1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

SKA Hotelbetriebe GbR
Hotel Hanseat Hamburg
Bergedorfer Straße 41
21033 Hamburg, Germany
Represented by the partners: Aman Kapoor, Kevin Talwar, Seiman Kapoor
Phone: +49 40 7216464
E-mail: info@skahotels-hamburg.de

A data protection officer has not been appointed, as the legal requirements for a mandatory appointment are not met. For any questions regarding data protection, please contact us using the details above.

2. General Information on Data Processing

We process personal data of our website visitors and guests only to the extent necessary to provide a functional website as well as our content and services. Processing is generally carried out only with the consent of the data subject or where processing is permitted by law.

The relevant legal bases are in particular:

• Art. 6(1)(a) GDPR – consent (e.g. for statistics cookies and Google Maps),
• Art. 6(1)(b) GDPR – performance of a contract and pre-contractual measures (e.g. processing of booking enquiries),
• Art. 6(1)(c) GDPR – legal obligations (e.g. retention obligations under commercial and tax law, registration form under the German Federal Registration Act),
• Art. 6(1)(f) GDPR – legitimate interests (e.g. secure provision of the website).

3. Hosting and Server Log Files

Our website is hosted by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus (“Hostinger”). When you visit our website, the hosting provider automatically collects and stores information in so-called server log files, which your browser transmits automatically:

• IP address of the requesting device,
• date and time of access,
• page or file accessed,
• data volume transferred and access status,
• browser type and version, operating system,
• referrer URL (previously visited page).

Processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the technically error-free presentation, stability and security of our website (e.g. to defend against attacks). This data is not merged with other data sources. Log files are deleted as soon as they are no longer required for the purpose for which they were collected.

We have concluded a data processing agreement with Hostinger in accordance with Art. 28 GDPR. Hostinger processes the data only in accordance with our instructions.

4. Cookies and Consent Management

Our website uses cookies and comparable technologies. Technically necessary cookies required for the operation of the website are used on the basis of Art. 6(1)(f) GDPR in conjunction with Section 25(2) no. 2 of the German TDDDG. All other cookies (in particular statistics and map services) are only set with your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG.

To obtain and manage your consent, we use the WordPress plugin Real Cookie Banner by devowl.io GmbH, Tannet 12, 94539 Grafling, Germany. The plugin stores your consent decision locally and logs it for evidence purposes (Art. 7(1) GDPR). The legal basis for the associated data processing is Art. 6(1)(c) GDPR (proof of consent) and Art. 6(1)(f) GDPR.

You can change or withdraw your consent at any time with effect for the future via the “Cookie Settings” link in the footer of our website.

5. Contacting Us

5.1 Contact Form

For enquiries via our contact form, we use the WordPress plugin Contact Form 7. The data you enter in the form (e.g. name, e-mail address, message and, where applicable, details of your requested booking) is processed exclusively for the purpose of handling your enquiry and transmitted to us by e-mail. The legal basis is Art. 6(1)(b) GDPR where your enquiry is directed at concluding an accommodation contract, and otherwise Art. 6(1)(f) GDPR (legitimate interest in handling enquiries).

5.2 E-mail and Telephone

If you contact us by e-mail or telephone, we process your details in order to handle your request. Our e-mail mailbox is hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. A data processing agreement pursuant to Art. 28 GDPR is in place with IONOS. The legal bases correspond to those set out in Section 5.1.

5.3 Retention Period for Contact Data

Your enquiry data remains with us until the purpose of storage no longer applies and no statutory retention obligations (in particular under commercial and tax law, Section 257 HGB, Section 147 AO) prevent deletion. Booking-related correspondence is generally subject to the retention periods under commercial and tax law.

6. Room Booking via CheckedInn (External Booking Link)

For online bookings we use the booking system CheckedInn. When you click the “Book now” button (or comparable booking links) on our website, you leave our website and are redirected to the CheckedInn booking process. Data (e.g. your IP address) is only transmitted to CheckedInn once the booking page is opened; no data is transferred to CheckedInn merely by viewing our website.

As part of the booking, CheckedInn collects the data required for the reservation (e.g. name, contact details, dates of stay and, where applicable, payment data) and transmits it to us for the performance of the accommodation contract. The legal basis is Art. 6(1)(b) GDPR. The provider’s privacy policy, which you can view within the booking process, additionally applies to data processing on the CheckedInn pages.

7. Google Analytics 4

If you have given your consent, this website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

Google Analytics uses cookies and comparable technologies that enable an analysis of your use of the website (e.g. pages viewed, time spent, approximate region of origin, device used). IP addresses are not logged or stored in Google Analytics 4; they are truncated at the point of collection and used only to derive a rough location before being discarded. The information obtained is generally transferred to Google servers and processed there, which may also involve transfers to the USA.

The sole legal basis is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. Google Analytics is not loaded without your consent. Transfers to the USA are based on the European Commission’s adequacy decision regarding the EU-US Data Privacy Framework; Google LLC is certified under this framework. We have concluded a data processing agreement with Google.

You can withdraw your consent at any time with effect for the future via the “Cookie Settings” in the footer. We have configured the retention period for analytics data to the shortest possible setting.

8. Google Maps

To display our location, we embed the map service Google Maps provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The map is only loaded once you have expressly consented (two-click solution / content blocker). Until then, you will only see a placeholder and no data is transmitted to Google. When the map is loaded, Google receives your IP address and, where applicable, further usage data; this may also involve transfers to the USA on the basis of the EU-US Data Privacy Framework.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. You may withdraw your consent at any time via the “Cookie Settings” in the footer. Alternatively, you can reach us using the address details on our contact page without using the map.

9. Data Processing in Connection with Your Stay

When you book and stay with us, we process the data required for the performance of the accommodation contract (Art. 6(1)(b) GDPR), in particular name, address, contact details, period of stay and invoicing data. Under the German Federal Registration Act (Bundesmeldegesetz), we are also obliged to have a registration form completed on the day of arrival (Art. 6(1)(c) GDPR); foreign guests are subject to a statutory identification requirement. Registration forms are retained in accordance with the statutory periods and subsequently destroyed. Invoicing data is subject to retention periods under commercial and tax law of up to ten years.

10. Disclosure of Data

Your data will only be disclosed to third parties where described in this policy, where necessary for the performance of the contract (e.g. to the booking system, payment service providers or our tax advisor), where you have consented, or where we are legally obliged to do so. Data processing agreements pursuant to Art. 28 GDPR are in place with all service providers processing personal data on our behalf.

11. Your Rights as a Data Subject

You have the following rights vis-à-vis us with regard to your personal data:

• right of access (Art. 15 GDPR),
• right to rectification (Art. 16 GDPR),
• right to erasure (Art. 17 GDPR),
• right to restriction of processing (Art. 18 GDPR),
• right to data portability (Art. 20 GDPR),
• right to object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR),
• right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR).

To exercise your rights, an informal message to info@skahotels-hamburg.de is sufficient.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The supervisory authority responsible for us is: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (HmbBfDI), Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany, datenschutz-hamburg.de.

12. Data Security

Our website uses SSL/TLS encryption. You can recognise an encrypted connection by “https://” and the padlock symbol in your browser’s address bar. Data you transmit to us cannot be read by third parties while encryption is active. In addition, we take appropriate technical and organisational measures to protect your data against loss, destruction and unauthorised access.

13. Validity and Amendment of this Privacy Policy

We will amend this Privacy Policy whenever changes to the services used or to the legal situation make this necessary. The current version published on this page applies.