Skip to content
PLAZA Hotelgroup
Book

Privacy Policy

Contents

  • § 1 Information on the collection of personal data
  • § 2 Legal basis for processing
  • § 3 Disclosure of data
  • § 4 Rights of data subjects
  • § 5 Collection of personal data when you visit our website
  • § 6 Contact, enquiry and registration forms
    • 6.1 Contact form
    • 6.2 Conference and group enquiries
    • 6.3 Changing or cancelling a booking
    • 6.4 Newsletter
  • § 7 Booking and payment
    • 7.1 Direct booking on plazahotels.de
    • 7.2 Payment processing via Datatrans
    • 7.3 Credit card as a guarantee
    • 7.4 Registration form on arrival
    • 7.5 Redeeming vouchers
  • § 8 Customer area (PLAZA Club)
  • § 9 Vouchers
  • § 10 Online check-in and Mobile Key
    • 10.1 Online check-in (straiv)
    • 10.2 Mobile Key
  • § 11 Links to other websites / references to third-party websites
  • § 12 Hosting
  • § 13 Cookies and similar technologies
    • 13.1 Consent management (cookie banner)
    • 13.2 Cloudflare Turnstile
    • 13.3 Accessibility tool and read-aloud function
    • 13.4 Matterport (360° tours)
    • 13.5 Click A Tree (tree-planting element)
    • 13.6 AI chat for individual hotels (DialogShift)
  • § 14 Marketing and web analytics
    • 14.1 What information is included in website analytics
    • 14.2 Google Tag Manager
    • 14.3 Google Analytics 4
    • 14.4 Google Ads
  • § 15 Newsletter and advertising to existing customers
  • § 16 Processing on behalf of the controller
  • § 17 SSL or TLS encryption
  • § 18 Security notice
  • § 19 Changes to this privacy policy
  • § 20 Duration of storage of personal data

§ 1 Information on the collection of personal data

Below, we provide information on the collection of personal data when you use our website. Personal data is any data that can be related to you personally, e.g. name, address, email addresses, user behaviour.

The controller pursuant to Art. 4(7) of the EU General Data Protection Regulation (GDPR) is:

PLAZA Hotelgroup GmbH
Lise-Meitner-Straße 4, 74074 Heilbronn
represented by the Managing Director: Yonca Yalaz
Telephone: +49 (0)7131 26417 0
Email: info@plazahotels.de
(see our legal notice: https://plazahotels.de/de/impressum)

You can contact our data protection officer at DSKC Datenschutz-Arbeitssicherheit-Kompetenz-Center GmbH, Sielower Landstraße 68, 03044 Cottbus, email: info@dskc.de, telephone: 0355/48679410.

§ 2 Legal basis for processing

PLAZA Hotelgroup GmbH relies on Art. 6(1)(1)(a) GDPR as the legal basis for processing data where we obtain your consent for a specific processing purpose. For the storage of information on your terminal equipment or access to such information, Section 25(1) TDDDG additionally applies, insofar as the access is not strictly necessary (Section 25(2) TDDDG).

For processing operations that are necessary for the performance of a contract or for taking steps prior to entering into a contract, for example in the case of a room booking, a voucher purchase or an enquiry about our services, the processing is based on Art. 6(1)(1)(b) GDPR.

Where we are subject to a legal obligation that requires the processing of personal data, e.g. retention obligations under commercial and tax law or the registration obligation under the Federal Registration Act (Bundesmeldegesetz), the processing is carried out on the basis of Art. 6(1)(1)(c) GDPR.

Processing operations may also be based on Art. 6(1)(1)(f) GDPR. This legal basis applies where none of the legal bases listed applies and the processing is necessary for the purposes of a legitimate interest pursued by us or by a third party, provided that the interests, fundamental rights and fundamental freedoms of the data subject do not override it. We state the respective legitimate interest for each individual processing operation.

§ 3 Disclosure of data

Your personal data will not be transferred to third parties for purposes other than those listed below. We only disclose your personal data to third parties if:

  • you have given your express consent to this pursuant to Art. 6(1)(1)(a) GDPR,
  • the disclosure pursuant to Art. 6(1)(1)(b) GDPR is necessary for the performance of contractual relationships with you, in particular to the hotel you have booked, to our reservation service provider and to payment service providers,
  • there is a legal obligation for the disclosure pursuant to Art. 6(1)(1)(c) GDPR,
  • the disclosure pursuant to Art. 6(1)(1)(f) GDPR is necessary for the establishment, exercise or defence of legal claims and there is no reason to assume that you have an overriding legitimate interest in your data not being disclosed.

Service providers that process data on our behalf are contractually bound by our instructions (see § 16). Where data is transferred to a country outside the EU or the EEA, we state the basis for the transfer for the respective processing operation (e.g. an adequacy decision of the European Commission or standard contractual clauses).

§ 4 Rights of data subjects

In accordance with the statutory provisions of the GDPR, you have the following rights with regard to the personal data concerning you:

  • Right of access pursuant to Art. 15 GDPR
  • Right to rectification pursuant to Art. 16 GDPR
  • Right to erasure pursuant to Art. 17 GDPR
  • Right to restriction of processing pursuant to Art. 18 GDPR
  • Right to data portability pursuant to Art. 20 GDPR
  • Right to object to processing pursuant to Art. 21 GDPR
  • Right to withdraw, based on consent given, pursuant to Art. 7(3)

You also have the right pursuant to Art. 77 GDPR to lodge a complaint with a data protection supervisory authority about unlawful processing of your personal data by us.

Template for withdrawing consent

You may withdraw any consent you have given at any time, informally and with effect for the future. For this purpose, you can use the following text, for example:

To: PLAZA Hotelgroup GmbH, Lise-Meitner-Straße 4, 74074 Heilbronn, email: info@plazahotels.de

I hereby withdraw my consent to the processing of my personal data for the following purpose with effect for the future: ______________________ (e.g. newsletter, statistics & analytics)

Surname, first name: ______________________

Email address or postal address: ______________________

Date, signature: ______________________

The withdrawal does not affect the lawfulness of processing carried out up to that point. You can additionally withdraw consent given in the cookie banner at any time via the "Cookie settings" link in the footer; you can unsubscribe from the newsletter via the unsubscribe link in every email.

§ 5 Collection of personal data when you visit our website

When you use the website for information purposes only, i.e. if you do not register or otherwise transmit information to us, we only collect the personal data that your browser transmits to our server. If you wish to view our website, we collect the following data, which is technically necessary for us to display our website to you and to ensure its stability and security (the legal basis is Art. 6(1)(1)(f) GDPR):

  • IP address
  • Domain name of the website from which you came
  • Names of the files retrieved and addresses of the pages accessed
  • Date and time of a request
  • Name of your internet service provider
  • and, where applicable, the operating system and browser version of your terminal device

These server logs are created irrespective of your selection in the cookie banner. They are deleted after 30 days at the latest, unless they are needed for longer to investigate a security incident.

If you access our website via a QR code or a printed address from our advertising materials, the address accessed contains a campaign tag. It describes the advertising material (campaign, type and category of the advertising material, issuing hotel), not you as a person. We redirect short addresses and QR codes exclusively via our own service; this only counts the requests per address and day, without IP address, cookie or browser identifier.

The fonts used on our website are embedded locally; no connection to third-party servers is established for this purpose.

§ 6 Contact, enquiry and registration forms

You can contact us via various forms on our website. The data collected in each case is evident from the respective form; mandatory fields are marked with an asterisk. Without this information, we cannot process your request; all other information is voluntary. To protect the forms against automated requests, we use the service described in section 13.2.

Your information is forwarded to the responsible department – depending on your request, to our central reservations team or to the hotel you have selected.

6.1 Contact form

For enquiries you send us via the contact form, by email or by telephone, we process your information (hotel, name, email address, your message and, voluntarily, form of address, telephone number, country and preferred method of contact) only for the purpose of processing the enquiry and in the event of follow-up questions. The legal basis is Art. 6(1)(1)(b) GDPR insofar as your enquiry relates to a booking or service, and otherwise Art. 6(1)(1)(f) GDPR; our legitimate interest lies in responding to your request. The data is deleted once your request has been conclusively dealt with and no statutory retention obligations preclude this, at the latest after 6 months.

6.2 Conference and group enquiries

For a conference, event or group enquiry, we process your contact details (contact person, email address and, voluntarily, telephone number, company and address) as well as the information about your plans (hotel or location, period, number of participants and rooms, requirements). The data is used to prepare an offer and for further coordination with you. The legal basis is Art. 6(1)(1)(b) GDPR. If no contract is concluded, we delete your information after 6 months; otherwise the periods set out in § 20 apply.

We process conference and event enquiries with the support of seminargo GmbH, Simmeringer Hauptstraße 24, 1110 Wien, Österreich. For this purpose, the information from your enquiry is transmitted to Seminargo and processed there on our behalf; Seminargo does not use it for its own purposes. No transfer to countries outside the EU takes place.

6.3 Changing or cancelling a booking

If you wish to change or cancel an existing booking, we process the hotel, your booking number, your email address, your name, voluntarily your telephone number and your request. To protect against changes by unauthorised persons, we send a confirmation to the email address stored with the booking. The legal basis is Art. 6(1)(1)(b) GDPR, as the processing serves the performance of your accommodation contract. Separate consent is not required for this. The information is stored together with the booking data in accordance with § 20.

