Privacy notice

1. Controller and contact

Contact the email address above with privacy requests or to exercise your rights. Internal guest feedback is received by the team of Hotel New Schwanstein GmbH, Augsburger Straße 18, 87629 Füssen, info@hotel-fuessen.bestwestern.de. The hotel operator is responsible for hotel services and its subsequent handling of your requests.

2. Visiting the website and hosting

Visits involve processing your IP address, request time and URL, HTTP status, and device, browser and, where transmitted, referrer information. This delivers content, diagnoses errors and prevents attacks. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is secure, reliable operation.

Hosting, content delivery and technical security are provided by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Server functions are configured for Frankfurt. Delivery uses a global network, so processing is not limited exclusively to Germany. The portal does not integrate Vercel Web Analytics or Speed Insights for visitor tracking.

Vercel retains runtime logs for one day in the standard Pro plan, or 30 days with the Observability Plus add-on. The available period depends on the subscribed logging option. Logs are used for troubleshooting and security. Longer retention may be necessary to investigate a specific security incident or meet legal obligations. Vercel privacy notice · Vercel data processing terms

3. Database, login and documents: Supabase

We use Supabase Pte. Ltd., Singapore, for the database, hotel staff authentication and document/image storage. The project is hosted in Frankfurt (eu-central-1). It stores portal content, file metadata, guest feedback, and approved staff members’ email addresses, user IDs and authentication data. General hotel information is retrieved through our server.

Opening a document redirects your browser to a public Supabase file URL. Supabase then receives connection information, including your IP address, to deliver the file. Administration features such as uploads may also connect your browser directly to Supabase. Supabase and its infrastructure providers process access and security logs. The Pro plan used here normally retains logs for seven days and daily database backups for seven days. Deleted data may remain in backups until that cycle expires.

Technical provision and security are based on Article 6(1)(f) GDPR. Processing of the actual content additionally follows the purposes described below. Supabase privacy notice · Supabase data processing terms

4. Cookies and browser storage

We do not use cookies for advertising, audience measurement or cross-site profiles. The storage described below supports requested functions. Where strictly necessary, it is based on Section 25(2)(2) TDDDG; associated personal data is processed under Article 6(1)(f) GDPR to provide these functions.

The introductory notice explains these functions. “Understood, continue” acknowledges the information; it is not consent to optional tracking or a waiver of privacy rights. “Leave this site” opens a neutral page within this site without contacting an external service. The legal and privacy notices remain available without acknowledgment. You can reopen the notice through “Cookie notice” in the footer.

You can delete or block cookies and site data in your browser. This may prevent language preferences from being saved, show the notice again or prevent administrator login. Leaving the site does not automatically delete existing cookies. The application uses no persistent localStorage or fingerprinting feature.

5. Internal guest feedback

Feedback is voluntary. Submitting the form stores your overall rating, optional room, service and location ratings, optional comment, language, timestamp and selected review channel (Google or Tripadvisor), if applicable. A random submission ID prevents duplicate submissions; a processing timestamp marks feedback as read. We do not request a name, email address or room number. Free text can nevertheless contain personal information. Please do not include sensitive information.

Feedback is accessible to approved hotel staff and authorised technical administrators and is not automatically published. It is used to handle your feedback and improve guests’ stays under Article 6(1)(f) GDPR. Our legitimate interest is responding to guests and improving service quality. A specific contractual request may additionally fall under Article 6(1)(b) GDPR.

Retention depends on handling the matter and any evidence needed for that purpose. Personal feedback must be deleted or anonymised once no longer needed, unless legal obligations or specific legal claims require continued retention. There is currently no automatic deletion period; the responsible parties review and delete the data. You may request review or deletion through our privacy contact.

To limit abusive submissions, your IP address is converted into a keyed value that changes daily. Your IP address is not stored with the feedback. The value is used only for rate limiting, not visitor recognition. Old rate-limit records are removed on the next new feedback submission after one day. This does not affect technical hosting logs. The legal basis is Article 6(1)(f) GDPR.

5a. DASCARDS consultation requests using email drafts

“Guest Guide by DASCARDS” lets you prepare a no-obligation consultation request about websites or guest portals. The form asks for your name, email address, optional telephone number and a description of your idea. Entries remain in your browser’s working memory; this form does not submit them to our server or Supabase or store them in cookies or persistent browser storage.

“Prepare email” passes the recipient (info@denscards.com), subject and text assembled from your entries to your configured email application through a mailto link. Your email app’s and provider’s privacy terms apply. Nothing is sent automatically; you review and send the message yourself. “Copy text” writes the draft to your device’s clipboard only when you click it. Depending on your device settings, other applications may access the clipboard.

When you send the message, Denscha IT & E-Commerce e. K. and our mailbox provider IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany, receive the message, sender/contact details and technical delivery information. The purpose is to respond and, if appropriate, prepare an offer. The legal basis is Article 6(1)(b) GDPR for pre-contractual requests, or Article 6(1)(f) for other enquiries (handling your contact request). Retention depends on resolution, necessary evidence and statutory retention duties; the data must then be deleted. No automatic mailbox deletion period is configured. These requests are not published in the hotel’s feedback area. There is no newsletter subscription, and you can use the guide without making a request.

6. NFC plates and language selection

NFC plates contain web addresses. On opening a link, the server processes the number in the path (1–199) to redirect to the guide. The application creates no individual plate statistics and does not associate the number with feedback or a guest profile. The requested URL, including the plate number, can appear in technical server logs. Redirects use your saved language or preferred browser language. The application does not access location, camera, microphone or other NFC device data.

7. Links, reviews, bookings and contact

Google Maps, Google reviews, Tripadvisor, Best Western / Best Western Rewards and activity providers are linked. There are no embedded maps, social-media pixels, external video players or third-party booking forms. The portal does not connect to a link destination before you open it. Once opened, that provider’s privacy rules apply and it receives your IP address and browser connection data. For bookings or public reviews, you decide there which additional details to submit.

The review dialog opens the external review page for five stars on Google or four or five stars on Tripadvisor. Lower ratings lead to the internal feedback form. No rating is submitted automatically, either externally or internally.

Phone and email links open your own applications. If you send a request, the recipient and its communication providers process the content and contact details to handle it. Contract or booking requests are based on Article 6(1)(b) GDPR; other requests on Article 6(1)(f). Retention depends on completion and any statutory requirements. The root URL dascards.de/ redirects to the separate DASCARDS website, which has its own privacy notice.

8. Hotel administration

The protected admin area is limited to expressly approved staff. Access control and content management process email address, user ID, protected password data, session information, permissions and login/change timestamps. Uploaded files and filenames are published to guests and must therefore not contain confidential staff or guest data. Account data is needed while access is authorised and is removed afterwards, subject to necessary records. The legal basis is Article 6(1)(f) GDPR: secure portal administration.

9. Domains, fonts and images

Domain administration and authoritative DNS are provided by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. DNS services process domain queries and technical connection data during name resolution. The portal includes no IONOS analytics feature. Montserrat fonts are served locally with no Google Fonts requests. Images are served through our host; hotel-uploaded images may be retrieved and optimised server-side from Supabase Storage.

10. Recipients and international processing

Recipients include authorised staff, the hotel named above and service providers needed for operation, hosting, database and communication, to the extent required. Vercel and Supabase act as processors for the technical functions described. Their published data processing terms govern additional infrastructure and support providers. International providers may process data outside the EU/EEA, including in the USA or Singapore, particularly for network operations or support.

Transfers outside the EU/EEA are subject to Articles 44 et seq. GDPR. Providers’ data processing terms include EU Standard Contractual Clauses for applicable transfers. Information about the safeguards and a copy can be obtained from our privacy contact or the data processing terms linked above. Choosing an EU server region does not completely exclude international access.

11. Your rights

Subject to the GDPR, you have rights of access (Article 15), rectification (Article 16), erasure (Article 17), restriction (Article 18) and portability (Article 20). Where processing is based on consent, you may withdraw that consent at any time with future effect. Acknowledging the cookie notice is not such consent.

Right to object: Where processing is based on Article 6(1)(f) GDPR, you may object under Article 21 on grounds relating to your particular situation. Contact info@denscards.com.

You may also complain to a data protection supervisory authority, particularly in your place of residence, work or an alleged infringement. For private businesses in Bavaria, you may contact the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany. www.lda.bayern.de

Providing feedback or contact details is voluntary; the guide can be used without feedback. Technical connection data is necessary to deliver the site. We do not make automated decisions with legal or similarly significant effects under Article 22 GDPR or carry out advertising profiling.