Privacy Policy

for the Hotel ConventGarten

The management of Hotel ConventGarten attaches great importance to the protection of your personal data. We process personal data exclusively in accordance with the General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG) and other applicable data protection regulations.

Hotel ConventGarten uses the same technical systems, software solutions and service providers as ONNO Hotel by Norman for its website, bookings, payments, communications, marketing and analytics. The following provisions therefore apply in the same way and to the same extent in terms of structure, content and legal rationale.

In principle, it is possible to use our website without providing any personal data. However, if specific services such as online bookings, contact forms, chat functions, newsletters, Wi-Fi access or payment services are used, the processing of personal data may be necessary.

1. Data controller

Hotel ConventGarten Betriebs GmbH & Co. KG
Hindenburgstraße 38–42
24768 Rendsburg
Germany

Telephone: +49 4331 59050
Email: info@conventgarten.de
Website: www.conventgarten.de

Data Protection Officer

Martha Theede
Email: m.theede@conventgarten.de

(Note: This is a designated contact person for data protection enquiries, not a legally appointed data protection officer within the meaning of Article 37 of the GDPR.)

IT support:
MS4 IT, Hamburg

2. General information on data processing

We process personal data only to the extent necessary to provide a fully functional website, to process bookings, to handle enquiries or to fulfil statutory or contractual obligations.

Legal bases for processing (Article 6(1) of the GDPR):

a) Consent of the data subject
b) Performance of a contract or pre-contractual measures
c) Legal obligation
f) Legitimate interest

3. Cookies & Consent Management (Cookiebot)

We use the consent management service Cookiebot by Usercentrics, provided by Cybot A/S, Havnegade 39, 1058 Copenhagen, Denmark.

Cookiebot enables us to obtain, manage and document consent for the use of cookies and similar technologies in compliance with data protection regulations.

In particular, the following data is processed:

IP address (truncated or pseudonymised)
Date and time of consent
Browser and device information
Consent status (Consent ID)

Purpose of processing:
Obtaining, managing and documenting consent, and ensuring the lawful operation of the website.

Legal basis:
Article 6(1)(c) of the GDPR (legal obligation)
Article 6(1)(f) of the GDPR (legitimate interest in legally compliant operation)

You may change or withdraw your consent at any time via the cookie settings on our website.

Further information:
https://www.cookiebot.com/de/privacy-policy/

4. Hosting & server log files

When you visit our website, the hosting provider automatically collects the following data:

IP address
Date and time of access
Browser type and version
Operating system
Referrer URL

Purpose: technical provision, stability and security
Legal basis: Article 6(1)(f) of the GDPR
Retention period: maximum 14 days

5. Contact forms

When you use our contact forms, we process the data you submit (e.g. name, email address, message). The transmission is SSL-encrypted.

Purpose: Processing your enquiry
Legal basis: Article 6(1)(b) of the GDPR

Data will not be disclosed to third parties without your consent.

6. Bookings & price comparisons (HotelNetSolutions)

For direct bookings and price comparisons, we use HotelNetSolutions GmbH, Berlin.

Data processed:
Name, address, contact details, travel dates, payment information

Purpose: To process bookings and price comparisons
Legal basis: Article 6(1)(b) of the GDPR

Data is transferred to our hotel management system (MEWS) and to payment service providers solely for the purpose of contract fulfilment.

7. Hotel management system (MEWS)

We use MEWS Systems B.V., Netherlands, to manage bookings and stays.

Data: Guest details, stay and billing details, payment status
Purpose: Contract fulfilment and guest communication
Legal basis: Article 6(1)(b) of the GDPR

8. Payment processing

a) Stripe

Payment provider: Stripe Payments Europe Ltd., Ireland

Data: Name, payment details, billing address, IP address
Purpose: Payment processing
Legal basis: Article 6(1)(b) of the GDPR

Data transfers to the USA are carried out on the basis of the Standard Contractual Clauses (SCCs).

b) Klarna

Provider: Klarna Bank AB (publ), Sweden

Data may be transferred to credit reference agencies (including SCHUFA and Creditreform) for creditworthiness and fraud checks.

Legal basis: Article 6(1)(b) and (f) of the GDPR
Alternative payment methods without a credit check are available.

c) PayPal

Provider: PayPal (Europe) S.à r.l. et Cie, Luxembourg

Purpose: Payment processing
Legal basis: Article 6(1)(b) of the GDPR

9. Newsletters

Newsletters are sent via Mailchimp (Intuit Inc., USA) and Microsoft Outlook.

Data: Name, email address
Legal basis: Article 6(1)(a) of the GDPR

Newsletters are sent exclusively on a double opt-in basis. You may withdraw your consent at any time via the unsubscribe link. Data transfers to the USA are carried out on the basis of the SCCs.

10. Chatbot (DialogShift)

We use the chatbot provided by DialogShift GmbH, Berlin, to communicate with guests.

Data: Chat content, name (where applicable), email address, IP address
Legal basis: Article 6(1)(b) and (f) of the GDPR

11. Wi-Fi use in the hotel

When using our guest Wi-Fi, connection data (IP address, device identifier, MAC address, time) is processed.

Retention period: maximum 7 days
Legal basis: Article 6(1)(f) of the GDPR

12. Web analytics & marketing

Google Analytics 4

Provider: Google Ireland Ltd.
IP anonymisation is enabled.

Use is subject exclusively to your consent via Cookiebot.

Legal basis: Article 6(1)(a) of the GDPR

Data transfers to the USA are carried out on the basis of the Standard Contractual Clauses (SCCs).

Google Ads

Purpose: Performance measurement and optimisation of advertising campaigns
Legal basis: Article 6(1)(a) of the GDPR

13. External content & plugins

YouTube

Videos from the YouTube service (Google Ireland Ltd.) may be embedded on our website.
These are only embedded with your consent.

Google Maps

We use Google Maps to display maps.
Here too, the integration only takes place with your prior consent.

Google Fonts

We use Google Fonts integrated locally.
No data is transferred to Google.

14. CCTV in the hotel

We use CCTV in publicly accessible areas.

Purpose: protection of guests, staff and property
Retention period: maximum 48 hours
Legal basis: Article 6(1)(f) of the GDPR

Surveillance is clearly signposted on site.

15. Rights of data subjects

You have the right to access, rectification, erasure, restriction of processing, data portability, objection and withdrawal of consent. You also have the right to lodge a complaint with the relevant supervisory authority.

16. Retention period

Personal data will only be stored for as long as is necessary to fulfil the purpose for which it was collected or in accordance with statutory retention obligations.

17. Changes to this Privacy Policy

We reserve the right to amend this privacy policy in the event of legal or technical changes.

18. Cookie Policy

The current overview of all cookies and services used is automatically provided and updated by Cookiebot.

Last updated: January 2026

Use of Cookiebot

Cookiebot is an online service that helps us ensure the use of cookies and online tracking complies with data protection regulations. When using the web service provided by Cybot A/S (Havnegrade 39, 1058 Copenhagen, Denmark), your browser transmits personal data to the aforementioned company. The legal basis for data processing is Article 6(1)(f) of the GDPR. The legitimate interest lies in ensuring the website functions correctly. The data will be deleted as soon as the purpose for which it was collected has been fulfilled. Further information on how the transferred data is handled can be found in the privacy policy of cookiebot.com: www.cookiebot.com/de/privacy-policy/. You can prevent the collection and processing of your data by cookiebot.com by disabling the execution of script code in your browser or by installing a script blocker in your browser (you can find one, for example, at www.noscript.net or www.ghostery.com).
You have the right to amend or withdraw your consent at any time.

Use of Cookiebot

Cookiebot is an online service that helps us to ensure the use of cookies and online tracking complies with data protection regulations. When using the web service provided by Cybot A/S (Havnegrade 39, 1058 Copenhagen, Denmark), your browser transmits personal data to the aforementioned company. The legal basis for data processing is Article 6(1)(f) of the GDPR. The legitimate interest lies in ensuring the website functions correctly. The data will be deleted as soon as the purpose for which it was collected has been fulfilled. Further information on how the transferred data is handled can be found in the privacy policy of cookiebot.com: www.cookiebot.com/de/privacy-policy/. You can prevent the collection and processing of your data by cookiebot.com by disabling the execution of script code in your browser or by installing a script blocker in your browser (you can find one, for example, at www.noscript.net or www.ghostery.com).
You have the right to amend or withdraw your consent at any time.

19. Other plugins and tools

gastronovi (table booking)

On this website, you can book a table at our restaurant via an embedded form. The provider is Gastronovi GmbH, Buschhöhe 2, 28357 Bremen, Germany (hereinafter ‘gastronovi’).

The booking form is not loaded automatically. It is only integrated once you actively click the relevant button. No data is transferred to gastronovi prior to this. By clicking, you consent to the integration. When the form loads, your IP address is transmitted to gastronovi; as part of a booking, gastronovi also processes the data you have entered (e.g. name, contact details, date, time and number of people).

Processing is carried out on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG. Consent may be withdrawn at any time with future effect. Insofar as the booking serves to initiate or fulfil a contract, the processing is also carried out on the basis of Article 6(1)(b) of the GDPR.

Further information can be found in gastronovi’s privacy policy: https://www.gastronovi.com/datenschutz/.

Data processing on behalf of a controller

We have entered into a data processing agreement (DPA) for the use of the aforementioned service. This is a contract required under data protection law, which ensures that the service provider processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

Proposales (enquiry form)

We use the Proposales service for enquiries regarding conferences, celebrations and events. The provider is Proposales AB, Torsgatan 26, 113 21 Stockholm, Sweden (hereinafter ‘Proposales’).

On pages containing an enquiry form, a script is loaded from a Proposales server when the page is accessed. In doing so, your IP address is transmitted to Proposales. The enquiry form itself only opens once you click the relevant button; the data entered there (e.g. name, contact details and information regarding your enquiry) is processed by Proposales on our behalf.

This processing is carried out in the interests of simple and structured handling of event enquiries and constitutes a legitimate interest within the meaning of Article 6(1)(f) of the GDPR. Where consent has been sought, processing takes place exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s device within the meaning of the TDDDG. Consent may be withdrawn at any time. Insofar as your enquiry serves to initiate a contract, processing is additionally carried out on the basis of Article 6(1)(b) of the GDPR.

The provider is based in Sweden; in this respect, no data is transferred to a third country outside the EU.

Data processing on behalf of a client

DialogShift (chatbot)

We use a chatbot on this website through which you can ask us questions. The provider is DialogShift GmbH, Torstraße 201, 10115 Berlin, Germany (hereinafter ‘DialogShift’).

The chat does not load automatically. It is only activated when you actively click on the chat button. No data is transferred to DialogShift beforehand, and no cookies are set. By clicking, you consent to the chatbot being activated. Subsequently, your IP address and technical details about your device are transferred to DialogShift, cookies are set, and the content you enter in the chat is processed.

This processing is carried out on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG. You may withdraw your consent at any time with future effect.

Further information can be found in DialogShift’s privacy policy: https://www.dialogshift.com/data-privacy.