Privacy policy

This English translation is provided for your convenience. Only the German version is legally binding.

1. Controller

Privathotel Riesenbeck, owner Hannes Lammers
Sünte-Rendel-Straße 5, 48477 Hörstel-Riesenbeck, Germany
Phone: +49 5454 3969895 · E-mail: info@hotel-riesenbeck.de

No data protection officer has been appointed, as there is no legal obligation to do so. If you have questions about data protection, please use the contact details above.

2. Overview

Personal data is any data that can be used to identify you personally. We only process it insofar as this is necessary to run this website, answer your enquiries and handle your booking. We do not use cookies for analytics or advertising, we use no analytics or tracking tools and we do not embed social media plugins. There is no automated decision-making, including profiling.

3. Hosting and server log files

This website is hosted by Railway Corporation, 548 Market St PMB 68956, San Francisco, California 94104, USA. Each time a page is accessed, the server processes technically necessary data transmitted by your browser: IP address, date and time, requested address, referrer URL, browser type and version, and operating system. This serves the secure and error-free delivery of the website (Art. 6 (1) (f) GDPR). Railway stores these log data for 90 days and then deletes them automatically.

A data processing agreement (Art. 28 GDPR) is in place with Railway. The transfer to the USA is based on the EU standard contractual clauses (Commission Implementing Decision (EU) 2021/914).

4. Fonts, images and scripts

The fonts, images and scripts of this website are stored on our own server. No connection to Google Fonts or other font providers is established when a page is called up. We store nothing in your browser that is not technically necessary for your visit.

5. Contact by e-mail, phone or enquiry form

When you write to us, call us or use the enquiry form, we process your details (e.g. name, e-mail address, phone number, travel dates, message) in order to answer your enquiry and for any follow-up questions. The legal basis is Art. 6(1)(b) GDPR where a booking or an offer is concerned, otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries). Mandatory fields are marked; without them we cannot process the enquiry.

The form is processed via our own server (Lammers Connector, also hosted by Railway) and delivered to us by email. Our mailbox is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany (processor). We delete enquiries as soon as they have been dealt with, at the latest after 12 months, unless statutory retention obligations (e.g. for a resulting booking) prevent this.

6. Booking via DIRS21

For room bookings we use the DIRS21 booking engine of TourOnline AG, Borsigstraße 26, 73249 Wernau, Germany. When you choose “Show available rooms and rates”, you switch to the DIRS21 booking process; your arrival and departure dates and the number of guests are passed on. For the booking we process your name, address, email address, phone number, payment and booking data to perform the contract (Art. 6 (1) (b) GDPR) and to comply with legal obligations, such as the guest registration form and retention under commercial and tax law (Art. 6 (1) (c) GDPR). The booking data are stored in our hotel software (3RPMS).

7. Max, our digital assistant

On the website you can write or talk to Max. Max is an AI and gives answers without guarantee. Max only starts when you open him. The program files for this come from our own server. Your text or voice input is then transmitted to our service provider ElevenLabs and processed there to generate answers. The microphone is only used if you start voice mode and allow it in your browser. Please do not share sensitive data in the conversation that is not needed for your request.

The legal basis is Art. 6 (1) (f) GDPR (our interest in answering questions around the clock) or Art. 6 (1) (b) GDPR if you request a booking via Max. According to its own information, ElevenLabs is certified under the EU-US Data Privacy Framework; a data processing agreement has been concluded with ElevenLabs. Audio recordings of your conversations are not stored at ElevenLabs; the text transcripts are deleted there after 30 days.

8. Online guest folder

Some sections of our online guest folder (bar.hotel-riesenbeck.de, also our own service) open in a window on this website. Only when you open such a window does the guest folder load its content. Fonts and program files come from our own server; no request is sent to Google Fonts or any other font provider. To show the weather, the guest folder retrieves weather data from Open-Meteo; in the process, your IP address is transmitted to Open-Meteo. Only when you display the map are map images loaded from Esri (Environmental Systems Research Institute, Inc., USA); in the process, your IP address is transmitted to Esri, including to the USA. If you start Max there, section 7 applies. The same applies if you open the guest folder directly at bar.hotel-riesenbeck.de.

9. Links to other providers

Links to Google Maps (“Route from the hotel”), to the ARD Mediathek or to destinations only open the pages of these providers when you click on them. From then on, their privacy policies apply.

10. SSL/TLS encryption

This website uses SSL/TLS encryption. You can recognise an encrypted connection by “https://” and the padlock symbol in the address bar.

11. Your rights

• Access to your stored data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

Right to object (Art. 21 GDPR): where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation.

To exercise these rights, please use the contact details above. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

12. Changes

We update this policy when legal requirements or our services change. The current version applies. As of: 5 Nov 2026.