General

If you book a hotel room at acom Hotel Berlin City Süd, acom Hotel Berlin Kurfürstendamm, acom Hotel Köln, or acom Hotel München, the controller of your personal data is Premier Inn GmbH, Friedrich-Ebert-Anlage 49, 60308 Frankfurt am Main, Germany.

If you book a hotel room at acom Hotel Wien, the controller of your personal data is Premier Inn AT Hotelbetriebsgesellschaft GmbH, Sonnwendgasse 8, 1100 Vienna, Austria.

Both companies are members of the Whitbread Group, whose parent company is Whitbread PLC, based in Dunstable, United Kingdom.

If you are dealing with one of the aforementioned companies, the “controller” of your personal information is always the company with which you interact or with which your information has been shared. A “controller” is a company that decides for what reason and in what way your personal information is processed.

Unless otherwise stated, references in this Data Processing Notice to “we,” “our,” “us,” or “acom Hotels” below refer to the respective company that is the controller of your personal data.

Under “How can I get in touch with you” you will find the contact details for your questions.

The data protection officer of Pa Einhundertneununzigste WT Holding GmbH and Premier Inn GmbH for acom Hotels is Andreas Thurmann, DataSolution LUD GmbH, Isarstr. 13, 14974 Ludwigsfelde. The e-mail address of the data protection officer is mail@hoteldatenschutz.de.

You have the right to object to some of the processing of your personal data that we carry out. For more information about your rights and how to exercise them, please see the section “Your rights” below.

This privacy notice applies to:

• • Guests;
  • Visitors;
  • Caller; and
  • other customers.

This privacy notice also applies to anyone who uses our:

• • Website;
  • Applications (“Apps”);
  • Facebook pages
  • LinkedIn pages
  • Xing pages
  • Newsletter
  • Reservation Center;
  • Guest services team; and
  • Hotels and other premises

contacts, visits or uses.

Legal basis for the processing of personal data

As a matter of principle, we collect and use personal data only insofar as this is necessary for the provision of a functional website and our content and services, or we collect and process the data for other purposes independent of the website. We process personal data on the basis of the following legal grounds:

• • Insofar as we obtain the consent of the data subject for processing operations of personal data, Art. 6 (1) lit. a DSGVO serves as the legal basis.
  • When processing personal data that is necessary for the performance of a contract to which the data subject is a party, Art. 6 (1) lit. b DSGVO serves as the legal basis. This also applies to processing operations that are necessary for the performance of pre-contractual measures.
  • Insofar as the processing of personal data is necessary for the fulfillment of a legal obligation (statutory provisions) to which our company is subject, Art. 6 (1) lit. c DSGVO serves as the legal basis.
  • If the processing is necessary to protect a legitimate interest of our company or a third party and the interests, fundamental rights and freedoms of the data subject do not override the former interest, Art. 6 (1) lit. f DSGVO serves as the legal basis for the processing.

We will refer to the relevant terminology in connection with the respective processing so that you can classify on what basis we process personal data.

If personal data is processed on the basis of your consent, you have the right to revoke your consent at any time with effect for the future.

If we process data on the basis of a balance of interests, you as the data subject have the right to object to the processing of personal data, taking into account the requirements of Art. 21 DSGVO.

Summary of the purposes of the processing of your personal data and the legal basis:

• • We process personal data under an accommodation contract to make, change and manage room bookings, perform check-in on the day of arrival, provide hotel services, process and store payment data, and provide other products and services (e.g. meals and parking). We also process inquiries, collect customer feedback, conduct market research and direct marketing (including analytics to create profiles) to promote our business and improve our service and performance.

• • When you book with us, we do not ask for accessibility, dietary requirements, health conditions or any other sensitive personal information. If you (or someone on your behalf) provide us with such information, please note that we may ask for your explicit consent. In some cases, it may be permissible for us to have such information because you may have a vital interest in it.

• • We use contact persons and contact data of business partners and corporate customers exclusively for our own purposes and for the needs-based design of our own sales activities. The legal basis for processing the data is our legitimate interest in data processing. If the contact is aimed at the conclusion of a contract, the additional legal basis for processing is the business initiation relationship or contractual relationship. To increase our services, we manage all data received in the CRM module of our hotel software.

• • The data transmitted to us for job advertisements and applications are used exclusively for processing by the specialist department and for communication. The legal basis for processing the data is the contract initiation relationship or the conclusion of a contract. We will obtain prior consent for forwarding the application documents.

• • We use third-party advertising and analytics cookies on our websites, and similar technologies are included in our marketing emails, as explained in our Cookie Notice. You can reject and block cookies in your browser settings.

• • If you post about our company on social media, we may use your contact information to respond to complaints or comments based on our legitimate interests.

• • In our legitimate interest, we also seek to prevent and detect crime and to protect our business and premises. To this end, we operate video surveillance systems in the hotels.

To fulfill the above purposes:

• • we share your personal information with payment providers, technology providers, insurers, and other specialized professional and technical service providers to manage your bookings, initiate payments, and provide services;

• • If we transfer your personal data outside the European Economic Area (the EU member states as well as Iceland, Liechtenstein and Norway), we will take measures to protect your data;

• • We store your data to fulfill our contract with you or to provide services when required by law, to respond to a question or complaint, to comply with record retention regulations, to preserve or protect contractual or legal rights, when you or another party has a vital interest in doing so, or when it is in our legitimate interest to do so. If we process personal data based on your consent, we will store it for as long as necessary for the stated purpose. In addition, we store your data within the framework of the statutory limitation periods and for tax, legal or official purposes.

If you would like more details regarding our privacy notice, please continue reading below.

Personal information that we collect

We collect personal data when you book with us or commission or use our services. This includes hotel and restaurant visits, use of our website or apps, or correspondence with us. We may also obtain personal data about you from another source. This includes

• • Personal identifiers – title, name, marital status, postal and email addresses, zip code, IP addresses and contact telephone numbers. We may also collect the names of those who are part of a group booking and the ages of children to meet your needs (e.g., to provide a crib) and to allow us to confirm any restrictions that may apply to a room booking;

• • Corporate client information – for corporate clients and business contacts: Job title, business address and business email address;

• • Transaction information – payment, reservation and booking details, including meals, drinks and parking;

• • Membership Information – Details of any premium memberships;

• • Newsletter information – When you register for our newsletter, you provide us with your e-mail address, first name and last name. We use this information exclusively to send you the newsletter. The data you enter when registering for the newsletter will be stored by us until you unsubscribe from our newsletter. You can unsubscribe at any time by using the link provided in the newsletter or by sending us a message to this effect. By unsubscribing, you object to the use of your e-mail address.

• • Facebook Pages Access Data Regarding Facebook Page Views – In connection with our Facebook Pages, we may receive access data from Facebook, which is aggregated data that helps us understand how visitors navigate our site, and may be based on personal data collected during your visit to our site. Solely in connection with the processing of personal data, we are joint controllers with Facebook Ireland Limited. Facebook Ireland Ltd has committed to assuming primary responsibility under the GDPR with respect to the processing of data relating to Insights, so all requests for information and inquiries in this regard should be directed to Facebook Ireland Limited. The Insights Controller Addendum page describes the respective responsibilities and is subject to the jurisdiction of the courts and law of Ireland. The Irish Data Protection Commissioner is the ultimate supervisory authority; and

• • Customer-specific requests and feedback, including complaints – via call centers, e-mails and online free text fields.

Third parties from whom we receive personal data may include:

• • Travel agents, travel agencies, booking agencies, other agencies, tour operators and schools;
  • Corporate clients and public sources of information such as the Commercial Register;
  • Comparison and review portals;
  • Social media;
  • Parking garage operator;
  • Business account operators;
  • Market Researcher;
  • Marketing services and ad technology provider;
  • Government and law enforcement agencies;
  • Other licensees according to the terms of the license;
  • Hotel providers and other organizations as part of their emergency response plans; and
  • Company of the Whitbread group of companies.

How do we use your data and what is the legal basis for this?

To implement a contract or related steps. This is the case when you make a reservation with us or wish to receive other products and services from us, such as meals, and includes:

• • Creating, modifying or managing your room reservations and meal orders;
  • Providing the products and services you want;
  • Verification of your identity;
  • Fulfillment of the legal obligation to report,
  • Payment Processing;
  • Managing your Premier Inn business account;
  • Communication with you;
  • Providing customer service, including complaint management; and
  • Notify you by text message, email or phone if an unplanned event occurs that requires us to make other arrangements under our contract (or if we believe you have a vital interest in doing so).

If the information we request is not provided, we may not be able to enter into a contract or comply with our legal obligations.

In our legitimate interest in conducting our business, in particular:

To ensure customer satisfaction, maintain business value and resolve disputes:

• • We provide technical support, and investigate and address any complaints about our website or our products or services and maintain appropriate records for internal administrative purposes. We reserve the right to request evidence of any claims or complaints.

To protect our business operations and prevent fraud:

• • Monitor, test and review the performance and security of our systems, networks, processes and premises to prevent and detect fraud and protect our business operations; and
  • If you provide a credit or debit card as a means of payment, we use third-party vendors to verify the validity of your bank account or card information to prevent fraud.

For business performance and improvement:

• • Observing and recording video surveillance data, call center communications, including inbound and outbound calls and emails, for employee training and quality improvement and fact-finding purposes; and
  •  Analyze transactions to improve our services and products and plan our business development.

For the safety of our guests and employees:

• • For the protection of the premises and for security purposes, including information recorded by video;
  • For monitoring food safety and hygiene;
  • To obtain statements from witnesses regarding accidents and other incidents; and
  •  for the detection and prevention of crime.

Development and marketing of products and services:

• • to increase brand awareness;
  • to better understand you as a customer by analyzing your transactions and other information you provide to us or that we learn through your interactions with us;
  • to send marketing (including profiling), sweepstakes and promotions by mail, email, SMS and push notifications, as permitted by law;
  • to provide you with personalized promotional offers where permitted by law;
  • We may also use your information to provide you with personalized promotional offers on selected partner websites (e.g., you may see an advertisement for our products on a partner website such as Facebook or Google);
  • We also share some of your information with marketing service providers and ad technologies, as well as digital marketing networks such as Facebook, Google, Adobe, and Rocket Fuel, to show ads that may interest you.

For example, we may share information about you with such providers so that they can recognize your devices and provide you with interest-based content and advertising. This information may include your name, email address, device ID or other identifier in encrypted form. The providers may process the information in hash form. These vendors may collect additional information from you, such as your IP address and information about your browser or operating system; may combine information about you with information from other companies in data sharing partnerships in which we participate; and may place or recognize their own unique cookie on your browser. These cookies may contain demographic or other data in anonymized form;

• • to monitor the use of our website and apps to improve their performance and optimize our media spend;
  • we use personal information about some individuals to invite them to provide feedback or participate in market research activities; and
  • for the development of the company’s business and application of tariffs.

For legal and regulatory purposes:

• • We process personal data in connection with the pursuit and defense of legal claims (including disclosure of such information court proceedings), as well as for regulatory purposes;
  • we process personal data to comply with health and safety regulations, e.g. logging of accidents;
  • we process personal data to prevent, investigate and report suspected fraud, terrorism, security incidents or other crimes in accordance with applicable law; and
  • to anonymize personal data when we no longer process it.

Where we have relied on legitimate interests for processing, we have carried out a balancing of interests. For further details on this balancing, please contact our data protection officer at mail@hoteldatenschutz.de.

Provided you have given us your consent,

• • we will send you emails, texts and push notifications (including newsletters) regarding products and services provided by us or by our named affiliates and carefully selected partners;
  • we place cookies and similar technologies on your computer, cell phone or other device and use these technologies, including pixel tags and web beacons, in marketing emails and communications (see also our Cookie Notice) when you use our website or apps;
  • we may perform credit checks when you apply for a business account (“Business Account”);
  • to participate in contests we run and, if you win, to use your information for promotional purposes;
  • We will process health information, such as dietary, accessibility, and allergy information, that you or someone on your behalf provides to us (we may also do this if you have a vital interest in this); and
  • if you make a donation to a charitable organization, we will process your corresponding payment; and
  • on other occasions when we ask for your consent, we will use the personal data for the purpose we explain at that time.

You have the right to revoke any consent given at any time.

For purposes required by law:

• • When checking into our hotels in Germany, we must comply with the requirements of national registration laws. Domestic guests are required to fill out a registration form and provide the dates of travel, name, birthday, address, nationality and the number of fellow travelers. Foreign guests are additionally required to provide the number of a passport or other identity card.
  • In response to government, law enforcement or intelligence requests and court orders;
  • When necessary to comply with health and safety regulations to which we are subject;
  • We may be required to share information with other licensees in accordance with their respective license terms; and
  • Responding to data privacy inquiries from data subjects.

To protect your vital interests or those of another person:

• • We disclose your personal information to emergency services when we believe it is necessary to protect your vital interests or the vital interests of another person; and
  • If you (or someone acting on your behalf) provide us with nutrition or other personal health information, such as allergies.

Other recipients to whom we disclose your personal information

Group companies

We share your personal information with the Whitbread group of companies to manage hotel services and products. Details of the Whitbread Group of Companies can be found on our corporate website at www.whitbread.co.uk. The group also includes Premier Inn GmbH and Pa One Hundred Ninety-Nine WT Holding GmbH. We share data within the Whitbread Group of Companies when Whitbread Group plc provides us with support, consulting, IT, security and video surveillance and other services.

Service provider

For some activities, we use external service providers, including when we are joint controllers. Your personal data will be shared with these organizations when necessary to provide a service or when it is in our legitimate interest to do so. You will be informed separately when a third party and we are acting as joint controllers. We use third party service providers to:

• • Manage bookings;
  • To provide W-LAN;
  • To provide parking facilities;
  • Conduct customer feedback surveys;
  • perform analyses;
  • To send promotional offers;
  • send personalized advertising;
  • to advertise vacancies in our hotels,
  • Offer insurance;
  • Provide IT development, support, maintenance and hosting, including application deployment and website hosting;
  • Process payments so you can pay by credit or debit card;
  •  Conduct credit and fraud controls; and
  • Provide and maintain video surveillance systems.

Other parties

Personal data may be disclosed to regulatory authorities, government agencies and/or law enforcement agencies for the prevention or detection of crime when required by law, to enforce legal or contractual claims, or for regulatory reasons.

We share your personal information with payment providers, technology providers, insurers, and other specialized professional and technical advisors to manage your bookings, initiate payments, and provide services.

Restructuring and sale

There is a possibility that we will restructure our group of companies in such a way that different group companies will operate our hotels and provide the related services. In this case, we will inform you and your data may be transferred to this company and processed as described in this notice. In the event that a company is sold or integrated into another company, we may share your data with our advisors and the advisor of a potential buyer and in any case with the new owners of the company.

If the Whitbread Group expands its business by acquiring new hotels and/or companies, your personal data may be transferred to these hotels and companies, in particular if this is necessary to carry out your booking.

International transmissions

Sometimes we may need to send or store your information outside the European Economic Area (the EU plus Iceland, Liechtenstein and Norway) (“EEA”). For example, to follow your instructions, to comply with a legal obligation, or to cooperate with or obtain services from our service providers that we use to manage your accounts and our services.

When we transfer information outside the EEA, we ensure that it is protected by one of these safeguards:

• • Transfer to a non-EEA country with data protection laws that provide the same level of protection as the EEA. Some countries have been deemed appropriate by the EU.
  • Entering into a contract with the recipient that includes that the recipient must protect your data to the same standards as within the EEA or use other mechanisms and measures to achieve adequate protection. We may also use the standard data protection clauses published by the EU.
  • Binding internal data protection rules (Binding Corporate Rules). These are internal rules issued by Group companies to enable international transfers of personal data to companies in the same corporate group in countries that do not offer an adequate level of protection.

For our service providers in the U.S., we use the 2021 version of the EU standard data protection clauses, for example, for vendors who transfer reservation data into our hotel software or help us with our customer feedback surveys. We rely on contractual measures for a small number of our suppliers who have or use offices outside the EEA and who have limited access to some data to provide us with IT services such as development, testing, support and maintenance. For more information about the mechanisms used and a copy of the measures selected, please contact our Data Protection Officer using the following email address: mail@hoteldatenschutz.de.

Essential automated decision making

Like many companies, we use corporate rules for financial and other information to detect and prevent fraud. When used, these can identify a risk so that a particular transaction cannot be processed.

What rights do I have?

Revocation of consent

Wherever we rely on your consent, you can always revoke it at any time with effect for the future. We will continue to process your personal data for other purposes on another legal basis (other than consent), where applicable.

Objection to data processing, including direct advertising

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of legitimate interests, is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, including profiling. After your objection, we will not further process your personal data unless we can demonstrate compelling grounds for the processing which override your interests, rights and freedoms, or the processing is for the establishment, exercise or defense of legal claims.

Where personal data is processed to carry out direct marketing, you have an unrestricted right to object at any time to direct marketing and any profiling we carry out for direct marketing. You can do this by clicking on the ‘unsubscribe’ link located in the footer of any marketing email or text message or by contacting us (see contact details below). If you object to our processing of data to engage in direct marketing, we will no longer process your personal data for these purposes.

If you have a relationship with another organization, such as a social media platform like Facebook, we may ask them to send marketing to you if you have consented to this. If you object to receiving marketing from us, we will stop marketing to you. However, please contact the organization directly if you wish to withdraw your consent regarding marketing by that organization.

Other restricted rights

• • You have the right to know whether we process information about you and to request information about it.

• • You have the right to update, correct and complete any information we hold about you if it is inaccurate or incomplete.

• • You have the right to receive the personal data that you provide to us for a contract or with your consent in a common, structured and machine-readable format and to request us to disclose (transfer) this personal data to another controller.

• • You have the right to request that we delete your personal data or restrict its processing.

• • In addition, you may object to the processing if the legal basis is our legitimate interests.

The above rights are limited if the fulfillment of your request discloses personal information about another person or you request us to delete information that we are required by law to retain. We will inform you of relevant restrictions that we rely on to respond to your request.

To exercise these rights, you may contact our Data Protection Officer, mail@hoteldatenschutz.de.

If you have concerns in connection with our processing of personal data, you have the right to lodge a complaint with a data protection supervisory authority, in particular the authority in the country where you live, work or where your complaint arises. The contact details of the competent German supervisory authority can be found at https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html. Details of all EU supervisory authorities can be found at http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612080.

How long do you store my personal data?

We store your data to fulfill our contract with you or to provide services, when required by law, to respond to a question or complaint, to comply with record retention regulations, to preserve or protect contractual or legal rights, or when you or another party has a vital interest in doing so, or when it is in our legitimate interest to do so. If we process personal data on the basis of your consent, we will only store it for as long as is necessary for the stated purpose. In addition, we store your data within the framework of the statutory limitation periods and for tax, legal or official purposes.

The period for which we retain your personal data depends on the purposes for which we process it, and if the same personal data is processed for two or more purposes, we retain it for the longer period. For example, we store:

• • Records of video surveillance up to 48 hours;
  • incoming and outgoing voice recordings for up to 1 year (although we will keep the consent you give us during a call for as long as we rely on it as a lawful basis for processing);
  • any personal data we have processed for the management of your hotel or restaurant bookings, for up to 25 months after your last stay;
  • any personal data we have processed in connection with inquiries, complaints or feedback regarding your hotel or restaurant bookings, for up to 36 months after settlement;
  • personal data that we have processed for marketing purposes (including profiling) for a period of 3 years after you last contacted us, unless you ask us to stop sending you electronic direct mail, whereupon we will stop sending you electronic direct mail and store your instructions to do so indefinitely;
  • Accident report forms for 3 years (or for accidents involving a child, for 3 years after the child’s 18th birthday);
  • Financial and transactional data for information and analysis purposes for up to 10 years in Germany and up to 7 years in Austria; and

In any of the above cases, we may retain personal data for longer periods of time if necessary for internal or external investigations or litigation. In these cases, the data may be stored until the matter is resolved. We reserve the right to store your data longer within the framework of statutes of limitations or if we cannot delete it, e.g. for tax, legal or regulatory reasons.

You have the limited right to request the deletion of your personal data at any time, or we can have your personal data deleted ahead of time, e.g. if we no longer need to process it.

When you call up our website, you transmit data to our web server (out of technical necessity) via your Internet browser. The following data is recorded during an ongoing connection for communication between your internet browser and our web server:

• • Date and time of the request
  • Name of the requested file
  • Page from which the file was requested
  • Access status (file transferred, file not found, etc.)
  • Web browser and operating system used
  • Complete IP address of the requesting computer
  • volume of data transferred.

For reasons of technical security, in particular to defend against attempted attacks on our web server, this data is stored by us for a short period of time. It is not possible for us to draw conclusions about individual persons on the basis of this data. After seven days at the latest, the data is anonymized by shortening the IP address at domain level, so that it is no longer possible to establish a link to the individual user. The data is also processed in anonymized form for statistical purposes; it is not compared with other data or passed on to third parties, even in excerpts.

Cookies and other similar technologies we use

Information about the cookies and other technologies we use are both available in our Cookie Notice.

How can I reach you?

General data protection issues

If you have any questions about the processing of your personal data, please contact our data protection officer at the following e-mail address: mail@hoteldatenschutz.de.

This privacy policy was last updated on March 1, 2023. Changes to this privacy policy will be communicated on our website.