Privacy Policy

for the ONNO Hotel by Norman

The management of the ONNO Hotel by Norman attaches great importance to the protection of your personal data. We process personal data exclusively in accordance with the General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG) and other applicable data protection regulations.

In principle, it is possible to use our website without providing any personal data. However, if you make use of specific services such as online bookings, contact forms, chat functions, newsletters, Wi-Fi access or payment services, the processing of personal data may be necessary.

1. Data controller

Claas Normann Mäder-Rønnestad
trading under the business name
ONNO Hotel by Norman
Königstraße 42
24768 Rendsburg
Germany

Telephone: +49 4331 58910
Email: info@onnohotel.com
Website: www.onnohotel.com

Data Protection Officer:
Martha Theede
Email: m.theede@conventgarten.de

IT Support:
MS4 IT, Hamburg

2. General information on data processing

We process personal data only to the extent necessary to provide a fully functional website, to process bookings, to handle enquiries or to fulfil legal or contractual obligations.

Legal basis for processing (Article 6(1) of the GDPR):

• a) Consent of the data subject

• b) Performance of a contract or pre-contractual measures

• c) Legal obligation

• f) legitimate interests

3. Cookies & Consent Management

We use the Cookiebot by Usercentrics consent management platform.

Cookies that are not technically necessary, as well as tracking and marketing technologies, are only set once you have given your active consent. When you first visit our website, a cookie banner appears showing the categories ‘Necessary’, ‘Preferences’, ‘Statistics ’ and ‘Marketing’.

You can change or withdraw your consent at any time via the cookie settings (‘Privacy Trigger’). Cookiebot carries out regular automatic scans and keeps the cookie list up to date.

4. Hosting & Server Log Files

When you visit our website, the hosting provider automatically collects the following data:

• IP address

• Date and time of access

• Browser type and version

• Operating system

• Referrer URL

Purpose: technical provision, stability and security
Legal basis: Article 6(1)(f) of the GDPR
Retention period: maximum 14 days

5. Contact forms

When you use our contact forms, we process the data you provide (e.g. name, email address, message).

The transmission is SSL-encrypted.

Purpose: To process your enquiry
Legal basis: Article 6(1)(b) of the GDPR
Data will not be disclosed to third parties without your consent.

6. Bookings & price comparisons (HotelNetSolutions)

For direct bookings and price comparisons, we use HotelNetSolutions GmbH, Berlin.

Data processed:
Name, address, contact details, travel dates, payment information

Purpose: To process bookings and price comparisons
Legal basis: Article 6(1)(b) of the GDPR

Data is transferred to our hotel management system (MEWS) and to payment service providers solely for the purpose of contract fulfilment.

7. Hotel management system (MEWS)

We use MEWS Systems B.V., Netherlands, to manage bookings and stays.

Data: Guest details, stay and billing details, payment status
Purpose: Contract fulfilment and guest communication
Legal basis: Article 6(1)(b) of the GDPR

8. Payment processing

a) Stripe

Payment provider: Stripe Payments Europe Ltd., Ireland

Data: Name, payment details, billing address, IP address
Purpose: Payment processing
Legal basis: Article 6(1)(b) of the GDPR

Data transfers to the USA are carried out on the basis of the Standard Contractual Clauses (SCCs).

b) Klarna

Provider: Klarna Bank AB (publ), Sweden

Data may be transferred to credit reference agencies (including SCHUFA and Creditreform) for creditworthiness and fraud checks.

Legal basis: Article 6(1)(b) and (f) of the GDPR
Alternative payment methods without a credit check are available.

c) PayPal

Provider: PayPal (Europe) S.à r.l. et Cie, Luxembourg

Purpose: Payment processing
Legal basis: Article 6(1)(b) of the GDPR

9. Newsletters

Newsletters are sent via Mailchimp (Intuit Inc., USA) and Microsoft Outlook.

Data: Name, email address
Legal basis: Article 6(1)(a) of the GDPR

Newsletters are sent exclusively on a double opt-in basis. You may withdraw your consent at any time via the unsubscribe link. Data transfers to the USA are carried out on the basis of the SCCs.

10. Chatbot (DialogShift)

We use the chatbot provided by DialogShift GmbH, Berlin, to communicate with guests.

Data: Chat content, name (where applicable), email address, IP address
Legal basis: Article 6(1)(b) and (f) of the GDPR

11. Wi-Fi use in the hotel

When using our guest Wi-Fi, connection data (IP address, device identifier, MAC address, time) is processed.

Retention period: maximum 7 days
Legal basis: Article 6(1)(f) of the GDPR

12. Web analytics & marketing

Google Analytics 4

Provider: Google Ireland Ltd.
IP anonymisation is enabled.

Legal basis: Article 6(1)(a) of the GDPR (consent)

Google Ads

Purpose: To measure the effectiveness of advertising campaigns
Legal basis: Article 6(1)(a) of the GDPR

13. WordPress plugins used

• GTranslate

• AMP (Google AMP Cache)

• Site Kit by Google

• OMGF (local hosting of Google Fonts)

14. CCTV in the hotel

We use CCTV in public areas.

Purpose: Protection of guests, staff and property
Retention period: max. 48 hours
Legal basis: Article 6(1)(f) of the GDPR

Surveillance is clearly signposted on site.

15. Rights of data subjects

You have the right to access, rectification, erasure, restriction of processing, data portability, objection and withdrawal of consent. You also have the right to lodge a complaint with the relevant supervisory authority.

16. Retention period

Personal data will only be stored for as long as is necessary to fulfil the purpose for which it was collected or in accordance with statutory retention obligations.

17. Changes to this Privacy Policy

We reserve the right to amend this privacy policy in the event of legal or technical changes.

18. Cookie Policy

The current overview of all cookies and services used is automatically provided and updated by Cookiebot.