Book now
  • Data Privacy

    Springe zum Inhalt

Data Privacy

Hollywood Media Hotel GmbH
Kurfürstendamm 202
10719 Berlin

Fon: +49 (0)30 889 10-0
Fax: +49 (0)30 889 10-280
welcome@www.filmhotel.de
www.filmhotel.de

Data Protection Statement of the Hollywood Media Hotel GmbH

Privacy policy

General notes

The following notes provide a simple overview of what happens to your personal data when you visit our website. Personal data are all data with which you can be personally identified. For detailed information on the subject of data protection, please refer to the data protection notes listed below.

Of course, the protection of your personal data as well as fair and transparent data processing are important to us. In the following, we would like to provide you with the information in accordance with Art. 13 and 14 GDPR, which you need to check and exercise your data protection rights. We are responsible for our website and the data processing associated with it in accordance with the Basic Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG) as well as other data protection regulations. Comprehensive information on our organisation can be found in the imprint.

The following privacy policy is divided into the following four sections:

  • I.          Information on the person responsible
  • II.        data processing on our website
  • III.      data processing within the scope of our business services
  • III.      Rights of data subjects

 

I. Data on the person responsible

Person responsible for data collection:

Hollywood Media Hotel GmbH

Kurfürstendamm 202

10719 Berlin

e-mail: datenschutz@www.filmhotel.de

Phone: 49 (0)30 - 889 10-0

 

Data protection officer

GFAD data protection GmbH

Data protection officer

Huttenstrasse 34/35

10553 Berlin

Phone: +49 (0)30 269 111-1

E-mail: datenschutz@gfad.de

 

II. Data processing on our website

Data security on our website

For the security of our website we use a SSL certificate with a 256 bit key, version TLS 1.3. A website encrypted with SSL transmits personal data encrypted to the server so that it is impossible for third parties to intercept or read them. A certificate verifies our identity. Depending on your browser, you can see from the address bar and/or the green lock that a secure connection exists. By clicking on the green lock or the address bar you can read our online proof of identity. By encrypting the transmission, you can assume that the data you enter can only be read by us. You can see from the address bar that you are connected to our server and that it is not the site of a third-party provider. In addition, we have implemented further appropriate technical and organisational measures to protect our IT infrastructure in accordance with Art. 32 GDPR.

Protection of minors

Our offer is basically directed at adults. Persons under 18 years of age may not transmit personal data to us without the consent of their parents or legal guardians.

Hosting

The hosting services we use serve to provide the following services: Infrastructure and platform services, computing capacity, storage space and database services, security services as well as technical maintenance services which we use for the purpose of operating this online offer. In doing so, we, or our hosting service provider on our behalf, process inventory data, contact data, content data, contract data, usage data, meta and communication data of customers, interested parties and visitors of this online offer on the basis of our legitimate interests in an efficient and secure provision of our online offer in accordance with Art. 6 para. 1 lit. f GDPR. The data processing of our hosting service provider is carried out within the framework of a contract processing agreement in accordance with Art. 28 GDPR.

Provision of the website and log files

The entry of personal data is not necessary for purely informational use, i.e. unless you provide us with information in some other way, our website.

Nevertheless, every time you visit our website, in addition to information from the system of the calling computer or end device of the user, personal data is automatically collected, which your browser transmits to our server. The following data, which is technically necessary for us to display our website, is collected by us:

  • Information about the browser type and the version used
  • The Internet service provider of the user
  • The IP address of the user
  • The operating system of the user's end device
  • Date and time of access
  • Time zone difference to Greenwich Mean Time (GMT)
  • Content of the request (concrete page)
  • Access status/HTTP status code
  • Amount of data transferred in each case
  • The previous website from which the user accesses our website
  • Operating system and its interface
  • Language and version of the browser software

The legal basis for the temporary storage of this data in so-called log files are our legitimate interests as the responsible website operator in accordance with Art. 6 para. 1 lit. f. GDPR, to guarantee the technical presentation as well as stability and security of the website. The temporary storage of the user's IP address by our system is necessary to enable the website to be delivered to the user's computer. For this purpose, the user's IP address must necessarily remain stored for the duration of the session. The storage of the above-mentioned data in the log files is done to ensure the functionality of our website. In addition, this data serves us to optimise the website and to ensure the security of our information technology systems (e.g. attack detection). An evaluation of the data for marketing purposes does not take place in this context. The above-mentioned data is deleted as soon as it is no longer required for the purpose of its collection. In the case of the collection of data for the provision of the website, this is the case when the respective session is ended. In the case of storage of the data in log files, this is the case after 14 days at the latest. Storage beyond this period is possible if there are indications of an illegal attack on our systems.

Cookies

Third-party tools

Google Tag Manager

We use Google Tag Manager, a service of Google Ireland Limited Building Gordon House, Barrow St, Dublin 4, Ireland, because of our legitimate interest in efficient management of website tags in accordance with Art. 6 para. 1 lit. f GDPR. Google Tag Manager is a solution that enables marketers to manage website tags via an interface. The Tag Manager tool itself (which implements the tags) is a cookie-less domain and does not collect personal information. The tool triggers other tags, which in turn may collect data. Google Tag Manager does not access this data. If disabled at the domain or cookie level, it will persist for all tracking tags implemented by Google Tag Manager. For more information about privacy, please visit the following Google websites:

- Privacy policy: http://www.google.de/intl/de/policies/privacy

- FAQ Google Tag Manager: https://www.google.com/intl/de/tagmanager/faq.html

- Terms of use Google Tag Manager: https://www.google.com/intl/de/tagmanager/use-policy.html

Google Web Fonts

We use Google fonts from Google LLC (1600 Amphitheatre Parkway Mountain View, CA 94043, USA) on our website. For Google services within the EEA and Switzerland, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, has been the responsible "Data Controller" since 22.01.2019.

