Privacy policy

Protecting your personal data matters to us. We treat your personal data confidentially and in line with the statutory data protection rules (GDPR) and this policy. This is a translation of our German privacy policy; in case of doubt the German version applies.

Controller

Destan Sabani, Hotel Süderelbe, Großer Schippsee 29, 21073 Hamburg, Germany. Email: info@hotel-suederelbe.de

Contact and enquiry form

If you contact us through the form or by email, we process the details you provide to handle your enquiry and any necessary follow-up questions. For enquiries about a booking or stay, the legal basis is Art. 6 (1) (b) GDPR; for other enquiries it is Art. 6 (1) (f) GDPR based on our legitimate interest in responding to enquiries. The required checkbox merely confirms that you have read this privacy information. It is not consent to an international data transfer.

Technical service providers and international transfers

We use Cloudflare (Cloudflare, Inc., USA) for hosting, protection and server-side processing. We use Resend (Plus Five Five, Inc., USA) to deliver enquiry and review emails and to process technical delivery events. Depending on the operation, this may include your name, email address, message content, booking or guest identifier, and delivery metadata. The providers are engaged under data processing agreements. Where data is transferred to the USA or another country without an adequacy decision, the providers state in their data processing agreements that they use the EU Standard Contractual Clauses and supplementary safeguards. Resend states that account and customer data, including email metadata, logs and API records, is stored in the USA even when emails are dispatched from Ireland. Selecting an EU sending region therefore does not mean that data is stored exclusively in the EU. More information: Resend Data Processing Addendum, Resend regions, Resend subprocessors, Cloudflare Data Processing Addendum, and Cloudflare subprocessors.

Review email after your stay

After a confirmed booking we use your name, email address and the planned departure date stored with the booking to send you one review request on the following day, which also invites you to stay with us again. If the departure date changes before dispatch, the email date moves with it; no review email is sent after a cancellation or a stay marked as a no-show. There is no reminder and the delivery provider does not perform open or click tracking for this email. The legal basis is our legitimate interest in direct marketing towards our guests under Art. 6 (1) (f) GDPR in conjunction with Section 7 (3) of the German Act Against Unfair Competition (UWG). We record the time, method and text version of the objection notice so that its provision can be demonstrated. You may object to the use of your address for such messages at any time with effect for the future by emailing info@hotel-suederelbe.de and, after receiving the email, through its unsubscribe link. This costs you nothing beyond the basic transmission rates. An objection before dispatch blocks the review email permanently; you suffer no disadvantage from it. For guests who gave us express consent before 16 August 2026, that consent under Art. 6 (1) (a) GDPR remains the legal basis; it can be withdrawn at any time by the same means.

Feedback page and review pilot

When you open your personal review link, the application records without cookies whether the feedback page was opened, private feedback was submitted and the external Google link was clicked. The stored data consists of the guest identifier, a test variant assigned before any rating, the event and its timestamp. The application does not store an IP address or browser identifier for this purpose. A link click does not show whether a Google review was published. Each pilot event is deleted no later than 120 days after it was collected. Google processes data only after you deliberately open the external link.

Cookies and Google Analytics

By default this website sets no analytics cookies. Only if you explicitly consent in the cookie banner do we load Google Analytics (Google Ireland Ltd.) for anonymised audience measurement. This may involve transferring data to Google servers in the USA; your IP address is anonymised in the process. You can withdraw your consent at any time via the “Cookie settings” link in the footer. The legal basis is your consent under Art. 6 (1) (a) GDPR.

Map

The location map is first shown only as an image served from our own server. The interactive map is loaded only once you explicitly click “Pan and zoom the map”. Doing so retrieves map tiles from OpenStreetMap and CARTO and transmits your IP address to those providers. Without that click, no transfer takes place. The legal basis is your consent under Art. 6 (1) (a) GDPR.

Fonts (hosted locally)

This website uses locally hosted fonts. No data is transferred to Google Fonts or any other third party.

Server log files

When this website is accessed, our hosting provider processes technically necessary connection data, in particular the IP address, time, requested address, referrer and browser identifier. This serves secure delivery and abuse prevention on the basis of Art. 6(1)(f) GDPR. Personal review and unsubscribe tokens can technically form part of a request address; access to such logs must therefore be restricted and retention limited to what is necessary for operation, security and troubleshooting. The application itself does not add tracking profiles to these server logs.

Your rights

You have the right at any time to access, rectify, erase and restrict the processing of your data, as well as a right to object and a right to data portability. To exercise these rights, please contact us at the address given above.