I. Name and contact details of the data controller

Responsible for the processing of your personal data in the context of this contact is

A company of the GEMÜ Group
GEMÜ Gebr. Müller Apparatebau GmbH & Co KG
*Schloßhotel Ingelfingen
Gert-Müller-Platz 1
74635 Kupferzell
Germany

II. Contact details of the data protection officer

The designated data protection officer of the data controller can be reached at datenschutz@gemue.de.

III. Processing of your personal data…

1. … as a guest

a. The personal data that is processed by us

We process the following personal data as part of the contract initiation and the existing contractual relationship:

• Surname
• First name
• Your e-mail address
• Payment data
• Identity card
• Registration form details
• Company address

b. Purposes of data processing

Your personal data will be processed for the following purposes as part of the contract initiation and the existing contractual relationship:

• to process your enquiry as an interested party;
• for the implementation of pre-contractual measures;
• to add your data to our database;
• to make contact;
• to establish, implement and terminate the contractual relationship;
• to fulfil legal obligations (e.g. retention obligations);
• Measures to improve our service and strengthen our guest relationships, e.g. guest surveys;
• the surveillance of publicly accessible rooms at the Ingelfinger Fass by means of optical-electronic equipment (video surveillance);
• Direct marketing, provided you have not objected to the processing of your personal data for these purposes.

c. Legal basis for data processing

Your data will be processed on the basis of Art. 6 para. (1) sen. (1) lit. (b) GDPR, i.e. on the basis of pre-contractual measures or on the basis of the performance of our contract and on the basis of Art. 6 para. (1) sen. (1) lit. (c) GDPR in conjunction with Sections 257 HGB (German Commercial Code), 147 AO (German Fiscal Code), 14 UStG (German Value Added Tax Act), i.e. on the basis of the fulfilment of a legal obligation.

Processing of your personal data on the basis of consent

Insofar as we obtain your consent for the processing of your personal data (currently for direct marketing), your personal data is processed on the basis of Art. 6 para. (1) sen. (1) lit. (a) GDPR in conjunction with Art. 5, 7 GDPR.

The legal basis for video surveillance is Art. 6 para. (1) sen. (1) lit. (f) GDPR. Our legitimate interest lies in the protection of domiciliary rights, the deterrence of criminal offences and the preservation of evidence.

2. … as a supplier and service provider

a. The personal data that is processed by us

We process the following personal data as part of the contract initiation and the existing contractual relationship:

• Surname
• First name
• Company address
• Company
• Bank details
• Contact details (e.g. telephone number, e-mail address)
• Position in the company
• Supplier/service provider number

b. Purposes of data processing

Your personal data will be processed for the following purposes as part of the contract initiation and the existing contractual relationship:

• Initiation, execution and termination of the contractual relationship;
• to carry out needs analyses;
• The surveillance of publicly accessible rooms at the Ingelfinger Fass by means of optical-electronic equipment (video surveillance).

c. Legal basis for data processing

The legal basis for the processing of the data and purposes listed in points 2 a) and b) is Art. 6 para. (1) sen. (1) lit. (b) GDPR.

Insofar as we obtain your consent for the processing of your personal data, the processing of your personal data is carried out on the basis of Art. 6 para. (1) sen. (1) lit. (a) GDPR in conjunction with Art. 5, 7 GDPR.

The legal basis for video surveillance is Art. 6 para. (1) sen. (1) lit. (f) GDPR. Our legitimate interest lies in the protection of domiciliary rights, the deterrence of criminal offences and the preservation of evidence.

IV. Recipients or categories of recipients of the personal data

As part of the processing of your personal data, we may pass on your personal data to the following recipients. We only transfer your personal data to external recipients if you have given your consent or if this is permitted by law. External recipients of your personal data are in particular:

• Processors

V. Transfer of personal data to a third country

Your personal data will not be transferred to third countries outside the European Union or the European Economic Area and this is not planned.

VI. Duration of the storage of personal data

We do not store your personal data for longer than it is necessary for the purpose for which it was collected. This means that data is destroyed or deleted from our systems as soon as it is no longer required. We take appropriate measures to ensure that your personal data is only processed under the following conditions:

1. For the duration that the data is used to provide you with a service
2. As required by applicable law, contract or in light of our legal obligations
3. Only for as long as necessary for the purpose for which the data was collected or longer if required by contract, applicable law, using appropriate safeguards.

A requirement may exist in particular if the data is still needed to fulfil contractual services, to check and grant or defend against warranty and guarantee claims. If the data is no longer required for the fulfilment of contractual or legal obligations, it is regularly deleted, unless its – temporary – retention is still necessary, in particular to fulfil legal retention periods of up to ten years (e.g. from the German Commercial Code, the German Fiscal Code and the German Money Laundering Act). In the case of statutory retention obligations, deletion will only be considered after expiry of the respective retention obligation.

VII. Rights of data subjects

According to the General Data Protection Regulation (GDPR), you have the following rights:

• If your personal data is processed, you have the right to obtain information from the controller about the personal data stored about you (Art. 15 GDPR).
• If incorrect personal data is processed, you have the right to rectification (Art. 16 GDPR).
• If the legal requirements are met, you can request the erasure or restriction of processing (Art. 17 and 18 GDPR).
• If you have consented to the data processing or a contract for data processing exists and the data processing is carried out using automated procedures, you may have a right to data portability (Art. 20 GDPR).
• If the personal data concerning you are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing. If you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for these purposes.(Art. 21 GDPR).
• You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR).

If the legal requirements are met, you can object to the processing of personal data concerning you at any time for reasons arising from your particular situation, which is carried out on the basis of Art. 6 para. (1) sen. (1) lit. (e) or (f) GDPR (Art. 21 GDPR).

VIII. Right of revocation of consent

If you have consented to the processing by the controller by means of a corresponding declaration, you can revoke your consent at any time for the future. This does not affect the legality of the data processing carried out on the basis of the consent until the revocation.