The files (CSS, fonts) are requested via the Google domains fonts.googleapis.com and fonts.gstatic.com. With Google Fonts we can use fonts on our own website and do not have to upload them to our own server. All Google fonts are automatically optimized for the web, which saves data volume and is a great advantage especially for use on mobile devices. This represents a legitimate interest according to Art. 6 para. 1 lit. f GDPR. When you visit our site, the low file size ensures a fast loading time. When you visit our website, the fonts are reloaded via a Google server. This external call transfers data to the Google servers. In this way Google also recognises that you or your IP address is visiting our website. The Google Fonts API was developed to reduce the collection, storage and use of end user data to what is necessary for the efficient provision of fonts. With every Google Font request, information such as IP address, language settings, browser screen resolution, browser version and browser name will also be automatically transmitted to Google's servers. Google stores requests for CSS assets on your servers for one day. This allows us to use fonts with the help of a Google style sheet. A stylesheet is a style template that can be used to easily and quickly change, for example, the design or font of a web page. The font files are stored at Google for one year. Google's goal is to improve the loading time of web pages. Sometimes Google updates font files to reduce file size, increase language coverage and improve the design. The data that Google stores for a day or a year cannot simply be deleted. The data is automatically sent to Google when the page is viewed. To delete this data prematurely, you must contact Google support at https://support.google.com/?hl=de&tid=231568639289. You can find more information about Google Fonts and other questions at https://developers.google.com/fonts/faq?tid=231568639289.

You can also read about what data is generally collected by Google and what this data is used for at https://www.google.com/intl/de/policies/privacy/.

Google Analytics

This website uses functions of the web analysis service Google Analytics based on our legitimate interest in the statistical analysis of user behaviour for optimisation and marketing purposes in accordance with Art. 6 Para. 1 lit. f GDPR. The provider is Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA. For Google services within the EEA and Switzerland, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, has been the responsible "Data Controller" since 22.01.2019. Google Analytics uses so-called "cookies". These are text files which are stored on your computer and which enable an analysis of your use of the website. The information generated by the cookie about your use of this website is usually transferred to a Google server in the USA and stored there. This data is stored for 14 months before it is automatically deleted. The purpose of the Google Analytics component is to analyse the flow of visitors to our website. Among other things, Google uses the data and information obtained to evaluate the use of our website in order to compile online reports for us which show the activities on our website and to provide further services in connection with the use of our website. Google Analytics is considered a data processor in the sense of the GDPR, as data for website operators is collected and processed in Google Analytics in accordance with their instructions. For Google services within the EEA and Switzerland, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland has been the data controller since 22.01.2019.

Data protection and data security in Google Analytics

As evidenced by the Privacy Shield certification, Google is committed to complying with the EU-US Privacy Shield Agreement published by the US Department of Commerce regarding the collection, use and retention of personal data from EU Member States. In addition, Google Analytics and Google Analytics 360 have been certified to the independent security standard ISO 27001. ISO 27001 is one of the most widely recognized standards in the world. The certification applies to the systems provided through Google Analytics and Google Analytics 360.

IP anonymization

We have activated the IP anonymization function on this website. As a result, your IP address is shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area before it is transmitted to the USA. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will process this information in order to statistically evaluate your use of the website, to compile reports on the website activities and to provide further services to the website operator in connection with the use of the website and the Internet. The IP address transmitted by your browser within the scope of Google Analytics is not merged with other Google data. The person responsible for processing uses the addition "_gat._anonymizeIp" for web analysis via Google Analytics. By means of this addition, the IP address of the Internet connection of the person concerned is shortened and anonymised by Google if the access to our Internet pages is from a member state of the European Union or from another state that is a party to the Agreement on the European Economic Area.

Browser Add-on

You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website. You can also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) to Google and the processing of this data by Google by downloading and installing the browser add-on available under the following link to deactivate Google Analytics: tools.google.com/dlpage/gaoptout

Opposition to data collection

If you do not want your website activity to be available for Google Analytics, you can install the browser add-on to disable Google Analytics by following the link tools.google.com/dlpage/gaoptout. An opt-out cookie will be set to prevent the collection of your data on future visits to this website by the Java Script (gtag.js, ga.js, analytics.js and dc.js) running on websites that share activity data with Google Analytics. You can also prevent the storage of cookies by adjusting your browser software accordingly; however, we would like to point out that in this case you may not be able to use all functions of this website to their full extent.

You can find more information on how Google Analytics handles user data in the Google privacy policy: support.google.com/analytics/answer/6004245.

 

Google Maps

To make it easier for you to find us, we have integrated map material from the Google Maps service of Google LLC into our website via an API for the visual presentation of geographical information in interactive maps on the basis of our legitimate interest in accordance with Art. 6 Para. 1 lit. f GDPR. To be able to display the content in your browser, Google must receive your IP address, otherwise Google will not be able to display this integrated content. In addition, to the best of our knowledge, the use of Google maps also provides Google LLC. Transmitted:

- Date and time of the visit to the website in question,

- Internet address or URL of the web page called up,

- IP address

In this processing, our cooperation with Google is based on a concluded agreement on joint responsibility according to Art. 26 GDPR, available at https://privacy.google.com/intl/de/businesses/mapscontrollerterms/.

For the transmission of the data to Google LLC. Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA" an adequate level of EU data protection exists due to the certification according to the Privacy Shield https://www.privacyshield.gov/list. For Google services within the EEA and Switzerland, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, has been the responsible "Data Controller" since 22.01.2019.

By visiting the website, Google receives the information that you have called up the corresponding subpage of our website. This occurs regardless of whether Google provides a user account through which you are logged in or whether no user account exists. If you are logged in at Google, your data will be assigned directly to your account. If you do not want your profile to be associated with Google, you must log out before activating the button. Google stores your data as user profiles and uses them for purposes of advertising, market research and/or demand-oriented design of its website. Such an evaluation is carried out in particular (even for users who are not logged in) for the purpose of providing needs-based advertising and to inform other users of the social network about your activities on our website. You have a right of objection to the creation of these user profiles, whereby you must contact Google in order to exercise this right. If you do not want Google to collect, process or use data about you via our website, you can deactivate JavaScript in your browser settings. In this case, however, you cannot use the map display. For the purpose and scope of data collection and the further processing and use of data by Google, as well as your rights and settings options for protecting your privacy, please refer to Google's privacy policy at https://accounts.google.com/ and https://policies.google.com/privacy?hl=de.

