Hotel Hirsch — Fluorn Schwarzwald Hotel Hirsch — Fluorn Schwarzwald
DEEN
Enquire

Privacy Policy

Home / Privacy

The protection of your personal data is important to us. We process your data exclusively on the basis of the statutory provisions (GDPR, BDSG, TDDDG). In this privacy policy we inform you which data we process when you visit this website and when you book a stay at Hotel Hirsch, for what purpose, on what legal basis, how long we store it and which rights you have.

1. Controller

Gasthaus Hirsch (Hotel Hirsch), owner Ioan Florin Ardelean
Schmidgasse 18, 78737 Fluorn-Winzeln, Germany
Phone: +49 7402 910 79 84 · E-mail: gasthaus.hirsch@yahoo.com

We are not required by law to appoint a data protection officer, as the conditions of Art. 37 GDPR and § 38 BDSG are not met in our business. For any data protection matter, please contact us directly using the details above.

2. Server log files & hosting

When you visit our website, the hosting provider automatically collects and stores information in server log files: browser type and version, operating system, referrer URL, page requested, IP address, and the date and time of access. This data serves solely the technical provision, security and stability of the website and is not merged with other data sources.

The legal basis is our legitimate interest in technically error-free and secure operation (Art. 6 (1) (f) GDPR). Log files are deleted after 30 days at the latest, unless they are required to investigate a specific security or abuse incident.

Our website is hosted on our behalf by Hostinger International Ltd., Jonavos g. 60C, 44192 Kaunas, Lithuania. The provider processes the data on our behalf and solely according to our instructions; a data processing agreement pursuant to Art. 28 GDPR is in place. The servers are located within the European Union.

3. SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, this website uses SSL/TLS encryption. You can recognise an encrypted connection by the "https://" prefix in your browser's address bar and by the padlock symbol. When encryption is active, the data you send to us cannot be read by third parties.

4. Booking enquiry via the contact form

Via our enquiry form we process the details you enter: name, e-mail address, phone number, arrival and departure date, preferred room type, number of guests, whether you would like breakfast, and your message. Mandatory fields are marked as such; without them we cannot process your enquiry. All other details are optional.

Submitting the form requires your express consent via the privacy policy checkbox. The data is transmitted by e-mail to our mailbox and stored there in order to handle your enquiry. To protect against automated spam, the form contains a field that is invisible to you (a "honeypot"); no personal data is evaluated and no cookies are set for this purpose.

The legal basis is Art. 6 (1) (b) GDPR (pre-contractual measures taken at your request) and Art. 6 (1) (a) GDPR (your consent). If your enquiry does not result in a booking, we delete the data no later than six months after the last contact, unless statutory retention periods apply.

5. Contact by e-mail, phone, fax or WhatsApp

If you contact us by e-mail, phone, fax or WhatsApp, we process the data you provide (name, contact details, content of your enquiry) exclusively to handle your request. The legal basis is Art. 6 (1) (b) GDPR for contract-related enquiries, otherwise Art. 6 (1) (f) GDPR (legitimate interest in responding to enquiries). The data is deleted once your request has been dealt with conclusively and no statutory retention obligations apply.

We use an external e-mail service for our correspondence; the content of your message is stored on that provider's servers. Please note that an unencrypted e-mail may be read by third parties in transit. For confidential information, please use the phone or postal mail.

6. Booking and accommodation contract

If a booking is made, we process the data required to perform the accommodation contract: name, address, contact details, period of stay, room and board details, and billing and payment data. The legal basis is Art. 6 (1) (b) GDPR (performance of a contract).

Invoices and booking records are subject to commercial and tax retention obligations and are therefore kept for six or ten years respectively (§ 257 HGB, § 147 AO). The legal basis for this continued storage is Art. 6 (1) (c) GDPR.

7. Registration obligation under the German Federal Registration Act

As an accommodation business we are legally obliged to have our guests complete and sign a registration form on arrival (§§ 29, 30 Bundesmeldegesetz — BMG). This records in particular the dates of arrival and departure, surname, first name, date of birth, nationality, address and the number of accompanying persons; for foreign guests, also the type, number and issuing state of the identity document.

