VAT identification number pursuant to § 27 a of the German VAT Act: DE296222192
Responsible for journalistic-editorial content pursuant to § 18 (2) MStV
Destan Sabani, address as above.
Liability for content
As a service provider, we are responsible for our own content on these pages under the general laws. A general obligation to monitor third-party information transmitted or stored exists only where required by law.
Liability for links
Our site contains links to external third-party websites whose content we have no influence over. Responsibility for the content of linked pages always lies with their respective provider or operator.
Privacy policy
Protecting your personal data matters to us. We treat your personal data confidentially and in line with the statutory data protection rules (GDPR) and this policy. This is a translation of our German privacy policy; in case of doubt the German version applies.
If you contact us through the form or by email, we process the details you provide to handle your enquiry and any necessary follow-up questions. For enquiries about a booking or stay, the legal basis is Art. 6 (1) (b) GDPR; for other enquiries it is Art. 6 (1) (f) GDPR based on our legitimate interest in responding to enquiries. The required checkbox merely confirms that you have read this privacy information. It is not consent to an international data transfer.
Technical service providers and international transfers
We use Cloudflare (Cloudflare, Inc., USA) for hosting, protection and server-side processing. We use Resend (Plus Five Five, Inc., USA) to deliver enquiry and review emails and to process technical delivery events. Depending on the operation, this may include your name, email address, message content, booking or guest identifier, and delivery metadata. The providers are engaged under data processing agreements. Where data is transferred to the USA or another country without an adequacy decision, the providers state in their data processing agreements that they use the EU Standard Contractual Clauses and supplementary safeguards. Resend states that account and customer data, including email metadata, logs and API records, is stored in the USA even when emails are dispatched from Ireland. Selecting an EU sending region therefore does not mean that data is stored exclusively in the EU. More information: Resend Data Processing Addendum, Resend regions, Resend subprocessors, Cloudflare Data Processing Addendum, and Cloudflare subprocessors.
Registration form at reception (iPad)
The controller is Destan Sabani, Hotel Süderelbe, Großer Schippsee 29, 21073 Hamburg, Germany, phone +49 40 767 36 40, email info@hotel-suederelbe.de. At reception you fill in your registration form (Meldeschein) yourself on an iPad: you tap “Fill in registration form”, enter your details and sign on the screen with your finger or a stylus. The iPad shows no details of other guests.
The registration form contains: date of arrival and expected departure, surname, first names, date of birth, nationalities, address, the number of spouses or civil partners and minor children travelling with you, and your signature. Other adults travelling with you fill in their own form. Of your signature we store only the finished image, not pressure, speed or the sequence of strokes. The iPad does not ask for the number of your passport or ID card. If you fill in a paper form and write the number of your passport or ID card on it, we enter that number as well. We do not photograph or copy your ID.
The connection to our hotel system is encrypted. Once you submit, your details are stored there and not on the iPad. The page clears itself after you submit and after a short time without input. The only things kept on the iPad are a cookie by which our hotel system recognises the device and the name of the device, neither of them with guest details. If you cancel before submitting, nothing is stored. If the iPad is not available, guests without German citizenship fill in the form on paper and reception enters the details into our hotel system. Guests with German citizenship then do not fill in a form.
Reception then looks at your passport or ID card, compares it with your details and assigns the form to your booking. We record when and by whom this check was made, and we note it if no valid document is presented. We do not change the details you entered on the iPad, because your signature covers what you submitted. If something is wrong, you fill in the form again or we note the discrepancy. If the booking is in your name and no nationality is stored there yet, we enter yours. This lets our hotel system see whether the booking requires a registration form. We do not copy your address into the booking.
For guests without German citizenship the registration form is required by law. The legal basis is Art. 6 (1) (c) GDPR in conjunction with Sections 29 and 30 of the German Federal Registration Act (Bundesmeldegesetz, BMG). You must provide the details and sign the form. Anyone who does not fill it in or does not sign it commits an administrative offence (Section 54 BMG). We do not ask for your consent for this.
For guests with German citizenship, including those who also hold another, there has been no registration duty at hotels since 1 January 2025. We still ask all guests to fill in the same form. For them the legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest is to record all guests in the same way and to know who is staying at the hotel, for example for safety and in emergencies. You are not obliged to provide these details.
Right to object: as a guest with German citizenship you may object to this processing at any time (Art. 21 GDPR). Tell reception, and you do not fill in a registration form. You suffer no disadvantage from this. If you object only after submitting the form, we delete it.
