Data protection

Privacy Policy and Cookie Policy

BB Gastgeber GmbH, headquartered at Fischerstraße 19, 87435 Kempten (hereinafter referred to as BergBuddies), is committed to protecting the online privacy of its users. This document has been prepared in accordance with Article 13 of EU Regulation 2016/679 (hereinafter referred to as the "Regulation") to help you become familiar with our privacy policy and understand how your personal information is processed when using our website and, where applicable, to enable you to provide your explicit and informed consent to the processing of your personal data (valid only for persons aged at least 16 years). The information and data you provide or that we otherwise collect while you use our services on the website (hereinafter referred to as the "Services") will be processed in accordance with the provisions of the Regulation and the confidentiality obligations governing the activities of the Data Controller.

In accordance with the provisions of the Regulation, the processing carried out by BergBuddies is based on the principles of lawfulness, fairness, transparency, purpose limitation, storage limitation, data minimisation, accuracy, integrity and confidentiality.

TABLE OF CONTENTS

  1. The Data Controller
  2. Personal Data Subject to Processing
    1. Browsing Data
    2. Special Categories of Personal Data
    3. Data Voluntarily Provided
    4. Cookies
  3. Purpose of Processing
  4. Legal Basis and Mandatory or Optional Nature of Processing
  5. Recipients of Personal Data
  6. Disclosure of Personal Data
  7. Storage of Personal Data
  8. Rights of Data Subjects
  9. Lerch Genussclub
  10. Newsletter (SmartHost)
  11. Online Bookings (Hotel Net Solutions)
  12. Voucher Shop (Incert)
  13. Applications (Softgarden)
  14. Consent Management (Usercentrics)
  15. Changes

The Data Controller responsible for the processing carried out via this website is Panoramahotel Oberjoch GmbH, as specified above. For information regarding the processing of personal data by the Data Controller, including the list of data processors appointed to process the data, please contact us at: info@bergbuddies.de

  1. Personal Data Subject to Processing

We hereby inform you that, as a result of your use of this website, the Data Controller may process personal data consisting of identifiers such as your name, identification number, online identifier, postal address, email address, telephone number (landline and/or mobile), or one or more elements relating to your physical, physiological, mental, economic, cultural or social identity, which may identify or make you identifiable (hereinafter referred to as "Personal Data").

The personal data processed through the website includes the following:

  1. Browsing Data

The computer systems and software procedures used to operate the website collect certain personal data during their normal operation, the transmission of which is implicit in the use of Internet communication protocols. This information is not collected in order to be associated with identified individuals; however, by its very nature, through processing and association with data held by third parties, it could allow users to be identified. This category of data includes IP addresses or domain names of the computers used by users connecting to the website, the URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the server's response (successful, error, etc.), and other parameters relating to the user's operating system and IT environment. This data is used solely to obtain anonymous statistical information about the use of the website, to ensure its correct functioning, and to detect anomalies and/or misuse. It is deleted immediately after processing. The data may be used to establish liability in the event of hypothetical cybercrimes committed against the website or third parties. Apart from this possibility, the data collected through the website is deleted after a short period of time.

  1. Special Categories of Personal Data

If you use our website to submit an application (or send it to us by email), this may involve the transfer of your personal data, including special categories of personal data pursuant to Article 9 of the Regulation, namely "[...] personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as [...] genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person's sex life or sexual orientation." Please do not disclose such data unless it is strictly necessary. We expressly point out that the Data Controller cannot be held responsible in any way for the transmission of special categories of personal data in the absence of your explicit consent to the processing of such data (you are, of course, permitted to submit your CV), nor can any claims be made against the Data Controller, since in this case the processing is permitted because it concerns data that has manifestly been made public by the data subject, in accordance with Article 9(1)(e) of the Regulation. However, we would like to remind you that, as mentioned above, it is important to provide your explicit consent to the processing of special categories of personal data if you choose to submit such information.

We also inform you that, for the purpose of evaluating applicants, the Data Controller may analyse publicly accessible professional social media profiles available on the Internet (e.g. LinkedIn).

  1. Data Voluntarily Provided by the Data Subject

If you use certain services on the website (e.g. the enquiry, contact or reservation form), we may process personal data of third parties that you submit to the Data Controller. In such cases, you act as the Data Controller with regard to such personal data and assume all legal obligations and liabilities. Accordingly, you agree to fully indemnify and hold us harmless against any claims, demands, damages or liabilities arising from the processing of personal data of third parties submitted through the website in violation of the applicable data protection laws. Whenever you provide or otherwise process personal data of third parties while using the website, you guarantee that such processing is based on an appropriate legal basis in accordance with Article 6 of the Regulation, thereby legitimising the processing of the relevant information.