6.4 Newsletter

The separate information in § 15 of this privacy policy applies to subscribing to our newsletter.

§ 7 Booking and payment

7.1 Direct booking on plazahotels.de

You can book rooms directly on plazahotels.de. For this purpose, we process the information required for your reservation:

  • Master data: form of address (voluntary), first name and surname, company name for business trips; if you book for another person, also their form of address and name
  • Contact details: email address (booking confirmation and communication), telephone number (queries), voluntarily postal address (invoice)
  • Booking data: hotel, period of stay, room category, rate, number of travellers, age of accompanying children (for price calculation), additional services, a redeemed promotional or voucher code, special requests
  • Payment data: payment method and payment status (for card data, see 7.2)

Availability and prices come from the system of our reservation service provider Hotelpartner Management GmbH, Chaltenbodenstrasse 16, 8834 Schindellegi, Schweiz, in which your reservation is also created. To perform the contract, we transmit your booking data to this service provider and to the hotel you have booked; the reservation system sends the booking confirmation by email to you and to the hotel. The hotels' property management system is provided by protel Hotelsoftware GmbH, Europaplatz 8, 44269 Dortmund. An adequacy decision of the European Commission exists for Switzerland. You book in one of two ways:

  • Booking process on plazahotels.de (addresses containing "/buchen"): you enter your data on our website, and we transmit it to Hotelpartner via an interface. Depending on the rate, the reservation is thereby completed, or we redirect you to payment (see 7.2).
  • Hotelpartner booking engine at booking.plazahotels.de: your entries go directly to Hotelpartner.

The legal basis is Art. 6(1)(1)(b) GDPR. If you book for another person, we also process the data provided about that person in order to carry out the booking. Please inform that person about this privacy policy.

Which of the two ways is offered to you is determined randomly on your first visit according to a fixed proportion; anyone booking from the PLAZA Club members' area always receives our booking process. So that you see the same way for the following 24 hours and a booking does not switch between two systems, we store the assignment in the cookie "plaza_wbe"; it contains only the name of the way and no identifier. This access to your terminal device is strictly necessary for this purpose (Section 25(2)(2) TDDDG). In order to compare the two ways and improve the booking process, we count on our server exclusively the visits per day and per way, without reference to you as a person. The legal basis is Art. 6(1)(1)(f) GDPR; our legitimate interest lies in a functioning and improved booking process.

In our booking process, we store your booking information in our website's database in order to transmit the booking to Hotelpartner, to assign the payment status, to be able to investigate faults and to evaluate the booking process statistically (proportion of completed and abandoned processes, response times of the reservation system). For this purpose, we log the requests to the reservation system and its responses, including your information, the device type (smartphone or computer) and the course of the booking process, even if you do not complete the booking. When you first access the booking process, we set the cookie "plaza_sid" with a random session identifier for this purpose; it is valid for 24 hours, is only sent to our server and cannot be read by scripts. As long as it exists, we also log the availability queries on our hotel pages. Only authorised persons have access to this data. The legal basis is Art. 6(1)(1)(b) GDPR, and for the logging Art. 6(1)(1)(f) GDPR; our legitimate interest lies in a fault-free booking process. The cookie is strictly necessary for the booking (Section 25(2)(2) TDDDG).

We automatically delete the guest data in these records and the logs of the process, in each case calculated from the start of the process: for bookings that are not completed or are abandoned after 48 hours, for technically failed bookings after 30 days and for completed bookings after one year. In any case, we delete the logs no later than 30 days after their creation. Thereafter, information without names and contact details remains stored for our statistics (hotel, period, number of rooms and persons, rate, additional services, status, device type, reservation number and whether a voucher was redeemed). Via the reservation number, it can still be assigned to the booking in the reservation system; we delete this information completely 14 months after the start of the process. The legal basis for this statistical evaluation is Art. 6(1)(1)(f) GDPR; our legitimate interest lies in the evaluation and planning of our booking business. How long your booking is retained at the hotel is set out in § 20.

After completing a booking in our booking process, we show you a confirmation page. We store access to it in the cookie "plaza_booking_access"; it is valid for 48 hours, is only sent to our server and cannot be read by scripts. The page therefore only opens in the browser with which you made the booking (Section 25(2)(2) TDDDG). To protect the booking form against automated access, we use Cloudflare Turnstile (see 13.2).

If you choose to register for the PLAZA Club when booking, we transmit your form of address, your name and your email address to our customer system dailypoint (see 15.1); if you book for another person, no membership account is created. If no membership account exists yet, you will receive an email with which you confirm the registration; § 8 applies to the membership. If you start the booking from your members' area, we transfer your form of address, name, email address and telephone number to pre-fill the form in an encrypted cookie "plaza_member_guest", which can only be used once (lifetime 4 hours; Section 25(2)(2) TDDDG). The legal basis is Art. 6(1)(1)(b) GDPR.

