Privacy information

Please note: this English version is provided for your convenience. Only the German version is legally binding.

With this privacy information, we inform you about how we handle your personal data and about your rights under the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). The controller responsible for data processing is Fischer’s Loft Betriebsgesellschaft mbH (hereinafter “we” or “us”).

1. General information

Contact

If you have any questions or suggestions about this information, or wish to contact us to exercise your rights, please send your request to:

Fischer’s Loft Betriebsgesellschaft mbH
Fischergrube 83
23552 Lübeck
Germany
Phone: +49 451 400 82 558
Email: info@fishersloft-hotel.de

Legal bases

In data protection law, the term “personal data” means any information relating to an identified or identifiable natural person. We process personal data in compliance with the applicable data protection regulations, in particular the GDPR and the BDSG. We only process data where there is a legal basis for doing so. We process personal data only with your consent (Section 25 (1) TDDDG or Art. 6 (1) (a) GDPR), to perform a contract to which you are a party or, at your request, to take steps prior to entering into a contract (Art. 6 (1) (b) GDPR), to comply with a legal obligation (Art. 6 (1) (c) GDPR), or where processing is necessary for the purposes of our legitimate interests or those of a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require the protection of personal data (Art. 6 (1) (f) GDPR).

If you apply for a vacancy in our company, we also process your personal data in order to decide on establishing an employment relationship (Section 26 (1) sentence 1 BDSG).

Storage period

Unless otherwise stated below, we only store data for as long as is necessary to achieve the purpose of processing or to fulfil our contractual or legal obligations. Such statutory retention obligations may arise in particular from commercial or tax law. From the end of the calendar year in which the data was collected, we retain personal data contained in our accounting records for ten years and personal data contained in business letters and contracts for six years. Otherwise, we retain data relating to consents that must be documented, and to complaints and claims, for the duration of the statutory limitation periods. We delete data stored for advertising purposes if you object to processing for this purpose.

Categories of recipients

We use processors when processing your data. Processing operations carried out by such processors include, for example, hosting, sending emails, maintenance and support of IT systems, booking and guest management, accounting and billing, or the destruction of files and data carriers. Processors do not use the data for their own purposes; they process data exclusively on our behalf and are contractually obliged to ensure appropriate technical and organisational data protection measures. Beyond this, we may transfer your personal data to bodies such as postal and delivery services, our bank, tax advisers/auditors or the tax authorities. Further recipients may be named in the information below.

Data transfers to third countries

Our data processing may involve the transfer of certain personal data to third countries, i.e. countries where the GDPR does not apply. Such a transfer is permissible if the European Commission has decided that the third country ensures an adequate level of data protection. Where there is no such adequacy decision, data is only transferred if appropriate safeguards pursuant to Art. 46 GDPR are in place or one of the conditions of Art. 49 GDPR is met.

Unless otherwise stated below, we use the EU standard contractual clauses as appropriate safeguards. You can obtain or inspect a copy of them by contacting us at the address given above under “Contact”. If you consent to the transfer of personal data to third countries, the transfer is based on Art. 49 (1) (a) GDPR.

Processing when you exercise your rights

If you exercise your rights under Art. 15 to 22 GDPR, we process the personal data provided in order to implement these rights and to be able to provide evidence of this. We process data stored for the purpose of providing information and preparing to do so only for that purpose and for data protection monitoring, and otherwise restrict processing in accordance with Art. 18 GDPR. This processing is based on Art. 6 (1) (c) GDPR in conjunction with Art. 15 to 22 GDPR and Section 34 (2) BDSG.

Your rights

As a data subject, you have in particular the following rights:

access to information as to whether and, if so, to what extent we process personal data about you (Art. 15 GDPR, Section 34 BDSG),
rectification of your data (Art. 16 GDPR),
erasure of your personal data (Art. 17 GDPR, Section 35 BDSG),
restriction of processing (Art. 18 GDPR),
receipt of the data concerning you that you have provided to us in a structured, commonly used and machine-readable format, and transfer to another controller (Art. 20 GDPR).

If you have given us separate consent to data processing, you can withdraw it at any time in accordance with Art. 7 (3) GDPR. This does not affect the lawfulness of processing carried out before the withdrawal.