To optimise the user experience on our website, we use software provided by THE HOTELS NETWORK (https://www.thehotelsnetwork.com, Muntaner 262, 3º, 08021 Barcelona, Spain). This software enables us to analyse user behaviour in an anonymised manner in order to better understand how users interact with our website and to provide a more relevant user experience. To achieve this, The Hotels Network generates a backend hash using website user data. As all analyses and processing are carried out exclusively on an anonymised basis, it is impossible to personally identify the user.

  1. Cookies

General Information about Cookies

Cookies are small text files that are stored on the hard drive of a user's computer by a website through the browser in order to save small amounts of information for a certain period of time. There are various types of cookies. Some are essential for the proper functioning of the website, such as navigation or shopping cart cookies. There are also so-called analytics cookies, which collect information such as the number of website visitors and the paths they take through the website. Functional cookies enable the website to remember choices you have made (e.g. selected filter settings or the automatic language selection of a website).

In addition, there are so-called profiling cookies, which record user preferences and actions. Based on this information, a user profile is created. This makes it possible to match advertising messages to users' interests, enabling more targeted advertising. In many cases, these are third-party cookies used by the website operator to display personalised advertising.

Cookie Consent Requirement

Website visitors must actively consent to the use of cookies that are not essential for the functionality of the website. They also have the right to withdraw their consent at any time.

This website uses the Usercentrics Consent Management Platform to manage and document your cookie consent. When you visit the website, a banner appears informing you about the use of cookies, offering various consent options (accept all cookies, individual categories of cookies, or each individual cookie separately), and providing detailed information about the different cookies. The CMP stores the website user's selected preferences and automatically applies them during future visits. Website visitors can also withdraw their consent or change their settings at any time.

Blocking Cookies via Browser Settings

Firefox:

  1. Click on the menu and select Settings.
  2. Go to the Privacy tab.
  3. Under "History", select "Use custom settings for history" from the "Firefox will:" dropdown.
  4. In the options displayed, uncheck "Accept cookies".
  5. Click the "OK" button.

Detailed information is available at: https://support.mozilla.org/de/kb/Cookies-blockieren

Google Chrome

  1. Click on the menu and select Settings.
  2. Scroll to the bottom and click "Show advanced settings".
  3. Under "Privacy", click "Content settings...".
  4. Under Cookies, select "Block sites from setting any data".
  5. Click the "Done" button.

Detailed information is available at: https://support.google.com/chrome/answer/95647?hl=de

Internet Explorer

  1. Open "Internet Options" from the "Tools" menu or, if the menu bar is hidden, click the menu icon and select "Internet Options".
  2. Click the "Privacy" tab.
  3. Use the slider to choose the desired level of cookie handling. At the highest setting all cookies are blocked; at the lowest setting all cookies are accepted.
  4. Click the "OK" button.

Detailed information is available at: https://windows.microsoft.com/de-de/windows7/block-enable-or-allow-cookies

Safari

  1. Open "Privacy" in the Settings.
  2. Under "Accept Cookies", you can specify whether and when Safari should store cookies from websites. For more information, click the Help button (marked with a question mark).

Detailed information is available at: https://support.apple.com/kb/PH5042?locale=en_US

  1. Purpose of Processing

The processing that we carry out (where necessary) with your explicit consent serves the following purposes:

  1. To provide the services you have requested.
  2. To respond to customer service requests, information requests, or reservations.
  3. To analyse CVs and contact applicants who have submitted an application.
  4. To fulfil all legal, accounting, and tax obligations.
  5. Marketing purposes: Subject to your prior explicit and specific consent, the data provided may be processed for the purpose of sending advertising and marketing communications, including newsletters and market research surveys, using automated systems (SMS, MMS, email, push notifications) and non-automated systems (postal mail, call centres). The legal basis for processing your data for these purposes is Article 6(1)(a) of the Regulation. Consent to direct marketing is voluntary and entirely at your discretion. Refusing to provide consent for this purpose will not affect your ability to use our services.
  6. To enable and process guest bookings; to manage the guest's stay; to tailor the stay to the guest's wishes and interests; to offer future services based on the guest's interests; and to market and continuously improve the hotel's services.
  1. Legal Basis and Mandatory or Optional Nature of Processing

The legal basis for the processing of personal data for the purposes specified in Section 3 (a–c) is Article 6(1)(b) of the Regulation (performance of a contract), as the processing is necessary for the provision of the requested services or for responding to requests made by the data subject. Providing personal data for these purposes is voluntary; however, failure to do so will make it impossible to provide the services offered through the website, process requests, or evaluate applications. With specific reference to the purpose described in Section 3.c and the related analysis of professional social media profiles that are publicly accessible on the Internet pursuant to Section 2.b, the legal basis for processing is Article 6(1)(f) of the Regulation, namely the legitimate interest of the Data Controller in assessing potential risks regarding the applicant's suitability for the specific position.