7.2 Payment processing via Datatrans

We process payments for a booking via Datatrans AG, Kreuzbühlstrasse 26, 8008 Zürich, Schweiz. You enter your card data directly in the Datatrans payment window; it is not recorded in our systems. Datatrans forwards card payments to Nexi Germany GmbH, Helfmann-Park 7, 65760 Eschborn, Deutschland, and to the card network (e.g. Visa, Mastercard). An adequacy decision of the European Commission exists for Switzerland.

For card payments, the card networks require strong customer authentication (3-D Secure). So that your bank does not decline the payment, we additionally transmit to Datatrans for this purpose the name, email address and billing address from your booking; Datatrans forwards this information to your card-issuing bank and the card network. The legal basis is Art. 6(1)(1)(b) GDPR.

For rates with payment at the time of booking, you can additionally choose:

  • PayPal Deutschland GmbH, Marktplatz 1, 14532 Europarc Dreilinden
  • Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Schweden. Klarna may check your identity and creditworthiness in this context and, to that extent, processes the data as an independent controller: https://www.klarna.com/de/datenschutz/

7.3 Credit card as a guarantee

If a rate requires the credit card only as a guarantee, your card is not charged at the time of booking. Datatrans merely checks it by means of an authorisation for a very small amount (currently €0.01), which is not debited. Instead of the card number, we receive from Datatrans a substitute value (token), which our reservation service provider stores and transmits to the property management system of the booked hotel (protel, see 7.1). With this token, the hotel can only charge your card if the booking conditions provide for this, for example in the event of a no-show or late cancellation. The legal basis is Art. 6(1)(1)(b) GDPR.

7.4 Registration form on arrival

On arrival, we collect the data for the registration form in accordance with the registration law provisions of the respective country (in Germany, Sections 29 and 30 of the Federal Registration Act (Bundesmeldegesetz), now only for guests of foreign nationality). The legal basis is Art. 6(1)(1)(c) GDPR. The storage period is set out in § 20.

7.5 Redeeming vouchers

If you redeem a voucher or promotional code when booking, we process the code in order to check it and offset it against your booking; it is transmitted to the reservation system together with your booking. In our statistics, we only record whether a voucher was redeemed (see 7.1). The legal basis is Art. 6(1)(1)(b) GDPR. The purchase of vouchers is described in § 9.

§ 8 Customer area (PLAZA Club)

As a member of the PLAZA Club (member.plazahotels.de), you collect points for stays and spending in our hotels. For your membership, we process your registration data (e.g. name, email address, date of birth, password), your stays and spending, as well as your points balance and membership status. The legal basis is Art. 6(1)(1)(b) GDPR. We only send you promotional information about the Club if you have given separate consent (Art. 6(1)(1)(a) GDPR). You can have your membership account deleted at any time; we will then delete your data insofar as no statutory retention obligations preclude this.

We manage the membership accounts in the customer system dailypoint® (see § 15). If a guest profile from a previous stay already exists for your email address, dailypoint® merges your membership with this profile; your stays and your address are then displayed to you in the members' area. After signing in, you remain signed in via a technically necessary cookie until you sign out or close the browser (Section 25(2)(2) TDDDG).

Signing in with Google or Apple

Instead of an email address and password, you can also register and sign in with your Google account or your Apple ID. This is voluntary. You are only redirected to Google or Apple when you click the corresponding button; until then, our page does not load any content from these providers, and we do not transmit any data about you to the provider.

After you have signed in with the provider, it transmits to us an identifier under which it holds your account, your email address and the information as to whether it has been verified, and, in the case of Google accounts of an organisation, additionally the organisation's domain. We do not receive your name. With Apple, you can hide your email address; in this case, we receive a relay address from Apple.

Using your email address, we search for an existing membership account. We only link it without asking you if your mailbox is managed by the provider itself (for example with gmail.com, icloud.com or a Google account of your organisation); otherwise, we ask you once for your PLAZA password. In the case of a relay address from Apple, we cannot automatically find your existing account; in this case, you can link it with your PLAZA password. We inform you by email of every link with an existing account. You can only register as a new member via Google or Apple if your mailbox is held with the provider or you use a relay address from Apple; you then add your form of address and name, and we create your account with this address. In all other cases, please register with an email address and password. We do not pass on the provider's identifier to dailypoint®.

We store the identifier exclusively as a non-reversible check value, together with your membership number and the times of the linking and of your last sign-in, so that we can recognise you the next time you sign in. We delete the link if you disconnect it in your profile, end your membership or remove the connection in your Apple ID, but no later than 12 months after your last sign-in via Google or Apple. We also delete the link if your membership account is deleted or deactivated in any other way. We record sign-ins and links with the provider, a shortened check value and the membership number in the website's system log; this is deleted after 90 days.

