Privacy policy

1. Controller

Kerlin Hospitality e.K., owner Kristina Kuhn, Pariser Straße 37, 10707 Berlin, Germany, phone +49 30 8871650, hotel@kerlin.berlin

2. General

We only process personal data to the extent necessary for a functioning website, for handling your enquiries and bookings and for your stay, or where you have given your consent. The legal bases are Art. 6 (1) (a) GDPR (consent), (b) (contract and pre-contractual measures), (c) (legal obligations, e.g. registration obligations and retention under tax law) and (f) (legitimate interests). We delete data as soon as the purpose no longer applies and no statutory retention periods prevent deletion.

3. Hosting and server log files

This website is hosted by ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. When the website is accessed, the browser type and version, operating system, referrer URL, IP address and the date and time of access are automatically stored in log files in order to deliver the website and ensure its security (Art. 6 (1) (f) GDPR). The log files are deleted after seven days at the latest. We have a data processing agreement with the host.

4. Cookies and consent

We set technically necessary cookies on the basis of § 25 (2) TDDDG and Art. 6 (1) (f) GDPR. This also includes the storage that our chatbot “Eve” requires when you actively use it (§ 25 (2) no. 2 TDDDG). We only use all other cookies and comparable technologies (statistics, map) with your consent (§ 25 (1) TDDDG, Art. 6 (1) (a) GDPR), which you give via our consent banner and can withdraw or change there at any time under “Cookie settings” in the footer.

5. Audience measurement and usage analysis

With your consent, we use Microsoft Clarity by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, to understand how visitors use our website (e.g. areas clicked, scroll depth, sequence of pages) and to improve the website. Pseudonymised usage data, device information and your IP address are processed. Clarity creates heatmaps and pseudonymised session recordings; entries in form fields are masked. A transfer to the USA is possible; Microsoft is certified under the EU-US Data Privacy Framework. Microsoft deletes session recordings after 30 days, and heatmaps and aggregated usage data after 9 months. The legal basis is your consent (Art. 6 (1) (a) GDPR), which you can withdraw at any time.

6. Contact form and email

If you write to us via the contact form or by email, we process your details (name, email address, message and, optionally, travel dates and subject) to handle your enquiry (Art. 6 (1) (b) or (f) GDPR). We delete the data once the enquiry has been fully dealt with, unless statutory retention obligations apply.

7. Online booking via DIRS21

For online bookings we use the DIRS21 booking engine of TourOnline AG, Borsigstraße 26, 73249 Wernau, Germany. The data provided during the booking process (e.g. name, contact details, travel dates, payment details) is processed to handle your booking (Art. 6 (1) (b) GDPR). We have a data processing agreement with DIRS21.

8. Hotel operations, self check-in, payments and guest communication

To carry out your stay, we process your booking and contact data in our hotel management system ibelsa (ibelsa GmbH, Sybelstraße 41, 10629 Berlin, Germany) and via the guest communication service straiv (Straiv GmbH, Industriestraße 23, 70565 Stuttgart, Germany). You receive your booking confirmation, arrival information and notices during your stay via WhatsApp and/or email (Art. 6 (1) (b) GDPR). When WhatsApp is used, data is transferred to WhatsApp Ireland Ltd.; onward transfer to the USA (Meta Platforms Inc.) is possible; Meta is certified under the EU-US Data Privacy Framework. We have data processing agreements with ibelsa and Straiv. You can object to communication via WhatsApp at any time and will then receive all information by email. We retain legally required registration data (German Federal Registration Act) and tax-relevant data for the statutory periods (Art. 6 (1) (c) GDPR).

For self check-in we use a kiosk by Roommatik (ICTEL INGENIEROS S.L., Dr. Corbal 16, 36207 Vigo, Spain). At the kiosk you enter your reservation number and scan your ID card or passport to register. Your name, the details from your identity document and your signature are processed and transferred to our hotel management system. Roommatik processes this data on our behalf. The legal basis is Art. 6 (1) (b) GDPR and, where a registration obligation applies, (c) GDPR in conjunction with the German Federal Registration Act.

For card payments at the kiosk we use a card terminal by Nexi (Nexi Germany GmbH, Helfmann-Park 7, 65760 Eschborn, Germany). The payments themselves are processed by PAYONE (PAYONE GmbH, Lyoner Straße 15, 60528 Frankfurt am Main, Germany). The data needed for the payment (e.g. card details, amount and date) is transferred to PAYONE. PAYONE also processes this data under its own responsibility, for example for fraud prevention and to meet legal obligations; PAYONE’s privacy notice also applies. The legal basis is Art. 6 (1) (b) and (c) GDPR.

9. Chatbot “Eve”

On our website we offer a chatbot, our digital concierge “Eve”. Eve is an AI assistant; we point this out in the chat window. When you use Eve, your entries are processed to answer your questions and, if you wish, forwarded to us. We store the conversations in pseudonymised form for 90 days and evaluate them to improve our information; after that they are deleted. We developed the chatbot ourselves. To answer, it uses the AI language model Claude by Anthropic PBC, 548 Market Street, San Francisco, USA. We have a data processing agreement with Anthropic; the transfer to the USA is based on the EU Standard Contractual Clauses. Your chat entries are not used by Anthropic to train AI models. The chatbot is operated on the infrastructure of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA; Cloudflare is certified under the EU-US Data Privacy Framework. Your browser loads Eve’s button from Cloudflare when you visit our website; in doing so, your IP address is transmitted to Cloudflare (Art. 6 (1) (f) GDPR). The chat window is only loaded, and your entries are only processed, when you open Eve. If the chatbot forwards your enquiry to us, the email is sent via Brevo (Sendinblue SAS, 106 Boulevard Haussmann, 75008 Paris, France). We have data processing agreements with Cloudflare and Brevo. Please do not enter sensitive data such as payment information in the chat. The legal basis is Art. 6 (1) (b) or (f) GDPR.

10. Google Maps

To show our location, we use Google Maps by Google Ireland Limited. The map is only loaded when you actively click on it. Only then is data such as your IP address transferred to Google, possibly also to the USA; Google is certified under the EU-US Data Privacy Framework. The legal basis is your consent (Art. 6 (1) (a) GDPR).

11. Social media

On our website we link to our profiles on Instagram and Facebook. These are simple links; data is only transferred when you click on them and visit the respective platform. The privacy policy of Meta Platforms Ireland Ltd. applies there.

12. Fonts

All fonts are loaded locally from our server. No connection to third-party servers (e.g. Google Fonts) takes place.

13. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw any consent you have given at any time with effect for the future. Simply contact hotel@kerlin.berlin.

14. Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority, e.g. the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin.