1. Controller

BH Betriebsgesellschaft Heimhude UG (haftungsbeschränkt)

Heimhuder Straße 16 20148 Hamburg Germany

Managing Director: Alexander Garbe

Phone: +49 40 413330 Email: heimhude@stilwerkhotels.com

Data protection contact: datenschutz@stilwerk.de

If you have any questions regarding data protection or wish to exercise your rights, you may contact us at any time at datenschutz@stilwerk.de.

As our company employs fewer than 20 persons involved in automated data processing, there is no legal obligation to appoint a data protection officer (§ 38 BDSG).

2. General Information on Data Processing

We process personal data exclusively in accordance with the applicable legal provisions, in particular the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

Personal data means any information relating to an identified or identifiable natural person.

3. Your RightsYou have the following rights:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent at any time with future effect (Art. 7(3) GDPR)

You also have the right to lodge a complaint with a supervisory authority.

Competent supervisory authority (Hamburg):

The Hamburg Commissioner for Data Protection and Freedom of Information Ludwig-Erhard-Str. 22 20459 Hamburg Germany

Email: mailbox@datenschutz.hamburg.deWebsite: https://datenschutz-hamburg.de

4. Data Collection When Visiting Our Website (Server Log Files)

When accessing our website, information is automatically collected by the hosting provider (so-called server log files), in particular:

• IP address
• Date and time of the request
• Requested page/file
• Amount of data transferred
• Browser type and version
• Operating system
• Referrer URL

This data is technically necessary to provide the website, ensure stability and security, and to trace attacks.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation).

5. Hosting via Wix

Our website is hosted using the website builder Wix.com Ltd., Yunitsman 5, Tel Aviv, Israel.

Wix stores and processes personal data, among others, in data centers within the European Union (e.g. Ireland), in the United States, and in other locations worldwide. Wix also uses a global content delivery network (CDN) and third-party providers such as Amazon Web Services (AWS) and Google Cloud.

Israel is considered a secure third country with an adequacy decision by the European Commission.

Where personal data is transferred to third countries (in particular the USA), this is done on the basis of standard contractual clauses pursuant to Art. 46 GDPR as well as additional safeguards.

The use of Wix is based on our legitimate interest in a secure, fast, and efficient provision of our website (Art. 6(1)(f) GDPR).

Further information: https://de.wix.com/about/privacy

6. Contact (Email, Phone, Contact Form)

If you contact us, we process your data for the purpose of handling your request (e.g. name, contact details, content of the message).

Legal basis: Art. 6(1)(b) GDPR (contract/pre-contractual measures) and Art. 6(1)(f) GDPR (general inquiries).

The data will be deleted as soon as it is no longer required, unless statutory retention obligations apply.

Data Collection via Forms (Wix Forms) If you contact us via a form on our website, the data you enter (e.g. name, email address, message) will be processed to handle your request.

The processing is based on Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in handling inquiries).

The data is processed via Wix.com Ltd., Yunitsman 5, Tel Aviv, Israel. This may involve transfers of personal data to third countries (in particular the USA). Such transfers are based on standard contractual clauses pursuant to Art. 46 GDPR.

Further information: https://de.wix.com/about/privacy

7. Booking System (DIRS21)

For online bookings we use the system DIRS21 of TourOnline AG, Borsigstraße 26, 73249 Wernau, Germany.

Within the booking process, the following data is processed in particular:

• Name
• Contact details
• Booking and stay details (e.g. period, room category)
• Billing data, if applicable

Processing is carried out for the performance of the accommodation contract.

Legal basis: Art. 6(1)(b) GDPR.

We have concluded a data processing agreement with the provider.

Further information: https://www.dirs21.de/datenschutz/

8. Cookies and Consent Management

Our website uses cookies. Cookies are small text files stored on your device.

We use the following types of cookies:

• Strictly necessary cookies: Required for the proper operation of the website (Art. 6(1)(f) or (b) GDPR)
• Analytics and marketing cookies: Only set with your explicit consent (Art. 6(1)(a) GDPR)

Session cookies are automatically deleted when you close your browser. Persistent cookies remain stored on your device until deleted or automatically expire.

You can withdraw your consent at any time via our cookie banner.

9. Web Analytics with Google Analytics

If you have consented via the cookie banner, we use Google Analytics (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland) to analyze and improve the use of our website.

Google Analytics uses cookies/IDs and processes, among others, usage data (e.g. page views, interactions, device/browser information) and typically your IP address. IP anonymization is activated on this website, so your IP address is truncated within the EU/EEA.

Legal basis: Art. 6(1)(a) GDPR (consent).

Recipients/third country transfer: A transfer to third countries (in particular the USA) cannot be excluded. We use Google Analytics only within the framework of the data protection mechanisms provided by Google (e.g. standard contractual clauses and/or adequacy decisions).

Withdrawal: You can withdraw your consent at any time via the cookie settings.

10. Web Analytics via Wix

Our website uses analytics functions provided by Wix.com Ltd., Yunitsman 5, Tel Aviv, Israel.

Data regarding user behavior on our website (e.g. page views, interactions, technical information) may be processed.

Processing is carried out exclusively on the basis of your consent (Art. 6(1)(a) GDPR), provided via the cookie banner.

Data may also be processed on servers in third countries (in particular the USA). Transfers are based on standard contractual clauses pursuant to Art. 46 GDPR.

Further information: https://de.wix.com/about/privacy

11. Newsletter

If you subscribe to our newsletter, we use your email address on the basis of your consent (Art. 6(1)(a) GDPR).

We use the service of Wix.com Ltd., Yunitsman 5, Tel Aviv, Israel, for sending newsletters.

Within the use of Wix, personal data may be processed on servers in the European Union as well as in third countries (in particular the USA). Data transfers are based on standard contractual clauses pursuant to Art. 46 GDPR.

Subscription is carried out using a double opt-in procedure. You can unsubscribe at any time via the link included in every email.

12. Social Media Links (Instagram)

Our website contains links to our profiles on social media platforms (e.g. Instagram).

If you click on such a link, you will be redirected directly to the respective platform.

13. Payment Service Provider (Stripe)

For payment processing we use Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin, Ireland.

Depending on the payment method, personal data may be transferred to Stripe Inc., USA. Such transfers are based on standard contractual clauses pursuant to Art. 46 GDPR.

Processing is carried out for the performance of a contract (Art. 6(1)(b) GDPR).

Further information: https://stripe.com/de/privacy

14. Data Security

We implement appropriate technical and organizational measures to protect your data against loss, manipulation, and unauthorized access.

Our website generally uses SSL or TLS encryption.

15. Data Retention

We store personal data only as long as necessary for the respective purposes or as required by statutory retention obligations.

16. External Links

Our website may contain links to external websites. We have no influence on their content or data protection practices and assume no responsibility for them.

17. Changes to this Privacy Policy

We reserve the right to amend this privacy policy to reflect changes in legal requirements or our services.

Status: April 2026