For the sign-in process, we set technically necessary, encrypted cookies with a lifetime of no more than 10 or 15 minutes respectively (Section 25(2)(2) TDDDG). The legal basis for signing in, registration and linking is Art. 6(1)(1)(b) GDPR, and for the notification email and the system log Art. 6(1)(1)(f) GDPR; our legitimate interest consists in protecting your account against misuse. We send the notification email via our email service provider; the website is operated at Hetzner Online GmbH (see § 12).

The controller for signing in with Google is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland (policies.google.com/privacy), and for signing in with Apple, Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Irland (apple.com/legal/privacy). According to their own statements, both providers also process data in the USA.

§ 9 Vouchers

You can purchase vouchers for our hotels in our voucher shop at shop.plazahotels.de. Which data we process during purchase, payment and dispatch is set out in the voucher shop's privacy policy: https://shop.plazahotels.de/de/datenschutz. How we process a voucher in connection with your booking is set out in 7.5.

§ 10 Online check-in and Mobile Key

10.1 Online check-in (straiv)

In participating hotels, you can use the guest app of straiv GmbH, Industriestraße 23, 70565 Stuttgart (app.straiv.io), to check in online before arrival, complete and sign the registration form digitally, check out digitally and access hotel information and additional services. You will receive the link for this by email; you do not need to install an app. Use is voluntary; you can check in at reception as usual.

For this purpose, we process your booking and contact details as well as the information on the registration form including your signature. straiv exchanges this data with the hotel's property management system (protel, see 7.1).

straiv processes the data as our processor exclusively in the EU or the EEA. The legal basis is Art. 6(1)(1)(b) GDPR; for the registration form, Art. 6(1)(1)(c) GDPR in conjunction with the registration law provisions (in Germany, Sections 29 and 30 BMG). The storage period is set out in § 20.

10.2 Mobile Key

In hotels with Mobile Key, you open your room with your smartphone. The digital key is generated by the locking system of Hotek Hospitality Group, Munnikenheiweg 27, 4879 NE Etten-Leur, Niederlande. For this purpose, Hotek receives the information about your stay required for the key (room and validity period). The key is only valid for your room and only for the duration of your stay. Use is voluntary. The legal basis is Art. 6(1)(1)(b) GDPR.

§ 11 Links to other websites / references to third-party websites

Our website may also contain, among other things, links to third-party websites. If you follow the link to the external website, we would point out that the website contains its own privacy policy. We accept no liability for this privacy policy and its contents. We recommend that you inform yourself about the processing of your data by the external provider.

Only when you click on a link is your data (IP address, time of clicking, the page on which you clicked the link, information about your internet browser) passed on to the provider. This is technically necessary in order to be able to display the content to you. The legal basis is Art. 6(1)(1)(f) GDPR; our legitimate interest consists in being able to offer you a complete, easy-to-use range of information. If you do not click on these links, your data will not be passed on to third parties.

This applies in particular to:

  • Google Maps: The address of a hotel and the "Open route" button in the local tips are simple links. Only by clicking do you leave our website; the map is displayed on Google Maps (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland).
  • Social networks: The references to our presences on social networks are simple links, not social media plug-ins.

§ 12 Hosting

Our website is hosted by an external provider. Our host processes your data only to fulfil its service obligations and follows our instructions with regard to this data.

Your personal data is collected on our host's servers when you visit our website. This includes, for example, IP addresses, your contact details, your meta and communication data and other data generated when the website is accessed. The legal basis is Art. 6(1)(1)(b) GDPR insofar as the hosting serves the performance of a contract with you, and otherwise Art. 6(1)(1)(f) GDPR; our legitimate interest lies in the secure, fast and efficient provision of our online services.

Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Deutschland

A data processing agreement (DPA) has been concluded with the host.

§ 13 Cookies and similar technologies

Our website uses cookies and similar technologies such as your browser's local storage. Cookies are small text files that are stored on the user's terminal device via the internet browser. When our website is visited again or when switching between subpages, they can recognise the browser and transmit certain information.

The storage of information on, or access to information in, your terminal device takes place in accordance with Section 25 TDDDG:

  • No consent is required for technically necessary cookies and storage (Section 25(2)(2) TDDDG).
  • For all other cookies (e.g. statistics, marketing or third-party cookies), processing only takes place with your consent pursuant to Art. 6(1)(1)(a) GDPR in conjunction with Section 25(1) TDDDG.

You can withdraw or change your consent at any time with effect for the future by reopening the settings via the "Cookie settings" link in the footer of our website. Withdrawing consent is as easy as giving it. You can additionally delete cookies that have already been stored in your browser settings.

