Privacy Policy – Goldener Ochsen Göppingen-Hohenstaufen

Privacy Policy

This privacy policy explains which personal data we process, for what purposes this is done and which rights you have under the General Data Protection Regulation (GDPR).

Privacy policy last updated: 2 October 2026

Controller

Controller within the meaning of the GDPR:

Room enquiries and reservations are accepted exclusively by telephone. Telephone communication is in German. Arrival times and check-in are also arranged by telephone. Email is intended for general enquiries only. We do not use WhatsApp or other messaging services as official contact channels.

Web hosting and server log files

This website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. When the website is accessed, technically necessary connection and log data may be processed, in particular the IP address, date and time of access, requested file or URL, referrer URL, browser and operating system information, transferred data volume and HTTP status code.

The processing serves the technical provision, stability and security of the website, in particular error analysis and the detection and prevention of misuse and attacks. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the secure and reliable operation of our online service.

Our website is provided exclusively via HTTPS. The transmission between your browser and our web server is protected by TLS encryption against unauthorised reading or alteration while in transit.

According to information provided by STRATO, the hostname or IP address is anonymised in the access log files made available to hosting customers. The relevant log files can be accessed through the STRATO customer login and cover no more than the preceding six weeks. STRATO processes further technical log and security data in accordance with the technical and data protection requirements applicable to the relevant service. Where STRATO processes personal data on our behalf, a data processing agreement in accordance with Article 28 GDPR is in place.

Further information: STRATO privacy information.

Cookies, tracking and external links

We do not use cookies, tracking, analytics or marketing technologies on this website.

External map services, timetable information, social networks and other third-party services are not embedded in our website as interactive content, iFrames or external scripts; they are provided only as links.

Only when you actively click such an external link do you leave our website and establish a connection to the relevant provider. In particular, your IP address, technical connection data and the web address accessed may then be transmitted to that external provider. The privacy policy of the relevant provider applies to any subsequent processing.

Please note that individual external providers may also process personal data outside the European Union (EU) or the European Economic Area (EEA). We have no influence on this processing once you leave our website. The privacy information of the respective provider applies.

Any profiles we may maintain on social networks are used to provide public information about our business. Social-media content is not embedded on this website. If you open a linked profile on a social network, further data processing is carried out by the respective platform provider in accordance with its privacy policy.

Service Worker and offline function

On selected German core pages of this website, we use a so-called Service Worker. This is a script that runs in the background in the browser and can provide a technical offline information page in the event of an actual network connection failure.

The Service Worker stores only the file offline.htm in its own browser cache. Normal content pages of the website, in particular room, contact, price, privacy or other information pages, are not permanently cached by the Service Worker. Images, stylesheets, other JavaScript files and the web app manifest are also not stored in its offline cache.

As long as a network connection is available, pages handled by the Service Worker are loaded normally over the network. Only if such a navigation request fails because of an actual network error is the locally stored offline information page displayed. No artificial time limit is used for the page request.

Data processing: The Service Worker is not used for tracking, analytics or marketing purposes, does not create user profiles and does not transmit data to us or to third parties through its offline function. The offline information page is stored only locally in the browser on the relevant device; we have no direct access to this local storage.

Legal basis: Insofar as the technical use of the Service Worker constitutes processing of personal data, this is carried out on the basis of Article 6(1)(f) GDPR. Our legitimate interest lies in the technically reliable and user-friendly provision of basic offline information in the event of an actual network connection failure.

You can delete the local CacheStorage data for this website domain using your browser settings. You can also use the following button to first delete all CacheStorage entries stored by your browser for this website domain. Afterwards, only our offline information page offline.htm will be stored again so that the basic offline function remains available.

The button first deletes all CacheStorage caches for this website domain in this browser. Afterwards, only the fixed Ochsen offline cache ochsen-cache-offline containing offline.htm is created again. It does not clear the normal HTTP/browser cache, does not delete server-side data and does not delete personal data held by us. The Service Worker registration itself remains in place.

Contact and email communication

If you contact us by telephone, email or post, we process the information you provide insofar as this is necessary to deal with your enquiry. This may include, in particular, your name, contact details, the content of your enquiry and, where the matter relates to a stay or contract, the corresponding booking or transaction data.

Room enquiries and reservations are accepted exclusively by telephone. Telephone communication is in German. The email address is intended for general enquiries only. We use services provided by STRATO GmbH to send and receive emails. In particular, email addresses, message content and technical communication data are processed in this context.

Where your enquiry serves to initiate or perform a contract, Article 6(1)(b) GDPR is the legal basis. General enquiries are processed on the basis of Article 6(1)(f) GDPR; our legitimate interest lies in the appropriate and efficient handling of enquiries.

Please note that ordinary email communication is generally not end-to-end encrypted. Particularly confidential information should therefore not be sent by unencrypted email. In such cases, you may first contact us by telephone or use the postal service.

