Privacy policy

1. Controller

Hotel Johnel GbR
Represented by Detlef Krey and Ernst Josef Krey
Frankfurter Straße 152
53773 Hennef (Sieg)
Email: info@hoteljohnel.de
Telephone: 02242 969830

2. Providing the website

When you access our website, technically necessary connection data must be processed, including your IP address, access time, requested page and browser and system information. This is necessary to deliver content to your device, maintain availability and prevent attacks or misuse.

The application and its reverse proxy do not keep general access logs containing full IP addresses. IP addresses may be processed temporarily for specific security functions, including access restrictions and protection against excessive requests. In the relevant database tables, they are stored only as keyed one-way hashes. Retention periods are set out under “Retention”.

3. Room enquiries and bookings

When you request a room online, we process the contact, travel, room and, where applicable, company information you provide, the ages of accompanying children if supplied, and voluntary free-text entries. This enables us to check availability and prices, handle your enquiry, prepare or perform the accommodation contract and communicate with you. The legal basis is Article 6(1)(b) GDPR.

Required fields are marked in the enquiry form. Without these details, your enquiry cannot be submitted and processed. Other fields are optional.

4. Contact and company enquiries

For contact and company enquiries, we process the information supplied to respond and communicate with you. If the enquiry concerns a contract, the legal basis is Article 6(1)(b) GDPR. For other enquiries, the legal basis is Article 6(1)(f) GDPR; our legitimate interest is to respond appropriately to enquiries addressed to the hotel.

5. Enquiry status

The online status can be checked using the enquiry number and surname. Results are limited to information needed by the guest and protected against excessive requests. Processing is based on Article 6(1)(b) GDPR for pre-contractual measures or performance of the accommodation contract and Article 6(1)(f) GDPR to protect the service.

6. Email communication

Enquiry, booking, cancellation and service emails, as well as notifications about contact and company enquiries, are sent through the hotel's configured email infrastructure. We process the recipient address and the booking or enquiry information needed for each message. Staff responsible for handling these matters receive the necessary details. For contact and company enquiries, the supplied email address is also used as the reply-to address in the hotel notification so the hotel can reply directly.

The website outbox retains complete message content only until successful sending. After sending, text and HTML content, including personal management links, is removed from the website backend. Recipient addresses and subject lines are retained for technical verification and troubleshooting for no more than 14 days and then cleared. Messages that remain unsent are discarded after no more than 14 days.

Optional thank-you and review email

If you give separate consent in the enquiry form, we may send one thank-you email with an invitation to review us on Google on the day after a stay confirmed as completed by the hotel. This is optional and does not affect your room enquiry. Processing is based on your consent, which you can withdraw at any time by emailing info@hoteljohnel.de. Anonymised records, declined or cancelled enquiries and no-shows are excluded. The review link connects to Google only when clicked; no email tracking pixels are used.

7. Legal bases

Depending on the processing, we rely on Article 6(1)(b) GDPR for pre-contractual steps and performance of the accommodation contract; Article 6(1)(c) GDPR for legal obligations, particularly commercial and tax retention; Article 6(1)(f) GDPR for secure and economical website operation, prevention of misuse, answering general enquiries and data-minimising improvements to our enquiry process; and Article 6(1)(a) GDPR when you expressly consent to loading Google Maps.

8. Google Maps on the directions page

You can choose to display Google Maps on our directions page. The map does not load or connect to Google until you click “Load map”.

Google Maps is embedded only after you choose to load it. For users in the European Economic Area, the provider is generally Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Processing by Google LLC and other Google companies, including in the USA, is possible. Your IP address and browser and device information may be transferred. Depending on your device, browser and Google settings, further data, such as location information or information from cookies or browser storage, may be processed.

The map is loaded on the basis of your consent under Article 6(1)(a) GDPR. Where Google stores or reads information on your device, Section 25(1) TDDDG also applies. Consent is voluntary and not required to use the rest of the website. We do not permanently store your choice. You can withdraw consent for the future by reloading or closing the page; the map will load again only after another click. Processing before withdrawal remains lawful.

According to Google, transfers to Google LLC in the USA rely, where applicable, on the adequacy decision for the EU–US Data Privacy Framework, under which Google LLC is certified. Google cites standard contractual clauses for other transfers. Further information is available in Google's privacy policy and in Google's information about data transfers.

Alternatively, use “Open route in Google Maps”. Only when you open that external link do you leave our website and access Google Maps directly.

9. Cookies and browser storage

The public website does not set its own cookies or store identifiers in localStorage or sessionStorage for its core functions. The flow identifier used for data-minimising enquiry analysis exists only in memory while the enquiry page is open and is not stored permanently in the browser. No consent prompt is displayed for these core public functions. Optional visitor statistics are described separately below.

The protected hotel administration area uses only technically necessary session and MFA cookies configured as HttpOnly and SameSite=Strict. These enable the requested login and protect administration. Device access is based on Section 25(2)(2) TDDDG.

10. Data-minimising website and enquiry analysis

To improve the operation of our website, we record a small number of first-party events in the enquiry process, such as opening the enquiry page, checking availability, choosing a room and submitting an enquiry. No third-party analytics or marketing services are loaded for this purpose, and no analytics cookies or localStorage identifiers are set.

A random flow identifier generated when the enquiry page opens exists only during that page view and is stored server-side only as a hash. This allows steps within one enquiry process to be counted without building a persistent user profile. We store only the event type, time, room category where relevant, a broad source category such as direct access, Google or a campaign, and a broad device category. The device category is derived server-side from browser information already transmitted in the HTTP request; the full user agent is not stored for this analysis. IP addresses are not stored in the analytics table.

Processing helps identify technical problems, improve the enquiry process and analyse demand for rooms and offers. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the secure, economical and user-friendly operation of our direct enquiry service. Analytics data is not shared with advertising or analytics providers. Google Maps is activated separately using the two-click procedure described above.

11. Retention

Personal data from reservation and booking processes is generally retained operationally in the website backend until 14 days after the process ends or the stay is completed, and then automatically anonymised. Future or ongoing bookings are not anonymised solely because of their age. Declined or cancelled enquiries are generally anonymised 14 days after the process closes.

Completed contact and company enquiries are anonymised 14 days after closure. For open enquiries with stay dates, the period begins no earlier than the requested departure; for open enquiries without stay dates, it begins on receipt. Free-text fields are removed entirely. Cleanup takes place in the next daily deletion run after expiry. Personal management links then become invalid.

Invoice data subject to tax retention requirements is excluded. Copies of invoices and related tax-relevant information are retained for the statutory periods, currently generally eight years from the end of the calendar year in which the invoice was issued.

Pseudonymised first-party enquiry analytics events are retained for no more than 400 days and then automatically deleted. As a new flow identifier is generated for each open enquiry process, there is no recognition across sessions.

Technical security events are generally retained in the website backend for no more than 90 days; short-term rate-limit data is cleared after a few days. Expired or unnecessary management and decision tokens are automatically removed. Encrypted backups are rotated, with a default retention of 14 days. Existing encrypted backups may contain previously stored data for up to 14 additional days. They are used only for recovery. After a restore, cleanup runs again before release. Copies in the hotel mailbox and property management system have their own purpose-specific retention rules.

12. Recipients, processors and international transfers

Only authorised hotel staff and technical service providers have access to personal data, where necessary for their tasks. Hosting and email services are provided by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. The operator has confirmed the relevant data processing agreement.

Apart from the Google Maps transfer described above, which requires consent, our own website functions do not provide for transfers of personal data outside the European Union or European Economic Area.

13. Your rights

Subject to legal conditions, you have rights of access, rectification, erasure, restriction of processing and data portability. You may withdraw consent at any time with effect for the future.

Right to object: Where we process data under Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will stop processing unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or processing is needed to establish, exercise or defend legal claims.

To exercise your rights, email info@hoteljohnel.de. You may also complain to a supervisory authority. The competent authority in North Rhine-Westphalia is the State Commissioner for Data Protection and Freedom of Information, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany. Information on complaints is available at www.ldi.nrw.de.

14. Automated decisions

There are no solely automated decisions within Article 22 GDPR and no profiling. Availability and prices are calculated technically; hotel staff manually decide whether to accept or decline an online room enquiry.

15. Security

Technical and organisational measures protect personal data against unauthorised access, loss and tampering. The public website uses HTTPS. Management and session tokens are stored on the server only as hashes, and backups are encrypted. The current VPS filesystem, including the active database and local secrets, is not encrypted at rest. Access restrictions, restricted file permissions and encrypted offsite backups provide additional safeguards; they do not replace disk encryption.

Last updated: October 2026