Source: https://www.dorint.com/en/data-security-privacy/
Timestamp: 2019-04-20 06:58:15+00:00

Document:
We are very delighted that you have shown interest in our enterprise. Data protection is of a particularly high priority for the management of the Dorint GmbH. The use of the Internet pages of the Dorint GmbH is possible without any indication of personal data; however, if a data subject wants to use special enterprise services via our website, processing of personal data could become necessary. If the processing of personal data is necessary and there is no statutory basis for such processing, we generally obtain consent from the data subject.
The processing of personal data, such as the name, address, e-mail address, or telephone number of a data subject shall always be in line with the General Data Protection Regulation (GDPR), and in accordance with the country-specific data protection regulations applicable to the Dorint GmbH. By means of this data protection declaration, our enterprise would like to inform the general public of the nature, scope, and purpose of the personal data we collect, use and process. Furthermore, data subjects are informed, by means of this data protection declaration, of the rights to which they are entitled.
As the controller, the Dorint GmbH has implemented numerous technical and organizational measures to ensure the most complete protection of personal data processed through this website. However, Internet-based data transmissions may in principle have security gaps, so absolute protection may not be guaranteed. For this reason, every data subject is free to transfer personal data to us via alternative means, e.g. by telephone.
The data protection declaration of the Dorint GmbH is based on the terms used by the European legislator for the adoption of the General Data Protection Regulation (GDPR). Our data protection declaration should be legible and understandable for the general public, as well as our customers and business partners. To ensure this, we would like to first explain the terminology used.
The website of the Dorint GmbH collects a series of general data and information when a data subject or automated system calls up the website. This general data and information are stored in the server log files. Collected may be (1) the browser types and versions used, (2) the operating system used by the accessing system, (3) the website from which an accessing system reaches our website (so-called referrers), (4) the sub-websites, (5) the date and time of access to the Internet site, (6) an Internet protocol address (IP address), (7) the Internet service provider of the accessing system, and (8) any other similar data and information that may be used in the event of attacks on our information technology systems.
When using these general data and information, the Dorint GmbH does not draw any conclusions about the data subject. Rather, this information is needed to (1) deliver the content of our website correctly, (2) optimize the content of our website as well as its advertisement, (3) ensure the long-term viability of our information technology systems and website technology, and (4) provide law enforcement authorities with the information necessary for criminal prosecution in case of a cyber-attack. Therefore, the Dorint GmbH analyzes anonymously collected data and information statistically, with the aim of increasing the data protection and data security of our enterprise, and to ensure an optimal level of protection for the personal data we process. The anonymous data of the server log files are stored separately from all personal data provided by a data subject.
On the website of the Dorint GmbH, users are given the opportunity to subscribe to our enterprise's newsletter. The input mask used for this purpose determines what personal data are transmitted, as well as when the newsletter is ordered from the controller.
The Dorint GmbH informs its customers and business partners regularly by means of a newsletter about enterprise offers. The enterprise's newsletter may only be received by the data subject if (1) the data subject has a valid e-mail address and (2) the data subject registers for the newsletter shipping. A confirmation e-mail will be sent to the e-mail address registered by a data subject for the first time for newsletter shipping, for legal reasons, in the double opt-in procedure. This confirmation e-mail is used to prove whether the owner of the e-mail address as the data subject is authorized to receive the newsletter.
The personal data collected when registering for the newsletter will be used exclusively for sending our newsletter. Furthermore, subscribers to the newsletter may be informed by e-mail if this is necessary for the operation of the newsletter service or for registration, as could be the case in the event of changes to the newsletter offer or changes in the technical conditions. We use the newsletter dispatch service providers "MailChimp" and Serenata Intraware for the registration as well as for the dispatch of the newsletter. Detailed information on the newsletter dispatch service providers "MailChimp" and Serenata Intraware can be found here in the data protection declaration under point 20.