13.1 Consent management (cookie banner)

When you first visit our website, you select in the cookie banner which categories you consent to; until you make your decision, no services requiring consent are loaded. The legal notice and privacy policy can be accessed at any time without a decision. The following are available for selection:

  • Necessary – language selection, your selection in the banner, hotel search filters, a booking in progress, sign-in to the PLAZA Club and form protection with Cloudflare Turnstile (13.2); always active
  • Statistics & analytics – Google Tag Manager, Google Analytics 4 (§ 14)
  • Marketing – measuring the success of our Google ads (14.4)
  • AI chat for individual hotels – chat assistant of DialogShift GmbH (13.6)
  • External media – 360° tours by Matterport and tree-planting element by Click A Tree (13.4 and 13.5)

We store your selection in the cookie "opent-consent" in order to take it into account on further page views and to be able to demonstrate your consent. After 180 days and after every material change to the services used, we ask you again. The legal basis is Art. 6(1)(1)(c) GDPR in conjunction with Art. 7(1) GDPR (demonstration of consent) and Section 25(2)(2) TDDDG.

The following cookies and storage entries are strictly necessary for the operation of the website and are set without consent (Section 25(2)(2) TDDDG); we name the cookies of the services requiring consent under the individual services:

NamePurposeStorage period
site-localeselected languageuntil the browser is closed
opent-consentyour selection in the cookie banner180 days
plaza:hotel-finder-filters (session storage)hotel search filtersuntil the tab is closed
plaza_sidsession of a booking in progress, only from the booking process onwards24 hours
plaza_wbeassignment to one of two booking ways (see 7.1)24 hours
plaza_booking_accessaccess to your booking confirmation48 hours
plaza_anliegen"Change or cancel booking" link from the confirmation email30 minutes
plaza_member_guesttransfer of your data from the PLAZA Club to the booking4 hours
DP_LOGIN_TOKEN, MEMBER_SESSIONsign-in to the PLAZA Clubuntil sign-out or until the browser is closed
MEMBER_SSO_FLOW, MEMBER_SSO_PENDINGsign-in process with Google or Apple (§ 8)10 or 15 minutes respectively

13.2 Cloudflare Turnstile

To protect our forms against misuse by automated programs, we use Cloudflare Turnstile, a service of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. In the forms on plazahotels.de (contact form, conference and group enquiry, changing or cancelling a booking, newsletter registration) and in the contact form of the voucher shop, Turnstile is only loaded when you click on the form or enter something; in the booking process, it is loaded as soon as the button for submitting the booking appears. Turnstile is not loaded on any other pages.

Turnstile checks whether an entry originates from a human. For this purpose, your IP address, technical characteristics of your browser and terminal device and your interaction behaviour on the page are transmitted to Cloudflare and evaluated there; Turnstile may store information in your browser for this purpose. Cloudflare processes the data on our behalf for the protection of our forms. According to its own statements, Cloudflare additionally uses the data as an independent controller to improve its detection of automated access, but not for advertising.

The legal basis is Art. 6(1)(1)(f) GDPR. Our legitimate interest lies in the security of our forms and our booking system and in defending against automated access; Cloudflare's legitimate interest lies in improving this protection (Recital 49 GDPR). Access to your terminal device is strictly necessary for the service you have requested – the submission of the form or the booking (Section 25(2)(2) TDDDG). You can object to the processing pursuant to Art. 21 GDPR; you will then not be able to submit a form, but you can reach us at any time by telephone or email. Cloudflare is certified under the EU-US Data Privacy Framework; the transfer to the USA is based on the adequacy decision of the European Commission. Further information: https://www.cloudflare.com/privacypolicy/

13.3 Accessibility tool and read-aloud function

Via the icon in the header, you can adjust the display and operation of the website, e.g. font size, contrast or the highlighting of links. Your settings are stored in your browser's local storage so that they are retained the next time you visit a page. This storage takes place at your request and is strictly necessary for this purpose (Section 25(2)(2) TDDDG); the legal basis is Art. 6(1)(1)(f) GDPR, and our legitimate interest lies in providing an accessible service.

The read-aloud function uses the speech output of your browser or operating system. We do not transmit any data in this process. If you select an online voice of your browser (in Chrome, e.g. "Google Deutsch"), your browser sends the text to be read aloud to the provider of the voice; local voices work exclusively on your device. By default, we offer local voices.

