Privacy Policy
Privacy Policy
1. Privacy at a Glance
General Information
The protection of your personal data is important to us. Below, we provide information about what personal data is collected and processed when you visit our website, hotelderblauereiter.de; the purposes for which this is done; the legal basis for the processing; and the rights you have under the General Data Protection Regulation (GDPR).
Personal data refers to any information relating to an identified or identifiable natural person. This includes, for example, name, address, phone number, email address, IP address, as well as booking and inquiry data.
We treat your personal data confidentially and in accordance with applicable data protection laws, in particular the GDPR and the Telecommunications and Digital Services Data Protection Act (TDDDG).
2. Data Controller
The entity responsible for data processing on this website is:
Hotel Der Blaue Reiter GmbH & Co. KG
Amalienbadstraße 16
76227 Karlsruhe-Durlach
Germany
Phone: +49 (0)721 94266-0
Email: info@hotelderblauereiter.de
Represented by WF Verwaltungs-GmbH, represented by its managing director, Wolfgang Fränkle.
3. Data Protection Officer
If you have any questions regarding data protection, please contact our Data Protection Officer:
Hotel Der Blaue Reiter GmbH & Co. KG
Amalienbadstraße 16
76227 Karlsruhe-Durlach
Phone: +49 (0)721 94266-0
Email: datenschutzbeauftragter@hotelderblauereiter.de
4. General Information on Data Processing
Legal Basis
We process personal data primarily on the following legal grounds:
Art. 6(1)(a) of the GDPR
if you have given us your consent, for example for analytics, marketing, or external media services.
Art. 6(1)(b) GDPR
if the processing is necessary for the performance of a contract or for the implementation of precontractual measures, such as room inquiries, reservations, or event inquiries.
Art. 6(1)(c) GDPR
if we are legally required to process the data.
Art. 6(1)(f) GDPR
if the processing is necessary to protect our legitimate interests or the legitimate interests of third parties, and your interests, fundamental rights, and fundamental freedoms do not override those interests.
The provisions of § 25 of the TDDDG also apply to the storage or retrieval of information on your device.
5. Retention Period
Unless a more specific retention period is stated in this Privacy Policy, we store personal data only for as long as is necessary for the respective purpose of processing.
Data may also be stored if there are statutory retention requirements. In particular, documents related to commercial and tax law may be subject to statutory retention periods.
Once the purpose of processing no longer applies and the statutory retention periods have expired, personal data will be deleted or anonymized.
6. SSL or TLS Encryption
For security reasons, our website uses SSL or TLS encryption.
One way to tell if a connection is encrypted is if the website's address begins with "https://."
Encryption is used to protect the data you submit to us via our website from access by unauthorized third parties.
7. Hosting and Server Log Files
When you visit our website, the web server or hosting provider we use processes information that is technically necessary.
These may include, in particular:
IP address
Date and time of access
Page or file accessed
Amount of data transferred
Referrer URL
Browser used
Browser version
Operating system
Hostname of the accessing device
HTTP status code
This processing is technically necessary to deliver our website and to ensure its stability, security, and functionality.
The legal basis is Article 6(1)(f) of the GDPR. Our legitimate interest lies in the secure, reliable, and technically sound operation of our website.
To the extent that our hosting provider processes personal data on our behalf, this is done on the basis of a data processing agreement in accordance with Article 28 of the GDPR.
8. Cookies and Similar Technologies
Our website uses cookies and similar technologies.
Cookies are small data files that are stored on your device. Some cookies are technically necessary to ensure that our website and its basic functions can be provided. Other cookies or technologies serve purposes such as statistics, functionality, or marketing.
Technically Necessary Cookies
Technically necessary cookies may be used without consent to the extent that they are strictly necessary to provide a digital service that you have expressly requested.
The legal basis for accessing your device is Section 25(2) of the TDDDG. The subsequent processing of personal data is based, in particular, on Article 6(1)(f) of the GDPR.
Optional Cookies and Services
Non-essential cookies, analytics, marketing, and external media services are generally activated only after you have given your consent.
The legal basis is Section 25(1) of the TDDDG and Article 6(1)(a) of the GDPR.
You can revoke or change your consent at any time, effective for the future, through our cookie settings.