The newsletter of the Dorint GmbH contains so-called tracking pixels. A tracking pixel is a miniature graphic embedded in such e-mails, which are sent in HTML format to enable log file recording and analysis. This allows a statistical analysis of the success or failure of online marketing campaigns. Based on the embedded tracking pixel, the Dorint GmbH may see if and when an e-mail was opened by a data subject, and which links in the e-mail were called up by data subjects.
Such personal data collected in the tracking pixels contained in the newsletters are stored and analyzed by the controller in order to optimize the shipping of the newsletter, as well as to adapt the content of future newsletters even better to the interests of the data subject. These personal data will not be passed on to third parties. Data subjects are at any time entitled to revoke the respective separate declaration of consent issued by means of the double-opt-in procedure. After a revocation, these personal data will be deleted by the controller. The Dorint GmbH automatically regards a withdrawal from the receipt of the newsletter as a revocation. Here we work together with the newsletter dispatch service providers "MailChimp" and Serenata Intraware. Detailed information on the newsletter dispatch service providers "MailChimp" and Serenata Intraware can be found here in the data protection declaration under point 20.
The website of the Dorint GmbH contains information that enables a quick electronic contact to our enterprise, as well as direct communication with us, which also includes a general address of the so-called electronic mail (e-mail address). The contact forms are forms for general inquiries, booking and reservation requests, requests for table reservations in restaurants, forms for ordering brochures. If a data subject contacts the controller by e-mail or via a contact form, the personal data transmitted by the data subject are automatically stored. Such personal data transmitted on a voluntary basis by a data subject to the data controller are stored for the purpose of processing or contacting the data subject. There is no transfer of this personal data to third parties. If a user takes this opportunity to contact us, the data entered in the input mask will be transmitted to us and saved. This data is: First name, last name, phone and/or e-mail address. At the time the message is sent, the following data is also stored: the IP address of the user, date and time of registration, Your consent is obtained for processing the data as part of the sending process and reference is made to this data protection declaration.
Alternatively, you can contact us via the e-mail address provided. In this case, the user's personal data transmitted by e-mail will be stored. This personal data is not passed on to third parties.
The legal basis for the processing of data is Art. 6 para. 1 lit. a GDPR if the user has given his consent. The legal basis for the processing of data transmitted in the course of sending an e-mail is Art. 6 para. 1 lit. f GDPR. If the e-mail contact aims at the conclusion of a contract, then additional legal basis for the processing is Art. 6 exp. 1 lit. b GDPR.
The Dorint GmbH offers users the possibility to leave individual comments on individual blog contributions on a blog, which is on the website of the controller. A blog is a web-based, publicly-accessible portal, through which one or more people called bloggers or web-bloggers may post articles or write down thoughts in so-called blogposts. Blogposts may usually be commented by third parties.
The comments made in the blog of the Dorint GmbH may be subscribed to by third parties. In particular, there is the possibility that a commenter subscribes to the comments following his comments on a particular blog post.
If one of the aforementioned reasons applies, and a data subject wishes to request the erasure of personal data stored by the Dorint GmbH, he or she may, at any time, contact any employee of the controller. An employee of Dorint GmbH shall promptly ensure that the erasure request is complied with immediately.
Where the controller has made personal data public and is obliged pursuant to Article 17(1) to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform other controllers processing the personal data that the data subject has requested erasure by such controllers of any links to, or copy or replication of, those personal data, as far as processing is not required. An employees of the Dorint GmbH will arrange the necessary measures in individual cases.
If one of the aforementioned conditions is met, and a data subject wishes to request the restriction of the processing of personal data stored by the Dorint GmbH, he or she may at any time contact any employee of the controller. The employee of the Dorint GmbH will arrange the restriction of the processing.
In order to assert the right to data portability, the data subject may at any time contact any employee of the Dorint GmbH.
The Dorint GmbH shall no longer process the personal data in the event of the objection, unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.
If the Dorint GmbH processes personal data for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing. This applies to profiling to the extent that it is related to such direct marketing. If the data subject objects to the Dorint GmbH to the processing for direct marketing purposes, the Dorint GmbH will no longer process the personal data for these purposes.
In addition, the data subject has the right, on grounds relating to his or her particular situation, to object to processing of personal data concerning him or her by the Dorint GmbH for scientific or historical research purposes, or for statistical purposes pursuant to Article 89(1) of the GDPR, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
In order to exercise the right to object, the data subject may contact any employee of the Dorint GmbH. In addition, the data subject is free in the context of the use of information society services, and notwithstanding Directive 2002/58/EC, to use his or her right to object by automated means using technical specifications.
If the decision (1) is necessary for entering into, or the performance of, a contract between the data subject and a data controller, or (2) it is based on the data subject's explicit consent, the Dorint GmbH shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and contest the decision.
If the data subject wishes to exercise the rights concerning automated individual decision-making, he or she may, at any time, contact any employee of the Dorint GmbH.
If the data subject wishes to exercise the right to withdraw the consent, he or she may, at any time, contact any employee of the Dorint GmbH.
The data controller responsible for processing has integrated a Customer Relationship Management System (CRM) from Serenata Intraware. A customer relationship management system is used for customer care and describes the consistent orientation of a company towards its customers and the systematic design of customer relationship processes. The associated documentation and management of customer relationships is an important building block for our company and enables in-depth relationship marketing. Customer data stored on Serenata Intraware systems also includes personal data, namely contact, contract and payment data of guests or interested parties and also of employees, suppliers, service providers and other contractual partners of the customer or the companies as well as documents concerning communications between these and the customer or the companies.
The operating company of Serenata Intraware is Serenata Intraware GmbH, Neumarkter Str. 18, 81673 Munich.
Personal data is processed during online booking on the Dorint GmbH website and during online registration for the Dorint Card Bonus Programme. The processing of personal data is carried out in accordance with Art. 4 No. 2 and Art. 28 GDPR. The controller shall at all times, upon request, inform each data subject of the personal data relating to that data subject. Furthermore, the controller shall correct or delete personal data at the request or notice of the data subject, provided that there is no legal obligation to keep such data in safekeeping. All the employees of the controller are available to the data subject as contact persons in this context.
The data controller has integrated services of HotelREZ Limited. The services are software for collecting data to create and process reservations for hotel stays. On the dorint.com website, HotelREZ is used for the purpose of making a direct online reservation. The type and scope of the personal data requested can be seen from the corresponding input mask. The personal data is collected, processed and used exclusively for the execution and processing of the contractual relationship established with the reservation (accommodation contract) and hotel stay. The underlying legal basis is Art. 6 para. 1 sentence 1 lit. b) GDPR.
HotelREZ is operated by HotelREZ Linited, Balderton Hall, Fernwood, Newark, Nottinghamshire NG24 3JR United Kingdom.
The data controller uses the web hosting provider Mittwald based in Germany for the purposes of hosting the website and for back-up services. A hosting provider offers and operates Internet services which are necessary for the necessary infrastructure of the website of the data controller.
Mittwald's operating company is Mittwald CM Service GmbH & Co. KG, Königsberger Straße 4-6, 32339 Espelkamp, Germany.
In the course of providing services for hosting purposes, access to personal data by the contractor cannot be excluded. Data processing is carried out exclusively in a member state of the European Union or in another state party to the Agreement on the European Economic Area. The transmission of personal data generally involves user data such as IP addresses, log files and the logging of user activities (websites visited, time of access, amount of data sent in bytes, source/reference from which you accessed the site, browser used, operating system used, IP address used). The data collected about Mittwald will not be used to identify the data subject without the prior, separate and explicit consent of the data subject. This data is not combined with personal data or with other data containing the same pseudonym.
The person responsible for processing uses the e-mail marketing components of MailChimp and Serenata Intraware to send the newsletter.
MailChimp is a service of The Rocket Science Group, LLC, 512 Means Street, Suite 404, Atlanta, GA 30318, USA. The e-mail marketing system of Serenata Intraware is again a service of Serenata Intraware GmbH, Neumarkter Str. 18, 81673 Munich.