The purpose described in Section 3.d constitutes lawful processing of personal data pursuant to Article 6(1)(c) of the Regulation (compliance with a legal obligation). Once personal data has been provided, processing is necessary in order to comply with a legal obligation to which the Data Controller is subject.



The legal basis for the processing described in Section 3.e is Article 6(1)(a) of the Regulation (consent of the user). Without requiring your consent, the Data Controller may also process your email address and postal address for the purposes of sending direct marketing material, direct sales, market research or commercial communications relating to products or services of the Data Controller that are similar to those already purchased, in accordance with and within the limits permitted by Article 130(4) of the Italian Privacy Code and the decision of the Italian Data Protection Authority dated 19 June 2008. The legal basis for this processing is Article 6(1)(f) of the Regulation (legitimate interest).

  1. Recipients of Personal Data

Your personal data may be disclosed for the purposes described in Section 3 to:

  1. Entities that typically act as data processors, namely: i) individuals, companies or professional firms providing the Data Controller with accounting, administrative, legal, tax, financial, debt collection, marketing and communication support and consultancy in connection with the provision of the Services; ii) entities whose cooperation is necessary for the provision of the Services (e.g. hosting providers); iii) entities responsible for technical maintenance activities (including maintenance of network devices and electronic communication networks) (collectively referred to as "Recipients");
  2. Entities, public authorities or institutions to whom your personal data must be disclosed by law or by official order;
  3. Persons authorised by the Data Controller to process personal data that is necessary for carrying out activities relating to the provision of the Services or the other purposes specified in Section 3, and who are bound by confidentiality obligations or an appropriate statutory duty of confidentiality (e.g. employees of the Data Controller).

    Recipients of personal data in connection with the use of our website and the services offered may include, in particular, the following service providers and data processors:
    • Raidboxes GmbH (Website Hosting)
    • Usercentrics GmbH (Consent Management)
    • Google Ireland Limited (Google Analytics)
    • SmartHost GmbH (Newsletter Distribution)
    • HotelNetSolutions GmbH (Online Bookings)
    • Incert eTourismus GmbH & Co KG (Voucher Shop)
    • softgarden e-recruiting gmbh (Applicant Management)
    • GASTROpoint GmbH (KunLeiSys Guest Club)
     
    The transfer of personal data takes place solely for the respective intended purposes and in compliance with the applicable data protection regulations. Where required, data processing agreements pursuant to Article 28 GDPR have been concluded with the respective service providers.
  1. Transfer of Personal Data

Personal data is transferred to service providers and their subcontractors who provide cloud-based software and data processing solutions for the hotel and who analyse and process guest data on behalf of the hotel (for the purposes described above). Some of your personal data may be transferred to recipients located outside the European Economic Area. The Data Controller ensures that the processing of your personal data by such recipients is carried out in compliance with the Regulation. Such transfers may, in particular, be based on an adequacy decision, the standard contractual clauses approved by the European Commission, or another appropriate legal basis. For further information, please contact the Data Controller at: info@bergbuddies.de

  1. Retention of Personal Data

Personal data processed for the purposes specified in Sections 3(a) and 3(b) will be retained only for as long as is strictly necessary to achieve those purposes. As the processing is carried out for the provision of services, the Data Controller will in any case retain the personal data for the period prescribed by Italian law for the protection of its legal interests (Art. 2946 et seq. of the Italian Civil Code). With regard to CVs submitted via the website or by email pursuant to Section 3.c, the personal data will be retained for a period considered appropriate for the purpose for which the data was collected. This is without prejudice to the Data Controller's right to contact the applicant shortly before the expiry of the retention period in order to request an extension of that period.


Personal data processed for the purpose specified in Section 3.d will be retained for the period required by the relevant legal obligation or applicable law.


Personal data processed for the purposes specified in Section 3.e will be retained until the data subject withdraws their consent or, if no withdrawal is made, for a maximum period considered appropriate.

Further information regarding data retention periods and the criteria used to determine them is available from the Data Controller at the following address: info@bergbuddies.de

  1. Rights of the Data Subject

In accordance with Articles 15 et seq. of the Regulation, you have the right at any time to request information from the Data Controller regarding your personal data, to request its rectification or erasure, or to object to its processing. You also have the right to request the restriction of processing in the cases provided for in Article 18 of the Regulation   and, in the cases provided for in Article 20 of the Regulation, to receive your personal data in a structured, commonly used and machine-readable format.

Any request must be submitted in writing to the Data Controller at the following address: info@bergbuddies.de.

You have the right at any time to lodge a complaint with the competent supervisory authority (Data Protection Authority) pursuant to Article 77 of the Regulation if you believe that the processing of your personal data violates applicable data protection law.

  1. Lerch Genussclub

This website uses the KunLeiSys Guest Club software (Lerch Genussclub loyalty programme). The provider is GASTROpoint GmbH, Pommernstraße 17, 83395 Freilassing, Germany. KunLeiSys Guest Club software is a service used to organise and manage the guest club, special offers, loyalty points, occasion-related emails and newsletter distribution.
You can register for the Guest Club on our website. The data you provide during registration is used solely for the purpose of using the respective offer or service. The mandatory information requested during registration must be provided in full. Otherwise, we will not be able to complete your registration. The processing of the data entered during registration is based on your consent (Art. 6(1)(a) GDPR). You may revoke your consent at any time with future effect and free of charge. You can do so via the unsubscribe link included in the email or by cancelling your Guest Club membership.
The data you provide for the Guest Club will be stored until you unsubscribe. Once you unsubscribe and your Guest Club account has been deleted, the data will be removed from both our servers and the servers of GASTROpoint GmbH.
For important changes, such as modifications to the range of services or technically necessary updates, we will use the email address provided during registration or stored in your profile to inform you accordingly. Statutory retention periods remain unaffected. We have concluded a data processing agreement with GASTROpoint GmbH and fully comply with the strict requirements of the data protection authorities when using the KunLeiSys Guest Club software. As part of your Lerch Genussclub membership, personal data such as your name, address, contact details, stay information, bonus and loyalty point information, as well as information regarding the use of club benefits, is processed. This processing is carried out for the purpose of managing your membership and providing club services.

   10.  Newsletter (SmartHost)

If you subscribe to our newsletter, we will use the data you provide exclusively to send you information about our hotels, offers, events and news.
We use the services of SmartHost GmbH to distribute our newsletter. Processing is based on your consent pursuant to Art. 6(1)(a) GDPR.
You may revoke your consent at any time with future effect. Every newsletter contains a corresponding unsubscribe link for this purpose.
The data collected when subscribing to the newsletter is processed exclusively for sending the newsletter and for the associated technical administration.

   11.  Online Bookings (Hotel Net Solutions)

We use the booking solution provided by HotelNetSolutions GmbH to facilitate and process online bookings.
When you make a booking or submit an availability request via our website, the personal data you enter will be processed. This includes, in particular, your name, address, contact details, stay information, booking details and, where applicable, payment information.
Processing is carried out for the implementation of pre-contractual measures and the performance of a contract pursuant to Art. 6(1)(b) GDPR.
The data is used exclusively for processing your booking and fulfilling the contractual relationship.

   12.  Voucher Shop (Incert)

We use the services of Incert eTourismus GmbH & Co KG to provide and operate our voucher shop.
When ordering vouchers, the personal data you enter is processed. This includes, in particular, your name, address, email address, payment information and all information required to process your order.
Processing is carried out for the purpose of processing and fulfilling voucher orders pursuant to Art. 6(1)(b) GDPR.
Your data is processed exclusively for contract fulfilment and to comply with statutory retention obligations.

   13.  Applications (Softgarden)

We use the Softgarden applicant management platform to process job applications.
When you apply via our careers pages or online application forms, the personal data you provide will be processed. This includes, in particular, your contact details, application documents, qualification records and any other information you choose to provide.
Processing is carried out for the purpose of conducting the recruitment process in accordance with Art. 6(1)(b) GDPR and Section 26 of the German Federal Data Protection Act (BDSG).
Your data will be accessible only to those persons involved in the recruitment process and will be deleted after completion of the application process in accordance with the applicable legal requirements.

   14.  Consent Management (Usercentrics)

We use the Usercentrics Consent Management Platform to manage the consents you have given for cookies and similar technologies.
Usercentrics enables us to obtain, manage and document your consent in compliance with legal requirements pursuant to Art. 6(1)(c) GDPR. This involves processing information about your consent decision, the date and time of your consent or refusal, technical information about the device used, and pseudonymised user data.
The data is stored as proof of the consents granted and to fulfil our legal obligations.

   15.  Changes

This Privacy Policy is effective as of 31 May 2022. The Data Controller reserves the right to amend or update its content, in whole or in part, including as a result of changes in applicable legislation. We therefore recommend that you visit this section regularly to stay informed about the latest and most up-to-date version of this Privacy Policy.