Menu opener
Country and language
Country
Other countries
Language
English
Currency
EUR
Currency
EUR
  1. B&B HOTELS
  2. Protection of personal data
  3. B&B HOTELS Germany: Information according to Article 13 ff. of the General Data Protection Regulation (GDPR)
  • Destination
  • FromTo
    FromTo
  • 1 room, 1 adult
  • 1 room, 1 guest

B&B HOTELS Germany: Information according to Article 13 ff. of the General Data Protection Regulation (GDPR)

OLD PDF Version (October 2026)
Old PDF Version (April 2026)
Old PDF Version (February 2026)
Old PDF Version (October 2025)

 

Privacy Notice 

As of November 2026

 

Preamble

As part of our business operations, we process personal data from visitors to our websites, users of our app, hotel guests, participants in our loyalty programs, prospective customers, service providers, and other business partners.

This Privacy Policy is intended for users, guests, and prospective guests (hereinafter “you”) in connection with (i) visiting the website https://www.hotel-bb.com/de (hereinafter “Website”) and the B&B HOTELS mobile application (hereinafter “App”), as well as our channels on social media platforms in German, (ii) participation in one of our loyalty programs, and (iii) a stay at a hotel in Germany.

Its purpose is to inform you, in accordance with Regulation No. 2016-679 of the European Parliament and of the Council  of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter the “General Data Protection Regulation” or “GDPR”), about how your personal data is processed via our website, app, and social media channels, and in particular in connection with your stay at one of our hotels and with our loyalty programs.

The protection of your personal data is a top priority for the companies of the B&B HOTELS Group. Therefore, the companies of the B&B HOTELS Group are committed to processing this data in strict compliance with the General Data Protection Regulation and other applicable data protection laws.

 

1. Definitions

App: refers to the B&B HOTELS mobile application, which is available in iOS and Android versions.

“Data Controller” means the natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of the processing of personal data.

Website: refers to the website accessible at the URL https://www.hotel-bb.com/de.

User: refers to any person who accesses the website and the app, regardless of whether they are a customer, an operator, or a regular internet user with or without an account. 

For the terms used herein, we also refer to the definitions in Article 4 of the GDPR: 

Personal data is any information relating to an identified or identifiable natural person. This includes, for example, your name, your address and contact information, or your email address. 

“Processing” means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, distribution, or any other form of making available; the alignment or combination; the restriction, erasure, or destruction.

A data subject is any identified or identifiable natural person whose personal data is processed by the controller.

 

 

2. Data Controller 

1. The controller within the meaning of the GDPR is the person who determines the purposes and means of the processing of personal data. If several persons jointly determine the purposes and means of the processing, they are jointly responsible for the processing. For some processing operations, the German operating company of the B&B HOTELS Group listed below is solely responsible. In other cases, the operating companies of the B&B HOTELS Group are jointly responsible for the processing and act jointly with other companies.

Sole Data Controller:

B&B HOTELS Germany GmbH, Altkönigstraße 10, 65239 Hochheim am Main (Germany), registered in the Commercial Register of the Wiesbaden Local Court under number HRB 31371,

 is the sole data controller for the following processing operations:

(1) Processing of reservations not made through the online booking system;

(2) Management of lodging contracts;

(3) Exercising the rights of data subjects in accordance with the GDPR;

(4) Processing of insurance claims; 

(5) Management of accommodation registration forms; 

(6) Installation and operation of a video surveillance system in the company’s own hotels;

(7) Operation and provision of guest Wi-Fi in our own hotels;

(8) Handling guest complaints and claims; 

(9) Bookkeeping and accounts receivable management in connection with lodging at company-operated hotels.

The companies of the B&B HOTELS Group operate the online booking system, which serves as the central reservation system for all B&B Hotels. 

 

2. Companies within the B&B HOTELS Group act as joint controllers for the following processing activities:

(1) Operation of the online booking system and processing of reservations made through it;

(2) Carrying out direct marketing activities; 

(3) Management of loyalty programs.

The companies listed on the website, which you can access here, are jointly responsible for managing the paid B&B HOTELS Club loyalty program. 

The companies listed on the website, which you can access here, are jointly responsible for managing the free B&me loyalty program. 

The companies listed on the website, which you can access here, are jointly responsible for processing data for the purpose of managing direct marketing activities and campaigns for customers and prospects of the B&B HOTELS Group. 

The companies listed on the website, which you can access here, are jointly responsible for processing data for the purpose of managing online bookings

The companies listed on the website, which you can access here, are jointly responsible for processing data in the Central Reservation System (CRS), the purpose of which is to centralize booking data. 

The processing of personal data related to the management of the placement and reading of cookies on the website is carried out jointly by the companies listed on the website, which you can access here. As such, these companies are jointly responsible for the processing of data related to the placement and reading of cookies on the website.

The joint controllers have entered into joint liability agreements regarding the aforementioned processing operations, which define their respective obligations. The key provisions of these agreements are available upon request at the following address: datenschutz@hotelbb.com. 

Information regarding the processing operations carried out in this context is provided in detail below. The Data Protection Officer of B&B HOTELS Germany GmbH can be contacted by email atdatenschutz@hotelbb.com , by phone at +49 (0) 6146 9090-0, or via the postal address provided above with the note “Data Protection Officer.” 

 

3. General Criteria for Retention Periods

Unless a more specific retention period is stated in this Privacy Policy, your personal data will be retained until the purpose for which it was processed no longer applies. If you submit a valid request for erasure or revoke your consent to data processing, your data will be erased unless we have other compelling reasons to continue storing your personal data (e.g., retention periods under tax or commercial law); in the latter case, the data will be erased once these reasons no longer apply. 

 

4. General Information on the Legal Bases for Data Processing on This Website

If you have consented to data processing, we process your personal data on the basis of Article 6(1)(a) of the GDPR. In the event of explicit consent to the transfer of personal data to third countries, data processing is also carried out on the basis of Article 49(1)(a) of the GDPR. Consent may be revoked at any time. If your data is necessary for the conclusion or performance of a contract or for the implementation of pre-contractual measures, we process your data on the basis of Article 6(1)(b) of the GDPR. Furthermore, we process your data, to the extent necessary to comply with a legal obligation, on the basis of Article 6(1)(c) of the GDPR. Data processing may also be based on our legitimate interest pursuant to Article 6(1)(f) of the GDPR. We provide information on the applicable legal bases in each individual case in the following sections of this Privacy Notice.

 

5. General Information on Data Transfers to Third Countries 

Some companies within the B&B HOTELS Group are headquartered in a third country outside the European Union and the European Economic Area. For data transfers to these companies within the B&B HOTELS Group, the EU Standard Contractual Clauses have been implemented; you can obtain a copy of these upon request using the contact information provided, e.g., by emailing privacy@hotelbb.com. The European Commission’s adequacy decisions dated June 28, 2021 (United Kingdom) and July 26, 2000 (Switzerland) confirmed that these countries have a level of data protection comparable to that of the EU. 

Subject to your consent, the website and the app use tools and incorporate external content and media provided by companies based in third countries. If these tools are activated, your personal data may be transferred to these third countries and processed there. Please note that in third countries where data protection standards are insufficient, a level of data protection comparable to that of the EU cannot be guaranteed. In such cases, data transfers are made on the basis of additional safeguards pursuant to Art. 44 et seq. of the GDPR. Under certain conditions, the U.S. is classified by the European Commission as a safe third country with a level of data protection comparable to that of the EU. Data transfers to the U.S. are therefore permitted if the data recipient is certified under the “EU-U.S. Data Privacy Framework” (DPF). Information on transfers to third countries, including the data recipients, can be found in this Privacy Policy as well as in the information on cookies and other trackers.

 

6. Information on the Processing of Personal Data

 

  • 6.1 Visiting the Website

When you visit the website, your browser transmits certain system and browser data for technical reasons. This data (known as server log files) is processed by the companies jointly responsible for the online booking system:

  • IP address
  • Date and time of the server request
  • Browser, language, and version of the browser software
  • Operating system used
  • Hostname of the accessing computer
  • Website from which the request originates (“referrer URL”)

This data is not stored together with other personal data of the users. 

The temporary storage of the user’s IP address by the web server is technically necessary to display the website. For this purpose, the IP address must necessarily be stored for the duration of the session.

The above-mentioned data is stored in log files to ensure the proper functioning of the online booking system. This data is also used to ensure the security of the IT systems (e.g., for attack detection). The data is not analyzed for marketing purposes in this context.

The legal basis for the temporary storage of this data and the log files is Article 6(1)(f) of the GDPR. The legitimate interest lies in the technically error-free display and optimization of the website—for this purpose, the server log files must be collected.

The data mentioned above is deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. In the case of data collected to provide the website, this occurs when the respective session ends. For data stored in the log files, the retention period is up to 3 months. Storage beyond this period is possible if this data is required (e.g., to investigate attacks, misuse, or fraudulent activities). Data whose continued retention is necessary for evidentiary purposes is exempt from deletion until the respective incident has been fully resolved.

The collection of data for the purpose of providing the website and its storage in log files is technically essential for the operation of our website. Consequently, you have no right to object.

 

  • 6.2 Contact Form on the Website 

If you submit inquiries to us via the contact form on the website, we collect the data requested in the contact form (e.g., name, email address) as well as the details of your inquiry. Required fields are marked accordingly. We process your personal data to respond to your inquiry and handle your request. We store your data in case of follow-up questions.

If your inquiry relates to the performance of a contract or is necessary for the implementation of pre-contractual measures (e.g., a quote), the processing is based on Article 6(1)(b) of the GDPR. In all other cases, the processing is based on our legitimate interest in the effective handling of inquiries directed to us (Article 6(1)(f) of the GDPR).

The data is used exclusively for the purpose of handling the conversation and addressing your inquiry. The data you enter in the contact form will remain with us until you request its deletion or the purpose for storing the data no longer applies (e.g., after your inquiry has been fully processed). Mandatory legal provisions—in particular retention periods—remain unaffected. Your personal data will be deleted no later than three years after the completion of processing your inquiry, at the end of the calendar year. 

 

  • 6.3 Inquiries via Email or Phone 

If you contact us via the email addresses provided on the website or by phone, we will store and process your inquiry, including all personal data contained therein (name, address, contact information, inquiry), for the purpose of handling your request.

If your inquiry relates to the performance of a contract or is necessary for the implementation of pre-contractual measures (e.g., a quote), the processing is based on Article 6(1)(b) of the GDPR. In all other cases, the processing is based on our legitimate interest in the effective handling of inquiries directed to us (Article 6(1)(f) of the GDPR).

The data is used exclusively for the purpose of handling the conversation and processing your inquiry.

The data you provide via contact requests will remain with us until you request its deletion or the purpose for storing the data no longer applies (e.g., after your inquiry has been fully processed). Mandatory legal provisions—in particular retention periods—remain unaffected. Your personal data will be deleted no later than three years after the completion of processing your inquiry, at the end of the calendar year. 

 

  • 6.4 Newsletter 

You can subscribe to a newsletter on our website. We send newsletters only with the recipients’ consent. To this end, we use a double opt-in procedure. After subscribing to the newsletter, you will receive an email in which you must confirm your subscription. We use this procedure to ensure that no one can subscribe using someone else’s email address. We log newsletter subscriptions so that we can verify the subscription process in accordance with legal requirements. This includes the date, time, and IP address at the time of subscription. To subscribe to the newsletter, we collect your name and email address.

We send newsletters for promotional purposes to inform you about offers, promotions, and other news regarding B&B HOTELS.

If you have given your consent, we will send you personalized offers, benefits, travel ideas, and news from B&B HOTELS and the B&me program via email, text message, and/or WhatsApp.

To personalize these communications, we may process information about your browsing behavior on B&B HOTELS’ platforms that is, on our website and in our app. This includes, for example, content and offers you’ve viewed, your interest in specific hotels, destinations, or travel dates, as well as your interactions with our digital offerings.

Tracking pixels may be used in connection with these communications. This allows us to determine whether and when you open a communication and whether you click on links contained therein. We use this information to personalize the content and offers sent to you and to measure their relevance.

If you have provided the separate consent required for this purpose, personalization may also take into account your browsing behavior on websites of the third-party partners listed in the partner list, including social networks. The relevant third-party partners are listed in the linked partner list.

The processing of the data entered in the newsletter sign-up form is based solely on your consent (Art. 6(1)(a) GDPR in conjunction with § 7(2)(2) of the German Act Against Unfair Competition (UWG)). By sending the email as part of the double opt-in process, we fulfill our legal obligation to verify your email address, in accordance with Article 6(1)(c) of the GDPR. Your data related to newsletter subscription and distribution is processed by the marketing department of B&B HOTELS Germany GmbH. The companies of the B&B HOTELS Group, a list of which is available above, are jointly responsible for the administration and implementation of this direct marketing campaign. The joint controllers have commissioned B&B HOTELS DIGITAL SERVICES, 9 boulevard Romain Polland, 75014 Paris, France, and MOVE ON B&B HOTELS, 271, rue du Général Paulet, 29200 Brest, France, to manage and distribute the newsletters. The contractors act on the instructions of the joint controllers based on data processing agreements. 

 

You may revoke your consent to receive personalized promotional communications—including the associated personalization as well as open and click tracking—at any time, with future effect, by using the unsubscribe function provided in the respective communication. Such revocation does not affect the lawfulness of processing carried out on the basis of your consent prior to revocation. Upon receipt of your revocation, we will no longer send you any communications covered by this policy and will no longer use your data for the corresponding personalization or for open and click tracking.

You may revoke your separate consent to the use of your browsing behavior on third-party websites, including social networks, at any time with future effect—for example, by sending an email to datenschutz@hotelbb.com. Upon receipt of this revocation, we will no longer use this data for personalization. Personalized promotional communications may continue to be sent based on the remaining data, provided that consent for this has not been revoked in its entirety.

If you revoke your consent to receive personalized promotional communications in their entirety, we will mark the contact information you provided for this purpose—such as your email address and/or cell phone number—with a block flag for each respective channel. This allows us to document that you no longer wish to receive such communications via the channels for which consent has been revoked. Data that is no longer required will be deleted immediately. The block flag and the contact information stored for this purpose will be deleted three years after the end of the calendar year in which the block flag was set.

If you revoke only the separate consent to take into account activities on third-party websites, including social networks, we will note the revocation and will no longer use this data for personalization in the future.

If you do not confirm your consent as part of the double opt-in process, we will block the email address used during the registration process and delete it after six months, unless we are required to retain it for other reasons or in another context.

 

  • 6.5 Online Hotel Reservations and Check-In

When you book a room via the online booking system on the website or the app, we process the personal data requested on the booking form (e.g., personal master data, contact information, reservation/booking details, terms and conditions, payment and billing information) to complete the booking and establish an accommodation contract. Your email address is processed to send you reservation/booking confirmations, changes, cancellations, and other communications related to the reservation/booking and the accommodation contract. You will also receive an automatically generated invitation to check in online via email prior to your scheduled arrival date. To complete online check-in, you must register via the link in the email and provide your credit card information (card number, expiration date, security code) for payment purposes.

The companies of the B&B HOTELS Group—a list of which is available above—are jointly responsible for data processing via the online booking system on the website and the app. The joint controllers have entrusted B&B HOTELS DIGITAL SERVICES, 9 boulevard Romain Polland, 75014 Paris, France, and MOVE ON B&B HOTELS, 271, rue du Général Paulet, 29200 Brest, France, with the operation and management of the online reservation system. The contractors act on the instructions of the joint controllers based on data processing agreements. 

For the purpose of establishing and fulfilling the lodging agreement, data from the online booking system may be transferred to the operator of the hotel where you have booked your stay. 

To comply with legal reporting requirements, it may be necessary to transmit certain personal data to the registration authority responsible for the hotel at where you are staying after you have checked in at the hotel. You are required to provide this information upon check-in. 

In the case of a minor traveling alone, the hotel where the stay takes place will require a statement from a legal guardian specifying the minor’s name, contact information, and a partially redacted copy of an identification document. Details regarding data processing can be found in the corresponding form. 

The legal basis is Article 6(1)(b) of the GDPR, as the processing of the data is necessary for the conclusion and performance of a lodging contract at a B&B HOTEL. By reporting guest data to the relevant registration authority, the B&B HOTEL fulfills its legal obligation as a hotel operator under Article 6(1)(c) in conjunction with Sections 29 and 30 of the Federal Registration Act (BMG).

The data stored by us will be deleted as soon as it is no longer necessary for its intended purpose and no statutory retention obligations prevent its deletion. The retention periods under commercial and tax law in connection with the lodging agreement are six years (Section 257(1) of the German Commercial Code (HGB)) and ten years (Section 147(1) of the German Fiscal Code (AO)), respectively. The registration forms required under the Federal Registration Act are retained for one year after registration in accordance with the provisions of § 30 BMG and are destroyed within three months after the retention period expires. 

If you have made a reservation with us, we use your email address to send you promotional materials for similar goods and services related to your reservation. You may object to this use at any time by either clicking the unsubscribe link in the footer of such a promotional email or, alternatively, by sending us a message via the contact form on our website with the subject line “Feedback on Your Stay,” including your email address.

The legal basis for this data processing is Article 6(1)(f) of the GDPR, in compliance with the provisions of Section 7(3) of the German Unfair Competition Act (UWG). Our legitimate interest lies in promoting customer loyalty.

 

  • 6.6 Bookings via Airbnb

When you make a booking through the Airbnb platform, we receive the personal data necessary for the performance of the lodging contract from Airbnb Ireland UC, 8 Hanover Quay, Dublin 2, Ireland (“Airbnb”).
In particular, we process your name, contact information (e.g., email address, phone number), booking details (e.g., length of stay and services booked), and the content of communications related to the booking. This processing is carried out to fulfill the lodging agreement and to communicate regarding your booking pursuant to Article 6(1)(b) of the GDPR; where necessary, it is also carried out to comply with legal obligations (e.g., registration requirements) pursuant to Article 6(1)(c) of the GDPR.
The data is transmitted to us by Airbnb and shared within our company exclusively with the departments responsible for managing your stay; disclosure to third parties occurs only to the extent necessary for the performance of the contract or where a legal obligation exists. The data is stored only for the duration of the contract’s performance and in accordance with statutory retention requirements.

 

  • 6.7 User Account and Participation in the B&me Loyalty Program

On the website and in the app, you have the option to create a personalized user account (“B&me Account”) to view bookings, make future reservations more quickly, and take advantage of the B&me Loyalty Program. 

To create and maintain the B&me Account, the data requested in the registration form (personal master data, contact information, language and country settings, password, communication preferences) is processed. Details regarding bookings and hotel stays, as well as benefits redeemed through the B&me Loyalty Program, are stored in the B&me Account and can be accessed there at any time. Registration for the user account and participation in the B&me Loyalty Program are verified via a double opt-in process. You will receive a confirmation email containing a link that you must click to activate your B&me account. Your email address is stored for this purpose and for further communication regarding your B&me account.

The legal basis for data processing is Article 1(b) of the GDPR. The processing of this data is necessary for registering for the user account as well as for establishing and maintaining your participation in the B&me loyalty program. 

The companies of the B&B HOTELS Group, a list of which is available above, are jointly responsible for data processing in connection with the operation of the B&me loyalty program. The joint controllers have commissioned B&B HOTELS DIGITAL SERVICES, 9 boulevard Romain Polland, 75014 Paris, France, to provide services related to the administration of the B&me loyalty program. B&B HOTELS DIGITAL SERVICES processes the personal data on the basis of a data processing agreement in accordance with the instructions of the joint controllers.

Personal data is stored for the duration of the user account and participation in the B&me loyalty program. You can terminate your B&me account and your participation in the B&me loyalty program at any time via your user account. The data will then be deleted no later than the expiration of the six-year retention period under commercial law, in accordance with Section 257 of the German Commercial Code (HGB). 

 

  • 6.8 B&me Club Loyalty Program

Through the B&me account, users can register on the website and in the app to participate in the B&me Club loyalty program for a fee.

To establish and manage your participation in the B&me Club loyalty program, the data requested in the B&me Account registration form (personal information, contact details, language and country settings, password, communication preferences) is processed. Details regarding bookings and hotel stays, as well as benefits redeemed through the B&me Loyalty Program and the B&me Club Loyalty Program, are stored in the B&me Account and can be accessed there at any time. An identification number is also stored for each member. Participation in the B&me Club Loyalty Program is confirmed via an email sent to the address provided during registration. The email address is used for further communication regarding the B&me Club Loyalty Program. The legal basis for data processing is Article 1(b) of the GDPR. The processing of this data is necessary for registering the user account as well as for establishing and maintaining participation in the B&me Club Loyalty Program. 

The companies of the B&B HOTELS Group, a list of which is available above, are jointly responsible for data processing in connection with the operation of the B&me Club loyalty program. The joint controllers have commissioned B&B HOTELS DIGITAL SERVICES, 9 boulevard Romain Polland, 75014 Paris, France, to provide services related to the administration of the B&me Club loyalty program. B&B HOTELS DIGITAL SERVICES processes the personal data on the basis of a data processing agreement in accordance with the instructions of the joint controllers.

Personal data is stored for the duration of participation in the B&me Club loyalty program. Upon termination of participation in the B&me Club loyalty program, the data will be deleted no later than the expiration of the six-year retention period under commercial law, in accordance with Section 257 of the German Commercial Code (HGB). 

 

  • 6.9       Gift Certificate Shop

The website offers the option to purchase gift certificates for stays at a B&B HOTEL. Information regarding the processing of personal data in connection with this gift certificate shop is available directly in the shop section under “Privacy Policy.” 

 

  • 6.10      Payment Service Providers 

If you use third-party payment services (e.g., PayPal, Visa, Mastercard, Maestro, American Express), the companies of the B&B HOTELS Group work with the payment service provider Adyen N.V. (hereinafter “Adyen”), Simon Carmiggeltstraat 6-50, 1011 DJ, Amsterdam, Netherlands.

Adyen is a full-service payment provider that, among other things, handles payment processing. The data required for the respective payment method is transmitted to Adyen, unless it is collected directly by the respective payment service (e.g., PayPal) itself. 

The credit card number, expiration date, and security code are processed exclusively by Adyen, which merely provides us with a token to guarantee and process the transactions. 

The purpose of this transfer is identity verification, the requested payment processing, the performance of any credit checks, and fraud prevention. To the extent necessary to fulfill contractual obligations, Adyen also transfers personal data to service providers or subcontractors. 

The legal basis for the processing is Article 6(1)(b), (c), and (f) of the GDPR. By transmitting data for identity verification, we fulfill legal obligations regarding customer authentication pursuant to Article 6(1)(c) of the GDPR in conjunction with the Payment Services Directive and the Payment Services Supervision Act. The legitimate interest in the data transfer arises from the purposes outlined above.

The terms and conditions and privacy policy of our partner for electronic payment processing apply. For more information on data protection, visit https://www.adyen.com/de_DE/richtlinien-und-haftungsausschluss/privacy-policy. 

 

  • 6.11      Guest Reviews

To gather feedback from our guests about their stay, we use a review service provided by TrustYou GmbH, Schmellerstraße 9, 80337 Munich, www.trustyou.com. After your stay, you will receive an email from B&B HOTELS Germany GmbH containing a link that allows you to voluntarily submit a review of your most recent stay.  If you choose to submit a review, your name, email address, and/or phone number, IP address, your review score and details of the review, any other data you enter, as well as system data (browser type and version, device used, date and time the review was submitted, referring URL) will be transmitted to TrustYou GmbH and evaluated by TrustYou and B&B HOTELS Germany GmbH. The rating result, details of your review, your first name, the first letter of your last name, and the date of the review may be made publicly available on the website and the app. 

Collecting and analyzing reviews helps us improve our quality.

The legal basis is Section 7(3) of the German Unfair Competition Act (UWG) in conjunction with Article 6(1)(f) of the General Data Protection Regulation (GDPR) (legitimate interest in evaluating and improving the services of B&B HOTELS Germany GmbH).   

 Your responses will be evaluated exclusively for statistical purposes and without any reference to your identity. You may object to the use of your email address for this purpose at any time without incurring any costs other than the transmission costs according to the standard rates. 

TrustYou GmbH acts on behalf of B&B HOTELS Germany GmbH pursuant to a data processing agreement. For more information on how TrustYou handles data, please see TrustYou’s Privacy Policy at: https://www.trustyou.com/downloads/privacy-policy.pdf.

Reviews are made publicly available on the website and the app for a maximum period of 24 months from the date they are submitted. The data collected in connection with a review is stored and analyzed for a maximum period of five years from the date the review is submitted. TrustYou GmbH is authorized to anonymize the data thereafter and to store and use it for analytical purposes without any time or geographical restrictions. 

 

  • 6.12 Conducting Sweepstakes 

We occasionally host sweepstakes or other contests in which guests and other interested parties can participate, e.g., in connection with submitting a guest review. For this purpose, we process the data required for participation, such as names, email addresses, and answers to sweepstakes and contest questions. Subsequently, in the event of a win, address information may be requested in order to send the prize. 

Data processing is carried out solely for the purpose of conducting the sweepstakes or contest, i.e., to identify and notify winners and to send out prizes. 

For sweepstakes and other contests related to submitting a guest review, we rely on the support of TrustYou GmbH, Schmellerstraße 9, 80337 Munich, which acts on our instructions based on a data processing agreement.

To the extent that we obtain your consent in connection with a sweepstakes or contest, this constitutes the legal basis for data processing (Art. 6(1)(a) GDPR). Otherwise, Art. 6(1)(b) GDPR serves as the legal basis, as data processing is necessary for participation in the sweepstakes or contest.

The data will be deleted  after the prize draw or contest  has been completed, unless you have consented to the further processing of your data or a longer retention period is required in connection with redeeming or using a prize. 

 

  • 6.13 Video Surveillance in Hotels 

Video surveillance may be used in certain areas of hotels and their associated premises, particularly parking lots. In this context, images of guests may be recorded and reviewed as necessary. 

Video surveillance is generally conducted within the limits set by law. The legal basis is the legitimate interest in the safety of our guests and hotel property pursuant to Art. 6(1)(f) of the GDPR.

Detailed information on the use of video cameras and data processing in this context can be found on-site at the respective hotels. 

 

  • 6.14 Guest Wi-Fi in Hotels 

In the hotels operated by B&B HOTELS Germany GmbH in Germany, access to guest Wi-Fi is provided. 

When using the guest Wi-Fi, the following data may be processed; some of this data is stored through the use of cookies, while other information may be provided by you on an optional basis: MAC or IP address of the device used, email address, username, name, room number, and check-in date. 

B&B HOTELS Germany GmbH has commissioned m3connect GmbH, Friedlandstraße 18, 52064 Aachen, to provide and operate the guest Wi-Fi system. m3connect GmbH processes your data in accordance with your instructions based on a data processing agreement. 

The legal basis for data processing is Article 6(1)(b) of the GDPR, insofar as the data is necessary for the intended use of the guest Wi-Fi. In the case of information stored in cookies, we also base the processing on our legitimate interests pursuant to Article 6(1)(f) of the GDPR. The cookies are technically necessary to ensure the functionality of the Wi-Fi system. This also constitutes our legitimate interest.

The data is processed for authentication and to ensure the error-free operation of the guest Wi-Fi. 

The data is deleted no later than 10 weeks after collection, unless deletion is precluded by statutory retention requirements. The technically necessary cookies are session cookies with a maximum duration of one day.

For more details, please refer to the instructions provided when registering for the guest Wi-Fi on site. 

 

  • 6.15 Central Telephone Reservation Center 

As part of our services, the B&B HOTELS Group operates a central telephone reservation center, which is also available to the hotels of B&B HOTELS GmbH in Germany. Through this reservation center, you can make reservations by phone and obtain information about your stay. The purpose of this processing is to handle and manage reservations received by phone through the central reservation center; to centrally consolidate and manage reservation data; and to ensure quality and improve our booking service.

Individual calls may be recorded for quality control and employee training purposes. The recordings are used exclusively for internal purposes, are not shared with third parties, and are deleted after 30 days at the latest. The legal basis for this is Article 6(1)(f) of the GDPR (legitimate interest in optimizing our customer service). You will be informed of this before a recording begins and may object to it.

The legal basis for all other processing is Article 6(1)(b) of the GDPR (processing necessary for the performance of a contract or for taking steps at the request of the data subject prior to entering into a contract) as well as Article 6(1)(f) of the GDPR (legitimate interest in the efficient processing of reservations and the optimization of our service offerings). 

The following categories of personal data are processed for this purpose: name, title; address, email address, phone number; booking and travel details (hotel, length of stay, services booked, special requests); payment details (if necessary to secure the booking); and communication content (e.g., the content of phone inquiries or audio recordings, if a recording is made).

The recipients of the data are B&B HOTELS Germany GmbH, the hotels of the B&B HOTELS Group in Germany where a reservation is made, as well as agents and IT and service providers (within the scope of data processing on behalf of the controller).

Personal data is stored for the duration of the reservation processing and the stay. Once the reservation has been fully processed and the statutory retention periods have expired, the data will be deleted.

In addition, we would like to point out that, in the context of calls to the central reservation center, the content of the calls is automatically analyzed by AI-supported software (Amazon Connect). This is used exclusively for quality assurance and to optimize our service processes, in particular to assess the course of conversations, identify sentiment indicators (so-called sentiment analysis), and improve call handling.

The legal basis for this is Article 6(1)(f) of the GDPR (legitimate interest in quality assurance and the improvement of our services). The processing does not involve automated decision-making within the meaning of Article 22 of the GDPR.

If a call is recorded, data subjects are informed in advance and have the option to object to this processing by making the appropriate selection during the telephone announcement.

The AI-supported analysis is carried out exclusively within the framework of data processing on our behalf pursuant to Article 28 of the GDPR by Amazon Web Services EMEA SARL. An adequate level of data protection is ensured through the conclusion of the EU Standard Contractual Clauses pursuant to Article 46(2)(c) of the GDPR.

 

  • 6.16 Direct Mail

We process your name and mailing address to send you selected offers and information about our services by mail. If you are a member of our B&me program or have made a previous booking with us, we may also use information about your booking history or usage status to send you relevant offers.

The legal basis is our legitimate interest in direct marketing to existing customers pursuant to Article 6(1)(f) of the GDPR. For technical processing, we engage carefully selected service providers as data processors pursuant to Article 28 of the GDPR, who are permitted to use your data exclusively for the purpose of carrying out the mailing.

You may object to the use of your data for direct marketing purposes at any time (Article 21(2) of the GDPR) at no cost to you.

 

  • 6.17 External Voucher Providers 

To market our hotel offers, we collaborate with external voucher providers, such as Travelbroker GmbH (“Reiseschein”). Vouchers for overnight stays at our hotels can be purchased through these providers.

As part of this collaboration, both we and the respective voucher provider process personal data as independent data controllers within the meaning of Art. 4(7) of the GDPR. No processing on behalf of another party takes place.

If you purchase a voucher through such a provider, the voucher provider will process your personal data (in particular, your name, contact information, and payment details) to fulfill the purchase agreement, process the payment, and create and send the voucher.

To the extent necessary for redeeming the gift certificate and managing your stay, we receive the required information (e.g., gift certificate and booking details) from the gift certificate provider. We process this information to fulfill the accommodation contract and to manage your stay at our hotels.

The legal basis for the respective processing is Article 6(1)(b) of the GDPR (performance of a contract). To the extent that additional data processing occurs, we base this on Article 6(1)(f) of the GDPR (legitimate interest in the efficient marketing and fulfillment of our offers).

Please note that the respective voucher provider processes your personal data independently. For further information on data processing by the provider, please refer to its privacy policy.

 

  • 6.18 Cashback and Bonus Programs (Payback, Miles&More, Shoop, Topcashback)

If you visit our website via a link from Payback (DE/AT), Miles&More, Shoop, or Topcashback to earn points or miles for your purchase as part of the respective cashback or bonus program, we set a cookie through our affiliate service provider, Tradedoubler GmbH, which is used exclusively to associate your purchase with your cashback/bonus account (click ID, order number, time, and value of the transaction). Since you expressly intended to use this service by accessing the site via the respective portal, the storage of this information or access to it is exceptionally permitted without your separate consent, to the extent that this is absolutely necessary to enable you to receive the credit (§ 25(2)(2) TDDDG). The underlying data processing is based on our legitimate interest in providing these partner programs (Art. 6(1)(f) GDPR). The cookie is not used for any other purposes, in particular for audience measurement or retargeting. The points, miles, or cashback amount will then be credited to your respective customer or bonus account by the relevant provider (Payback, Miles&More, Shoop, or Topcashback), which is solely responsible for data protection under its own terms. For information on how your data is processed by the relevant provider as part of its bonus program, please refer to the provider’s own privacy policy. 

 

7. Cookies 

Our website uses so-called “cookies” and other tracking tools. Details on this and your settings options are provided in our information on cookies and other trackers at https://www.hotel-bb.com/en/cookies-policy.

 

8. Our Presence on Social Media Channels

B&B HOTELS Germany GmbH maintains its own channels on several social media platforms. When you visit our profile on one of these social media platforms, the respective social media platform provider processes your data to create user profiles and to operate and improve its own services. Furthermore, some social media platform providers provide us with analytics regarding the use of our profile in anonymized form. Some of this data processing takes place regardless of whether you are registered on the social media platform yourself. The analytics typically include the following information:

  • Reach metrics regarding the profile, posts, and other features, i.e., the total number of people who have visited or used the profile, posts, and other features;
  • Aggregated data on the age, gender, and location (country, region/city) of the people who visit the profile;
  • Duration of use for videos and other features;
  • Time and location of usage;
  • Devices, operating systems, and software used;
  • Interactions related to posts, e.g., click-through rates, shares, and comments.

With regard to the data processing operations for the purposes of the aforementioned analyses, B&B HOTELS Germany GmbH is jointly responsible with the respective social media platform providers within the meaning of the GDPR and has entered into corresponding agreements regarding joint responsibility.

We have no influence over whether or to what extent the providers collect personal data on their social media platforms. Nor are we aware of the scope, purpose, or retention period of the data collection. It must be assumed that at least the IP address and device-related information are collected and used. It is also possible that the providers use cookies and similar technologies on their platforms to track and analyze user behavior on the platforms and other services offered by the providers.

Some of the providers of social media platforms are based outside the European Union (EU) and the European Economic Area (EEA) (so-called “third countries”), particularly in the United States. Some of these third countries do not have a level of data protection equivalent to that of the EU, or recognition of an adequate level of data protection is subject to further conditions—such as, in the case of U.S. companies, certification under the EU-U.S. Data Framework Agreement. In some third countries, such as the United States, government agencies have extensive rights of access to data held by companies headquartered in those third countries. We cannot rule out the possibility that, even if the providers are based in the EU, data may still be transferred to group companies in the U.S. or in another third country.

Further information on the individual providers of the social media platforms on which we maintain a profile:

 

9. Automated Decision-Making, Profiling 

We do not use automated decision-making as defined in Article 22 of the GDPR to establish or carry out business relationships.

In the area of marketing, we use profiling methods to provide our guests with targeted and relevant information. This takes into account, among other things, past bookings, memberships, or interactions with our website in order to, for example, send personalized newsletters, reminder emails for canceled bookings, or customized advertisements (retargeting). Processing is based on consent pursuant to Article 6(1)(a) of the GDPR or on our legitimate interest pursuant to Article 6(1)(f) of the GDPR; in the case of email advertising to existing customers, Section 7(3) of the German Unfair Competition Act (UWG) also applies.

 

10. Obligation to Provide Data 

To establish, carry out, and terminate a business relationship (e.g., booking, lodging contract, participation in a loyalty program, receipt of a newsletter), it is necessary—or in some cases required by law—that you provide us with personal data. Without this data, a business relationship generally cannot be established or may have to be terminated. In forms, this data is typically marked as required fields. 

During your stay, we are required under applicable municipal statutes, state law, or relevant regulations to disclose certain data regarding guests to the competent authorities or tourism organizations. This applies in particular to the collection and remittance of fees such as the visitor’s tax, the overnight stay tax (also known as the bed tax), or similar municipal special levies.

The data transmitted may include, in particular, the following information: name, address, travel dates (arrival and departure dates), number of traveling guests, and, if applicable, whether an exemption or reduction from the relevant tax applies.

The processing and disclosure of this data is based on Article 6(1)(c) of the GDPR (legal obligation) in conjunction with the respective municipal bylaws or applicable state law.

The recipients of the data are the respective competent municipal authorities (e.g., spa administration, city administration, municipal administration, or tourism organization). The data will not be disclosed beyond this scope.

 

11. Data Security 

We place particular importance on the security of personal data. We implement technical and organizational measures appropriate to the sensitivity of the personal data to ensure the integrity and confidentiality of the data and to protect it from unauthorized access, loss, alteration, or disclosure to unauthorized third parties. These security measures include, for example, the encrypted transmission of data between your browser and our servers. Please note that SSL encryption is only enabled for transmissions over the Internet if the lock icon appears in your browser window and the address begins with https://. TLS (Transport Layer Security) uses encryption technology to protect data transmission from unauthorized access by third parties. If this option is not available, you may also choose not to send certain data over the Internet.

 

12. Your Rights

If we process your personal data, you have the following rights: 

Right of Access (Art. 15 GDPR): You have the right to request information about the personal data processed concerning you. This right also includes the right to receive a copy of the relevant data.

Right to Rectification (Art. 16 GDPR): You have the right to request the immediate rectification of personal data concerning you if it is inaccurate. Taking into account the purposes of the processing, you have the right to request the completion of personal data concerning you if it is incomplete.

Right to erasure (Art. 17 GDPR): You have the right to request that personal data concerning you be erased without undue delay, provided that one of the grounds listed therein applies.

Right to restriction of processing (Art. 18 GDPR): You have the right to request the restriction of the processing of your personal data if one of the grounds listed therein applies.

Right to Data Portability (Art. 20 GDPR): You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used, and machine-readable format, and under certain circumstances, you have the right to transmit this data to another controller without hindrance.

Right to Object (Art. 21 GDPR): You have the right to object at any time to the processing of your data for reasons arising from your particular situation, provided that the data processing is based on a balancing of interests pursuant to Art. 6(1)(f) GDPR. This also applies to profiling based on this provision within the meaning of Article 4(4) of the GDPR. If you object, your personal data will no longer be processed, unless there are demonstrably compelling legitimate grounds for the processing that override your interests, or the processing is necessary for the establishment, exercise, or defense of legal claims.

Withdrawal of Consent (Art. 7(3) GDPR): Pursuant to Art. 7(3) GDPR, you have the right at any time to withdraw your consent to the processing of personal data without providing a reason, with effect for the future. 

With regard to the right of access and the right to erasure, the restrictions set forth in Sections 34 and 35 of the Federal Data Protection Act (BDSG) apply.

 

You can exercise your rights: 

  • at the following email address: datenschutz@hotelbb.com;
  • or via the mailing address: B&B HOTELS Legal Department/Data Protection, Altkönigstraße 10, 65239 Hochheim am Main.

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR in conjunction with § 19 BDSG) if you believe that the processing of your personal data is not lawful. This can be done, for example, with the supervisory authority responsible for B&B HOTELS Germany GmbH: The Hessian Data Protection Commissioner, Gustav-Stresemann-Ring 1, 65189 Wiesbaden, https://datenschutz.hessen.de.

 

13. Changes to the Privacy Policy

We reserve the right to amend this Privacy Policy to adapt it to changes in the legal landscape or to modifications to the service and data processing. However, this applies only to statements regarding data processing. If user consent is required or if parts of the Privacy Policy contain provisions governing the contractual relationship with users, changes will be made only with the users’ consent.

Please review the content of the Privacy Policy regularly.

 

  • Print
    this page
  1. B&B HOTELS
  2. Protection of personal data
  3. B&B HOTELS Germany: Information according to Article 13 ff. of the General Data Protection Regulation (GDPR)