Privacy Policy for Hotel Goldener Ochsen in Göppingen-Hohenstaufen

Privacy Policy

This privacy policy explains which personal data we process, the purposes for which this is done and the rights you have under the General Data Protection Regulation (GDPR).

This English page is provided as a translation for information purposes. Only the German privacy policy is legally binding.

Privacy policy last updated: 13 August 2026

Controller

Room enquiries and reservations can only be made by telephone and in German. Arrival times and check-in are also arranged by telephone. Email is only intended for general enquiries. We do not use WhatsApp or other messaging services as official contact channels.

Web hosting and server log files

This website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. When the website is accessed, technically necessary connection and log data may be processed, in particular the IP address, date and time of access, requested file or URL, referrer URL, browser and operating system information, transferred data volume and HTTP status code.

The processing serves the technical provision, stability and security of the website, in particular error analysis and the detection and prevention of misuse and attacks. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the secure and reliable operation of our online service.

Our website is provided exclusively via HTTPS. The transmission between your browser and our web server is protected by TLS encryption against unauthorised reading or alteration while in transit.

According to information provided by STRATO, the hostname or IP address is anonymised in the access log files made available to hosting customers. The relevant log files can be accessed through the STRATO customer login and cover no more than the preceding six weeks. STRATO processes further technical log and security data in accordance with the technical and data protection requirements applicable to the relevant service. Where STRATO processes personal data on our behalf, a data processing agreement in accordance with Article 28 GDPR is in place.

Further information: STRATO privacy information.

Cookies, tracking and external links

We do not use cookies, tracking, analytics or marketing technologies on this website.

External map services, timetable information, social networks and other third-party services are not embedded in our website as interactive content, iFrames or external scripts; they are provided only as links.

Only when you actively click such an external link do you leave our website and establish a connection to the relevant provider. In particular, your IP address, technical connection data and the web address accessed may then be transmitted to that external provider. The privacy policy of the relevant provider applies to any subsequent processing.

Contact and email communication

If you contact us by telephone, email or post, we process the information you provide insofar as this is necessary to deal with your enquiry. This may include, in particular, your name, contact details, the content of your enquiry and, where the matter relates to a stay or contract, the corresponding booking or transaction data.

Room enquiries and reservations can only be made by telephone and in German. The email address is intended for general enquiries only. We use services provided by STRATO GmbH to send and receive emails. In particular, email addresses, message content and technical communication data are processed in this context.

Where your enquiry serves to initiate or perform a contract, Article 6(1)(b) GDPR is the legal basis. General enquiries are processed on the basis of Article 6(1)(f) GDPR; our legitimate interest lies in the appropriate and efficient handling of enquiries.

Please note that ordinary email communication is generally not end-to-end encrypted. Particularly confidential information should therefore not be sent by unencrypted email. In such cases, you may first contact us by telephone or use the postal service.

We handle enquiries and reservations personally. We do not use chatbots, generative AI systems or automated response systems for this purpose. We do not use WhatsApp or social media messaging services as official contact channels for our business.

General enquiries with no connection to a booking or contract are stored only for as long as is necessary to deal with the relevant matter and carry out reasonable follow-up. The data is then deleted unless statutory retention obligations or other legally permissible reasons require continued storage.

Data backup with STRATO HiDrive

We use STRATO HiDrive, provided by STRATO GmbH, to store and back up business documents and to create technical backups. Depending on the relevant process, invoices, receipts, business correspondence, booking documents and technical backups may be stored there.

The processing serves secure storage, recoverability and compliance with operational and statutory obligations. Depending on the content, the legal bases are Article 6(1)(b), Article 6(1)(c) and Article 6(1)(f) GDPR. Our legitimate interest lies in maintaining secure IT organisation and data backups.

The storage period depends on the purpose of the relevant data and the applicable statutory retention periods. Where STRATO acts as a processor, the data processing agreement in accordance with Article 28 GDPR applies.

Booking and contract data

In connection with room enquiries, reservations and stays, we process the data required to initiate and perform the accommodation contract. This may include, in particular, your name, contact details, stay dates, agreed services, payment and invoice data and necessary correspondence.

The legal basis is Article 6(1)(b) GDPR. Where statutory retention or documentation obligations apply, processing is additionally based on Article 6(1)(c) GDPR. Without the information required for the reservation or performance of the contract, a stay may not be arranged or provided.

Storage duration and statutory retention

We store personal data only for as long as is necessary for the respective purpose or for as long as statutory retention obligations apply. Once the purpose no longer applies and the relevant periods have expired, the data is deleted unless another legal basis permits further storage.

Tax and accounting documents

Depending on the type of document, statutory retention periods of 6, 8 or 10 years may apply to tax and accounting documents. The specific period depends on the legal classification of the document concerned.

Commercial and business correspondence

Commercial and business correspondence received, as well as copies of commercial and business correspondence sent, is generally retained for the period prescribed by law. Where a document is also subject to another retention obligation, a different, longer period may apply.

Special registration forms for accommodation establishments

Where the statutory requirements apply, we process data from special registration forms in accordance with Sections 29 and 30 of the German Federal Registration Act (Bundesmeldegesetz – BMG). Under the current law, this special registration obligation applies to foreign nationals staying at accommodation establishments.

The legal basis is Article 6(1)(c) GDPR in conjunction with the relevant provisions of the BMG. In accordance with Section 30 BMG, special registration forms are retained for one year and destroyed within three months after the end of the retention period.

Recipients of personal data

Personal data is disclosed only to bodies that require it for the relevant purposes. These may include STRATO as our hosting, email and cloud service provider, our tax adviser in connection with tax and accounting tasks, and authorities or other public bodies where there is a statutory obligation to disclose the data.

Where necessary for bookkeeping, annual financial statements, tax returns or tax advice, we provide our tax adviser with the documents and personal data required for these purposes. The tax adviser is generally independently responsible for processing the data supplied, in accordance with data protection law and within the scope of their statutory and professional duties.

We do not disclose personal data for advertising or market research purposes.

We do not carry out automated decision-making, including profiling, within the meaning of Article 22 GDPR.

Your rights

Subject to the statutory requirements, you have, in particular, the rights of access (Article 15 GDPR), rectification (Article 16 GDPR), erasure (Article 17 GDPR), restriction of processing (Article 18 GDPR), data portability (Article 20 GDPR) and objection (Article 21 GDPR).

Where processing is based on your consent, you may withdraw that consent at any time with effect for the future (Article 7(3) GDPR). To exercise your rights, you may contact the controller named above.

In addition, under Article 77 GDPR you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR.

Right to object under Article 21 GDPR

Where we process personal data on the basis of Article 6(1)(f) GDPR, you have the right to object to this processing at any time on grounds relating to your particular situation.

Following an objection, we will no longer process the personal data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or unless the processing serves the establishment, exercise or defence of legal claims.

You may submit your objection to the controller named above.

Data protection supervisory authority

In Baden-Württemberg, you may contact the following supervisory authority in particular: