Privacy Policy | Information for Data Subjects | Information Pursuant to Sections 15 and 16 of the KDR-OG and Articles 13 and 14 of the GDPR
Below, we provide information about how we process your personal data and the rights you have under the Church Data Protection Regulations for Religious Orders of Pontifical Right (KDR-OG) and the General Data Protection Regulation (GDPR).
I. Data Controller: Contact Information for the Data Protection Officer
The data controller within the meaning of Section 4(9) of the KDR-OG and Article 4(7) of the GDPR is ProGast Hotelbetriebs-GmbH, Konradistraße 1, 78476 Allensbach-Hegne. You can reach us by phone at +49 (0)7533-9366-2000 or by email at info@st-elisabeth-hegne.de.
II. Contact Information for the Data Protection Officer
You can contact our Data Protection Officer at the address of the data controller, c/o Data Protection Officer, or at the email address datenschutz@kloster-hegne.de.
III. Data Processing Information
We collect and process your personal data only within the scope of legal authorizations or based on your express consent, and in compliance with the provisions of the Church Data Protection Regulations for Religious Orders under Papal Law (KDR-OG), the European General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG), and all other applicable laws governing the processing of personal data and data protection.
IV. Processing of Personal Data of Our Hotel Guests
Category of Affected Individuals
Hotel guests
Data Categories
Master data (e.g., last name, first name, title, form of address, date of birth), contact information (e.g., email, phone numbers), address information (e.g., city, country, street), reservation information (check-in and check-out dates, room categories, number and last name/first name of accompanying adults if applicable, optional room features if applicable, room category), payment information (e.g., payment card type, number, and expiration date), service preferences (e.g., dietary requirements, pillow preferences, consumption habits), service booking information (e.g., Wi-Fi, restaurant reservations, wake-up calls, minibar, room and/or laundry service, parking, license plate number, taxi reservations).
Purpose of the Processing
Recording your arrival and departure, assigning and managing a key card, obtaining a credit card guarantee to ensure payment for your stay, providing additional hotel services and/or facilities during your stay, creating and managing a guest profile in our hotel management system, billing, managing billing, and processing payment for your stay; paying a commission to your travel advisor (if applicable); canceling your reservation; returning lost or forgotten items to our guests; and sending information, greetings, and offers.
Legal Basis
Section 6(1)(c) of the KDR-OG and Article 6(1), first sentence, (b) of the GDPR for the processing of personal data to fulfill a contract with you or to take precontractual measures in response to your request, Section 6(1)(g) of the KDR-OG and Article 6(1), first sentence, (f) of the GDPR to protect our legitimate interests, Article 6(1)(b) of the KDR-OG and Article 6(1)(a) of the GDPR to the extent that you have given us your consent to the processing of your data, and § 6(1)(d) of the KDR-OG and Article 6(1), sentence 1(c) of the GDPR in cases where processing is necessary to comply with a legal obligation.
Legitimate Interest
Your data will be processed to the extent that it is necessary for organizing your hotel stay, ensuring IT security and the IT operations of our company, returning lost or forgotten items, preventing and investigating criminal offenses, to enforce our property rights (e.g., for access control), and to ensure the security of our buildings and facilities—all to protect our legitimate interests or the legitimate interests of third parties. To the extent necessary, we process your data to protect our legitimate interests, to assert legal claims, and to defend ourselves in legal disputes.
Recipient Categories
Within our company, access to your data is granted to those departments that need it to fulfill our contractual, pre-contractual, or legal obligations, or that are permitted to process it based on our legitimate interest (e.g., room service, housekeeping, maintenance, front desk, and other hotel staff). We may disclose your personal data to third parties (e.g., financial institutions or payment service providers for payment processing, tax advisors to fulfill tax reporting obligations, telecommunications service providers, or public authorities and institutions such as tax authorities), provided that you have previously consented to the transfer or we are legally or contractually obligated or authorized to do so. In addition, we may share your data with service providers and vicarious agents to assist with contract fulfillment and compliance with legal obligations (e.g., IT service providers—including those for remote maintenance and support—hosting providers, data centers, etc.).