13.4 Matterport (360° tours)

For virtual 3D tours of rooms and event spaces, we use Matterport, a service of Matterport, Inc., 352 E. Java Drive, Sunnyvale, CA 94089, USA. We load the preview images via our own server. A connection to Matterport is only established once you activate the tour and have consented to the "External media" category; in this process, your IP address and technical information about your terminal device are transmitted. The legal basis is your consent pursuant to Art. 6(1)(1)(a) GDPR in conjunction with Section 25(1) TDDDG. The transfer to the USA takes place on the basis of the standard contractual clauses of the European Commission. Further information: https://matterport.com/de/privacy-policy

13.5 Click A Tree (tree-planting element)

On our website, we embed an element of Click A Tree GmbH, Erzbergerstraße 5, 78315 Radolfzell, which shows how many trees have been planted through our initiative. Without your consent to the "External media" category, you will see a notice in its place. With your consent, the element is loaded from the provider's server; in this process, Click A Tree receives your IP address and technical information about your browser and may set cookies. The legal basis is your consent pursuant to Art. 6(1)(1)(a) GDPR in conjunction with Section 25(1) TDDDG.

13.6 AI chat for individual hotels (DialogShift)

On the pages of individual hotels (currently Bremen, Goslar, Köln and München), a chat assistant answers your questions with the help of artificial intelligence. The provider is DialogShift GmbH, Torstraße 201, 10115 Berlin. In doing so, you are chatting with an AI; we also point this out in the chat window. Please do not enter any sensitive data in the chat.

The chat is only loaded once you have consented to the "AI chat for individual hotels" category. DialogShift then receives your IP address and technical information about your browser and, if you chat, your messages as well as the information you provide voluntarily. According to the provider, the chat works with language models from, among others, OpenAI and Anthropic, which are provided via Microsoft Azure or Amazon Web Services; according to DialogShift, processing takes place exclusively on servers in the EU. So that previous chat histories can be displayed to you, DialogShift sets the cookie "ds-custid" with a lifetime of 3 months. The legal basis is your consent pursuant to Art. 6(1)(1)(a) GDPR in conjunction with Section 25(1) TDDDG.

§ 14 Marketing and web analytics

We only use the services described in this section if you have consented to the respective category in the cookie banner. Without consent, no data is sent to these services, not even anonymously or in cached form; booking is possible without restriction without consent.

14.1 What information is included in website analytics

So that we can understand how the room search and booking process are used, Google Analytics 4 (14.3) records the following information:

  • General usage data: pages accessed, device, browser, language, approximate region and origin of the visit.
  • Campaign tag: if you arrive via a QR code or an address from our advertising materials, we record the campaign, type and category of the advertising material and the issuing hotel. In the case of advertising materials in the hotel (e.g. displays in the room or at reception), this indicates that the code was scanned in that hotel. Personal names are never contained in this tag.
  • Search process: desired travel period (arrival and departure date, number of nights), number of adults, children and rooms – we do not record any information on the age of children in website analytics –, the destination selected from our suggestion list, the result of the availability check and the lowest price displayed.
  • Selection: selected hotel, room category, offer and rate, as well as a redeemed promotional code insofar as it originates from our campaigns; other entries in the promotional code field are not transmitted.
  • Process: switch to the booking engine, step reached in the booking process, return without completion, time spent there.

This information relates to the search process, not to you as a person; we do not combine it with your booking, guest or contact data. Names, addresses, contact and payment data, booking numbers, confirmation links and free-text entries are not included in website analytics. No recording of sessions (session replay) takes place in Google Analytics 4. In our evaluations, we aggregate values with fewer than five cases, even when several characteristics are combined.

The legal basis is your consent pursuant to Art. 6(1)(1)(a) GDPR in conjunction with Section 25(1) TDDDG, which you give in the cookie banner under "Statistics & analytics". The storage periods are set out in § 20.

14.2 Google Tag Manager

This website uses Google Tag Manager, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland. The Tag Manager controls which analytics and marketing services are loaded and transmits the status of your consent to them (Google Consent Mode). It is only loaded if you have consented to the "Statistics & analytics" or "Marketing" category. In this process, your IP address is transmitted to Google. The legal basis is your consent pursuant to Art. 6(1)(1)(a) GDPR in conjunction with Section 25(1) TDDDG.

14.3 Google Analytics 4

This website uses Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland ("Google"). Google Analytics sets cookies (_ga and _ga_<identifier>, lifetime up to 2 years) that recognise your browser pseudonymously. The information listed under 14.1 is recorded. IP addresses are not stored by Google Analytics 4; only the approximate region is derived from them.

Google processes the data on our behalf in order to compile reports on the use of the website. We do not use a User-ID or any identifiers from our own systems. Event and user-related data is deleted after 14 months; the period for user-related data starts again with each further visit. In this process, data may be transferred to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework, and the standard contractual clauses of the European Commission additionally apply.

The legal basis is your consent pursuant to Art. 6(1)(1)(a) GDPR in conjunction with Section 25(1) TDDDG ("Statistics & analytics" category). Further information: https://policies.google.com/privacy and https://support.google.com/analytics/answer/6004245

14.4 Google Ads

With Google Ads, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland, we measure the success of our Google ads. This only happens if you have consented to the "Marketing" category.

