Last updated: August 2026
1. Controller
The controller responsible for the processing of personal data on this website is:
Hotel Westfalia
Friedrich Vette & Sohn GmbH
Langemarckstraße 38-42
28199 Bremen
Germany
Phone: +49 (0)421 59 02 0
Email: info@hotel-westfalia.de
2. General Information on Data Processing
We treat your personal data confidentially and in accordance with the applicable data protection regulations.
Personal data is any information relating to an identified or identifiable natural person. When you visit our website, technically necessary data is processed. Further personal data is processed if you provide it to us, for example via our contact form, by email or as part of an online booking.
We process personal data only where there is a legal basis for doing so, where processing is necessary in order to take steps prior to entering into a contract or to perform a contract, or where you have given your consent to the processing.
3. Hosting and Server Log Files
Our website is hosted by the following service provider:
STRATO GmbH
Otto-Ostrowski-Straße 7
10249 Berlin
Germany
When you access our website, the web server processes technically necessary information. This may include, in particular, the page or file accessed, the date and time of access, browser type and browser version, operating system used, referrer URL and information relating to the IP address of the accessing device.
The processing is carried out in order to ensure the secure, stable and error-free provision of our website on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and technically reliable operation of our website.
STRATO anonymises IP addresses and/or host names in the access logs made available to us. The log files are made available by STRATO for a limited period of time.
Where required, a data processing agreement pursuant to Art. 28 GDPR has been concluded with the hosting provider.
4. Technically Necessary Cookies and Session Data
Our website uses technically necessary session information and/or session cookies. These are required to provide basic website functions, for example session functions and the security code (CAPTCHA) used in our contact form.
Technically necessary cookies are not used to create user profiles or to display personalised advertising.
Where the storage of or access to information on your device is strictly necessary to provide a function expressly requested by you, this is carried out on the basis of Section 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG). The associated processing of personal data is based on Art. 6(1)(f) GDPR.
Session cookies are generally deleted when the browser session ends.
5. Contact Form
If you send us an enquiry using our contact form, we process the information you provide in order to deal with your enquiry. This may include, in particular, your name, telephone number, email address, subject and the content of your message.
If your enquiry relates to a reservation, an existing contract or pre-contractual measures, processing is carried out on the basis of Art. 6(1)(b) GDPR.
For other enquiries, processing is carried out on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in the appropriate and efficient handling of enquiries addressed to us.
The data you provide will be deleted once the purpose for which it was processed no longer applies, unless statutory retention obligations or other legitimate reasons prevent deletion.
6. Contact by Email or Telephone
If you contact us by email or telephone, we process the personal data you provide in order to deal with your enquiry.
Processing is carried out on the basis of Art. 6(1)(b) GDPR where your enquiry relates to the initiation or performance of a contract. In all other cases, processing is carried out on the basis of Art. 6(1)(f) GDPR due to our legitimate interest in handling enquiries addressed to us.
Statutory retention obligations remain unaffected.
7. Online Booking via Hotel-Spider
We use the Hotel-Spider booking solution for direct online hotel room reservations. The provider is:
Tourisoft Sàrl / Hotel-Spider
Route de Champ-Colin 18
1260 Nyon (VD)
Switzerland
Technical components provided by Hotel-Spider are integrated into our website in order to display the booking function. When the booking function is loaded, technically necessary connection data, in particular your IP address, may be transmitted to Hotel-Spider.
If you make an online booking, the booking and contact details you enter are transmitted to Hotel-Spider and processed there for the purpose of carrying out the reservation. This may include, in particular, your name, contact details, travel dates, requested room category, number of guests and any other information you provide during the booking process.
The processing of data required for the booking is carried out on the basis of Art. 6(1)(b) GDPR in order to take pre-contractual measures and to perform the accommodation contract.
The integration of the booking function is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in providing our guests with a convenient way to book directly online.
Where Hotel-Spider uses cookies or comparable technologies that are technically necessary to carry out the booking process expressly requested by you, their use is based on Section 25(2) TDDDG.
Hotel-Spider is operated by Tourisoft Sàrl, based in Switzerland. The European Commission has adopted an adequacy decision for Switzerland, meaning that personal data may generally be transferred to Switzerland without additional transfer safeguards.
Further information on data processing by Hotel-Spider can be found at:
Hotel-Spider Privacy Policy
8. Payment Data
Where payment data is required as part of a booking, this data is processed exclusively for the purpose of carrying out and processing the booking and payment.
Depending on the payment method selected, data may be transmitted to the bank or payment service provider involved in processing the payment. The legal basis for this processing is Art. 6(1)(b) GDPR.
Payment data is stored only for as long as necessary to process the payment and to comply with statutory retention obligations.
9. SSL or TLS Encryption
For security reasons, our website uses SSL or TLS encryption. This protects data that you transmit to us via our website against unauthorised access by third parties while it is being transmitted.
You can recognise an encrypted connection, in particular, by the address in your browser beginning with “https://”.
10. Storage Period
Unless a more specific storage period is stated in this Privacy Policy, we store personal data only for as long as necessary for the respective purpose of processing.
Where statutory retention obligations apply, the affected data will be stored for the duration of the relevant statutory period and subsequently deleted, unless another legal basis permits further processing.
11. Your Rights
Subject to the applicable legal requirements, you have, in particular, the following rights:
- the right of access to your personal data (Art. 15 GDPR),
- the right to rectification of inaccurate data (Art. 16 GDPR),
- the right to erasure of your personal data (Art. 17 GDPR),
- the right to restriction of processing (Art. 18 GDPR),
- the right to data portability (Art. 20 GDPR), and
- the right to object to processing in the cases provided for by law (Art. 21 GDPR).
Where processing is based on your consent, you may withdraw that consent at any time with effect for the future. The lawfulness of processing carried out before consent was withdrawn remains unaffected.
12. Right to Object under Art. 21 GDPR
Where your personal data is processed on the basis of Art. 6(1)(e) or (f) GDPR, you have the right to object to such processing at any time on grounds relating to your particular situation.
Following an objection, we will no longer process the personal data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or where processing is required for the establishment, exercise or defence of legal claims.
13. Right to Lodge a Complaint with a Supervisory Authority
Under Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR.
For companies based in the Federal State of Bremen, the competent supervisory authority is, in particular:
Der Landesbeauftragte für Datenschutz und Informationsfreiheit
der Freien Hansestadt Bremen
Georgstraße 122-124
27570 Bremerhaven
Germany
Phone: +49 421 361 2010 or +49 471 596 2010
Email: office@datenschutz.bremen.de
14. Amendments to this Privacy Policy
We reserve the right to amend this Privacy Policy if the legal requirements, our website or the services we use change.
