Privacy

1Controller

Hans Altreuter Konditorei-Cafe – Hotel garni am Daniel e.K., proprietor Roland Altreuter, Marktplatz 11, 86720 Nördlingen, Germany

Phone

+49 9081 4319

Email

mail@hotel-altreuter.de

We are not required to appoint a data protection officer. Please send questions about your data to the email address above.

2At a glance

We set no cookies for visitors, embed no third-party fonts, maps or videos and do not sell data.

3Hosting and visiting the website

The website, its server and its database run at Railway Corp. (San Francisco, USA) in a data centre in the EU (region “EU West”, Netherlands). When you open a page, the server processes technically necessary connection data: IP address, time, requested address, amount of data transferred and details of browser and operating system. Every request passes through the network of Cloudflare (Cloudflare, Inc., San Francisco, USA), which fends off attacks and serves copies of public pages, images and fonts from the location nearest to you; Railway’s own network (CDN) does the same for images and fonts. Depending on where you are, that location may be outside the EU. Cloudflare only passes what you enter in a form on to our server and does not store it.

This serves to deliver the pages, fend off attacks and find errors. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is safe and reliable operation. To prevent misuse of the forms, we briefly count requests per IP address in memory; this count is not stored. We have data processing agreements with Railway and Cloudflare (Art. 28 GDPR).

4Cookies and browser storage

This website sets no cookies for visitors, so there is no cookie banner. Your browser’s session storage (sessionStorage) holds only what a feature you use strictly needs (§ 25(2) no. 2 TDDDG); it is emptied when you close the window:

• On the page for hotel guests (/gaeste), that the short welcome has already played.
• If you arrive through the QR code in the café with a discount code (?code=…), your browser keeps that code in session storage (sessionStorage). It stays there until you close the window, so it reaches the booking from any page. In the same way it keeps the room and dates you hand to the booking there, so you can continue when you come back from RoomRaccoon.
• Staff of the house and people with a preview link receive cookies for signing in and for the preview. They do not arise for visitors of the website.

5Fonts, images and videos

Fonts, photos and videos are delivered from our own server. Your browser does not connect to Google Fonts, YouTube or similar services. Our server fetches the current lunch post from Facebook and shows its own copy; your browser sends no data to Facebook.

6Contact form and enquiries

Through the forms (contact, cake enquiry, groups) you send us your name and email address, which we need in order to reply. If you like, you add phone number, date, number of people, occasion and your message. The page you wrote from, the language and the time are stored with it.

The enquiry goes into the house’s administration, which only our staff can see, and is emailed to our mailbox at Strato (STRATO GmbH, Berlin). Email delivery is handled by Resend (Resend, Inc., San Francisco, USA). You receive a confirmation at your email address. If our system cannot be reached, the form prepares an email for you to send yourself.

The legal basis is Art. 6(1)(b) GDPR for a booking, order or celebration, otherwise Art. 6(1)(f) GDPR (our interest in answering your message).

Enquiries and the notes on them are deleted automatically two years after the last step on them. If a contract results, we keep the documents needed for it for the periods required by commercial and tax law (up to six or ten years).

7Email and phone

If you email or call us, we use your details to deal with your request (Art. 6(1)(b) or (f) GDPR). Our mailbox is hosted by Strato in Germany. Emails not related to a contract are deleted once they have been dealt with.

8Recipients outside the EU

Cloudflare, Railway and Resend are based in the USA. We have data processing agreements with them. Transfers to the USA are based on the European Commission’s adequacy decision (EU-U.S. Data Privacy Framework) where the provider is certified under it, and otherwise on the EU standard contractual clauses (Art. 46(2)(c) GDPR).

9Links to other services

Links to Google Maps, Google Hotels, Facebook, Instagram and other sites open that service only after your click. From then on its privacy notice applies. This includes “Rooms & prices”: the link leads to the booking page of RoomRaccoon (RoomRaccoon B.V., Netherlands); the website only passes your travel dates, the number of guests and, if any, a booking code in the address.

10Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future.

Right to object: where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). An informal message to the email address above is enough.

You can also complain to a data protection supervisory authority. Ours is the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, Germany.

Complaint to the BayLDA

11Required details and automated decisions

You do not have to give us any data. Without name and email address we cannot answer a form enquiry, and without the booking details we cannot let a room. There is no automated decision-making or profiling within the meaning of Art. 22 GDPR.