If you arrive via one of our Google ads, we store the ad's click identifier (GCLID, GBRAID or WBRAID) in the cookie "plz_adclick". The cookie is only sent to our server, cannot be read by scripts in the browser, is valid for a maximum of 30 days and is deleted after a booking. If you book during this period and your consent still exists at that time, our server transmits the click identifier, the time of booking, a pseudonymous booking number (from which Google cannot determine the booking number) and your consent status to Google. We do not transmit names, contact details or the booking amount. If you withdraw your consent, we delete the cookie and no longer transmit anything for bookings completed thereafter.

The legal basis is your consent pursuant to Art. 6(1)(1)(a) GDPR in conjunction with Section 25(1) TDDDG. Google processes the data as an independent controller; in this process, data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework. Further information: https://policies.google.com/technologies/ads

§ 15 Newsletter and advertising to existing customers

15.1 Newsletter

On our website, you have the option of subscribing to our newsletter with offers from PLAZA Hotelgroup. For the dispatch, we require your email address and your choice of newsletter; further information such as form of address, name and interests is voluntary. We use your interests to send you suitable content.

Registration takes place using the double opt-in procedure: after registering, you will receive an email in which we ask you for confirmation. Only after this confirmation do we add you to the mailing list. If you do not confirm your registration within 14 days, your information is automatically deleted. To demonstrate consent, we log the time of registration and confirmation, the IP address used in the process and the wording of the consent.

To protect the registration form against automated registrations, we use Cloudflare Turnstile (see 13.2).

In the newsletter, we evaluate whether and when an email was opened and which links were clicked. For this purpose, the emails contain tracking pixels and personalised links that are linked to your email address and an individual identifier. We use the results exclusively to improve the newsletter. We point out this evaluation at the time of registration; it forms part of your consent.

For dispatch and management, we use dailypoint®, a product of Toedt, Dr. Selk & Coll. GmbH, Augustenstraße 79, 80333 München, Deutschland; dispatch takes place via its service provider Mailingwork. No transfer of data to third countries takes place.

The legal basis for the dispatch, the evaluation and the logging is your consent pursuant to Art. 6(1)(1)(a) GDPR. You can withdraw your consent at any time with effect for the future, for example via the unsubscribe link in every newsletter or by email to info@plazahotels.de. The lawfulness of the processing carried out until withdrawal remains unaffected. After you unsubscribe, your email address is deleted from the mailing list. We additionally retain the evidence of the consent given for as long as this is necessary to defend against possible claims, for a maximum of three years; the legal basis for this is Art. 6(1)(1)(f) GDPR.

15.2 Advertising to existing customers

If you have made a booking with us or purchased a voucher, we may use your email address to inform you about our own similar offers, for example by means of a notice in the booking confirmation or in an email after your stay (Section 7(3) UWG). The legal basis is Art. 6(1)(1)(f) GDPR; our legitimate interest lies in direct marketing to our guests.

You can object to this use at any time without incurring any costs other than the transmission costs according to the basic rates – via the unsubscribe link in each of these emails or by email to info@plazahotels.de.

§ 16 Processing on behalf of the controller

Where we use service providers that process personal data on our behalf (e.g. hosting, web analytics, newsletter dispatch), we have concluded a data processing agreement with them pursuant to Art. 28 GDPR. This ensures that your data is processed exclusively in accordance with our instructions and in compliance with European data protection requirements.

§ 17 SSL or TLS encryption

Data is transmitted between your browser and our servers in encrypted form via SSL or its successor TLS (Transport Layer Security). Data transmitted in encrypted form cannot be read or altered by third parties. You can recognise an encrypted connection by the preceding "https://" and the padlock symbol in your browser's address bar.

§ 18 Security notice

By means of appropriate technical and organisational measures, we protect your data and ours against loss, destruction, unauthorised access, unauthorised alteration or unauthorised dissemination. Despite all due care, complete protection against all risks is not possible in every case. For example, we cannot fully guarantee data security when communicating by email. An alternative for the transmission of confidential information is by post.

§ 19 Changes to this privacy policy

If the legal situation, this online service or the type of data processing changes, we will adapt this privacy policy. The version published on this page applies in each case. If a change requires new consent, for example because a service is used for a new purpose, we will obtain this via the cookie banner or separately.

§ 20 Duration of storage of personal data

The duration of the storage of personal data is determined by the respective statutory retention period (e.g. retention periods under commercial and tax law). After the period has expired, the corresponding data is routinely deleted, provided that it is no longer required for the performance or initiation of a contract and/or there is no longer any legitimate interest on our part in continued storage.