This notice explains the processing of personal data when visiting this hotel website, contacting us and making a booking. It describes the technical version of the website provided here.
1. Controller and contact
The controller is Hotel Fruerlund, proprietor Dimitrios Sotiriu, Glücksburger Str. 174, 24943 Flensburg, Germany. Phone: +49 (0) 461 6099; email: info@hotelfruerlund.de. Please use these details for privacy questions and requests concerning your rights.
2. Hosting and technical access data
This deployment is hosted by Vercel Inc., USA. Technical connection data including IP address, time, requested URL and browser details support delivery, security and troubleshooting under Article 6(1)(f) GDPR (secure operation). Hosting logs are separate from optional anonymous performance measurements. International processing and retention depend on the hosting configuration and provider information: https://vercel.com/legal/privacy-policy
3. Cookies, local resources and optional content
Essential settings and optional services are handled separately. Fonts and hotel photos are served locally; article images may be loaded from Sanity. Your choice is stored for up to 180 days. Google Maps, Viato, Google analytics, Vercel Web Analytics and Speed Insights can each be controlled separately through the footer settings.
4. Email, telephone and contact form
We process details you provide, such as name, email, phone number, travel dates and message, to answer your enquiry. Contract-related enquiries rely on Article 6(1)(b) GDPR; other enquiries rely on Article 6(1)(f) and our legitimate interest in appropriate communication. Contact and offer enquiries go to info@hotelfruerlund.de. Without enabled direct delivery, forms open a draft in your email app; only sending it transmits the message. When direct delivery is enabled, entries are validated on the server and sent through the configured email service to the hotel. Acceptance for sending does not confirm inbox delivery. A recovery copy is stored at Upstash, Inc. for up to seven days; hashed IP rate-limit keys for one hour. An enquiry is neither a reservation nor a newsletter subscription. Do not submit payment details. Voucher PDF previews are created locally in your browser and cannot be redeemed. When you request a voucher, fruerlund-voucher-enquiry carries the value, recipient and message to the contact form in the same tab. This session storage is deleted after transfer or at the end of the session. Form entries are not sent to analytics. QR verification tokens are removed from the address bar on opening and sent to the verification endpoint only when requested; checking does not redeem a voucher.
5. WhatsApp and external links
WhatsApp and the restaurant website are external links. Their providers’ privacy notices also apply after clicking. Telephone and email remain available alternatives. Google Maps is embedded on contact and location pages only with express consent. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Loading shares your IP address and browser/connection data with Google. Google may use cookies and process data in the USA or other third countries. Optional embedding relies on Article 6(1)(a) GDPR and, for device access, section 25(1) TDDDG. Withdrawal through cookie settings removes the map and prevents further loads. Details: https://policies.google.com/privacy and https://www.whatsapp.com/legal/privacy-policy-eea. Facebook, Instagram and Google reviews are also external links. No social feeds or review widgets load in advance; opening a link brings the relevant provider’s privacy notice into effect.
6. Online booking with Viato
Direct booking uses the Viato BookingEngine provided by Viato GmbH, Burkheimer Str. 3, 79111 Freiburg, Germany. An explicit notice and activation control precede loading of the embed; you may alternatively open the booking page directly. Loading may send technical connection details to Viato. Booking involves data required for availability, reservations and the contract, such as dates, guest count, name, contact details and selected services. The legal basis for pre-contractual and contractual processing is Article 6(1)(b) GDPR. Where optional embeds or device access require consent, Article 6(1)(a) GDPR and section 25(1) TDDDG apply. See https://www.viato.net/datenschutz/ and the notices in the actual booking process.
7. 3RPMS hotel administration and payments
Reservations and stays are managed with 3RPMS from HaDre GmbH, Bauerngasse 32, 90443 Nürnberg, Germany. Booking and guest data may be exchanged between the booking system, channel manager and hotel management system. This supports reservations, guest service, invoicing and legal obligations under Article 6(1)(b) and (c) GDPR. 3RPMS is not directly embedded in this website’s browser interface. Provider information: https://3rpms-hotelsoftware.de/service/datenschutz. Payment data is processed through the payment providers identified during booking. This website frontend does not itself collect credit card details.
8. Recipients, retention and international processing
Data is received only by parties needing it for the described purposes, including hosting and IT providers, booking and hotel software providers, appointed payment providers and legally authorised authorities where applicable. Enquiry data is deleted once the matter is resolved and no further legal basis applies. Contract and accounting data is retained under applicable commercial and tax retention duties; legal disputes may justify further necessary retention. International transfers are subject to Articles 44 et seq. GDPR. The particular providers, recipients and safeguards depend on the service and its current contractual and privacy information.
9. Your rights
Subject to statutory conditions, you have rights of access (Article 15), rectification (16), erasure (17), restriction (18) and portability (20 GDPR). Under Article 21 you may object to processing based on legitimate interests on grounds relating to your particular situation, and may object to direct marketing at any time. Consent may be withdrawn at any time for the future without affecting the lawfulness of earlier processing. You may also complain to a data protection authority, including the Independent Centre for Data Protection Schleswig-Holstein: https://www.datenschutzzentrum.de/meldungen/.
10. Security and necessary information
The website uses encrypted HTTPS connections. Absolute security of internet communication cannot be guaranteed. Information for general enquiries is voluntary; without necessary contact or booking details we may be unable to handle the enquiry or contract. This hotel website does not carry out solely automated decisions producing legal or similarly significant effects, or profiling of that kind.
11. Analytics, newsletters and updates
Optional analytics and performance measurement start only after separate consent. When configured, Google Analytics 4 loads through Google Tag Manager or directly, never both. Google Ireland Limited may process usage and device information, identifiers and technical connection data, including transfers to other countries. This measurement is not fully anonymous. Ad personalisation and Google Signals are disabled in our direct integration. _ga cookies may last up to two years by default. Details: https://policies.google.com/privacy According to Vercel, Web Analytics provides aggregated statistics without analytics cookies; a visitor hash derived from the request is discarded after 24 hours. Speed Insights measures loading times and Web Vitals without identifying an individual. Technical hosting logs are separate. Our integration requires separate consent for both optional services. URL parameters and fragments are removed; email addresses, form entries and travel dates are not included in measurement events. Provider: Vercel Inc., USA. Details: https://vercel.com/docs/analytics/privacy-policy and https://vercel.com/docs/speed-insights/privacy-policy Google analytics, Vercel Web Analytics and Speed Insights are separate optional categories. Services that are not configured are marked inactive. Their scripts do not load without consent; Google Consent Mode v2 uses Basic mode. Withdrawal stops further measurement and reloads the page. Newsletters and remarketing are not enabled. When server-side tagging is enabled, consented Google analytics events are routed through a hotel subdomain to Google Analytics. Consent remains required. Only validated UTM campaign identifiers may be retained for visit attribution; other URL parameters are removed. Article images may be loaded from the Sanity image service, transmitting technical connection data to Sanity. Details: https://www.sanity.io/legal/privacy
Last updated: 22 October 2026