The legal basis is Art. 6 (1) (c) GDPR in conjunction with the provisions of the BMG cited above. The registration forms are retained for one year and one month after arrival and are then destroyed within three months (§ 30 (4) BMG). They are disclosed only to the authorities legally entitled to receive them and only to the extent provided for by law.

8. Cookies and local storage

Our website uses no tracking, analytics or marketing cookies. There is no web analytics, no advertising network, no social media plugin and no visitor counter, and no usage profiles are created.

We use only your browser's local storage (localStorage) to remember your choice in the cookie notice so that it does not reappear on a return visit. This entry remains on your device and is not transmitted to us. You can remove it at any time via your browser settings ("clear site data").

The legal basis for this technically necessary storage is § 25 (2) no. 2 TDDDG and Art. 6 (1) (f) GDPR. For non-essential access to your device — here, loading the Google Maps map — we obtain your prior consent pursuant to § 25 (1) TDDDG.

9. Fonts and embedded resources

All fonts, scripts, images and stylesheets on this website are served exclusively from our own server. There is no connection to Google Fonts, to content delivery networks or to any other external provider. Simply opening a page therefore transmits your IP address to no third party.

10. Google Maps (loaded on click only)

In the contact section we offer an interactive map from Google Maps, operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The map is not loaded by default: it is embedded only once you actively click the "Load map" button. Only with that click is data — in particular your IP address, information about your browser and device, and the page requested — transferred to Google. Transmission to Google LLC servers in the USA cannot be ruled out.

The legal basis is your consent pursuant to Art. 6 (1) (a) GDPR and § 25 (1) TDDDG; we additionally base the transfer to the USA on Art. 49 (1) (a) GDPR. You may withdraw your consent at any time with effect for the future by reloading the page without activating the map again. Our address and directions are also available in text form on the page without loading the map. Further information can be found in Google's privacy policy.

11. WhatsApp

Our website contains a link to WhatsApp, operated by WhatsApp Ireland Limited, Merrion Road, Dublin 4, Ireland (Meta group). This is a plain link, not an embedded plugin — simply opening our page transmits no data to WhatsApp. Only when you click the link does WhatsApp open on your device and your phone number and the content of your message are transmitted to the service.

WhatsApp's and Meta's privacy provisions additionally apply to that processing, over which we have no influence; a transfer of data to third countries is possible. The legal basis for handling an enquiry received via WhatsApp is Art. 6 (1) (b) or (f) GDPR. If you wish to avoid this, please use the contact form, the phone or e-mail instead.

12. Recipients of the data

Your data is passed on only where this is necessary to perform the contract or required by law. Recipients may be: our hosting and e-mail provider (as processors pursuant to Art. 28 GDPR), our tax adviser, and tax and registration authorities within the scope of statutory obligations. Your data is never sold or passed on for advertising purposes.

13. No automated decision-making

Automated decision-making, including profiling within the meaning of Art. 22 GDPR, does not take place.

14. Your rights

You have the following rights regarding your personal data:

  • Access to the data we process about you (Art. 15 GDPR)
  • Rectification of inaccurate data and completion of incomplete data (Art. 16 GDPR)
  • Erasure of the data we hold, unless a statutory retention obligation applies (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability in a structured, commonly used, machine-readable format (Art. 20 GDPR)
  • Objection to processing based on a legitimate interest (Art. 21 GDPR)
  • Withdrawal of consent at any time with effect for the future; the lawfulness of processing carried out before withdrawal remains unaffected (Art. 7 (3) GDPR)

An informal message to gasthaus.hirsch@yahoo.com or to our postal address given in the imprint is sufficient to exercise these rights.

15. Right to lodge a complaint with a supervisory authority

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Lautenschlagerstraße 20, 70173 Stuttgart, Germany
Phone: +49 711 615541-0 · E-mail: poststelle@lfdi.bwl.de

16. Whether you must provide the data

Providing your data is neither required by law nor by contract, except where it is expressly marked as mandatory or — as with the registration form — required by law. However, without the details marked as necessary we cannot process an enquiry or conclude an accommodation contract.

Last updated: July 2026. This English text is a courtesy translation. In case of doubt, the German privacy policy applies. This policy is amended as required to reflect changes in the legal framework or in our services.