Privacy Policy

Data protection is a special concern for Salvia Hotels GmbH. Our efforts to meet the requirements of the European General Data Protection Regulation (GDPR) and the Federal Data Protection Act in its new version are primarily aimed at respecting your privacy and personal sphere.

For modern companies like Salvia Hotels GmbH, the use of electronic data processing systems (EDP) is essential. We ensure the highest level of compliance with legal regulations.

The use of the websites of Salvia Hotels GmbH is generally possible without providing any personal data. However, if a data subject wishes to use special services from our company through our website, it may be necessary to process personal data. If the processing of personal data is required and there is no legal basis for such processing, we will generally obtain consent from the data subject. We will not sell or rent your personal information to third parties for their marketing or other purposes under any circumstances. If you do not agree with the provisions of the privacy policy, please do not send us any personal data.

1. General / Definitions

   This privacy policy is based on terms from the GDPR and aims to be easily readable and understandable for everyone. Therefore, we would like to explain various terms in advance:

   1. Personal Data

      Personal data is any information relating to an identified or identifiable natural person (hereinafter referred to as “data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

   2. Data Subject

      The data subject is any identified or identifiable natural person whose personal data is processed by the data controller.

   3. Processing

      Processing is any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, deletion, or destruction.

   4. Restriction of Processing

      Restriction of processing is the marking of stored personal data with the aim of limiting their future processing.

   5. Profiling

      Profiling is any form of automated processing of personal data that involves using personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning work performance, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements of that natural person.

   6. Pseudonymization

      Pseudonymization is the processing of personal data in such a way that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures that ensure that the personal data is not assigned to an identified or identifiable natural person.

   7. Controller

      The controller is the natural or legal person, authority, agency, or other body that alone or jointly with others determines the purposes and means of processing personal data. Where the purposes and means of such processing are determined by Union law or the law of the Member States, the controller or the specific criteria for its designation may be provided for by Union law or the law of the Member States.

   8. Processor

      A processor is a natural or legal person, authority, agency, or other body that processes personal data on behalf of the controller.

   9. Recipient

      A recipient is a natural or legal person, authority, agency, or other body to whom personal data are disclosed, regardless of whether they are a third party or not. However, authorities that may receive personal data in the course of a specific investigation under Union law or the law of the Member States are not considered recipients.

   10. Third Party

       A third party is a natural or legal person, authority, agency, or other body other than the data subject, the controller, the processor, and the persons who, under the direct authority of the controller or the processor, are authorized to process the personal data.

   11. Consent

       Consent is any freely given, specific, informed, and unambiguous indication of the data subject’s wishes, by which they signify agreement to the processing of personal data relating to them, by means of a statement or a clear affirmative action.

2. Information on the Collection of Personal Data

   Below, we inform you about the collection of personal data when using our website. Personal data are all data that relate to you personally, such as your name, address, email addresses, user behavior, etc.

   1. The controller according to Article 4 (7) of the EU General Data Protection Regulation (GDPR) is
      Salvia Hotels GmbH, represented by the managing director
      Marc Reiner
      Seewiesenstraße 18
      73054 Eislingen
      Tel: +49 7161 94500-200
      E-Mail: m.reiner@salvia-hotels.de
      Website: www.portofino-eislingen.de

   2. Our data protection officer is:
      Mr. Attorney Sascha Weller, IDR – Institute for Data Protection Law
      Ziegelbräustraße 7
      85049 Ingolstadt
      Tel.: +49 841 88516715
      E-Mail: ra-weller@idr-datenschutz.de
      Web: www.idr-datenschutz.de

   3. When you contact us by email or via a contact form, the data you provide (your email address, possibly your name, and your phone number) will be automatically stored by us to answer your inquiries. Such personal data transmitted voluntarily by a data subject to the controller will be stored exclusively for the purposes of processing or contacting the data subject. We will delete the data collected in this context once the storage is no longer necessary, or restrict the processing if there are legal retention obligations.

   4. If we use commissioned service providers for individual functions of our offering or would like to use your data for advertising purposes, we will inform you in detail about the respective processes below. We will also specify the criteria for the duration of storage.

   5. As the controller, we have implemented numerous technical and organizational measures to ensure the most complete protection of personal data processed through this website. Nevertheless, internet-based data transmissions can generally have security vulnerabilities, so absolute protection cannot be guaranteed. For this reason, it is at the discretion of each data subject to transmit personal data to us via alternative means, such as by telephone.

   6. As a responsible company, we refrain from automated decision-making or profiling.

3. Your Rights

   You have the following rights regarding your personal data:

   • Right to Access

     Any person affected by the processing of personal data has the right, granted by the GDPR, to obtain from the controller free information about the personal data concerning them and a copy of this information at any time. Furthermore, the European legislator has granted the data subject the right to be informed about the following information:

     • the purposes of the processing

     • the categories of personal data that are being processed

     • the recipients or categories of recipients to whom the personal data have been or will be disclosed, especially recipients in third countries or international organizations

     • if possible, the planned duration for which the personal data will be stored, or, if that is not possible, the criteria used to determine that duration

     • the existence of the right to rectification or deletion of the personal data concerning them or to the restriction of processing by the controller or a right to object to such processing

     • the existence of a right to lodge a complaint with a supervisory authority

     • if the personal data is not collected from the data subject: all available information about the source of the data

     • The existence of automated decision-making, including profiling, in accordance with Article 22(1) and (4) GDPR, and—at least in these cases—meaningful information about the logic involved as well as the significance and the intended consequences of such processing for the data subject. In addition, the data subject has the right to know whether personal data has been transferred to a third country or to an international organization. If this is the case, the data subject also has the right to obtain information about the appropriate safeguards relating to the transfer.
       
       If a data subject wishes to exercise this right to access, they may contact any employee of the controller at any time.

     • Right to Withdraw Consent:
       Any person affected by the processing of personal data has the right to withdraw their consent to the processing of personal data at any time. If a data subject wishes to exercise this right to withdraw consent, they may contact any employee of the controller at any time and through any means of communication.

     • Right to Rectification:

       The data subject has the right to request from the controller the rectification of inaccurate personal data concerning them without undue delay. Taking into account the purposes of the processing, the data subject has the right to request the completion of incomplete personal data—also by means of a supplementary statement. If a data subject wishes to exercise this right, they may contact any employee of the controller at any time.

     • Right to Deletion / Right to Be Forgotten:

       The data subject has the right to request from the controller the immediate deletion of personal data concerning them, and the controller is obliged to delete personal data immediately if one of the following reasons applies:

       • The personal data are no longer necessary for the purposes for which they were collected or otherwise processed.

       • The data subject withdraws their consent on which the processing is based according to Article 6(1)(a) or Article 9(2)(a), and there is no other legal basis for the processing.

       • The data subject objects to the processing according to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing according to Article 21(2).

       • The personal data have been unlawfully processed.

       • The deletion of personal data is necessary to fulfill a legal obligation under Union law or the law of the Member States to which the controller is subject.

       • The personal data were collected in relation to services offered by the information society according to Article 8(1). If a data subject wishes to exercise this right to deletion / right to be forgotten, they may contact any employee of the controller at any time. If we have made the personal data public and are obliged to delete it under Article 17(1) GDPR, we will take reasonable measures, including technical measures, to inform controllers that process the personal data that a data subject has requested the deletion of all links to this personal data or copies or replications of this personal data. Our employees will take the necessary steps.

     • Right to Restriction of Processing:

       The data subject has the right to request the restriction of processing from the controller if one of the following conditions is met:

       • The accuracy of the personal data is contested by the data subject for a duration that allows the controller to verify the accuracy of the personal data.

       • The processing is unlawful, and the data subject refuses the deletion of the personal data and instead requests the restriction of the use of the personal data.

       • The controller no longer needs the personal data for the purposes of processing.

       • The data subject needs the personal data for the establishment, exercise, or defense of legal claims, or the data subject has objected to the processing according to Article 21(1) while it is still unclear whether the legitimate grounds of the controller override those of the data subject. If a data subject wishes to exercise this right to restrict processing, they may contact any employee of the controller at any time.

     • Right to Object to Processing:

       • Every person affected by the processing of personal data has the right granted by the GDPR to object at any time to the processing of personal data concerning them, based on grounds relating to their particular situation, which is carried out pursuant to Article 6(1)(e) or (f) of the GDPR. This also applies to profiling based on these provisions.

       • We will no longer process personal data in the event of an objection unless we can demonstrate compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the data subject, or the processing serves the establishment, exercise, or defense of legal claims.

       • If we process personal data for the purpose of direct marketing, the data subject has the right to object at any time to the processing of personal data for the purposes of such advertising. This also applies to profiling to the extent that it is related to such direct marketing. If the data subject objects to the processing for direct marketing purposes, we will no longer process the personal data for these purposes.

