Privacy Policy

Controller

The controller responsible for the processing of personal data on this website is:

MW HOTELS GmbH
Managing Director: Michael Wagner
Stühlingerstraße 21
79106 Freiburg im Breisgau

Phone: +49 761 600 466 0
Email: office@mw-hotels.de

Data Protection Officer

You can reach our data protection officer at:

Freiburger Datenschutzgesellschaft mbH
Rechtsanwalt Jörg M. Leuchtner
Luisenstraße 5
79098 Freiburg im Breisgau

Email: info (at) freiburger-datenschutzgesellschaft.de
Website: https://freiburger-datenschutzgesellschaft.de

General information on data processing

Protecting your personal data is important to us. We process personal data exclusively within the scope of the statutory provisions, in particular the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Digital Services Act (DDG).

Personal data is any information relating to an identified or identifiable natural person.

Hosting and server log files

When you visit our website, the hosting provider automatically collects and stores information in so-called server log files.

The data collected includes in particular:

IP address
Date and time of access
Browser type and browser version
Operating system used
Referrer URL
Host name of the accessing computer
Volume of data transferred

This data is processed to ensure the technical operation and security of our systems and to optimise our website.

The legal basis is Art. 6 para. 1 lit. f GDPR.

Our website uses cookies and comparable technologies.

Technically necessary cookies ensure the secure and error-free operation of the website. In addition – provided you have given your consent – analysis and convenience functions are used.

When you first visit our website, you can use the consent banner to choose which cookies and services may be activated.

Processing is based on:

Art. 6 para. 1 lit. a GDPR (consent)
§ 25 para. 1 TDDDG
Art. 6 para. 1 lit. f GDPR for technically necessary cookies

You can withdraw your consent at any time with effect for the future.

You can also use our website without cookies. To do so, please change the relevant settings in your browser; its help function explains how to deactivate cookies. Please note, however, that this may impair some functions of this website and reduce ease of use.

Contact

If you contact us by email or via a contact form, we process the data you provide in order to handle your enquiry.

Processing is based on Art. 6 para. 1 lit. b GDPR and Art. 6 para. 1 lit. f GDPR.

The data is deleted as soon as it is no longer required to process your enquiry and no statutory retention obligations apply.

Applications

If you send us application documents, we process your personal data exclusively for the purpose of conducting the application procedure.

The legal basis is § 26 BDSG and Art. 6 para. 1 lit. b GDPR.

If no employment relationship is established, the data is generally deleted no later than six months after completion of the application procedure, unless statutory retention obligations or legitimate interests require otherwise.

Google Analytics

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics uses cookies that enable an analysis of how the website is used.

Processing takes place exclusively on the basis of your consent pursuant to Art. 6 para. 1 lit. a GDPR.

We have activated IP anonymisation. Your IP address is truncated by Google within the European Union or the European Economic Area before transmission.

It cannot be ruled out that data is transferred to servers of Google LLC in the USA. Google uses standard contractual clauses pursuant to Art. 46 GDPR.

You can withdraw your consent at any time via the cookie settings.

Further information:
https://policies.google.com/privacy

Online booking via DIRS21

Our website features an online booking mask from the provider DIRS21 by TourOnline AG.

The provider is:

TourOnline AG
Borsigstraße 26
73249 Wernau

When you use the booking function, personal data is processed and transmitted to DIRS21 for the purpose of handling your booking.

Processing is carried out to implement pre-contractual measures and to fulfil the contract pursuant to Art. 6 para. 1 lit. b GDPR.

Further information:
https://www.dirs21.de/datenschutz/

Payment processing

We use the payment service provider First Cash Solution GmbH to process payments.

As part of payment processing, the personal data required for this purpose is transmitted to the payment service provider.

Processing is based on Art. 6 para. 1 lit. b GDPR.

Further information:
https://www.firstcashsolution.de/datenschutz/

Security deposit for rentals

To secure any claims arising from the rental relationship (for example in the event of damage or heavy soiling), we retain your credit card or passport details as a deposit upon arrival. This data is processed exclusively for this purpose and is irrevocably deleted on the day of your departure.

The legal basis is Art. 6 para. 1 lit. b GDPR and Art. 6 para. 1 lit. f GDPR.

Video Surveillance at the Mozartstraße 1 Site, Freiburg

At our site at Mozartstraße 1 in Freiburg, we use video surveillance in narrowly defined entrance and access areas.

The controller responsible for the video surveillance is:

MW HOTELS GmbH
Stühlingerstraße 21
79106 Freiburg im Breisgau

Phone: +49 761 600 466 0
Email: office@mw-hotels.de

You can reach our data protection officer at:

Freiburger Datenschutzgesellschaft mbH
Rechtsanwalt Jörg M. Leuchtner
Luisenstraße 5
79098 Freiburg im Breisgau

Email: info (at) freiburger-datenschutzgesellschaft.de
Website: https://freiburger-datenschutzgesellschaft.de

Scope of the video surveillance

The video surveillance is limited to two narrowly defined areas:

Outer entrance area: this covers the immediate access to the building, including the area around the access terminal where a PIN or apartment key card is used to open the entrance door.
Inner entrance area: this covers the immediate area behind the main entrance, including the area around the check-in machine.