 

Facebook Connect

We use "Facebook Connect" on our website, a service of Facebook Inc, 1601 S California Ave, Palo Alto, California 94304, USA (hereinafter referred to as: "Facebook"). Facebook Connect facilitates registration for services on the Internet. Instead of using a registration mask on our website, you can enter your login data for Facebook and then use our service. By using "Facebook Connect", your web browser automatically establishes a direct connection with the Facebook server. For registration you will be redirected to the Facebook page. There you can log in with your usage data. Through this, your user account on Facebook is linked to our service. We have no influence on the scope and further use of data collected by Facebook through the use of Facebook Connect. To the best of our knowledge, Facebook receives information that you have called up the corresponding part of our website or clicked on an advertisement from us. If you have a user account with Facebook and are registered, Facebook can assign the visit to your user account. Even if you are not registered with Facebook or have not logged in, there is a possibility that Facebook will find out and store your IP address and, if necessary, other identifying features. We use Facebook Connect to make the registration and login process easier and shorter. This is also in our legitimate interest in the processing of the above data by the third party provider. The legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR. You can prevent processing of the above information by Facebook by using our registration mask and not using Facebook Connect. In addition, Facebook has signed up to the privacy shield agreement concluded between the European Union and the USA. In doing so, Facebook undertakes to comply with the standards and regulations of European data protection law. You can find more information in the following linked entry: https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active

Third party information: Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. For more information about the third party's privacy practices, please visit the following Facebook website: https://www.facebook.com/about/privacy.

Sojern

We work with Sojern, Inc, 255 California St Suite 1000, San Francisco, CA 94111, USA to analyze your activity on our site and to provide you with relevant ads from us and other advertisers on unrelated sites. This advertising service uses pixel tags (web beacons), cookies and other tracking technologies to collect and store information about your visit to our website.  This information is stored on Sojern's servers in the USA. Sojern is certified under the US privacy shield, ensuring an adequate level of EU data protection. This can be viewed at https://www.privacyshield.gov/list . If you visit our website using your mobile device, an advertising service may also collect the unique identifier or location of your device and may attempt to synchronize your visit to a mobile website with other website visits.

As with most advertising services, Sojern uses a combination of pixel tags - web beacons - and cookies to recognize your preferences. A pixel tag is a small image placed on a web page to track visitor activity when ads are delivered or clicked on. Pixel tags are often used in combination with cookies. A cookie is a small text file containing a string of characters that is placed on your browser or device by a host when you visit a website. When you revisit the website, the cookie enables that host to recognize your browser. You can learn more about cookies at www.youronlinechoices.eu. It enables the Sojern Platform to display targeted and relevant advertising from us on selected websites. If you are served a relevant ad on another website based on the information collected on our site, it is referred to as an "interest-based" ad and has a blue "Adchoices" icon in the upper right corner. Clicking on this icon will tell you more about the interest-based advertising service and your ability to opt-out of interest-based ads. The use of Sojern is in the interest of optimizing the service and promoting the services of Hollywood Media GmbH. This represents a legitimate interest in the sense of Art. 6 para. 1 lit. f GDPR.

The cookies set by Sojern are deleted by Sojern after two years at the latest. No sensitive personal data of yours will be stored. Sojern works in accordance with GDPR. For further information, please see the Sojern data protection statement at https://www.sojern.com/gdpr-faq/. We have no access to these advertising services and cannot influence how cookies are used when interest-related advertisements are placed. You can, however, refuse the use of this information by clicking here: https://www.aboutads.info/choices

Please note that when you deactivate, you will still see ads, but they may not be targeted to your travel interests. You have many options to block, delete or decline soy. Any modern Internet browser will allow you to reject third-party cookies such as Sojern or delete cookies altogether. However, if you delete third-party cookies, such as Sojern, by modifying your web browser settings, Sojern cookies will be set again the next time you visit so that you can continue to receive online advertising. If you want to disable web-based ads for desktop devices delivered through the Sojern platform, you can do so by clicking here or by visiting https://preferencesmgr.truste.com/?pid=sojern01&aid=sojern03&type=sojern_product. When you log out, a cookie is placed in your browser that instructs Sojern not to serve targeted ads. Please note that there may be a delay in updating the information. As a mobile user, you also have numerous controls in your operating system that allow you to choose whether to accept cookies or share your Advertising ID with companies such as Sojern. Click here or go to https://www.networkadvertising.org/mobile-choices for information on how to control your mobile options. For more information, please see the Sojern Privacy Policy at https://www.sojern.com/privacy/product-privacy-policy/ .

Double click

This website still uses the online marketing tool DoubleClick by Google. DoubleClick uses cookies to deliver ads that are relevant to users, to improve campaign performance reports, or to prevent a user from seeing the same ads more than once. Google uses a cookie ID to help identify which ads are shown in which browser and to prevent them from being shown more than once. DoubleClick may also use cookie IDs to track conversions related to ad requests. For example, if a user sees a DoubleClick ad and then later visits the advertiser's website using the same browser and makes a purchase. According to Google, DoubleClick cookies do not contain any personal information. Because of the marketing tools used, your browser automatically establishes a direct connection with Google's server. We have no influence on the scope and further use of the data collected by Google through the use of these tools and therefore inform you according to our state of knowledge: Through the integration of DoubleClick, Google receives the information that you have called up the corresponding part of our website or clicked on an advertisement from us. If you are registered with a Google service, Google can assign the visit to your account. Even if you are not registered with Google or have not logged in, it is possible that the provider will find out your IP address and save it. You can prevent this tracking process in a number of ways: a) by adjusting your browser software to prevent you from receiving third-party ads, in particular by disabling third-party cookies; b) by disabling cookies for conversion tracking by setting your browser to block cookies from the domain "www.googleadservices.com", https://www.google. de/settings/ads, this setting being deleted when you delete your cookies; c) by disabling interest-based ads from providers that are part of the self-regulatory campaign "About Ads" via the link http://www.aboutads.info/choices, this setting being deleted when you delete your cookies; d) by permanently disabling them in your Firefox, Internet Explorer or Google Chrome browsers via the link http://www.google.com/settings/ads/plugin. We would like to point out that in this case you may not be able to use all functions of this offer to their full extent. The legal basis for the processing of your data is our legitimate interest in improving advertising campaigns in accordance with Art. 6 Para. 1 S. 1 lit. f GDPR. Further information on DoubleClick by Google can be found at https://www.google.de/doubleclick and http://support.google.com/adsense/answer/2839090, and on data protection at Google in general: https://www.google. de/intl/en/policies/privacy. Alternatively, you can visit the website of the Network Advertising Initiative (NAI) at http://www.networkadvertising.org. Google has certified itself under the EU-US Privacy Shield to ensure an adequate level of EU data protection. The certification can be viewed at https://www.privacyshield.gov/EU-US-Framework. For Google's services within the EEA and Switzerland, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, has been the responsible "Data Controller" since January 22, 2019.

AppNexus

AppNexus is not an ad network or data intermediary. AppNexus is a digital advertising technology platform. Our goal is to make efficient use of our advertising spending by reaching the right audiences and by measuring the effectiveness of our ads. This represents a legitimate interest according to Art. 6 para. 1 lit. f GDPR. To achieve these goals, we use this platform to employ a variety of techniques, including interest-based advertising, real-time (or programmatic) advertising, contextual advertising and location-based advertising. This platform is operated by AppNexus Inc, 28 W 23rd Street, 4th Floor, New York, NY, 10010, USA. As evidenced by the privacy shield certification, AppNexus has undertaken to comply with the EU/US Privacy Shield Agreement on the collection, use and retention of personal data from EU member states, as published by the US Department of Commerce. Further information can be found at https://www.privacyshield.gov/list .

This platform was developed to use certain types of data, which we refer to collectively as platform data. This includes data generated through the Platform and data that customers receive from other sources and subsequently use on the Platform, or that they buy or sell through the Platform. This may include information about Internet users' browsers and devices, such as:

- the type of browser and its settings,

- Information about the operating system of the device,

- Cookie information,

- information on other identifying features of the device, and

- the IP address with which the device accesses the website or mobile application of a customer

- Information about the user's activities on this device, including websites visited or used and mobile applications

- Information about the geographic location of the device when it accesses a web page or mobile application

- Inferences or information regarding the interests of users that are created, received, purchased, sold or used by our customers

 

Facebook Custom Audience

Furthermore, the website uses the remarketing function "Custom Audiences" of Facebook Inc. 1 Hacker Way, Menlo Park, CA 94025, USA ("Facebook") as "Facebook Pixel". This allows users of the website to be shown interest-related advertisements ("Facebook Ads") when they visit the social network Facebook or other websites that also use the procedure. In this way, we pursue the interest in displaying advertisements that are of interest to you in order to make our website more interesting for you. With the help of the Facebook pixel, we also want to ensure that our Facebook Ads correspond to the potential interest of the users and do not appear annoying. The Facebook Pixel also allows us to track the effectiveness of Facebook Ads for statistical and market research purposes by seeing whether users are redirected to our website after clicking on a Facebook Ad (so-called "conversion"). The use of the Facebook pixel and the storage of "conversion cookies" is based on Art. 6 para. 1 lit. f GDPR. We have a legitimate interest in analysing user behaviour in order to optimise both our website and our advertising. Facebook is certified under the Privacy Shield Agreement and thus offers a guarantee of compliance with European data protection law. The certification can be viewed at https://www.privacyshield.gov/list. Due to the marketing tools used, your browser automatically establishes a direct connection with the Facebook server. We have no influence on the scope and further use of the data collected by Facebook through the use of this tool and therefore inform you according to our state of knowledge: Through the integration of Facebook Custom Audiences, Facebook receives the information that you have called up the corresponding website of our Internet presence or clicked on an advertisement from us. If you are registered with a Facebook service, Facebook can assign the visit to your account. Even if you are not registered with Facebook or have not logged in, there is a possibility that the provider will find out and save your IP address and other identifying features. It is possible for logged-in users to deactivate the "Facebook Custom Audiences" function at https://www.facebook.com/settings/?tab=ads#_. Further information on data processing by Facebook is available at https://www.facebook.com/about/privacy . You can also object to the use of cookies for reach measurement and advertising purposes via the deactivation page of the network advertising initiative http://optout.networkadvertising.org/?c=1 and additionally the US American website aboutads.info at http://optout.aboutads.info/?c=2&lang=EN or the European website youronlinechoices.com at http://www.youronlinechoices.com/uk/your-ad-choices.

Social media buttons

We currently use the following social media buttons-ins: [Facebook, Google+, instagram, LinkedIn, you tube]. We use the so-called two-click solution. This means that when you visit our site, no personal data is initially passed on to the button providers. You can recognize the provider of the button by its logo. We give you the opportunity to communicate directly with the provider of the button. Only if you click on the marked field and thereby activate it, the provider will receive the information that you have called up the corresponding website of our online offer. In the case of Facebook, the IP address is anonymised immediately after it has been collected, according to the respective provider in Germany. By activating the button, your personal data is transmitted to the respective provider and stored there (in the case of US providers in the USA). Since the provider collects the data in particular via cookies, we recommend that you delete all cookies before clicking the button via the security settings of your browser. We have no influence on the collected data and data processing procedures, nor are we aware of the full scope of data collection, the purposes of processing, the storage periods. We also have no information about the deletion of the collected data by the provider. The provider stores the data collected about you as user profiles and uses them for the purposes of advertising, market research and/or demand-oriented design of its website. Such an evaluation is carried out in particular (also for users who are not logged in) for the purpose of presenting need-based advertising and to inform other users of the social network about your activities on our website. You have a right of objection to the creation of these user profiles, whereby you must contact the respective provider in order to exercise this right. Via the buttons we offer you the possibility to interact with the social networks and other users, so that we can improve our offer and make it more interesting for you as a user. The legal basis for use is Art. 6 Paragraph 1 S. 1 lit. f GDPR. The data is passed on regardless of whether you have an account with the provider and are logged in there. If you are logged in with the provider, your data collected by us will be assigned directly to your account with the provider. If you click on the activated button and, for example, link to the page, the provider also saves this information in your user account and publicly communicates it to your contacts. We recommend that you log out regularly after using a social network, but especially before activating the button, as you can then avoid being assigned to your profile with the provider. Further information on the purpose and scope of data collection and its processing by the plug-in provider can be found in the following data protection declarations of these providers. There you will also find further information on your rights in this regard and setting options for protecting your privacy. Addresses of the respective providers and URL with their data protection information:

Google+ and you tube: Google LLC, 1600 Amphitheater Parkway, Mountainview, California 94043, USA; https://www.google.com/policies/privacy/partners/?hl=de . Google has certified itself in accordance with the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework . For Google services within the EEA and Switzerland, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, has been the responsible "Data Controller" since 22.01.2019.

LinkedIn Corporation, 2029 Stierlin Court, Mountain View, California 94043, USA; http://www.linkedin.com/legal/privacy-policy . LinkedIn has submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework .

Facebook and Instagram: Facebook Inc, 1601 S California Ave, Palo Alto, California 94304, USA; http://www.facebook.com/policy.php ; further information on data collection: http://www.facebook.com/help/186325668085084 , http://www.facebook.com/about/privacy/your-info-on-other#applications and http://www.facebook.com/about/privacy/your-info#everyoneinfo . Facebook is subject to the EU-US Privacy Shield, https://www.privacyshield.gov/ EU-US Framework.

 

Vimeo & tips for integrating videos

We like to use videos on this website. Videos are a good way to transport content better and make it more understandable. Since local hosting of videos is not powerful enough, we use the possibility of external video providers due to our legitimate interest in a powerful integration of videos according to Art. 6 para. 1 lit. f GDPR. For our own videos, we primarily use Vimeo, a service of Vimeo LLC, White Plains, New York, USA and occasionally YouTube, a service of Googe LLC. We also occasionally include other videos from external sites. Third party providers are also used here. Due to the integration of the videos it comes - for technical reasons - to calls of the servers of the providers such as Vimeo. For the use of data from your browser or device, please refer to the respective data protection notices of the providers. They are responsible for the corresponding data processing. The Vimeo privacy policy can be found at https://vimeo.com/privacy. According to Vimeo, they guarantee an adequate level of data protection by adhering to the Privacy Shield guidelines. The certification can be viewed at https://www.privacyshield.gov/list. The privacy policy of you tube can be found at Google LLC, 1600 Amphitheater Parkway, Mountainview, California 94043, USA; https://www.google.com/policies/privacy/partners/?hl=de . Google has certified itself in accordance with the EU-US Privacy Shield https://www.privacyshield.gov/EU-US-Framework . For Google services within the EEA and Switzerland, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, has been the responsible "Data Controller" since 22.01.2019.

Online bookings

On our website https://www.filmhotel.de you have the possibility to book rooms and/or arrangements for the Hollywood Media Hotel Berlin. If a user takes advantage of this opportunity, the data entered in the input mask will be transmitted to us and stored. These personal data are: First name, surname, e-mail address, telephone, billing address and contact person for corporate customers, if applicable number, names and contact details of fellow travellers, arrival and departure dates, preferences, payment details (payment method - such as credit card and payment amount - total price), date & time of booking. If you make an online booking on our website, this is done by the online reservation system OnepageBooking of Hotelnetsolutions GmbH. The headquarters of Hotelnetsolutions GmbH is located at Genthiner Str. 8, D-10785 Berlin, Germany. All booking data entered by you will be transmitted encrypted. Our contractual partners have committed themselves to handling your transmitted data in a data protection compliant manner. They take all organisational and technical measures to protect your data. Mandatory data necessary for the processing of contracts are marked separately, further data are voluntary and do not have to be provided. We process the data provided by you exclusively for processing your order. For this purpose, the service provider may pass on your payment data to the respective company you have specified (e.g. credit card company, PayPal or Sofortüberweisung) for payment processing. The legal basis for this is article 6 paragraph 1 sentence 1 letter b GDPR. We are obliged by commercial and tax law to store your address, payment and order data for a period of ten years. To prevent unauthorised access by third parties to your personal data, in particular financial data, the ordering process is encrypted. In this context, no further forwarding of data on our part to third parties will take place. The data is used exclusively for processing the booking and for communication. The legal basis for processing the data is the initiation and conclusion of an accommodation contract with the user in accordance with Art. 6 Para. 1 lit. b GDPR. Failure to provide this data may mean that a contract cannot be concluded and managed. The transmitted data is stored in our hotel software on an internal server and used for the execution of the contract.

Registration form

As part of the registration form, we are obliged to process personal data in accordance with Section 30 BMG. The legal basis for this under data protection law is the fulfilment of a legal obligation in accordance with Art. 6 para 1, lit. c GDPR. The registration forms are kept for one year for submission to the regulatory authorities. For the digital registration form, we use the external service provider Code2Order as part of an order processing contract.

The billing address is processed for the fulfilment of the accommodation contract in accordance with Art. 6 para 1, lit. b GDPR. Invoices are kept for 10 years In accordance with tax and commercial retention periods according to § 147 AO and § 257 HGB.

Bonus program

In order to participate in the bonus programme, we process your personal data (first and last name, e-mail) based on your consent in accordance with Art. 6 Para. 1 lit. a GDPR. The given consent can be revoked at any time with effect for the future. Unfortunately, participation in the bonus program is not possible without providing the required data in the mandatory fields. Your data will be deleted if you revoke the given consent or apply for deletion, unless legal retention periods conflict with this.

Company Login

For corporate customers we provide a separate login area for bookings. A login ID and a password are required to access this area. The processing of personal data is also carried out within the framework of contract initiation and implementation in accordance with Art. 6 Para. 1 lit. b GDPR. The data is deleted as soon as it is no longer required for the purpose of its collection. In the case of a contractual relationship, we will delete the data received as soon as national, commercial, statutory or contractual retention requirements are met.

Conference enquiries

You can use our online form to make inquiries about booking conference rooms. For this we need information about date, time, number of participants and desired equipment of the conference room as well as information about special requests and need for overnight rooms. For the initiation of a contract for the rental of a conference room according to Art. 6 para. 1 lit. b GDPR, we need the corresponding personal data. Mandatory data are marked as mandatory fields, further information can be provided voluntarily. Failure to provide such data may result in the inability to conclude and manage a contract. The transmitted data is stored in our hotel software on an internal server and used for the execution of the contract. The processing of the personal data from the input mask serves us solely to process the booking request. The data is deleted as soon as it is no longer required for the purpose of its collection. In the case of a contractual relationship, we will delete the data received as soon as national, commercial, statutory or contractual storage regulations are fulfilled. All booking data entered by you will be transmitted encrypted.

Hotel evaluation

We use tools to download current customer reviews of our hotel from the rating portal customer alliance, Ullsteinstr. 130, Tower B, 12109 Berlin, Germany and display them on the website. For this purpose, the IP address is transferred to the server of the rating portal. The customer ratings are displayed in the interest of comprehensive, neutral information about our hotel. This represents a legitimate interest in the sense of Art. 6 Par. 1 lit. f GDPR. The submission of ratings after your visit to our website is voluntary and is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR. The processing of the comments by customer alliance is carried out within the framework of a contract processing agreement in accordance with Art. 28 GDPR.

Booking, reservation and contact by e-mail, fax and telephone

We can be contacted via the e-mail addresses provided. In this case, the personal data of the sender, i.e. the user, transmitted with the inquiry will be stored. In this context, we would like to point out that the transmission as unencrypted e-mail has certain security risks, as reading or unauthorized access cannot be excluded. The processing of this data, which is transmitted in the course of sending an enquiry, takes place on the legal basis of Art. 6 Par. 1 lit. f. GDPR of our legitimate interests to answer your request satisfactorily. If the enquiry aims at the fulfilment of an existing contract or the conclusion of a new contract, the additional legal basis for processing is Art. 6 para. 1 lit. b GDPR for the initiation/fulfilment of a contract. The processing of this personal data serves us solely to process the contact.  Your data will be deleted as soon as they are no longer required for the purpose of their collection, no contract has been concluded and no legal retention periods exist.

Voucher shop

For the order/reservation of vouchers, we require personal data in accordance with Art. 6 Para. 1 lit. b GDPR for the execution of your order. The data required for the order are marked as mandatory fields, without this information an order is not possible. In addition, further information can be provided voluntarily. For the payment of the order we offer you the online payment services of Paypal and Klarna Sofortüberweisung. The voucher shop is offered by our service provider gurado GmbH, Wittbräucker Str. 32, 44287 Dortmund, Germany. The invoice data must be stored by us for 10 years due to tax regulations,

Upselling e-mail

We offer our guests the service of UpsellGuru GmbH, Unterm Hagen 35, 59939 Olsberg, due to our legitimate interests according to Art. 6 para. 1 lit. f GDPR to offer our guests the greatest possible comfort for their stay. For this purpose data will be passed on to UpsellGuru GmbH. The following personal data will be passed on in order to send our guests an advance email on our behalf in connection with the booking. The following data will be transmitted to UpsellGuru GmbH in encrypted form: last name, first name, e-mail address, day of arrival, day of departure, status of the reservation, language, salutation, title, booked room category.

Guests will be given the opportunity to upgrade their rooms and receive extra services with the UpsellGuru GmbH service. The decision whether the guest's offer is accepted or not is ultimately up to us.

Newsletter

If you have expressly consented in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR, we will use your e-mail address to send you our newsletter on a regular basis. For this purpose we will store your e-mail address accordingly. To receive the newsletter, it is sufficient to provide an e-mail address. You can unsubscribe at any time, for example via a link at the end of each newsletter. Alternatively, you can send your unsubscription request at any time by e-mail to datenschutz@www.filmhotel.de. Your e-mail address will then be immediately deleted from the distribution list or blocked at your request.

For the dispatch of newsletters, we use the service provider CleverReach as a processor according to Art. 28 DSGVO. The provider is CleverReach GmbH & Co. KG, Mühlenstr. 43, 26180 Rastede, Germany CleverReach is a service with which newsletter dispatch can be organized and analyzed. The data entered by you for the purpose of receiving the newsletter (e.g. e-mail address) is stored on the CleverReach servers in Germany or Ireland.

Our newsletters sent with CleverReach allow us to analyze the behavior of the newsletter recipients. Among other things, we can analyze how many recipients opened the newsletter message and how often which link in the newsletter was clicked on.

The data processing is based on your consent (Art. 6 para. 1 lit. a GDPR). You can revoke this consent at any time by cancelling the newsletter. The legality of the data processing operations already carried out remains unaffected by the revocation.

If you do not want CleverReach to analyze your data, you must unsubscribe from the newsletter. For this purpose, we provide a corresponding link in every newsletter message. Furthermore, you can also unsubscribe from the newsletter directly on the website.

The data that you provide us with for the purpose of subscribing to the newsletter will be stored by us until you unsubscribe from the newsletter and will be deleted from our servers as well as from the servers of CleverReach after the newsletter has been cancelled. Data that has been stored for other purposes remains unaffected.

For further details, please refer to the CleverReach privacy policy at: https://www.cleverreach.com/de/datenschutz

Career/Jobs

You can apply to us electronically via e-mail at bewerbung@www.filmhotel.de. Your details will only be used to process your application. Please note that unencrypted e-mails are not protected against access.

Please send your application documents with cover letter, CV and references by post or e-mail. Please also provide us with your e-mail address, your next possible starting date and your weekly working hours. Without this information we are unfortunately not able to process your application. Furthermore, you have the possibility to provide additional information voluntarily. The legal basis for the data processing of your application is the initiation of an employment relationship in accordance with article 6 paragraph 1 b GDPR and § 26 BDSG. Your personal data will be deleted and destroyed after a maximum of 6 months after completion of the application procedure, unless you have given us your express consent to store your data for a longer period or a contract has been concluded.

Recipients of the data or categories of recipients

Within our organization, those entities will have access to your data that need it to fulfill their contractual and legal obligations.

External service providers (contract processors)

Your data will be passed on to service partners, e.g. IT and software service providers for maintenance and support in order to help us provide our services.

A processing of your personal data by commissioned service providers is carried out within the scope of order processing according to Art. 28 GDPR.

Transfers to third countries

If we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)) or if this is done in the context of using the services of third parties or disclosure or transfer of data to third parties, this will only take place if it is done to fulfil our (pre-)contractual obligations, on the basis of your consent, on the basis of a legal obligation or on the basis of our legitimate interests. Subject to legal or contractual permissions, we will only process or transfer data to a third country if the special requirements of Art. 44 ff. GDPR. In other words, processing is carried out, for example, on the basis of special guarantees, such as the officially recognised determination of a level of data protection corresponding to that of the EU (e.g. for the USA through the "Privacy Shield") or compliance with officially recognised special contractual obligations (so-called "standard contractual clauses").

III. Data processing within the scope of our business services

Contractual services with business partners

We process the data of our contractual partners and interested parties as well as clients, suppliers, service providers, customers and guests in accordance with Art. 6 Par. 1 lit. b. GDPR in order to provide them with our contractual or pre-contractual services. The data processed in this context, the type, scope and purpose of such processing and the necessity of processing it, shall be determined by the underlying contractual relationship. The processed data includes the master data of our contractual partners (e.g. names and addresses), contact data (e.g. e-mail addresses and telephone numbers) as well as contract data (e.g. services used, contract contents, contractual communication, names of contact persons) and payment data (e.g. bank details, payment history). As a matter of principle, we do not process special categories of personal data, unless they are part of a commissioned or contractual processing. We process data which are necessary for the justification and fulfilment of the contractual services and point out the necessity of their disclosure, if this is not evident to the contractual partners. Disclosure to external persons or companies will only be made if it is necessary within the framework of a contract. When processing the data provided to us within the framework of an order, we act in accordance with the instructions of the client and the statutory requirements.

When using our online services, we may store the IP address and the time of the respective user action. The storage is based on our legitimate interests of the users in protection against misuse and other unauthorized use. As a matter of principle, this data is not passed on to third parties, unless it is necessary to pursue our claims in accordance with Art. 6 Para. 1 lit. f. GDPR or there is a legal obligation to do so in accordance with Art. 6 Paragraph 1 lit. c. GDPR.

The data is deleted when the data is no longer required to fulfil contractual or legal obligations of care and handling of any warranty and comparable obligations, whereby the necessity of storing the data is regularly reviewed annually. In all other respects, the statutory storage obligations apply.

Direct advertising

If we receive your e-mail address and postal address within the scope of the conclusion of a contract, we process this data for the purpose of direct advertising based on our legitimate interests in accordance with Art. 6 Para. 1 letter f GDPR, in order to inform you from now on by e-mail and by post about our own similar product and service offers. If you do not wish to receive any further advertising information by e-mail or post, you can object to the advertising use of your contact data at any time with effect for the future without incurring any costs other than the transmission costs according to the basic tariffs. You can send your objection by mail or e-mail directly to Hollywood Media Hotel GmbH, Kurfürstendamm 202 10719 Berlin, e-mail: datenschutz@www.filmhotel.de.

Recipients of the data or categories of recipients

Within our organization, those entities will have access to your data that need it to fulfill their contractual and legal obligations.

External service providers (contract processors)

Your data will be passed on to service partners, e.g. IT and software service providers for maintenance and support in order to help us provide our services.

A processing of your personal data by commissioned service providers is carried out within the scope of order processing according to Art. 28 GDPR.

Other service providers, partners and third parties

We may cooperate with other partners if it is necessary to fulfil our service offers or if we are legally obliged to release data. These may be the following partners or third parties: IT and software service providers; credit institutions and payment service providers; credit reference agencies; call centers for support; disclosure to public authorities or by court order, advertising agencies; document destruction companies and logistics; consulting and advisory services, auditors; insurance companies; law firms and competent jurisdiction.

In the event of a credit risk (name, address, e-mail address, details of the company and, if applicable, contractual and receivables data), we will transfer your data to IHD Gesellschaft für Kredit und Forderungsmanagement mbH, Augustinusstr. 11 B, 50226 Frechen, Germany, and, if applicable, to other cooperating credit agencies for the purpose of credit assessment and to check whether the address given can be delivered and for the purpose of debt collection processing. The legal basis for this transmission is Art 6 I b GDPR and Art 6 I f GDPR. Transmissions on the basis of Art 6 I f GDPR may only be made insofar as this is necessary to safeguard the legitimate interests of our company and does not outweigh the interests or fundamental rights and freedoms of the person concerned, which require the protection of personal data.

We attach importance to processing your data within the EU. However, it may happen that we use service providers who operate outside the EU. In these cases, we ensure that an adequate level of data protection is established before your personal data is transferred. This means that a level of data protection comparable to the standards within the EU is achieved through EU standard contracts or an EU adequacy finding, such as the EU Privacy Shield.

Origin of personal data

We process personal data that we receive in the course of our business relationship. In addition, to the extent necessary for the provision of our services and the fulfilment of contracts, we process personal data which we have received from other companies in our group of companies or from other third parties (e.g. credit agencies) in a permissible manner (e.g. for the execution of orders, for the fulfilment of contracts or on the basis of consents given by you). In addition, we process personal data that we have obtained and are permitted to process from publicly accessible sources (e.g. commercial and association registers, press, media).

Categories of personal data

We process the following categories of personal data about you:

Personnel master data (name, address and other contact data, date of birth), if applicable order and contract data (e.g. delivery order), payment data, data from the fulfilment of our contractual obligations, advertising and sales data, documentation data (data from consulting and service discussions) and comparable data.

Storage of data

Where necessary, we process and store personal data for the duration of the business relationship. This also includes the initiation and execution of a contract. For the duration of the existence of warranty and guarantee claims, the necessary personal data will be stored. We also store personal data insofar as we are legally obliged to do so. Corresponding proof and storage obligations result from the German Commercial Code and the German Fiscal Code. The periods of retention or documentation assigned there are six years in accordance with commercial law requirements under § 257 HGB and up to ten years due to tax requirements under § 147 AO. We delete personal data of the person concerned as soon as the purpose of the storage no longer applies and legal retention periods do not prevent deletion.

 

IV. Rights of data subjects

Information, blocking, erasure and correction

Within the framework of the applicable legal provisions, you have the right to obtain information free of charge at any time about your stored personal data, its origin and recipients and the purpose of the data processing and, if applicable, a right to correct, block or delete this data. For this purpose, as well as for further questions regarding personal data, you can contact us at any time at the address given in the text above.

Right to limitation of processing

You have the right to request the restriction of the processing of your personal data. To do so, you can contact us at any time at the address given in the imprint. The right to restrict processing exists in the following cases:

- If you dispute the accuracy of your personal data stored with us, we usually need time to verify this. For the duration of the review, you have the right to demand the restriction of the processing of your personal data.

- If the processing of your personal data was/is unlawful, you may request the restriction of data processing instead of deletion.

- If we no longer need your personal data, but you need them to exercise, defend or assert legal claims, you have the right to demand the restriction of the processing of your personal data instead of deletion.

- If you have lodged an objection in accordance with Art. 21 Paragraph 1 GDPR, a balance must be struck between your interests and ours. As long as it has not yet been determined whose interests outweigh the interests of both parties, you have the right to demand that the processing of your personal data be restricted.

If you have restricted the processing of your personal data, these data - apart from their storage - may only be processed with your consent or for the assertion, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of an important public interest of the European Union or a Member State.

Right to data portability

You have the right to have data which we process automatically on the basis of your consent or in fulfilment of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another responsible party, this will only take place to the extent that it is technically feasible.

Revocation of your consent to data processing

Many data processing operations are only possible with your express consent. You can revoke a previously given consent at any time. For this purpose an informal notification by e-mail to us is sufficient. The legality of the data processing carried out up to the time of revocation remains unaffected by the revocation.

Right to object to data collection in special cases and to direct advertising (Art. 21 GDPR)

If the data processing is carried out on the basis of Article 6 paragraph 1 letter e or f GDPR, you have the right to object to the processing of your personal data at any time for reasons arising from your particular situation; this also applies to profiling based on these provisions. You will find the respective legal basis on which processing is based in this Data Protection Declaration. If you object, we will no longer process your personal data concerned unless we can prove that there are compelling reasons for processing which are worthy of protection and which outweigh your interests, rights and freedoms, or unless the processing serves to assert, exercise or defend legal claims (objection according to Art. 21 Para. 1 GDPR).

If your personal data are processed for the purpose of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing, including profiling, insofar as it is connected with such direct marketing. If you object, your personal data will subsequently no longer be used for the purpose of direct advertising (objection under Art. 21 para. 2 GDPR).

Right of appeal to a data protection supervisory authority

In the event of violations of the GDPR, the data subjects have a right of appeal to a data protection supervisory authority, in particular in the Member State of their habitual residence, their place of work or the place where the alleged violation occurred. This right of appeal is without prejudice to other administrative or judicial remedies.

Rights relating to data processing on the basis of legitimate interest

Under Article 21 paragraph 1 of the GDPR, you have the right to object at any time, for reasons arising from your particular situation, to the processing of personal data concerning you, which is carried out on the basis of Article 6 paragraph 1 letter e GDPR (data processing in the public interest) or Article 6 paragraph 1 letter f GDPR (data processing to safeguard a legitimate interest). This also applies to profiling based on this provision. In the event of your objection, we will no longer process your personal data unless we can prove compelling reasons for processing that are worthy of protection and outweigh your interests, rights and freedoms, or unless the processing serves to assert, exercise or defend legal claims.

Direct mail rights

If we process your personal data for the purpose of direct marketing, you have the right to object at any time to the processing of personal data relating to you for the purpose of such marketing, including profiling, in so far as it is connected with such direct marketing, in accordance with Art. 21 Para. 2 GDPR.

If you object to processing for the purpose of direct advertising, we will no longer process your personal data for these purposes. The objection can be made without any formality and should be addressed, if possible, to Hollywood Media Hotel GmbH, Kurfürstendamm 202, 10719 Berlin, e-mail: datenschutz@www.filmhotel.de

Legal or contractual provisions on the provision of personal data; necessity for the conclusion of the contract; obligation of the data subject to provide the personal data; possible consequences of not providing the data

We would like to inform you that the provision of personal data is partly required by law (e.g. tax regulations) or can also result from contractual regulations (e.g. information on the contractual partner). For the conclusion of a contract it is necessary that you provide us with personal data. Without this data, we will usually have to refuse to conclude the contract or will no longer be able to execute an existing contract and may have to terminate it. If there is a legal obligation to provide the data, you are obliged to provide us with personal data. If you do not provide the data, we may not enter into the desired business relationship.

Automated decision making, execution of a profiling

As a matter of principle, we do not use exclusively automated decision-making within the meaning of Art. 22 GDPR to establish and conduct a business relationship.

Objection to advertising e-mails

The use of contact data published within the scope of the imprint obligation for the transmission of not expressly requested advertising and information material is hereby contradicted. The operators of the website expressly reserve the right to take legal action in the event of unsolicited sending of advertising information, such as spam e-mails.

Changes to the data protection information

We will update this data protection information if this becomes necessary for legal or factual reasons due to changes to our website. Please keep up to date with the current status of this declaration on a regular basis.

(Current status: October 2020)