Privacy policy

This is a translation for your convenience. Only the German version is legally binding: Datenschutzerklärung.

1. Name and contact details of the controller and of the company data protection officer

The operator of this website and the party responsible for the collection, processing and use of your personal data within the meaning of the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG 2018) is

Hotel “Zur Burgstiege”
Owner: Joachim Seidel
Eschbachstr. 44–46
42659 Solingen
Germany

Phone: +49 212 6456363
Fax: +49 212 332235
Email: info@duerpellos.de

The data protection officer is Mr Joachim Seidel, contact details as above.

2. General information

We use your data in compliance with the applicable data protection regulations. This privacy policy informs you which personal data we collect and store from you. You will also receive information on how your data is used and which rights you have with regard to the use of your data.

3. Collection and storage of personal data and the nature and purpose of its use

You have various ways of contacting us via the internet.

a) Visiting our website

Each time you visit our website, your browser automatically sends information to the server of our website, which is temporarily stored in a so-called log file.

The following data is recorded without any action on your part and stored until it is automatically deleted:

• the IP address of the requesting computer
• the date and time of access
• the name and URL of the file retrieved
• the website from which access was made
• the operating system of your computer and the browser you use
• the name of your internet access provider.

We process this data for the following purposes:

• ensuring a smooth connection to the website
• ensuring convenient use of our website
• evaluating system security and stability
• other administrative purposes.

The legal basis for the data processing is Art. 6 (1) sentence 1 lit. f GDPR, according to which processing is lawful if it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Our legitimate interest in collecting the data follows from the purposes listed above. Under no circumstances do we use the data collected to draw conclusions about your person.

Our website is operated by STRATO AG, Berlin. The server log files are processed there.

b) Booking via our booking form

You can book an overnight stay with us using the “Book now” form. Your name, a valid email address, a telephone number and your address are required so that we know who the booking is from, can confirm it, can reach you quickly if we have questions and can issue you an invoice. We also process the desired travel dates, rooms and number of people. You can voluntarily provide the country (if not Germany), your approximate arrival time, the occasion and a message.

The details are stored in our booking system. You receive an acknowledgement by email, and we are informed about the booking by email. To protect against misuse (e.g. bookings sent automatically in large numbers), we do not store your IP address in plain text but only as an encrypted check value.

The data processing is based on your consent (Art. 6 (1) sentence 1 lit. a GDPR), which you give when submitting the form, and on the performance of pre-contractual measures and the handling of your stay (Art. 6 (1) sentence 1 lit. b GDPR).

Storage period: your personal details are deleted or anonymised 24 months after your departure; for rejected, expired or cancelled bookings after 6 months. If we have issued you an invoice, we keep the data required for it for the statutory retention period of 8 years (§ 14b of the German VAT Act).

We can also be booked via booking portals such as Booking.com. So that a room is not booked twice, we transmit to these portals only the occupied periods per room – without names or any other details of our guests.

c) Display of available dates

On the “Rooms” page, you can display a calendar of available and booked dates for each room; the booking form also checks availability for your dates. To do this, your browser retrieves the occupancy from our own server. Only the periods in which a room is booked are shown – without names or any other details of other guests. No cookies are set and no data is transmitted to third parties.

To protect against misuse (e.g. large numbers of automated requests), we count the requests per visitor. For this purpose, we do not store your IP address in plain text but only as an encrypted check value together with the time of the request. These entries are deleted at the latest with the next request after 24 hours have passed. The legal basis is Art. 6 (1) sentence 1 lit. f GDPR; our legitimate interest is the security and availability of our booking system.

d) Guestbook

If you expressly agree when booking (optional checkbox in the booking form, Art. 6 (1) sentence 1 lit. a GDPR), we will send you an email once after your departure with a personal link to the guestbook. Without your consent you will not receive this email; your booking does not depend on it. The link is valid for 60 days and can be used once. We only store an encrypted check value of it.

Using the link, you can write an entry with a display name, a text and up to three photos. Your entry is only published after we have read and approved it. Publicly visible are then the display name, the text, the photos and the month of your stay (“Verified stay”) – not your booking, your email address or your full name. Please only upload photos that you took yourself and on which no one can be recognised who does not agree. When uploading, we remove all additional data from the photos, such as the location (geodata) and the camera data.

You can withdraw your consent at any time: a message to info@duerpellos.de is sufficient, and we will then permanently delete your entry including the photos. We delete entries that have not been approved after 30 days; unused invitations expire with the link.

4. Disclosure of data

Your personal data will only be transferred to third parties if

• you have given your express consent to this (Art. 6 (1) sentence 1 lit. a GDPR)
• the disclosure is legally permissible and necessary for the performance of contractual relationships with you (Art. 6 (1) sentence 1 lit. b GDPR)
• there is a legal obligation for the disclosure (Art. 6 (1) sentence 1 lit. c GDPR)
• the disclosure is necessary for the establishment, exercise or defence of legal claims and there is no reason to assume that you have an overriding legitimate interest in your data not being disclosed (Art. 6 (1) sentence 1 lit. f GDPR).

5. Cookies

Our website does not set any cookies for visitors and does not use any statistics or analysis services. Fonts, images and scripts are loaded exclusively from our own server; no content from third-party providers is embedded. Maps (OpenStreetMap or Google Maps) only open when you click the corresponding link (see section 10).

Only our internal administration area, which only our staff use after logging in, sets a technically necessary session cookie.

6. Protection of minors

Persons under 18 years of age should not transmit any personal data to us without the consent of their parents or legal guardians.

We do not request any personal data from children and young people. We do not knowingly collect such data and do not pass it on to third parties.

7. Rights of data subjects

You have the right

• pursuant to Art. 7 (3) GDPR to withdraw the consent you have given us at any time. The withdrawal does not affect the lawfulness of processing carried out on the basis of your consent before its withdrawal. The withdrawal only means that we may no longer continue the data processing based on this consent in the future.
• pursuant to Art. 15 GDPR to request information about your personal data processed by us. In particular, you can request information about the purposes of processing; the categories of personal data that are or were processed; the recipients or categories of recipients to whom your data is or was disclosed; the planned storage period; the existence of a right to rectification, erasure or restriction of processing or a right to object; the existence of a right to lodge a complaint with a supervisory authority; the origin of your data if it was not collected by us; the existence of automated decision-making including profiling and, where applicable, meaningful information about the logic involved and the scope and intended effects of such processing for you.
• pursuant to Art. 16 GDPR to request the immediate rectification of inaccurate personal data concerning you or the completion of your personal data stored by us if it is incomplete.
• pursuant to Art. 17 GDPR to request the erasure of your personal data stored by us. This does not apply insofar as the processing of your data is necessary for exercising the right of freedom of expression and information; for compliance with a legal obligation; for reasons of public interest in the area of public health; for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes; for the establishment, exercise or defence of legal claims.
• pursuant to Art. 18 GDPR to request the restriction of the processing of your personal data. This applies insofar as you contest the accuracy of the data; the processing is unlawful but you oppose the erasure of the data and request the restriction of its use instead; we no longer need the data but you need it for the establishment, exercise or defence of legal claims; you have objected to the processing pursuant to Art. 21 (1) GDPR.
• pursuant to Art. 20 GDPR to receive the personal data you have provided to us in a structured, commonly used and machine-readable format or to request its transmission to another controller.
• pursuant to Art. 77 GDPR to lodge a complaint with a supervisory authority. As a rule, you can contact the supervisory authority of your habitual residence or place of work or of our registered office.

8. Right to object

If your personal data is processed on the basis of legitimate interests (Art. 6 (1) sentence 1 lit. f GDPR), you have the right under Art. 21 GDPR to object to the processing insofar as there are grounds for doing so arising from your particular situation or the objection is directed against direct marketing. In the latter case, you have a general right to object, which we will implement without you having to state a particular situation.

If you wish to exercise your right to object, please send an email to info@duerpellos.de.

9. Data security

Our website is transmitted exclusively in encrypted form (TLS, recognisable by “https://” and the padlock symbol in your browser’s address bar). This also applies to the data you send via the booking form.

We also use appropriate technical and organisational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or unauthorised access by third parties. Our security measures are continuously improved in line with technological developments.

10. Links to other websites

We link to websites of other providers (third parties) not affiliated with us.

Once you click on these links, we no longer have any influence over which data is collected and used by these providers (third parties). You can find more detailed information on data collection and use in the privacy policy of the respective provider (third party).

We accept no responsibility for the collection and processing of data by third parties.

11. How to contact us with questions

If you have any questions about data protection on our website, we look forward to receiving your email at info@duerpellos.de.

12. Regular updating of this privacy policy

The data protection framework for service providers is subject to constant changes and adjustments.

These changes and adjustments make it necessary from time to time to update our privacy policy.

You can recognise the current version by the line “As of: …” at the end of this privacy policy.

As of: 4 November 2026