Authorities receive registration forms only if they request them and are entitled to do so; for guests without German citizenship under Section 30 (4) BMG. We do not use the details for marketing. Within the hotel, only reception and the hotel management see registration forms. Our hotel system runs on Cloudflare, Inc. (USA). Cloudflare processes the data on our behalf. Where data is transferred to the USA, Cloudflare states in its data processing agreement that it uses the EU Standard Contractual Clauses and supplementary safeguards.
We keep the registration form for one year from the day of your departure and delete it within three months after that period ends (Section 30 (4) BMG). The same period applies to guests with German citizenship, so that we can answer questions about your stay later, for example about damage, lost property or enquiries from authorities. It also applies to the image of your signature and to paper forms. Details you submitted on the iPad that reception has not taken over are deleted after the same period. If reception discards a submission, for example because it arrived twice, we delete the details and the signature immediately. The nationality in your booking is kept as long as the booking itself.
You may request access to your details (Art. 15 GDPR), have incorrect details rectified (Art. 16 GDPR) and request restriction of processing (Art. 18 GDPR). We do not alter a form signed on the iPad for this; we add the correction to it as a note. For guests without German citizenship we may not delete the form before the period ends (Art. 17 (3) (b) GDPR), and the right to object does not apply there, because we keep the form to meet a legal obligation. Guests with German citizenship may also request erasure (Art. 17 GDPR) and object as described above. The right to data portability does not apply to the registration form. To exercise your rights, contact reception or info@hotel-suederelbe.de. You may also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information (Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit), Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany.
Review email after your stay
After a confirmed booking we use your name, email address and the planned departure date stored with the booking to send you one review request on the following day, which also invites you to stay with us again. If the departure date changes before dispatch, the email date moves with it; no review email is sent after a cancellation or a stay marked as a no-show. There is no reminder and the delivery provider does not perform open or click tracking for this email. The legal basis is our legitimate interest in direct marketing towards our guests under Art. 6 (1) (f) GDPR in conjunction with Section 7 (3) of the German Act Against Unfair Competition (UWG). We record the time, method and text version of the objection notice so that its provision can be demonstrated. You may object to the use of your address for such messages at any time with effect for the future by emailing info@hotel-suederelbe.de and, after receiving the email, through its unsubscribe link. This costs you nothing beyond the basic transmission rates. An objection before dispatch blocks the review email permanently; you suffer no disadvantage from it. For guests who gave us express consent before 16 August 2026, that consent under Art. 6 (1) (a) GDPR remains the legal basis; it can be withdrawn at any time by the same means.
Feedback page and review pilot
When you open your personal review link, the application records without cookies whether the feedback page was opened, private feedback was submitted and the external Google link was clicked. The stored data consists of the guest identifier, a test variant assigned before any rating, the event and its timestamp. The application does not store an IP address or browser identifier for this purpose. A link click does not show whether a Google review was published. Each pilot event is deleted no later than 120 days after it was collected. Google processes data only after you deliberately open the external link.
Cookies and Google Analytics
By default this website sets no analytics cookies. Only if you explicitly consent in the cookie banner do we load Google Analytics (Google Ireland Ltd.) for anonymised audience measurement. This may involve transferring data to Google servers in the USA; your IP address is anonymised in the process. You can withdraw your consent at any time via the “Cookie settings” link in the footer. The legal basis is your consent under Art. 6 (1) (a) GDPR.
Map
The location map is first shown only as an image served from our own server. The interactive map is loaded only once you explicitly click “Pan and zoom the map”. Doing so retrieves map tiles from OpenStreetMap and CARTO and transmits your IP address to those providers. Without that click, no transfer takes place. The legal basis is your consent under Art. 6 (1) (a) GDPR.
Fonts (hosted locally)
This website uses locally hosted fonts. No data is transferred to Google Fonts or any other third party.
Server log files
When this website is accessed, our hosting provider processes technically necessary connection data, in particular the IP address, time, requested address, referrer and browser identifier. This serves secure delivery and abuse prevention on the basis of Art. 6(1)(f) GDPR. Personal review and unsubscribe tokens can technically form part of a request address; access to such logs must therefore be restricted and retention limited to what is necessary for operation, security and troubleshooting. The application itself does not add tracking profiles to these server logs.
Your rights
You have the right at any time to access, rectify, erase and restrict the processing of your data, as well as a right to object and a right to data portability. To exercise these rights, please contact us at the address given above.
We would like to use cookies and Google Analytics to improve our website. These services are loaded only after you have given consent. Details are available in our .