No use of AI systems for customer enquiries and reservations

We do not use AI telephone assistants, AI chat assistants, chatbots, generative AI systems or other automated response systems to receive or process customer enquiries, room enquiries or reservations. Enquiries and reservations are handled personally by us.

Personal data from customer enquiries, room enquiries or reservations is not transmitted by us to generative AI systems for substantive processing or for training such systems.

Technical safeguards used by our hosting and email services, such as spam, virus or abuse filters, may use automated processes. This concerns the technical security and provision of the services, not our substantive handling of your enquiry.

WhatsApp, messaging services and social media

We do not use WhatsApp, Facebook/Instagram Messenger or other social-media messaging services as official contact channels for enquiries, reservations or other business correspondence. Please use the contact methods listed in this privacy policy, in particular telephone, email or post.

In particular, please do not send booking data, copies of identity documents, payment information or other confidential personal data via messaging services or social-media messages. If messages nevertheless reach us through such services, we may not be able to process them there and may refer you to our official contact channels.

General enquiries with no connection to a booking or contract are stored only for as long as is necessary to deal with the relevant matter and carry out reasonable follow-up. The data is then deleted unless statutory retention obligations or other legally permissible reasons require continued storage.

Data backup with STRATO HiDrive

We use STRATO HiDrive, provided by STRATO GmbH, to store and back up business documents and to create technical backups. Depending on the relevant process, invoices, receipts, business correspondence, booking documents and technical backups may be stored there.

The processing serves secure storage, recoverability and compliance with operational and statutory obligations. Depending on the content, the legal bases are Article 6(1)(b), Article 6(1)(c) and Article 6(1)(f) GDPR. Our legitimate interest lies in maintaining secure IT organisation and data backups.

The storage period depends on the purpose of the relevant data and the applicable statutory retention periods. Where STRATO acts as a processor, the data processing agreement in accordance with Article 28 GDPR applies.

Booking and contract data

In connection with room enquiries, reservations and stays, we process the data required to initiate and perform the accommodation contract. This may include, in particular, your name, contact details, stay dates, agreed services, payment and invoice data and necessary correspondence.

The legal basis is Article 6(1)(b) GDPR. Where statutory retention or documentation obligations apply, processing is additionally based on Article 6(1)(c) GDPR. Without the information required for the reservation or performance of the contract, a stay may not be arranged or provided.

Storage duration and statutory retention

We store personal data only for as long as is necessary for the respective purpose or for as long as statutory retention obligations apply. Once the purpose no longer applies and the relevant periods have expired, the data is deleted unless another legal basis permits further storage.

Tax and accounting documents

Depending on the type of document, statutory retention periods of 6, 8 or 10 years may apply to tax and accounting documents. The specific period depends on the legal classification of the document concerned.

Commercial and business correspondence

Commercial and business correspondence received, as well as copies of commercial and business correspondence sent, is generally retained for the period prescribed by law. Where a document is also subject to another retention obligation, a different, longer period may apply.

Special registration forms for accommodation establishments

Where the statutory requirements apply, we process data from special registration forms in accordance with Sections 29 and 30 of the German Federal Registration Act (Bundesmeldegesetz – BMG). Under the current law, this special registration obligation applies to foreign nationals staying at accommodation establishments.

The legal basis is Article 6(1)(c) GDPR in conjunction with the relevant provisions of the BMG. In accordance with Section 30 BMG, special registration forms are retained for one year and destroyed within three months after the end of the retention period.

Recipients of personal data

Personal data is disclosed only to bodies that require it for the relevant purposes. These may include STRATO as our hosting, email and cloud service provider, our tax adviser in connection with tax and accounting tasks, and authorities or other public bodies where there is a statutory obligation to disclose the data.

Where necessary for bookkeeping, annual financial statements, tax returns or tax advice, we provide our tax adviser with the documents and personal data required for these purposes. The tax adviser is generally independently responsible for processing the data supplied, in accordance with data protection law and within the scope of their statutory and professional duties.

We do not disclose personal data for advertising or market research purposes.

We do not carry out automated decision-making, including profiling, within the meaning of Article 22 GDPR.

Your rights

Subject to the statutory requirements, you have, in particular, the rights of access (Article 15 GDPR), rectification (Article 16 GDPR), erasure (Article 17 GDPR), restriction of processing (Article 18 GDPR), data portability (Article 20 GDPR) and objection (Article 21 GDPR).

Where processing is based on your consent, you may withdraw that consent at any time with effect for the future (Article 7(3) GDPR). To exercise your rights, you may contact the controller named above.

In addition, under Article 77 GDPR you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR.

Right to object under Article 21 GDPR

Where we process personal data on the basis of Article 6(1)(f) GDPR, you have the right to object to this processing at any time on grounds relating to your particular situation.

Following an objection, we will no longer process the personal data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or unless the processing serves the establishment, exercise or defence of legal claims.

You may submit your objection to the controller named above.

Data protection supervisory authority

In Baden-Württemberg, you may contact the following supervisory authority in particular: