We take the protection of your personal data very seriously. We will treat your personal data confidentially and in accordance with this data protection declaration and the statutory data protection regulations.
We would like to point out that internet data transmission (e.g. communication via email) can be subject to security risks. It is therefore not possible to ensure complete protection of the data from third party access.
1. Name and contact information of the responsible authority
The responsible body for data processing on this website is:
aletto Service und Marketing GmbH
Tel: +49 (0)30 233 214 100
Fax: +49 (0)30 2332142-19
2. Name and address of the data protection officer
Our external data protection officer can be contacted as follows:
Data protection supervisor
microPLAN IT-Systemhaus GmbH
3. Collection of personal data
We process personal data during your visit to our website and our company.
According to Art. 4 para. 1 GDPR, personal data is all information relating to an identified or identifiable natural person.
We collect and process the following data:
Inventory data (e.g. names, addresses),
Contact data (e.g. telephone number, email),
Content data (e.g. text entries),
Usage data (e.g. websites visited, interest in content, access times),
Meta/communication data (e.g. device information, IP addresses).
a) Collection of personal data when you visit our website
If you use our website for informational purposes only, we collect the following data that is technically essential for us to display our website to you and ensure its stability and security:
- IP address
- Date and time of the request
- Time zone difference to Greenwich Mean Time (GMT)
- Content of the request (concrete page)
- Access status/HTTP status code
- Amount of data transferred in each case
- Website from which the request originates
- Operating system and its interface
- Browser type
- Language and version of the browser software.
This data is collected on the basis of Art. 6 para. 1 sentence 1 (f) GDPR.
This data is not merged with other data sources.
b) Collection of personal data for enquiries by telephone, email or contact form
We store the data you provide (e.g. name, telephone number, email address) when you contact us via telephone, email or our contact forms.
Additional personal data, including address and date of arrival and departure, is also recorded for contractual measures in the case of a booking.
The data collected within this context will be used to process your questions, forwarded to our service provider “aletto Kudamm GmbH” or "aletto Potsdamer Platz GmbH" for processing and deleted after storage is no longer necessary. Where legal retention periods exist, storage will be restricted accordingly.
Data processing for the purpose of establishing contact with us is carried out in accordance with Art. 6 para. 1 sentence 1 (a) GDPR on the basis of your voluntarily given consent or in accordance with Art. 6 para. 1 sentence 1 (b) GDPR, insofar as your enquiry is connected with the fulfilment of the accommodation contract or is necessary for the implementation of pre-contractual measures.
c) On site data collection in the aletto Hotel
We collect further data from you on site. This includes registration forms, in which we collect personal information from our guests. In particular, we make a note of the date of arrival and expected departure, first and last name, date of birth, nationality, address, in the case of travel companies the number of fellow travellers and their nationality, as well as the passport number or passport replacement in the case of foreign persons. We process this data for the fulfilment of the contract (Art. 6 para. 1 sentence 1 (b) GDPR) and for the fulfilment of our legal obligations (Art. 6 para. 1 sentence 1 (c) GDPR in conjunction with § 30 BMG). As a matter of principle, registration forms shall be kept for one year from the date of arrival and shall be destroyed within three months after the retention period has ended in accordance with § 30 para. 4.
d) Data processing on payment:
In order to make your booking as pleasant as possible, we offer different payment methods. The first option is to pay on arrival. In this case your payment details will be recorded at the hotel. You can also pay online. In order to enable you to make online payments, we offer you the option of making your payment via various payment service providers.
In the following you will find the payment service providers with whom we cooperate:
PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A, 22-24 Boulevard Royal, L-2449 Luxembourg, Luxembourg
Data protection declaration: https://www.paypal.com/de/webapps/mpp/ua/privacy-full
Klarna: Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden
Data protection declaration: https://www.klarna.com/de/datenschutz/
Saferpay: SIX Payment Services (Europe) S.A, 10, rue Gabriel Lippmann, 5365 Munsbach, Luxembourg
Data protection declaration:: https://www.six-payment-services.com/de/services/legal/privacy-statement.html
Datatrans: Datatrans AG, Kreuzbühlstrasse 26, CH-8008 Zurich, Switzerland
Data protection declaration: https://www.datatrans.ch/de/datenschutzbestimmungen/#google-maps
When you make a payment, we only obtain the information that it has been received. Information you provide to the aforementioned payment service providers within the framework of payment processing is not passed on to us.
We want our guests to be able to pay easily and securely with a payment service provider of their choice.
Data processing by the above-mentioned payment service providers serves to fulfil the accommodation contracts in accordance with Art. 6 para. 1 sentence 1 (b) GDPR. The storage of the data takes place within the context of the legal retention periods.
When you use our website, cookies are stored on your computer. Cookies are small text files which are stored on your computer by your browser. They cannot execute programmes or transmit viruses to your computer, but serve to make the online offer more user-friendly and effective overall.
aa) Necessary Cookies
Necessary cookies help to make a website usable by enabling basic functions, such as page navigation and access to secure areas of the website.
So-called transient cookies store a so-called session ID, with which various requests from your browser can be assigned to the shared session. This allows your computer to be recognised when you return to our website. They are automatically deleted when you close your browser or log out.
You can generally set your browser to inform you about the download of cookies and only allow cookies in individual cases, accept cookies for certain cases or generally exclude them, as well as activate the automatic deletion of cookies when closing the browser. If cookies are deactivated, the functionality of this website may be restricted.
Cookies which are necessary for the performance of the electronic communication process are stored on the basis of Art. 6 para. 1 sentence 1 (f) GDPR.
bb) Statistics, marketing
Cookies also help us to tailor our website to your needs, such as your language or preferred areas of interest. In accordance with Art. 6 para. 1 sentence 1 (a) GDPR, we will request your consent in advance for cookies used for statistical or marketing purposes.
Third party cookies are used by third parties to collect information from users and to create targeted advertisements.
Persistent cookies are automatically deleted after a specified period, which may vary depending on the cookie. Further information on the various cookies can be found separately in this declaration.
Below you will find a list of browsers, in which you can learn more about the configuration of cookies:
For Internet Explorer:
4. Disclosure of personal data to third parties
The user’s personal data will be treated confidentially and will only be passed on to external service providers within the scope of Art. 6 para. 1 sentence 1 (b) and (f) GDPR if this is necessary for the fulfilment of the accommodation contracts, for the processing of enquiries or for the correct presentation of our company and services.
With regard to bookings we work together with the following service provider: ASSD GmbH, Hauptstr. 8b, 82008 Unterhaching, Germany.
In addition to the service providers and companies mentioned in this data protection declaration, this may include IT service providers who maintain our systems and data centres that store our website and databases.
The external service providers are obligated to treat the data confidentially and securely and may only use this data to the extent necessary to fulfil their task.
Our external service providers are carefully selected and commissioned by us. A separate order processing agreement has been concluded with the service providers to ensure the protection of your personal data.
Otherwise, personal data will only be disclosed if the user has expressly consented in advance (Art. 6 para. 1 sentence 1 (a) GDPR), if there is a legal obligation (Art. 6 para. 1 sentence 1 (c) GDPR) or if processing is carried out to safeguard our legitimate interests (Art. 6 para. 1 sentence 1 (c) GDPR). Transmissions to authorities or state institutions with a right to information will only take place if there is a statutory duty to provide information or if a judicial decision is taken (Art. 6 para. 1 sentence 1 (c) GDPR).
If necessary, we may be obliged by law to disclose your data to third parties. We shall only comply with such requests to the extent that this is necessary within the framework of a statutory obligation. Any consent given by you to the sharing of the data can be revoked at any time and without giving us reasons.
5. Transfers to third countries
If we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)) or if this is done within the context of the use of third-party services or disclosure or transfer of data to third parties, this will only occur if it is done to fulfil our (pre)contractual obligations, on the basis of your consent, a legal obligation or on the basis of our legitimate interests. Subject to legal or contractual permissions, we process or allow the data to be processed in a third country only if the special requirements of Art. 44 et seq. GDPR are met. This means that data processing takes place on the basis of special guarantees, for example, such as the officially recognised determination of a data protection level corresponding to that of the EU (e.g. for the USA through the “Privacy Shield”) or the observance of officially recognised special contractual obligations (so-called “standard contractual clauses”).
6. Use of Google Analytics
With your consent pursuant to Art. 6 para. 1 sentence. 1 (a) GDPR, we use Google Analytics on our website to analyse and regularly improve the use of our website.
Google Analytics is a web analytics service provided by Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001. (“Google“).
You can revoke your consent to the use of Google Analytics at any time with effect for the future here.
The user conditions are listed at https://marketingplatform.google.com/about/analytics/terms/de/ and an overview of data protection at https://policies.google.com/privacy?hl=de&gl=de
Google also processes your personal data in the US and has therefore submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.
7. Integration of Google Maps
In order to be able to display interactive maps and provide you with comfortable use, we use “Google Maps” of the provider Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland on the basis of Art. 6 para. 1 sentence 1 (a) GDPR with your consent.
When you visit our website, Google receives the information that you have accessed the corresponding subpage of our website. In addition, the data mentioned under “Collection of personal data when visiting our website” is transmitted. This occurs regardless of whether Google provides a user account that you are logged in to or whether there is no user account. If you are logged in to Google, your information will be directly associated with your account. If you do not want your profile to be associated with Google, you must log out before activating the button. Google stores your data as user profiles and uses them for the purposes of advertising, market research and/or the design of its website as required. Such evaluation is carried out in particular to provide demand-oriented advertising and to inform other users of the social network about your activities on our website (even for users who are not logged in).
You can revoke your consent to the use of Google Maps at any time with effect for the future here. Further information on your rights in this regard and settings options for the protection of your privacy can be found at https://policies.google.com/privacy
Google also processes your personal data in the US and has therefore submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework
We have integrated Google Ads on our website to promote our website by displaying interest-based advertisements on third-party websites and in Google search engine results. The legal basis for this is your consent pursuant to Art. 6 para. 1 sentence 1 (a) GDPR. The company operating the Google Ads services is Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001. (“Google“).
A conversion cookie is used to store personal information, such as the web pages visited by the person concerned. Each time you visit our website, personal data, including the IP address of the Internet connection used by the person concerned, is transferred to Google and stored. Google may share this personal information collected through the technical process with third parties.
This data and information is used by Google to compile visit statistics for our website. These visit statistics are in turn used by us to determine the total number of users and thus the success or failure of the respective ads and to optimise our ads for the future. Neither our company nor other Google Ads advertisers receive information from Google that could identify the individual concerned.
You can revoke your consent to the use of Google Ads at any time with effect for the future here. More information and Google’s current data protection declaration can be found at https://policies.google.com/privacy .
With your consent, we use plug-ins from the YouTube online video portal on our website in accordance with Art. 6 para. 1 sentence 1 (a) GDPR. The operator of the pages is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, Telephone: +353 1 543 1000, Fax: +353 1 686 5660, Email:support-deutschland@ When you visit one of our pages equipped with a YouTube plug-in, a connection is established with the YouTube servers. google.com
YouTube and Google will receive information through the YouTube component that the person concerned has visited our website whenever that person is logged into YouTube at the same time as accessing our website, regardless of whether that person clicks on a YouTube video or not.
You can revoke your consent to the use of Google Ads at any time with effect for the future here. The data protection regulations published by YouTube, which are available at https://policies.google.com/privacy provide information about the collection, processing and use of personal data by YouTube and Google.
There is a link to Facebook on our website.
Facebook is operated by Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
Facebook can detect the IP address of the user. For without the IP address, they would not be able to send the content to the respective user’s browser. The IP address is therefore required, in order to display the content. We have no control over whether Facebook stores the IP address for statistical purposes, for example.
We have no influence on the extent of the data that Facebook collects with the help of this link and therefore inform you according to our state of knowledge:
If you are logged in to Facebook, Facebook can assign the visit to your Facebook account. If you are not a Facebook user, there is still a possibility that Facebook may learn and store your IP address.
The purpose and scope of the data collection and further processing and use of the data by Facebook, as well as your rights in this regard and settings options to protect your privacy can be found in Facebook’s data protection information: https://www.facebook.com/policy.php. If you are a Facebook member and do not want Facebook to collect data about you via our website and link it to your Facebook member data, you must log out of Facebook before visiting our website.
We have integrated a link to Instagram on our website. Instagram is a service that qualifies as an audiovisual platform that enables users to share photos and videos and also disseminate such data on other social networks.
The operator of Instagram’s services is Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2 Ireland.
If the person concerned is logged in to Instagram at the same time, Instagram recognises the person concerned and which pages the person visits when the link is opened. This information is collected by the Instagram components and assigned by Instagram to the Instagram account of the person concerned.
We have integrated a link to the microblogging service Twitter on our website.
The current Twitter data protection declaration is available at https://twitter.com/privacy?lang=de .
13. Use of the Triptease services:
With your consent pursuant to Art. 6 para. 1 sentence 1 (a) GDPR, we use the Triptease service to analyse user behaviour. The operating company in Europe is Triptease Ltd, WeWork Bishopsgate, 15 Bishopsgate, London; tel: +44 (0) 203 950 7688.
We may share a limited amount of your information (such as room search, email address and name if you provide it) with the Triptease Group (“Triptease”) and use Triptease to collect data for analysis purposes when you visit our website to book a stay with us. As our shared data controller, Triptease analyses your use of our website and tracks it through cookies and similar technologies so that we can improve our service.
14. Rights of data subjects
Pursuant to Art. 16 GDPR, you have the right to request the completion of data concerning you or the correction of incorrect data concerning you.
Pursuant to Art. 17 GDPR, you have the right to demand that the relevant data be deleted immediately or, alternatively, to demand a restriction on the processing of the data pursuant to Art. 18 GDPR.
You have the right to request information from the responsible person about the recipients who the responsible person has notified of a correction, deletion or restriction of the processing of your personal data in accordance with Art. 19 GDPR.
You have the right to demand that we receive the data concerning you that you have provided to us in accordance with Art. 20 GDPR and to demand that it be transferred to other responsible parties.
You also have the right to appeal to a supervisory authority pursuant to Art. 77 GDPR.
15. Right of withdrawal
You have the right to revoke your consent at any time with effect for the future in accordance with Art. 7 para. 3 GDPR. You can revoke your consent to cookies here. An informal email notification to us is sufficient to revoke other consents. The revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent up to the time of revocation.
16. Right of objection
You may object at any time to the future processing of the data concerning you in accordance with Art. 21 GDPR. The objection may in particular be lodged against processing for the purposes of direct marketing.
You can find all the information you need to apply for a job with us on our “About Us” page. You have the option of applying to us electronically. For the processing of your application we collect the following data: First and last name, email address, application documents (e.g. curriculum vitae, certificates).
We collect and process the personal data of applicants for the purpose of handling the application procedure in accordance with Art. 6 para. 1 sentence 1 (b) GDPR and § 26 para. 1 BDSG-neu. Further processing will not take place or will only take place with your effective consent pursuant to Art. 6 para. 1 sentence 1 (a) GDPR in conjunction with Art. 7 GDPR.
With your express consent pursuant to Art. 6 para. 1 sentence 1 (a) GDPR, we may also save your application for future job placements for a predetermined period of time. In the event of revocation, your application can no longer be considered for the application procedure.
If we conclude an employment contract with an applicant, the transmitted data will be included in your personnel file for the purpose of processing the employment relationship on the basis of Art. 6 para. 1 sentence 1 (b) GDPR and § 26 para. 1 BDSG. In this case, your application documents will not be deleted and destroyed until the employment relationship is terminated and another three years have elapsed since the end of the year of termination.
If no employment contract is concluded with the candidate, the application documents shall be automatically deleted six months after notification of the rejection decision, unless deletion conflicts with any other legitimate interests of the controller. Another legitimate interest in this sense is, for example, an obligation to provide evidence in proceedings under the General Equal Treatment Act (Allgemeines Gleichbehandlungsgesetz - AGG).
18. Deletion of Data
According to legal requirements in Germany, storage takes place mainly for 10 years according to §§ 147 para. 1 AO, 257 para. 1 no. 1 and 4, para. 4 HGB (books, records, management reports, accounting documents, commercial books, for taxation of relevant documents etc.) and 6 years according to § 257 para. 1 no. 2 and 3, para. 4 HGB (commercial letters).