Last updated: October 2026

1. Controller

Hotel Zollhaus Betriebs-GmbH
Landhotel Altes Zollhaus
Altenberger Straße 7
01776 Hermsdorf/Erzgebirge (Neuhermsdorf district), Germany
Managing Director: Gerrit Curcio
Phone: +49 (0)35057 54-0
e-mail: info@hotel-zollhaus.com

2. General information on data processing

We only process personal data to the extent necessary to provide our website, answer enquiries, handle bookings and stays, or comply with legal obligations. The legal bases are in particular Art. 6 (1) (a) (consent), (b) (contract or pre-contractual measures), (c) (legal obligation) and (f) GDPR (legitimate interest). Data is deleted as soon as the purpose no longer applies and no statutory retention obligations (e.g. under commercial and tax law) prevent this.

3. Hosting and server log files

Our website is operated by an external hosting provider that processes data exclusively on our behalf and according to our instructions (Art. 28 GDPR).

When you visit our website, the following data is automatically stored in server log files: IP address, date and time of access, page requested, referrer URL, browser type and version, and operating system. This is necessary for the secure and stable provision of the website (Art. 6 (1) (f) GDPR). The log files are deleted automatically after a short period unless a security incident requires longer retention.

4. SSL/TLS encryption

For security reasons, this website uses SSL/TLS encryption. You can recognise an encrypted connection by “https://” and the padlock symbol in your browser’s address bar.

5. Contacting us (email, phone, contact form, WhatsApp)

If you contact us by email, phone or via the contact form, we process the information you provide (e.g. name, email address, phone number, travel dates, message) in order to handle your enquiry. The legal basis is Art. 6 (1) (b) GDPR where the enquiry relates to a booking or contract, otherwise Art. 6 (1) (f) GDPR. The data is deleted once your enquiry has been fully dealt with and no statutory retention obligations apply.

Our website also has a button that lets you contact us via WhatsApp. Only when you click it are you redirected to WhatsApp (WhatsApp Ireland Ltd., Meta). WhatsApp then processes your data according to its own privacy policy, possibly also in the USA. Using it is voluntary; you can always reach us by email or phone instead.

6. Online booking and vouchers (DIRS21)

For room bookings and our voucher shop we use the DIRS21 booking system (TourOnline AG, Germany). On pages with the booking widget, content is loaded from DIRS21 servers, which transmits your IP address to DIRS21. When you make a booking or buy a voucher, the data you enter (e.g. name, address, contact details, travel dates, payment information, requests) is processed to perform the contract (Art. 6 (1) (b) GDPR). DIRS21 processes the data on our behalf.

7. Reservations and digital menu

For reservations (zollhaus.reservision.online) and our digital menu and ordering system (zollhaus.igetnow.com) we use external services. When you open them, you leave our website and the privacy policy of the respective provider also applies. We process the data you enter there to carry out your reservation or order (Art. 6 (1) (b) GDPR).

8. Data of our hotel guests

To carry out your stay, we process the data required for booking, invoicing and providing our services (Art. 6 (1) (b) GDPR). As an accommodation provider, we are obliged under §§ 29, 30 of the German Federal Registration Act (BMG) to collect certain data on a registration form (Art. 6 (1) (c) GDPR). Registration forms are kept for one year after departure and then destroyed within three months. Invoice data is retained in accordance with commercial and tax law retention periods.

9. Newsletter

If you subscribe to our newsletter, we use your email address (and your name, if provided) solely to send you the newsletter. Subscription uses the double opt-in procedure; the legal basis is your consent (Art. 6 (1) (a) GDPR). You can unsubscribe at any time via the link in every email or by sending us a message. To send the newsletter we use an external service provider that processes the data on our behalf (Art. 28 GDPR). After you unsubscribe, your address is deleted or, to prevent it from being sent again, stored on a block list.

10. Web analytics with trackboxx

We use the web analytics service trackboxx (servers in Germany) to evaluate website visits statistically. trackboxx does not set cookies or store any information on your device. Your IP address is only used briefly to generate an anonymous identifier that changes daily. There is no recognition on later visits, no cross-site tracking, no linking with other data and no disclosure to third parties. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in designing and optimising our website according to demand. You can object to this processing at any time, e.g. by email to info@hotel-zollhaus.com.

11. Cookie consent

We use a cookie banner (WPConsent) to manage consents. Your choice is stored in a cookie on your device so that we can take it into account on future visits. This cookie is technically necessary (§ 25 (2) no. 2 TDDDG; Art. 6 (1) (c) GDPR). You can change or withdraw your consent at any time via the cookie banner.

12. Fonts

The fonts on our website are stored locally on our server; no connection to Google is made for them. However, the embedded DIRS21 booking widget (see section 6) may load fonts from Google Fonts (Google Ireland Ltd.). In doing so, your IP address is transmitted to Google, possibly also to the USA. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in a functioning, consistently displayed online booking system.

13. Comments

If you write a comment on our website, we store the data entered in the form (name, email address, website if provided), the comment text as well as the time, IP address and browser identifier (user agent) in order to detect abuse and spam (Art. 6 (1) (f) GDPR). Comments and their metadata are stored until you request deletion or the post is removed. Your email address is not published.

If you choose to have your data saved when commenting, your name, email address and website are stored in cookies for one year so that you do not have to enter them again for your next comment (consent, § 25 (1) TDDDG in conjunction with Art. 6 (1) (a) GDPR).

14. Technically necessary cookies for logged-in users

For logged-in users (e.g. editors), WordPress sets technically necessary cookies for login and display options (§ 25 (2) no. 2 TDDDG). Login cookies expire after two days or – with “Remember me” – after two weeks; display option cookies after one year. These cookies are not set for regular visitors.

15. Embedded content and links to social networks

Posts on this website may contain embedded content from other providers (e.g. videos). Such content behaves as if you had visited the provider’s website directly; the provider may collect data, set cookies and record your interaction. We only load such content if you have given your consent via the cookie banner (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG).

We refer to our profiles on Facebook and Instagram (Meta Platforms Ireland Ltd.) by simple links only. Only when you click a link are you redirected to the respective platform, whose privacy policy then applies.

16. Your rights

You have the following rights with regard to your personal data:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR) where it is based on Art. 6 (1) (f) GDPR
• Withdrawal of consent with effect for the future (Art. 7 (3) GDPR)

To exercise your rights, simply send an email to info@hotel-zollhaus.com.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Saxon Data Protection and Transparency Commissioner (Sächsische Datenschutz- und Transparenzbeauftragte), Devrientstraße 5, 01067 Dresden, Germany, www.datenschutz.sachsen.de.

17. Changes

We update this privacy policy whenever our data processing or the legal situation changes. The version published here applies.