Data Sources
We process personal data that we receive from you via the online booking platform through which you made your reservation, directly through the booking form, from our staff if you booked rooms and/or services directly, or, where applicable, from your travel advisor, or that we have lawfully obtained from publicly available sources (e.g., the press, the Internet) and are permitted to process.
Transfers to Third Countries
We do not transfer your personal data to a third country or to international organizations.
Use of Third-Party Services and Content
It may happen that third-party content, such as maps from Google Maps, is embedded on our website. This always requires that the providers (“third-party providers”) collect the users’ IP addresses. This is because without the IP address, they cannot send the content to the respective user’s browser. We make every effort to use only content whose respective providers use the IP address solely for the purpose of delivering the content. However, we have no control over whether third-party providers store the IP address, for example, for statistical purposes.
Obligation to Provide
As a general rule, we collect only the data that is required by law or contract, or that is necessary to enter into a contract with you, to prepare for such a contract on a pre-contractual basis, or to subsequently perform it. Without this data, we will generally not be able to establish, perform, and maintain the contract with you.
Unless required by law or contract, or necessary for entering into a contract, you are not obligated to provide us with personal data. There are no negative consequences associated with not providing voluntary data. However, in individual cases, failure to provide such data may, for example, make communication with you more difficult or cause delays.
Retention period
The data will be deleted immediately after the specified purposes have been fulfilled, provided that no legal obligations preclude such deletion. In such cases, your personal data will be deleted once the legal obligation no longer applies and any resulting limitation periods have expired.
V. Your Rights as a Data Subject
You have the right to request from us, pursuant to § 17 KDR-OG and Art. 15 GDPR, access to the personal data we have stored about you, as well as, pursuant to § 18 KDR-OG and Art. 16 of the GDPR, to have inaccurate data corrected or deleted, provided that one of the grounds specified in § 19 of the KDR-OG and Art. 17 of the GDPR applies, e.g., if the data is no longer necessary for the purposes for which it was collected. You also have the right to restrict processing if one of the conditions specified in § 20 KDR-OG and Art. 18 GDPR applies, and, in the cases covered by § 22 KDR-OG and Art. 20 GDPR, the right to data portability. You also have the right, pursuant to § 24 KDR-OG and Art. 22 of the GDPR, not to be subject to a decision based solely on automated processing—including profiling—that produces legal effects concerning you or similarly significantly affects you.
Notice Regarding the Right to Withdraw Consent
Pursuant to Section 8(6) of the KDR-OG and Article 7(3) of the GDPR, you have the right to withdraw your consent at any time without affecting the lawfulness of the processing that has taken place to date. If you withdraw your consent, we will cease the corresponding data processing and delete the data processed for this purpose, unless you have expressly consented to the continued use of your data or there is a legal basis for further processing.
Notice Regarding the Right to Object
If data is collected on the basis of Section 6(1)(g) of the KDR-OG and Article 6(1)(f) of the GDPR (data processing to safeguard legitimate interests), you have the right, for reasons arising from your particular situation, to object to the processing at any time. We will then no longer process the data unless there are demonstrable compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the data subject, or the processing is necessary for the establishment, exercise, or defense of legal claims.
VI. Right to File a Complaint with a Supervisory Authority
If you believe that the processing of your personal data violates data protection regulations, you have the right to file a complaint with the data protection supervisory authority pursuant to § 48 KDR-OG. This right to file a complaint may be exercised, in particular, with the data protection supervisory authority in the jurisdiction where the alleged violation occurred. Furthermore, pursuant to Section 49 of the KDR-OG, you have the right to seek judicial remedy against a decision by the data protection supervisory authority concerning you, or against the controller or the processor, particularly if you believe that your rights under the KDR-OG have been violated as a result of the processing of your personal data in a manner not in accordance with this law. The ecclesiastical court for data protection matters has jurisdiction over judicial remedies against a decision by the data protection supervisory authority, a controller, or a processor.