If you believe that the processing of personal data concerning you infringes the GDPR, you have the right to lodge a complaint with a supervisory authority in accordance with Art. 77 GDPR.

Right to object

In accordance with Art. 21 (1) GDPR, you have the right to object, on grounds relating to your particular situation, to processing based on Art. 6 (1) (e) or (f) GDPR. If we process personal data about you for direct marketing purposes, you can object to this processing in accordance with Art. 21 (2) and (3) GDPR.

2. Data processing on our website

When you use the website, certain information is collected automatically during your visit. In data protection law, an IP address is generally also regarded as personal data. An IP address is assigned by the internet provider to every device connected to the internet so that it can send and receive data.

Hosting

Our website is hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. IONOS processes the data arising when the website is accessed (see “Server log files”) on our behalf on the basis of a data processing agreement under Art. 28 GDPR. Processing serves our legitimate interest in providing the website securely and reliably (Art. 6 (1) (f) GDPR).

Server log files

When you use our website for information purposes only, general information that your browser transmits to our server is stored automatically. By default, this includes: browser type and version, operating system used, page accessed, previously visited page (referrer URL), IP address, date and time of the server request, and HTTP status code.

Processing is carried out to protect our legitimate interests and is based on Art. 6 (1) (f) GDPR. It serves the technical administration and security of the website. The stored data is deleted after seven days unless there is a justified suspicion of unlawful use based on specific indications and further examination is necessary for this reason. We are not able to identify you as a data subject on the basis of the stored information. Art. 15 to 22 GDPR therefore do not apply pursuant to Art. 11 (2) GDPR, unless you provide additional information that enables you to be identified in order to exercise your rights.

Cookies and tracking

Our website itself does not set any cookies and does not use any analytics or marketing services. Fonts, images and scripts are loaded exclusively from our own server. When you access our pages, no data is therefore transferred to third parties and no information is stored on your device.

Cookies or similar technologies (e.g. local storage in the browser) from third-party providers can only arise if you trigger them yourself:

YouTube: when you load a video by clicking on the preview image. Google may then use cookies and similar technologies, even in privacy-enhanced mode (see “YouTube”).
ibelsa: when you submit the booking form and switch to the ibelsa booking page. The cookie and privacy information of ibelsa applies there.
Other websites: when you follow a link, e.g. to Facebook, Instagram, Google Maps, OpenStreetMap or the Hidden Places.

A cookie banner is therefore not necessary: you give your consent for YouTube by clicking on the preview image, and you are informed about this directly at the video.

Room booking via ibelsa

For room bookings, we use the booking system of ibelsa GmbH, Sybelstraße 41, 10629 Berlin, Germany (commercial register: Amtsgericht Berlin, HRB 156388 B). When you select and submit your arrival and departure dates in the booking form on our website, you are forwarded to the ibelsa booking page; the selected dates are transmitted in the process. Only there do you enter your booking details. ibelsa processes this data on our behalf on the basis of a data processing agreement. We process the data exclusively to handle your booking and your stay. The legal basis is Art. 6 (1) (b) GDPR. Information marked as mandatory is required for the booking; without it, we cannot process your booking. Further information is voluntary.

YouTube

On some pages, we show videos stored on YouTube, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When the page is accessed, only a preview image from our own server is displayed at first; no data is transferred to YouTube. Only when you click on the preview image is the video loaded in privacy-enhanced mode (youtube-nocookie.com) or YouTube opened in a new window. Your IP address is then transmitted to Google, and Google may use its own cookies or similar technologies.

Processing is based on the consent you give by clicking (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG). You can withdraw your consent for the future by reloading the page. A transfer of your data to the USA cannot be ruled out; please note the information under “Data transfers to third countries”. Further information can be found in Google’s privacy policy (opens in a new window).

Map image and map links

On the “Contact & Location” page, we show a map section as an image from our own server (map data © OpenStreetMap contributors). No interactive map is embedded. Only when you follow a link to Google Maps or OpenStreetMap are you forwarded to the website of the respective provider, whose privacy policy then applies.

Links to other websites

Our website contains links to websites of other providers, e.g. to our social media profiles and to the Hidden Places. No data is transferred to these providers when you access our pages. Only when you follow a link does the respective provider process data under its own responsibility.

