Privacy Policy

Last updated: October 2026

1. Controller

Promenaden Service UG (haftungsbeschränkt), Messerschmiedestraße 6, 06712 Zeitz, Germany
Business premises / hotel: Promenaden Hotel am Theater, Theaterstraße 2–4, 07545 Gera
Phone +49 170 4790000 · E-mail info@promenaden-hotel.de
Represented by the managing director Volodymyr Harkavenko

2. General information

We process personal data only to the extent necessary for operating the website, handling enquiries and bookings, performing the accommodation contract, complying with legal obligations or pursuing legitimate interests.

3. Legal bases

Art. 6(1)(b) GDPR (contract/pre-contractual measures), (c) (legal obligation), (f) (legitimate interest), (a) (consent).

4. Server log files

When the website is accessed, the web server processes technical data (IP address, date/time, page accessed, amount of data, browser, operating system, referrer). Purpose: operation and security. Legal basis: Art. 6(1)(f) GDPR. Storage period: no more than 30 days.

5. Hosting

The website, booking system and hotel software run on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in data centres in Germany/Finland (EU). A data processing agreement (DPA, Auftragsverarbeitungsvertrag – AVV) is in place. Backups are stored in encrypted form with Hetzner (EU).

6. Contact by e-mail and telephone

We process the information you provide in order to handle your enquiry (Art. 6(1)(b) or (f) GDPR). Our e-mail service is Microsoft 365 (Microsoft Ireland Operations Ltd., Dublin, Ireland; data processing in the EU, DPA in place). We send automatic booking and stay e-mails via Microsoft 365; only in the event of a malfunction do we use Google Gmail (Google Ireland Ltd., Dublin) as a substitute.

7. WhatsApp and Telegram

If you contact us via WhatsApp (WhatsApp Ireland Ltd.) or Telegram (Telegram Messenger Inc. / Telegram FZ-LLC, Dubai, UAE), your messages are processed via these services; a transfer to third countries cannot be ruled out in this context. Use is voluntary; you can also reach us at any time by telephone or e-mail. Our Telegram bot @hotel_gera_bot answers questions with our AI assistant Mia (see section 8).

8. AI assistant "Mia" (website chat, Telegram bot)

The chat on our website and our Telegram bot answer questions with the help of an AI language model (Anthropic Claude), which we operate via Amazon Web Services (Amazon Web Services EMEA SARL, Luxembourg) in the Frankfurt am Main data centre. We operate the chat platform (Dify) ourselves on our servers in the EU. Processing takes place within the EU; content is not used to train AI models. Before you use the website chat for the first time, we obtain your consent (Art. 6(1)(a) GDPR). Your inputs and the conversation history of the session are processed; we store chat histories for no more than 30 days for error analysis. For availability and booking information, Mia accesses our booking system. Use is voluntary.

9. Telephone assistant

Calls to +49 365 43033996 (forwarding when we cannot be reached) are answered by an AI telephone assistant. For this purpose, your telephone number and the content of the call are processed via Twilio Inc. (USA) and OpenAI L.L.C. (USA); our hotel team receives a summary. The transfer to the USA takes place on the basis of the EU-US Data Privacy Framework or EU standard contractual clauses. At the beginning of the call, the assistant points out that it is an AI. Legal basis: Art. 6(1)(b) and (f) GDPR.

10. Bookings and accommodation contract

For the booking and stay we process, among other things, name, address, telephone, e-mail, arrival/departure, room category, number of persons, payment and invoice data, requests, correspondence and stay history (Art. 6(1)(b) GDPR).
Direct bookings via promenaden-hotel.de/buchen are processed in our own booking and hotel management system (ZS PMS, operated on our servers in the EU). In addition, we currently use the Mews hotel management system (Mews Systems B.V., Amsterdam, Netherlands; DPA in place).

11. Booking portals and channel manager

We receive bookings via Booking.com, Expedia, Agoda, Trip.com, Google and others from these portals, which are themselves responsible for their own processing. We exchange availability, prices and bookings via the channel manager Channex (registered in the United Kingdom; an adequacy decision of the EU Commission exists for the United Kingdom).

