Privacy policy
§ 1 General Information
This Privacy Policy provides detailed information about what happens to your personal data when you visit our website, https://hotel-nymphenburg.de. Any data that allows us to personally identify you is considered personal data. When processing your data, we strictly adhere to legal requirements, in particular the General Data Protection Regulation (“GDPR”). It is very important to us that your visit to our website is completely secure.
§ 2 Data Controller
Under data protection law, responsibility for the collection and processing of personal data on this website lies with:
Hotel Nymphenburg
Owner: Mathias van der Kemp
Nymphenburger Straße 141, 80636 Munich
Phone: 089 / 1215970, Email: info@hotel-nymphenburg.de
§ 3 Cookies
We use so-called cookies to make your visit to our website more enjoyable and to enable the use of certain features. These are small text files that are stored on your device. Cookies cannot run programs or transmit viruses to your computer system. Necessary cookies, which are required for electronic communication or to provide requested features, are stored in accordance with Article 6(1)(f) of the GDPR. Our legitimate interest in storing these cookies is to ensure the technically sound and optimized provision of our services. Other cookies (e.g., for analyzing your browsing behavior) are addressed separately in this Privacy Policy.
We primarily use so-called “session cookies,” which are automatically deleted at the end of your visit. In addition, we use cookies that remain stored on your device until you delete them yourself. These enable us to recognize your browser at
during your next visit.
You can configure your browser to notify you when cookies are about to be set. You can then decide whether to allow cookies on a case-by-case basis, whether to allow cookies for specific purposes, or whether you wish to reject cookies
altogether. You can also set your browser to automatically delete cookies when you close it
. Please note that the functionality of this website
may be limited if you disable cookies.
§ 4 Web Analytics Tools and Advertising
A. Google Analytics
We use the web analytics service Google Analytics (version Google Analytics 4) on our website. This service is provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).
Google Analytics uses so-called “cookies.” These are text files that are stored on your computer and enable an analysis of your use of our website. Within Google Analytics, all data from devices located in the EU (based on the geographic IP address) is initially collected via domains and servers within the EU before the data traffic is routed to the Analytics servers for further processing. The processing of your data is based on the consent you provided in the Cookie Consent
tool (in accordance with Art. 6(1), first sentence, lit. a of the GDPR).
a. IP Anonymization
IP anonymization for Google Analytics is automatically enabled on our website
. This means that your IP address is truncated within the EU or the EEA before it is transmitted to Google in the United States. Only in exceptional cases is the full IP address transmitted and truncated there. Google uses this information on our behalf to evaluate your use of the website, compile activity reports, and provide other services related to website and internet usage. According to Google, IP addresses are not logged or stored in Google Analytics; instead, they are processed only briefly for geolocation purposes and then immediately deleted. Your IP address is not combined with other Google data at
.
b. Data Processing
We have entered into a data processing agreement with Google and strictly adhere to the rigorous requirements of the German data protection authorities when using Google Analytics.
c. Retention Period
User- and event-level data stored by Google that is linked to cookies,
user identifiers (such as the User ID), or advertising IDs (such as DoubleClick cookies or the Android Advertising ID) is deleted after 2 months. For more details, please visit this link:
https://support.google.com/analytics/answer/7667196?hl=de.
d. Right to Withdraw Consent
Many data processing activities require your explicit consent. If the processing of your data is based on your consent, you have the right to withdraw that consent at any time with future effect, in accordance with Article 7(3) of the GDPR. To do so, simply change your selection in the cookie settings. Such a revocation does not affect the lawfulness of the data processing that took place on the basis of your consent up until the time of revocation. The storage of data for billing and accounting purposes remains unaffected by this revocation.
More detailed information on the processing of user data by Google Analytics is available in Google’s Privacy Policy at the following link:
https://support.google.com/analytics/answer/6004245?hl=de. For general
data protection provisions, please refer to Google’s Privacy Policy: https://policies.google.com/privacy?hl=de&gl=de.
B. Google Fonts
On our website, we use Google Fonts (formerly Google Web Fonts), a service provided by Google LLC. Google Fonts allows for the integration of external fonts, known as Google Fonts. To do this, your web browser downloads the required Google Font to the browser cache when you visit our website. This is necessary to ensure a more visually appealing display of our text. If your browser does not support this feature, a standard font from your computer will be used instead.
Google Fonts are integrated via a server request, typically to a Google server in the United States. In the process, information about which of our web pages you have visited is transmitted to the server. Additionally, Google stores the IP address of your device’s browser. We have no influence over the scope and further use of the data collected and processed by Google through the use of Google Fonts.
The use of Google Fonts serves optimization purposes, in particular to improve the user-friendliness and appealing design of our website. This also constitutes our legitimate interest in the processing of the aforementioned data by the third-party provider
. The legal basis for this is Art. 6(1)(f) of the GDPR.
Further information on Google Fonts can be found at https://fonts.google.com/,
, and https://developers.google.com/fonts/faq?hl=de-DE&csw=1.
§ 5 Google Maps
Our website uses the Google Maps service, which is integrated via an application programming interface (API).
To protect your data when you visit our website, Google Maps is disabled by default. A connection to Google’s servers is established only when you actively use Google Maps (consent pursuant to Art. 6(1)(a) of the GDPR). This prevents your data from being transmitted to Google the first time you visit our website.
Once Google Maps is activated, your IP address is collected by Google and
is typically transmitted to a server in the United States and stored there. Once Google Maps is activated, the operator of this website has no control over this data transfer.
Detailed information on the processing of user data can be found in Google’s Privacy Policy: https://www.google.de/intl/de/policies/privacy/.
§ 6 Contacting Us
When you contact us, including via email, the data transmitted to
—including your contact information—will be stored in order to process your inquiry and to be available for any follow-up questions. This data will not be disclosed to third parties without your express consent.
The processing of your personal data is based exclusively on the consent you have provided in accordance with Article 6(1)(a) of the GDPR. You have the right to withdraw this consent at any time without providing a reason. An informal email to us is sufficient to withdraw your consent. The lawfulness of data processing carried out prior to the revocation remains unaffected by the revocation.
The transmitted data will be stored by us until you request its deletion, revoke your consent to its storage, or the need for
data storage no longer applies. Statutory retention periods remain unaffected by this.
§ 7 Use and Disclosure of Data
We assure you that personal data you provide to us—for example, via email (such as your name, address, or email address)—will not be sold to third parties or otherwise used for commercial purposes. Your data is processed exclusively for the purpose of corresponding with you and to fulfill the purpose for which you provided us with the data. As part of the payment processing via
, your payment data is forwarded to the designated financial institution
.
The data automatically collected when you visit our website is used exclusively for the purposes mentioned above at
. The data is not used for any other purpose.
Protecting your personal data is important to us. Therefore, we generally do not disclose your data to third parties unless we are legally required to do so or you have given us your express consent.
§ 8 Encryption (SSL/TLS)
Our website uses SSL or TLS encryption to ensure the security and protection of confidential content during transmission. This applies in particular to requests that you, as a visitor to the site, send to us as the website operator. An encrypted connection can be identified by “https://” in your browser’s address bar and the padlock icon in your browser’s address bar.
Enabling SSL or TLS encryption ensures that the data you send to us cannot be intercepted by unauthorized third parties.
§ 9 Retention Period
The personal data you provide to us via our website will be stored only for as long as is necessary to fulfill the respective purpose of the data processing. However, in accordance with commercial and tax law retention requirements, certain data may be stored for up to 10 years.
§ 10 Your Data Protection Rights
As a data subject, you have the following rights with respect to your personal data vis-à-vis the data controller, in accordance with the applicable legal provisions:
A. Right to Withdraw Consent
Many data processing activities are only possible with your explicit consent. If the processing of your data is based on your consent, you have the right to withdraw that consent at any time with future effect, in accordance with Article 7(3) of the GDPR. The lawfulness of data processing carried out on the basis of your consent up until the time of withdrawal remains unaffected. The storage of data for billing and accounting purposes is not affected by a revocation.
B. Right of Access
Pursuant to Article 15 of the GDPR, you have the right to request confirmation from us as to whether we are processing your personal data. If this is the case, you have the right to access this data, including the purposes of processing, the categories of data processed, the recipients or categories of recipients to whom the data has been or will be disclosed, the planned retention period or the criteria for determining it, the existence of a right to rectification, erasure, restriction of processing, objection to processing, lodge a complaint with a supervisory authority, the origin of the data if it was not collected directly from you, the existence of automated decision-making, including profiling, and, where applicable, meaningful information about the logic involved, as well as the significance and intended effects of such processing on you, and your right to be informed of the safeguards in place pursuant to Article 46 of the GDPR when your data is transferred to third countries.
C. Right to Rectification
You have the right, at any time, pursuant to Article 16 of the GDPR, to request that we correct any inaccurate personal data concerning you and/or complete any incomplete personal data.
D. Right to Erasure
You have the right, pursuant to Art. 17 of the GDPR, to request the erasure of your personal data if any of the following grounds apply:
a. Your personal data is no longer necessary for the purposes for which it was collected or otherwise processed.
b. You withdraw your consent on which the processing was based pursuant to Art. 6(1)(a) or Art. 9(2)(a) of the GDPR, and there is no other legal basis for the processing.
c. You object to the processing pursuant to Art. 21(1) of the GDPR and there are no
compelling legitimate grounds for the processing, or you object to the processing pursuant to Art. 21(2) of the GDPR.
d. The personal data has been processed unlawfully.
e. We are required to erase the personal data due to a legal obligation under Union law or the
law of the Member State to which we are subject.
f. The personal data was collected in connection with the provision of information society services pursuant to Article 8(1) of the GDPR.
This right may be restricted under the following circumstances, if the processing is necessary:
a. to comply with a legal obligation that requires processing under Union law or the law of the Member State to which we are subject, or to perform a task carried out in the public interest or in the exercise of official authority;
b. to fulfill a legal obligation that requires processing under the law of the Union or of the Member State to which we are subject, or to perform a task carried out in the public interest or in the exercise of official authority
entrusted to us;
c. for reasons of public interest in the area of public health pursuant to Art. 9(2)(h) and (i) and Art. 9(3) of the GDPR;
d. for archiving purposes, scientific or historical research purposes, or for
statistical purposes pursuant to Article 89(1) of the GDPR, which are in the public interest, provided that the protection of the data subject’s rights would render the purposes of such processing impossible or seriously impair them; or
e. for the establishment, exercise, or defense of legal claims. If we have made your personal data public and are obligated to erase it in accordance with the preceding provisions, we will take appropriate measures, including technical measures, taking into account available technology and implementation costs, to inform the data controllers processing such data that you, as the data subject, have requested the deletion of all links to your personal data or of copies or replicas of such data.
E. Right to Restriction of Processing
Pursuant to Article 18 of the GDPR, you have the right to request the restriction of processing (blocking) of your personal data. To exercise this right, you may contact us at any time. You can find our contact information in the legal notice. A restriction on processing may be requested in the following cases:
a. If you dispute the accuracy of your personal data stored by us, we generally need time to verify this. For the duration of the verification, you have the right to request the restriction of processing of your personal data.
b. If the processing of your personal data was or is unlawful, you may request the restriction of data processing instead of erasure.
c. If we no longer need your personal data, but you need it to exercise, defend, or assert legal claims, you have the right to request the restriction of the processing of your
personal data instead of erasure.
d. If you have lodged an objection pursuant to Art. 21(1) of the GDPR, a balancing of interests between yours and ours must be carried out. As long as it has not yet been determined whose interests prevail, you have the right to request the restriction of the processing of your personal data.
Once the processing of your personal data has been restricted, it may generally only be processed with your consent. Exceptions apply in certain cases defined by law, such as for the assertion of legal claims or the protection of public interests.
F. Right to Be Informed
If you exercise your right to rectification, erasure, or restriction of processing of your personal data, we are required under Article 19 of the GDPR to inform all recipients to whom the data has been disclosed. This does not apply if such notification proves impossible or would involve a disproportionate effort. Upon your request, we will inform you of the recipients of your data.
G. Protection Against Automated Decisions (Profiling)
Pursuant to Article 22 of the GDPR, you have the right not to be subject to a decision based solely on automated processing—including profiling—that produces legal effects concerning you or similarly significantly affects you.
This does not apply if the decision
a. is necessary for the conclusion or performance of a contract between you and us,
b. is permitted under Union or Member State law to which the controller is subject, and such law provides for appropriate measures to safeguard your rights, freedoms, and legitimate interests, or
c. is based on your explicit consent.
However, decisions in the cases listed in (a) through (c) may not be based on special categories of personal data as defined in Article 9(1) of the GDPR, unless Article 9(2)(a) or (g) applies and appropriate measures have been taken to protect your rights and freedoms as well as your legitimate interests.
In the cases mentioned in (a) and (c), we will take appropriate measures to protect your rights and freedoms, as well as your legitimate interests. This includes, at a minimum, the right to request human intervention by the data controller, to present your own point of view, and to challenge the decision.
H. Right to Data Portability
If your personal data is processed based on your consent pursuant to Article 6(1)(a) of the GDPR or Article 9(2)(a) of the GDPR, or based on a contract pursuant to Article 6(1)(b) of the GDPR, and such processing is carried out using automated means, you have the right under Article 20 of the GDPR to receive the data you have provided to us in a structured, commonly used, and machine-readable format and to transmit this data to another controller or to request that we transmit it to another controller, provided this is technically feasible.
I. Right to Object
If we process your personal data on the basis of a balancing of interests pursuant to Article 6(1)(f) of the GDPR, you have the right to object to this processing at any time for reasons arising from your personal situation; this also applies to profiling based on such processing. You can find the applicable legal basis for the processing in this Privacy Policy.
In the event of an objection, we will no longer process your personal data in question unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims (objection pursuant to Article 21(1) of the GDPR).
If your personal data is processed for direct marketing purposes, you have the right to object to such processing at any time; this also applies to profiling, provided it is related to such direct marketing. If you object, your personal data will no longer be used for direct marketing purposes (objection pursuant to Art. 21(2) of the GDPR).
With regard to the use of information society services, notwithstanding Directive 2002/58/EC, you have the option to exercise your right to object through automated means, using technical specifications.
J. Right to File a Complaint with the Competent Supervisory Authority Pursuant to Article 77 of the GDPR
In the event of violations of the provisions of the GDPR, data subjects have the right to file a complaint with a competent supervisory authority. In particular, the complaint may be lodged in the Member State where the data subject has his or her habitual residence, place of work, or where the alleged infringement occurred. The right to lodge a complaint under this provision is without prejudice to any other administrative or judicial remedies.
§ 11 Validity and Amendments to This Privacy Policy
This Privacy Policy takes effect on September 1, 2026. We reserve the right to amend this policy as necessary and in compliance with applicable data protection laws. This may be necessary, for example, to meet new legal requirements or to reflect changes to our website or new services offered through our website. The most current version of the Privacy Policy, available at the time of your visit to our website, is binding.
In the event of changes to this Privacy Policy, we will publish them on this page to fully inform you about what personal data we collect, how we process it, and under what conditions we may share it.