Your data stored during newsletter registration via Serenata Intraware (e-mail address, IP address, date and time of your registration) will be transmitted to a server of Serenata Intraware GmbH, Neumarkter Str. 18, 81673 Munich. The processing of personal data is carried out in accordance with Art. 4 No. 2 and Art. 28 GDPR.
You can cancel or revoke your subscription to this newsletter and your consent to the storage of your data at any time in the future. Details can be found in the confirmation e-mail and in each individual newsletter. Our newsletters contain so-called tracking pixels (web bugs) with which we can recognize whether and when an e-mail was opened and which links in the e-mail were followed by the personalized recipient.
This data is stored by us so that we can optimally tailor our newsletter to the wishes and interests of our subscribers. Accordingly, the data collected is used to send personalized newsletters to the respective recipient. We ask for your consent in this regard as follows: "I agree that my data and my usage behaviour are stored electronically by the newsletter tracking to send me an individualized newsletter".
With the revocation of the consent to receive the newsletter, the consent to the aforementioned tracking is also revoked. With the revocation of the consent to receive the newsletter, the consent to the aforementioned tracking is also revoked. The data will be processed for the purpose of contacting us in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR on the basis of your voluntary consent. The personal data collected by us for the use of the contact form will be automatically deleted after your request has been processed.
The following personal data are saved and processed in the context of offering of “eStandby Upgrade”-Services: reservation details like name and address of the customer respectively name and address of the recipient of the invoice; the services, which are already booked; “loyalty club”-memberships such like Dorint Bonus Card etc.; data about the hotel-customer-contract-relation; ….. [bitte ggf. ergänzen].
The data controller has integrated Customer Alliance services. Customer Alliance is used to analyze customer ratings on the Internet, actively question customers and receive new bookings. Customer Alliance collects, uses and processes personal data for this purpose. The nature and purpose of the processing of personal data by Customer Alliance is to address customers of the controller with a request to evaluate the service provided, to record the customer evaluations and then to evaluate and make them available to the controller.
The operator of Customer Alliance services is CA Customer Alliance GmbH, Ullsteinstraße 130, 12109 Berlin, Germany.
Customer Alliance processes data types/categories within the scope of the order: Name, title, gender, language, contract duration, e-mail address, telephone number, address, information on the provision of services (costs, turnover, number of service items), any individual segmentation data available, route of concluding the contract (Internet, telephone, etc.), country of origin, service category or service group, customer evaluation of the customer (customer evaluation). The processing of personal data takes place exclusively in the territory of the Federal Republic of Germany, in a member state of the European Union or in another state party to the Agreement on the European Economic Area.
The data controller has integrated Google Maps services into this website. The Google Maps API is used to display geographical information visually. When using Google Maps, Google also collects, processes and uses data about the use of map functions by visitors.
Google Maps places a cookie on the information technology system of the person concerned. What cookies are has already been explained above. By setting the cookie, Google will be able to recognize the visitor to our website when he or she subsequently visits websites that are also members of the Google advertising network. Every time you visit a website on which the Google Mapsintegriert service is integrated, the person's Internet browser automatically identifies itself to Google. As part of this technical procedure, Google obtains knowledge of personal data, such as the IP address or the user's surfing behaviour, which Google uses, among other things, to display interest-relevant advertising.
The data controller has integrated information on communication via WhatsApp on this website. WhatsApp is a social communications network and is part of Facebook Inc.
A social network is an Internet-operated social meeting place, an online community that typically enables users to communicate with each other and interact in virtual space. A social network can serve as a platform for the exchange of opinions and experiences or enables the Internet community to provide personal or company-related information. WhatsApp enables social network users to create private profiles, upload photos, and network via telephone numbers, among other things.
WhatsApp is operated by WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. If a data subject lives outside the United States or Canada, the data controller for processing personal data is WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

References: Art. 6
 Art. 6
 Art. 6
 Art. 4
 Art. 28
 Art. 6
 Art. 4
 Art. 28
 Art. 6