Apartment doors and areas from which movements to individual apartments or the presence of individual guests could be inferred are not intended to be covered.

Areas that are not required are excluded as far as possible through camera positioning or technical masking.

There is no audio recording. No facial recognition, biometric identification, behavioural analysis, automatic number plate recognition, people counting or other AI-based evaluation procedures are used.

Purposes of processing

The video surveillance is carried out exclusively for the following purposes:

Protection of guests and employees
Protection of property
Exercising and enforcing the right to control access to the premises
Preventing and investigating specific unauthorised access
Investigating specific security and access incidents
Securing evidence following an incident that has actually occurred

The video surveillance is not used for the general observation of the behaviour of guests or employees, nor for monitoring the performance or conduct of employees.

In particular, it is not used to categorise individuals by gender, clothing, origin, nationality, skin colour, appearance, or suspected sexual or commercial activity.

Legal basis and legitimate interests

The legal basis for the video surveillance is Art. 6 para. 1 lit. f GDPR.

Our legitimate interests lie in protecting guests, employees and property, in exercising our right to control access to the premises, and in preventing and investigating documented unauthorised access and other specific security incidents.

Specific security- and usage-related incidents have been documented at this site in the past. The video surveillance is spatially limited to the immediate entrance areas and supplements existing organisational and technical access and control measures.

Live view and recording

The cameras can transmit live images.

Where the recording function is activated following completion of the relevant data protection and technical approval, the image data is recorded automatically.

Routine or unprompted review of the recordings does not take place.

As a rule, recordings are only viewed in response to a specific, documented occasion.

Storage period

Where the recording function is activated, recordings are generally automatically deleted or overwritten no later than 48 hours after they are made, unless a specific incident becomes known within this period that requires individual sequences to be preserved.

The retention period of up to 48 hours takes into account, in particular, that incidents may only become known on the following day, or after complaints are received or evaluated with a delay.

If a specific incident becomes known within the regular storage period, only the sequence required for that matter may be separately preserved.

Any such copy of an incident is deleted as soon as it is no longer required for the relevant purpose and no statutory retention, legal prosecution or legal defence grounds continue to apply.

There is no general retention of data for the purposes of the police or other authorities.

Access authorisation

Access to live images and stored recordings is restricted to specifically authorised persons.

At present, within MW HOTELS GmbH, only the technical management is generally authorised to view the recordings.

Access, preservation and disclosures are documented.

Recipients and disclosure

Video recordings are not disclosed as a matter of routine.

In the event of a specific incident, the required sequences may be disclosed in particular to the following recipients, provided a legal basis exists in the individual case:

Police and other law enforcement authorities
Public prosecutors’ offices and courts
Insurers
Lawyers instructed by us
Other bodies, insofar as a statutory obligation to disclose the data exists

The legal basis for the original video recording and the legal basis for any subsequent disclosure are each assessed separately.

Processing on our behalf and cloud storage

Where an external cloud or system provider is used for storing or technically providing the recordings, that provider is engaged in accordance with Art. 28 GDPR.

Before commissioning, we review in particular the server location, any sub-processors, technical and organisational measures, and any transfers to third countries.

Where personal data is processed outside the European Union or the European Economic Area, this only takes place in compliance with the requirements of Art. 44 et seq. GDPR.

Technical and organisational protective measures

Suitable technical and organisational measures are used, in particular, to protect the video recordings. These include, to the extent technically available and required:

Role-based access rights
Individual user accounts
Multi-factor authentication
Encrypted data transmission
Encrypted storage
Logging of access and exports
Automatic deletion
Technical limitation or masking of image areas that are not required
Deactivation of audio and analysis functions
Regular review of access authorisations

Your rights in connection with the video surveillance

Subject to the statutory requirements, data subjects have in particular the following rights:

When submitting a request for access, you may be required to state the approximate time of your presence in the monitored area and to prove your identity in a suitable manner.

Where other individuals are identifiable in a recording, their rights and freedoms are taken into account. This may, in particular, make it necessary to redact, pixelate or otherwise restrict the recording that is provided.

Right to object

Where processing is based on Art. 6 para. 1 lit. f GDPR, you have the right, pursuant to Art. 21 GDPR, to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you.

We will then no longer process the personal data concerned, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data.

The competent authority for MW HOTELS GmbH is in particular:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg

Website: https://www.baden-wuerttemberg.datenschutz.de/

Your rights

You have the following rights regarding the personal data concerning you:

Right of access pursuant to Art. 15 GDPR
Right to rectification pursuant to Art. 16 GDPR
Right to erasure pursuant to Art. 17 GDPR
Right to restriction of processing pursuant to Art. 18 GDPR
Right to data portability pursuant to Art. 20 GDPR
Right to object pursuant to Art. 21 GDPR
Right to withdraw consent given, pursuant to Art. 7 para. 3 GDPR

Right to lodge a complaint with the supervisory authority