Privacy Policy

1. Controller responsible for data processing

2. General information on data processing

We process our users' personal data only to the extent necessary to provide a functional website as well as our content and services. As a rule, our users' personal data is processed only with the user's consent. An exception applies in cases where obtaining prior consent is not possible for factual reasons and the processing of the data is permitted by law.

3. Legal basis for data processing

Where we obtain the data subject's consent for processing operations involving personal data, Art. 6(1)(a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis for processing personal data.

Where the processing of personal data is necessary for the performance of a contract to which the data subject is a party, Art. 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations necessary for taking steps prior to entering into a contract.

Where the processing of personal data is necessary for compliance with a legal obligation to which our business is subject, Art. 6(1)(c) GDPR serves as the legal basis.

Where processing is necessary for the purposes of a legitimate interest pursued by our business or by a third party, and the interests, fundamental rights and freedoms of the data subject do not override that interest, Art. 6(1)(f) GDPR serves as the legal basis for the processing.

4. Erasure of data and storage period

The data subject's personal data will be erased or blocked as soon as the purpose of storage no longer applies. Data may also be stored beyond this if provided for by the European or national legislator in EU regulations, laws or other provisions to which the controller is subject. Data will also be blocked or erased when a storage period prescribed by the aforementioned provisions expires, unless further storage of the data is necessary for the conclusion or performance of a contract.

5. Provision of the website and creation of log files

Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing device.

The following data is collected:

• Information about the browser type and version used
• The user's operating system
• The user's internet service provider
• The user's IP address
• Date and time of access
• Websites from which the user's system reaches our website
• Websites accessed by the user's system via our website

The data is stored in our system's log files. This data is not stored together with other personal data of the user.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the proper functioning of the website, the improvement of our services and IT security.

6. Use of cookies

Our website uses only technically necessary cookies. These are small text files required for the proper operation of the site – for example, to maintain a session during your visit. These cookies are not used to analyse your behaviour.

This includes the cookie “fhp_lang”: for up to 12 months it stores the language (German, English or Polish) in which you last viewed our website, so that it is shown to you in that language again. On your first visit we choose the language based on your browser’s language setting.

We do not use any analytics, tracking or marketing cookies and do not pass on any data to third parties for advertising purposes.

Legal basis: § 25(2) TTDSG (German Telecommunications and Telemedia Data Protection Act – technically necessary storage) in conjunction with Art. 6(1)(f) GDPR. Our legitimate interest lies in the proper and secure provision of our website.

You can set your browser to inform you when cookies are being set and to allow cookies only in individual cases, to refuse cookies for certain cases or in general, and to delete cookies automatically when you close the browser.

7. Contact form and email contact

If you contact us via the contact form or by email, the details you provide in the enquiry form, including the contact details you enter there, will be stored by us for the purpose of processing your enquiry and in case of follow-up questions. We will not pass on this data without your consent.

Legal basis: Art. 6(1)(b) GDPR (for booking enquiries) or Art. 6(1)(f) GDPR (for general enquiries).

8. Booking processing

To process bookings, we collect the following personal data:

• Surname and first name
• Address
• Email address
• Telephone number
• Bank details (for payment processing)
• Number of guests
• Stay details

Legal basis: Art. 6(1)(b) GDPR (performance of a contract)

We use external service providers to process bookings. They are contractually obliged to process your data only on our behalf and in accordance with our instructions.

9. SSL encryption

For security reasons and to protect the transmission of confidential content, such as bookings or enquiries that you send to us as the site operator, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the browser's address bar changing from "http://" to "https://" and by the padlock symbol in your browser bar.

10. Web analytics and tracking

We deliberately do without analytics and tracking services. In particular, we do not use Google Analytics or comparable tools to evaluate user behaviour. No cookies are set for this purpose and no user profiles are created.

Should we use an analytics service in future, we will do so only with your express consent (Art. 6(1)(a) GDPR), which you may withdraw at any time with effect for the future. In that case, this privacy policy will be amended accordingly.

11. Fonts (hosted locally)

To display fonts consistently, we use web fonts (“Open Sans” and “Dancing Script”) that are stored locally on our server. When you open a page, the fonts are loaded directly from our server. No connection is made to servers operated by Google or other third parties; your IP address is not transmitted to third parties for this purpose.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the optimal presentation and functionality of our website.

12. External booking platforms

We use external booking platforms to check availability and process bookings. When you use these services, you are redirected to the providers' websites. The privacy policies of these platforms apply to the processing of data on them.

13. Your rights as a data subject

You have the following rights:

• Right of access (Art. 15 GDPR): You have the right to request information about your personal data processed by us.
• Right to rectification (Art. 16 GDPR): You have the right to request the correction of inaccurate data or the completion of incomplete data.
• Right to erasure (Art. 17 GDPR): You have the right to request the erasure of your personal data.
• Restriction of processing (Art. 18 GDPR): You have the right to request the restriction of the processing of your data.
• Data portability (Art. 20 GDPR): You have the right to receive your data in a structured, commonly used and machine-readable format.
• Right to object (Art. 21 GDPR): You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you.
• Withdrawal of consent (Art. 7(3) GDPR): You have the right to withdraw any consent you have given at any time.

14. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority about our processing of personal data.

Competent supervisory authority:
Die Landesbeauftragte für den Datenschutz Niedersachsen (Data Protection Commissioner of Lower Saxony)
Prinzenstraße 5
30159 Hannover
Phone: 0511 120-4500
Email: poststelle@lfd.niedersachsen.de

15. Changes to this privacy policy

We reserve the right to amend this privacy policy from time to time so that it always complies with current legal requirements or to reflect changes to our services. The new privacy policy will then apply to your next visit.