 147(3), (4), AO). These storage periods may run to ten years.

If you file an application with us, we shall store your application data for the period of the application procedure. If we do not make you an offer, we shall delete your data two months after the decision containing our rejection has been received. If we employ you, we shall continue to store your personal data to implement the employment relationship.

8. Your rights as a data subject

Subject to meeting the statutory preconditions, you have the following rights as a data subject, which you can exercise in dealings with us.
Right to obtain information: as part of Article 15, GDPR, you have the right to obtain from the controller confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, as part of Article 15, GDPR, you furthermore have the right to gain access to such personal data and the certain, additional, information (including processing purposes, categories of personal data, categories of recipients, planned storage period, the data origin, the use of automated decision-making and in the event of third country transfer the suitable guarantees and a copy of your data).

Right to rectification: in accordance with Article 16, GDPR, you have the right to request that we rectify your personal data if such data are inaccurate or faulty.

Right to erasure: under the preconditions set out in Article 17, GDPR, you have the right to request that we erase personal data that apply to you without undue delay. The right to erasure shall not apply, inter alia, if the processing of personal data is necessary (i) for exercising the right of freedom of expression and information, (ii), for compliance with a legal obligation (e.g. statutory storage obligations) or (iii) for the establishment, exercise or defence of legal claims.
Right to restriction of the processing: under the preconditions set out in Article 18, GDPR, you have the right to request that we restrict the processing of your personal data.

Right to data portability: you have the right under the preconditions set out in Article 20, GDPR, to request that we hand over to you your personal data, which you have provided to us, in a structured, commonly used and machine-readable format.

The right to withdraw: you have the right to withdraw at any time consent given to the processing of personal data with an effect for the future.
Right to object: under the preconditions set out in Article 21, GDPR, you have the right to object to the processing of your personal data such that we must stop processing your personal data. The right to object applies only within the restrictions provided for in Article 21, GDPR. In addition, our interests may conflict with an end of the processing such that irrespective of your objection we shall be entitled to process your personal data.

Right to lodge a complaint with a supervisory authority: under the preconditions set out in Article 77 GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating you infringes on GDPR. The right to object applies irrespective of other administrative law or court remedies.

Our relevant supervisory authority is:

The Hesse Authorised Representative for Data Protection and Freedom of Information
PO Box 3163
D-65021 Wiesbaden

E-mail: Poststelle@datenschutz.hessen.de

Tel.: +49 611 1408 - 0
Fax: +49 611 1408 – 611

However, we recommend that you initially send us a complaint at all times.
Your applications about exercising your rights should, where possible, be addressed to us in writing and directed to the above-mentioned address or be addressed to us directly.

9. Scope of your obligations to provide data

As a matter of principle you do not undertake to make your personal data available to us. However, if you do not do so, we shall not be able to make our website available to you, shall not be able to reply to your enquiries directed to us and shall not be able to enter into a contract with you. Personal data that we do not urgently require for the aforementioned processing purposes are marked by way of "where applicable" or another sign as voluntary details.

10. Automated decision-making / profiling

We do not use automated decision-making or profiling (an automated analysis of your personal circumstances).

Information about your right to object Article 21 GDPR

You have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data which is based on point (e) (Processing in the public interest) or point (f) (Processing based on weighing up interests) of Article 6(1), GDPR. This also applies to profiling based on this provision within the meaning of Article 4, no. 4, GDPR.

If you object, we shall no longer process your personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

The objection need not honour any formal requirements and where possible should be directed to

Realotel Hamburg Hotelbetriebs GmbH
c/o Holiday Inn Hamburg – City Nord
Bahnhofstraße 67
D-65185 Wiesbaden

E-mail address: info@hi-city-nord.de
Homepage: www.hi-city-nord.de

Telephone number: +49 (0) 40 99 99 9 0

Fax number: +49 (0)40 99999 2000 

11. Amendments

We reserve the right to amend this Data Protection Policy at any time. Where applicable amendments shall be announced by way of publishing the amended Data Protection Policy on our website. In the absence of a regulation to the contrary, such amendments shall come into effect immediately. Therefore, please review this Data Protection Policy regularly to view the respective, latest, version.
Last updated in May 2018