12. Payments

We process online payments via Stripe (Stripe Payments Europe Ltd., Dublin, Ireland). Card data is processed directly by Stripe; we only receive the payment status and the last digits of the card. Stripe may also process data in the USA for fraud prevention (EU standard contractual clauses / Data Privacy Framework). Legal basis: Art. 6(1)(b) GDPR.

13. Online check-in, guest app and digital room access

Via online check-in (link in the booking confirmation or gast.promenaden-hotel.de) we collect the registration data (section 14) and provide you with your room number, door code and invoice. Door codes are generated in our electronic locking system; door openings are logged (time, door, type of opening). The log serves security and cleaning planning and is deleted after 30 days. We send door codes by e-mail and, if provided, by SMS via seven communications GmbH & Co. KG (Kiel, Germany). Legal basis: Art. 6(1)(b) and (f) GDPR.

14. Registration data (Federal Registration Act – Bundesmeldegesetz)

Under §§ 29, 30 BMG (Bundesmeldegesetz) we are obliged to collect a registration form (including arrival, expected departure, name, date of birth, nationality, address, for foreign guests the identity document number, and number of accompanying travellers). Legal basis: Art. 6(1)(c) GDPR. Retention for one year after departure, followed by deletion within three months.

15. Invoices and retention

We process invoice, payment and accounting data for proper bookkeeping; retention under § 147 AO (Abgabenordnung) and § 257 HGB (Handelsgesetzbuch) for up to 10 years (Art. 6(1)(c) GDPR). Disclosure to our tax adviser.

16. Guest Wi-Fi

For the free guest Wi-Fi we process technical connection data (device identifier/MAC address, time, data volume) to provide and secure the network (Art. 6(1)(b) and (f) GDPR); storage period 30 days.

17. House rules, damage, security

Processing to enforce our house rights, document damage, handle complaints and assert claims (Art. 6(1)(f) GDPR).

If the hotel has imposed a house ban because of a breach of the house rules (§ 13 of the Terms and Conditions), we store the name, date of birth, contact details, the reason and, where applicable, an official file number in order to enforce the ban and to check future bookings – including those made via booking portals. The legal basis is our legitimate interest in protecting guests, staff and property (Art. 6(1)(f) GDPR). The data are stored for the duration of the house ban, for a maximum of three years, and then deleted.

18. Cookies and local storage

We do not use cookies for analytics or advertising purposes and do not integrate any tracking services. We load fonts from our own server. The website chat stores only your yes/no consent locally in the browser; the booking system uses technically necessary session data (§ 25 Abs. 2 TDDDG). A consent banner is therefore not required.

19. Map and external links

The map is an image from our server based on OpenStreetMap data; no map service is embedded live. When you click on external links (booking portals, social networks: Facebook, Instagram, TikTok, YouTube, Telegram, WhatsApp), the privacy policies of the respective providers apply; data is only transmitted when you click.

20. Recipients

Hosting/IT (Hetzner), e-mail (Microsoft; as a substitute Google), hotel software (Mews), channel manager (Channex), payment service (Stripe), AI (Amazon Web Services; telephone: Twilio, OpenAI), locking system, SMS (seven), booking portals, tax adviser, cleaning and service providers where necessary, authorities where legally required, lawyers/debt collection agencies to enforce claims. No disclosure for advertising purposes.

21. Transfer to third countries

As a rule, we process data in the EU. A transfer to third countries may take place in the case of: the telephone assistant (Twilio, OpenAI – USA), Stripe (USA, fraud prevention), Telegram/WhatsApp, and by booking portals under their own responsibility. Basis: adequacy decision (EU-US Data Privacy Framework) or EU standard contractual clauses (Art. 46 GDPR).

22. Storage period

We store data only for as long as is necessary for the purpose or as statutory retention periods apply; thereafter it is deleted or blocked.

23. Your rights

Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21), withdrawal of consent (Art. 7(3)) – at any time to info@promenaden-hotel.de.

24. Right to lodge a complaint

Thüringer Landesbeauftragter für den Datenschutz und die Informationsfreiheit, Häßlerstraße 8, 99096 Erfurt, Tel. +49 361 57-3112900, poststelle@datenschutz.thueringen.de

25. SSL/TLS encryption

All pages are transmitted in encrypted form (https).

26. No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

27. Changes

We adapt this policy when technology, the legal situation or processes change. Last updated: October 2026.