       • Furthermore, the data subject has the right to object, on grounds relating to their particular situation, to the processing of personal data concerning them that is carried out for scientific or historical research purposes or for statistical purposes in accordance with Article 89(1) of the GDPR, unless such processing is necessary for the performance of a task carried out in the public interest.

       • To exercise the right to object, the data subject may contact any employee directly. The data subject is also free to exercise their right to object in connection with the use of information society services, regardless of Directive 2002/58/EC, through automated means that use technical specifications.

     • Right to Data Portability: The data subject has the right to receive the personal data concerning them, which they have provided to a controller, in a structured, commonly used, and machine-readable format, and they have the right to transmit those data to another controller without hindrance from the controller to whom the personal data has been provided, provided that

       • the processing is based on consent according to Article 6(1)(a) or Article 9(2)(a) or on a contract according to Article 6(1)(b) and

       • the processing is carried out by automated means. In exercising their right to data portability according to Article 20(1) of the GDPR, the data subject has the right to obtain the direct transfer of personal data from one controller to another, where technically feasible and without adversely affecting the rights and freedoms of other persons. If a data subject wishes to exercise their right to data portability, they can contact an employee of the controller at any time.

     • Automated Decision-Making in Individual Cases Including Profiling: Every data subject has the right granted by the GDPR not to be subjected to a decision based solely on automated processing—including profiling—that produces legal effects concerning them or similarly significantly affects them, unless the decision

       • is necessary for entering into or performance of a contract between the data subject and the controller, or

       • is authorized by Union or Member State law to which the controller is subject and that law provides for suitable measures to safeguard the rights and freedoms as well as the legitimate interests of the data subject, or

       • is based on the explicit consent of the data subject.

       If the decision is necessary for entering into or performance of a contract between the data subject and the controller or is based on the explicit consent of the data subject, we will implement appropriate measures to safeguard the rights and freedoms as well as the legitimate interests of the data subject, which include at least the right to obtain human intervention on the part of the controller, to express their own point of view, and to contest the decision.

       If a data subject wishes to assert rights regarding automated decisions, they can contact an employee of the controller at any time.

       They also have the right to lodge a complaint with a supervisory authority regarding the processing of their personal data by us. The supervisory authority responsible for our company is:

       Bavarian State Office for Data Protection Supervision
       Promenade 27
       91522 Ansbach
       Tel.: +49 981 531300
       E-Mail: poststelle@lda.bayern.de

   • Collection of Personal Data When Visiting Our Website / Cookies

     1. When you use our website merely for informational purposes, meaning that you do not register or otherwise transmit information to us, we only collect the personal data that your browser transmits to our server. If you wish to view our website, we collect the following data, which is technically necessary for us to display our website and ensure stability and security (the legal basis is Article 6(1)(1)(f) GDPR):

        • IP address
        • Date and time of the request
        • Time zone difference to Greenwich Mean Time (GMT)
        • Internet service provider of the accessing system
        • Content of the request (specific page)
        • Access status/HTTP status code
        • Volume of data transmitted
        • Website from which the request originates (referrer)
        • Browser
        • Operating system and its interface
        • Language and version of the browser software.

     2. In addition to the data mentioned above, cookies are stored on your computer when you use our website. Cookies are small text files that are stored on your hard drive and associated with the browser you are using, through which certain information flows to the entity that sets the cookie (in this case, us). Cookies cannot execute programs or transmit viruses to your computer. They serve to make the overall internet offering more user-friendly and effective.

   • Use of Cookies:

     1. This website uses the following types of cookies, which are explained in detail below:

        • Transient Cookies (see b)
        • Persistent Cookies (see c)
        • Flash Cookies (see f)

     2. Transient cookies are automatically deleted when you close your browser. This particularly includes session cookies. These store a so-called session ID, with which various requests from your browser can be assigned to the same session. This allows your computer to be recognized when you return to our website. The session cookies are deleted when you log out or close the browser.

     3. Persistent cookies are automatically deleted after a predefined period, which may vary depending on the cookie. You can delete the cookies at any time in the security settings of your browser.

     4. You can configure your browser settings according to your preferences and, for example, reject the acceptance of third-party cookies or all cookies. We would like to point out that you may not be able to use all the features of this website.

     5. We use cookies to identify you for subsequent visits if you have an account with us. Otherwise, you would have to log in again for each visit.

     6. The Flash cookies used are not captured by your browser but by your Flash plug-in.