9. Consent Management with Borlabs Cookie
We use Borlabs cookies on our website to manage the privacy settings and consents you have selected.
Borlabs Cookie uses a technically necessary cookie for this purpose, which stores information such as which services you have accepted or which services you have declined.
This information is used to ensure that your selected settings are retained when you revisit the page.
The legal basis is Section 25(2) of the TDDDG in conjunction with Article 6(1)(f) of the GDPR. Our legitimate interest lies in the legally compliant and user-friendly management of your privacy settings.
You can change your preferences at any time through the cookie settings on our website.
10. Contact via email, phone, or the contact form
If you contact us via the contact form, email, or phone, we will process the data you provide in order to handle your inquiry.
These may include, in particular:
Name
Title
Address
Email address
Phone number
Company
Booking or stay details
Check-in and check-out dates
Number of guests
Content of your message
If your inquiry relates to a booking, reservation, conference, event, or any other contractual service, the processing is based on Article 6(1)(b) of the GDPR.
For general inquiries, data processing is based on Article 6(1)(f) of the GDPR. Our legitimate interest lies in processing and responding to your inquiry.
To the extent that you expressly provide consent, Article 6(1)(a) of the GDPR may serve as the legal basis.
Your data will be deleted as soon as it is no longer needed to process your inquiry and there are no legal retention requirements that prevent this.
11. Hotel Bookings and Reservations
When you make a room reservation or submit a reservation request through our website, we process the personal data required for this purpose.
These may include, in particular:
Name
Address
Contact Information
Check-in and Check-out Dates
Room Category
Number of Guests
Booking Information
Payment and Billing Information
Requests or Comments You Have Provided
Data processing is carried out for the purpose of implementing pre-contractual measures or fulfilling the accommodation contract on the basis of Article 6(1)(b) of the GDPR.
To the extent that statutory documentation or retention requirements apply, further storage is based on Article 6(1)(c) of the GDPR.
12. Online booking via DIRS21
For our online room reservations and for the purchase of certain gift certificates, we use services provided by:
TourOnline AG
Borsigstraße 26
73249 Wernau
Germany
Operator of the DIRS21 booking system.
When you access or use the online booking system or the gift certificate store, personal data may be transmitted to TourOnline or processed there.
These may include, in particular:
Name and contact information
Booking period
Number of guests
Booked services
Billing information
Payment information
Technical connection data
Data processing is carried out, in particular, for the purpose of initiating and fulfilling your booking or gift certificate agreement, based on Article 6(1)(b) of the GDPR.
To the extent that TourOnline processes data on our behalf, this is done in accordance with Article 28 of the GDPR. For processing operations in which TourOnline itself is the data controller, the privacy policies of DIRS21 and TourOnline apply in addition.
13. Event Bookings via OneTicketing
For select events, we provide a link to the external booking platform OneTicketing.
If you click on the corresponding link, you will leave our website and be redirected to the external provider's platform.
From that point on, the data protection policies of the respective platform operator apply to the data processing that takes place there.
When booking an event, the following information may be processed: name, contact information, ticket and booking details, and payment information.
To the extent that we receive booking information, we process it for the purpose of fulfilling the respective event contract on the basis of Article 6(1)(b) of the GDPR.
14. Table Reservations via OpenTable
On our website, we provide links to the OpenTable reservation service for certain dining options.
When you access OpenTable, you are leaving our website or using a service provided by a third party.
OpenTable is generally responsible for the processing of personal data by OpenTable in accordance with the privacy policy provided on its website.
When making a reservation, the following information may be processed: name, contact information, desired reservation time, number of people, and other reservation details.
To the extent that we subsequently receive and process this data in order to process your reservation, we do so on the basis of Article 6(1)(b) of the GDPR.
15th Newsletter
You can subscribe to our newsletter on our website.
To sign up, we generally need your email address. Additional information is only required if it is specified for the respective newsletter or is provided voluntarily.
Data processing is based on your consent pursuant to Article 6(1)(a) of the GDPR.
To verify that a user has properly subscribed to the newsletter, data regarding the subscription and consent may be stored. To the extent necessary, this processing is based on Article 6(1)(f) of the GDPR. Our legitimate interest lies in being able to verify that consent has been given.
You can unsubscribe from the newsletter at any time. To do so, you can use the unsubscribe link at the bottom of each newsletter.
The withdrawal does not affect the lawfulness of the processing carried out prior to the withdrawal.
16. Sending Newsletters with Mailchimp
We use Mailchimp, a service provided by:
The Rocket Science Group LLC, doing business as Mailchimp
a company of the Intuit Group
USA
When you sign up for the newsletter, your email address and information regarding your registration and consent are transmitted to Mailchimp.
Mailchimp may also collect technical information about newsletters, such as:
Time of delivery
Opening a message
Links clicked
Browser and device information
Technical connection information
To the extent that newsletter analytics features are used, this is done exclusively on the basis of your consent in accordance with Art. 6(1)(a) of the GDPR.
Data processing by Mailchimp may also take place in the United States.
Mailchimp, or rather the Intuit group of companies, uses recognized data protection mechanisms for international data transfers. These may include, in particular, the EU-U.S. Data Privacy Framework, as well as the European Commission’s Standard Contractual Clauses as a supplementary measure.
Mailchimp has the necessary data protection agreements in place for the processing of personal data.
Newsletter data is generally stored for as long as you subscribe to our newsletter. After you unsubscribe, the data will be removed from the active newsletter list, unless there are legal or regulatory reasons that require it to be retained.
17. Google Analytics
If you have given your consent via our cookie banner, we use Google Analytics for statistical analysis and to optimize our website.
The provider for users within the European Economic Area is generally:
Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland
Google Analytics allows us to analyze information about how visitors use our website.
In particular, the following may be processed for this purpose:
Pages visited
Time and duration of page visits
Source or referrer
Interactions with our website
Browser type
Operating system
Device information
Approximate geographic information
Technical connection information
Google Analytics uses cookies or similar technologies for this purpose.
Google states that it processes or discards IP addresses of users from the EU before storing them further and does not log or store individual IP addresses in Google Analytics.
Google Analytics is used only with your consent.
The legal basis is Section 25(1) of the TDDDG and Article 6(1)(a) of the GDPR.
You can revoke your consent at any time through our cookie settings, effective for the future.
When using Google services, the processing of data outside the European Union—particularly in the United States—cannot be ruled out. Google uses the applicable legal mechanisms for international data transfers in such cases.
The retention period depends on the settings we have configured in Google Analytics or the service's specifications.
18. Google Maps
We use Google Maps on our website to conveniently show you our location and directions to our office.
Google Maps is generally not loaded on our website until you have agreed to use the service.
The provider for users within the European Economic Area is generally:
Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland
When loading Google Maps, the following data, among others, may be processed:
IP address
Browser and device information
Date and time of the visit
Page visited
Location information, if applicable
If you are signed in to a Google Account at the same time, Google may, in some cases, associate your usage with your user account.
The legal basis is Section 25(1) of the TDDDG and Article 6(1)(a) of the GDPR.
The map will not load without your consent. You can withdraw your consent at any time through our cookie settings.
Alternatively, you can use external navigation links. By clicking on such a link, you will leave our website, and the privacy policy of the respective external provider will apply.
19. YouTube
Videos from the YouTube video portal may be embedded on our website.
The provider for users within the European Economic Area is generally:
Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland
YouTube content is generally blocked on our website at first and is only loaded after you have agreed to use the service.
When you load a YouTube video, your IP address, browser and device information, and information about the page you are viewing may be transmitted to Google or YouTube.
If you are signed in to your YouTube or Google account, Google may associate your visit to the page with your user account.
The legal basis is Section 25(1) of the TDDDG and Article 6(1)(a) of the GDPR.
You can withdraw your consent at any time through our cookie settings, effective for the future.
Data processing outside the European Union—particularly in the United States—cannot be ruled out.
20. External Links
Our website contains links to external websites, such as those of partner companies, restaurant and reservation services, social media platforms, navigation services, or tourism-related sites.
A standard link generally establishes a connection to the respective external provider only when you click on it.
Once you leave our website, we have no control over how the respective provider processes your personal data.
Data processing on external websites is subject to the privacy policies of the respective operators.
21. Applications
You can apply to us, specifically by email, using the contact address listed on our careers pages.
As part of the application process, we process the data you provide to us. This may include, in particular:
Name
Address
Contact Information
Resume
Transcripts
Qualifications
Professional History
Application Photo
Additional Application Documents
Data is processed for the purpose of deciding whether to establish an employment relationship in accordance with § 26 BDSG in conjunction with Art. 6(1)(b) GDPR.
If an employment relationship is not established, we will generally delete your application documents after the period required to defend against potential legal claims has expired, unless we have your consent to store them for a longer period or legal grounds require us to continue storing them.
If you expressly consent to being added to a candidate pool, further processing will be based on Article 6(1)(a) of the GDPR. You may revoke this consent at any time with future effect.
22. Recipients of Personal Data
Personal data will only be disclosed to external parties if it is necessary to fulfill a contract, if we are legally required to do so, if there is a legitimate interest in the disclosure, or if you have given your consent.
Recipients or categories of recipients may include, in particular:
Hosting and IT service providers
Booking and reservation systems
Payment service providers and financial institutions
Newsletter and marketing service providers
Analytics and statistics service providers
Tax advisors and auditors
Government agencies and public authorities when required by law
Other service providers we engage for data processing
To the extent that service providers process personal data exclusively on our behalf, we enter into the necessary contracts in accordance with Article 28 of the GDPR.
23. Data Transfers to Third Countries
Some of the service providers we use are based outside the European Union or the European Economic Area, or process data there.
Personal data will be transferred to a third country only in compliance with the legal requirements set forth in Articles 44 et seq. of the GDPR.
Depending on the service provider, the transfer may be based, in particular, on an adequacy decision by the European Commission, the EU-U.S. Data Privacy Framework, or the European Commission’s Standard Contractual Clauses.
Where necessary, additional protective measures will be taken.
24. Your Rights
Subject to the statutory requirements, you have the following rights in particular:
Right to Information
Pursuant to Article 15 of the GDPR, you have the right to request information regarding whether we process personal data about you and, if so, what data we process.
Right to Correction
Pursuant to Article 16 of the GDPR, you may request the rectification of inaccurate personal data or the completion of incomplete personal data.
Right to Erasure
Under the conditions set forth in Article 17 of the GDPR, you may request the deletion of your personal data.
Right to Restriction of Processing
Under the conditions set forth in Article 18 of the GDPR, you may request a restriction on processing.
Right to Data Portability
Provided that the legal requirements are met, you have the right under Article 20 of the GDPR to receive personal data in a structured, commonly used, and machine-readable format, or to request that it be transferred to another controller.
Right to Withdraw Consent
In accordance with Article 7(3) of the GDPR, you may revoke your consent at any time with future effect.
The lawfulness of the processing carried out up to the time of revocation remains unaffected.
25. Right to Object under Article 21 of the GDPR
IF WE PROCESS PERSONAL DATA ON THE BASIS OF ART. 6, PAR. 1, SUBPAR. E or F of the GDPR, you have the right to object to the processing at any time on grounds relating to your particular situation.
If personal data is processed for the purpose of direct marketing, you have the right at any time to object to the processing for the purpose of such marketing.
Once you have objected, your personal data will no longer be processed for these purposes.
26. Right to File a Complaint with a Supervisory Authority
If you believe that the processing of your personal data violates data protection laws, you have the right, pursuant to Article 77 of the GDPR, to file a complaint with a data protection supervisory authority.
The following authority has specific jurisdiction over companies headquartered in Baden-Württemberg:
The State Commissioner for Data Protection and Freedom of Information in Baden-Württemberg
Heilbronner Straße 35
70191 Stuttgart
Mailing Address:
P.O. Box 10 29 32
70025 Stuttgart
Phone: +49 711 615541-0
Email: poststelle@lfdi.bwl.de
The right to appeal exists independently of other administrative or judicial remedies.
27. Withdrawal of Your Cookie Consents
You can change or revoke any consent you have already provided for cookies, analytics, marketing, or external media services at any time, effective for the future, through the cookie settings on our website.
Withdrawal of consent does not affect the lawfulness of data processing that took place prior to the withdrawal.
28. Updates to This Privacy Policy
We reserve the right to update this Privacy Policy if our website, the services we use, or the legal framework change.
The current version published on this website applies.
As of September 2026