We have company pages on Facebook and Instagram to provide information about our hotel and to communicate with others. When you visit or interact with such a profile, personal data about you may be processed. The information associated with a social media profile used, as well as messages and statements made using the profile, also regularly constitute personal data. In addition, certain information is often collected automatically during your visit, which may also constitute personal data.

Facebook and Instagram

When you visit our Facebook or Instagram page, certain information about you is processed. Meta Platforms Ireland Limited (Ireland, EU) is solely responsible for this processing. Further information is available at facebook.com/privacy/explanation (opens in a new window). Meta offers the option of objecting to certain data processing; information and opt-out options can be found at facebook.com/settings?tab=ads (opens in a new window).

For our Facebook and Instagram page, Meta provides us with statistics and insights in anonymised form (“Page Insights”), which help us understand the types of actions people take on our page. This processing is carried out by Meta and us as joint controllers. It serves our legitimate interest in evaluating the actions on our page and improving the page on the basis of these insights. The legal basis is Art. 6 (1) (f) GDPR. We cannot assign the information from Page Insights to individual user profiles. We have concluded a joint controller agreement with Meta that sets out the allocation of data protection obligations; details can be found under information about Page Insights (opens in a new window). You can also exercise your data subject rights in relation to this processing against Meta.

According to Meta’s privacy policy, user data is also processed in the USA or other third countries. Meta only transfers user data to countries for which there is an adequacy decision by the European Commission under Art. 45 GDPR, or on the basis of appropriate safeguards under Art. 46 GDPR.

Comments and direct messages

We also process information that you provide to us via our company page, such as your user name, contact details or a message to us. This processing is carried out by us as sole controller on the basis of our legitimate interest in getting in touch with people who contact us (Art. 6 (1) (f) GDPR). Further data processing may take place if you have given your consent (Art. 6 (1) (a) GDPR) or if this is necessary to comply with a legal obligation (Art. 6 (1) (c) GDPR). If you have provided us with information to take part in a competition, we only process it in order to send you a prize if applicable, and delete it afterwards (Art. 6 (1) (b) GDPR).

4. Other data processing

Contact by email or phone

If you contact us by email or phone, we process the data transmitted in order to respond to your enquiry. If your enquiry relates to the conclusion or performance of a contract, the legal basis is Art. 6 (1) (b) GDPR; otherwise, it is our legitimate interest in getting in touch with people who contact us (Art. 6 (1) (f) GDPR).

Guest and prospective guest data

If you contact us as a guest or prospective guest, we process your data to the extent necessary to establish or carry out the contractual relationship. This regularly includes processing the master, contract and payment data provided to us, as well as contact and communication data of contact persons at business customers and business partners. The legal basis is Art. 6 (1) (f) GDPR; if you are personally our contractual partner, Art. 6 (1) (b) GDPR.

We also process guest and prospective guest data for analysis and marketing purposes. This processing is based on Art. 6 (1) (f) GDPR and serves our interest in developing our services and informing you specifically about our offers. Further data processing may take place if you have given your consent (Art. 6 (1) (a) GDPR) or if this is necessary to comply with a legal obligation (Art. 6 (1) (c) GDPR).

Use of your email address for marketing purposes

We may use the email address you provided when booking to inform you about our own similar offers and services. The legal basis is Art. 6 (1) (f) GDPR in conjunction with Section 7 (3) of the German Act against Unfair Competition (UWG). You can object to this at any time without incurring any costs other than the transmission costs according to the basic rates – via the unsubscribe link in every email or by email to info@fishersloft-hotel.de.

Job applications

If you apply to us, we process your application data exclusively for purposes related to your interest in current or future employment with us and the processing of your application. Your application is only processed by the responsible persons at our company; all employees entrusted with data processing are bound to confidentiality. If we cannot offer you employment, we retain your data for up to six months after a rejection in order to answer questions in connection with your application – unless statutory provisions prevent deletion, further storage is necessary for evidence purposes, or you have expressly agreed to longer storage. The legal basis is Section 26 (1) sentence 1 BDSG. You can withdraw your consent to longer storage at any time in accordance with Art. 7 (3) GDPR.

Last updated: October 2026