Privacy Policy

1. Controller

Gasthaus & Pension Schwarzes Kreuz, owner: Ercan Cinar, Hauptstraße 25, 96358 Teuschnitz, Germany. Phone: +49 9268 9913200, e-mail: info@schwarzeskreuz.com

2. Hosting and server log files

This website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. Each time a page is opened, the host automatically processes access data in server log files: page and file requested, date and time, volume of data transferred, confirmation of successful retrieval, browser type and version, operating system, referrer URL and IP address.

STRATO anonymises the IP address in its reports and, according to its own information, stores the full IP address for no longer than seven days in order to detect and prevent attacks. Legal basis: Art. 6(1)(f) GDPR. A data processing agreement is in place with STRATO.

3. E-mail

Our mailboxes (info@schwarzeskreuz.com, anja.cinar@schwarzeskreuz.com) are also operated by STRATO GmbH. The content and metadata of your messages are processed and stored there. Legal basis: Art. 6(1)(b) GDPR for contractual or pre-contractual matters, otherwise Art. 6(1)(f) GDPR.

4. Cookies and consent

We use cookies that are technically necessary for the website and for your consent decision to work. This includes the cookie wpconsent_preferences (purpose: storing your choice in the cookie banner, lifetime 30 days). Legal basis: Section 25(2)(2) TDDDG together with Art. 6(1)(f) GDPR.

All other cookies and services are used only after your express consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). Using the „Cookie-Einstellungen“ button at the bottom left of every page you can change your choice at any time or withdraw it with effect for the future. The lawfulness of processing carried out until then remains unaffected.

Please note: third-party cookies already set are not deleted automatically when you withdraw consent; no further data will be transmitted. You can delete such cookies in your browser at any time.

5. Google Ads (conversion measurement)

After you consent to the „Marketing“ category we use Google Ads conversion tracking. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Conversion ID: AW-18311617036.

The Google script is loaded only after your consent. Without consent no connection to Google takes place at all.

We measure whether a visit via one of our ads led to an enquiry through the contact form or to a click on our telephone number. The cookie _gcl_au is set (lifetime 90 days) and usage data is transferred to Google, possibly also to the USA. Google LLC is certified under the EU-US Data Privacy Framework. Legal basis: Art. 6(1)(a) GDPR, Section 25(1) TDDDG. You can withdraw consent at any time via „Cookie-Einstellungen“.

An analytics service such as Google Analytics is not currently used.

6. Table reservations (Reservino) – two-click solution

On the „Tisch reservieren“ page we offer the reservation system of Reservino GbR, Daniela Calvus and Steffen Thumser, Tannenweg 1, 55218 Ingelheim, Germany (e-mail info@reservino.de).

The reservation window does not load automatically. You first see a notice and a button. Only when you click it is a connection to Reservino established, transmitting among other things your IP address. Inside the window Reservino also embeds the payment provider Stripe (Stripe Payments Europe Ltd., Dublin, Ireland), which sets the cookies __stripe_mid and __stripe_sid for fraud prevention.

Legal basis for establishing the connection: Art. 6(1)(a) GDPR (your deliberate click); for the reservation itself Art. 6(1)(b) GDPR.

According to its own information, Reservino operates application servers and databases exclusively in the Amazon Web Services EU (Frankfurt) region. Amazon CloudFront is used to deliver the application files; its servers may also be located outside the EU, and your IP address may be processed in the process. This is safeguarded by EU standard contractual clauses and certification under the EU-US Data Privacy Framework.

If you would prefer not to connect to Reservino, please call us on +49 9268 9913200.

7. Room bookings and online check-in (Sirvoy)

On the „Zimmer buchen“ and „Online-Check-in“ pages the booking system of Sirvoy Limited, registered in the Republic of Ireland, is embedded. You open these pages specifically in order to book or check in, so the window loads together with the page, transmitting your IP address.

The window sets no cookies when loaded and stores nothing in your browser. It includes a technical error-monitoring service (Sentry, Functional Software Inc.) which transmits technical diagnostic data such as IP address, browser and device information, time and error message when a program error occurs.

The booking and check-in data you enter (name, address, contact details, period of stay, invoice address, payment details where applicable) is processed in order to perform the accommodation contract under Art. 6(1)(b) GDPR.

For foreign guests staying with us we process the registration data required by law on the basis of Art. 6(1)(c) GDPR together with Sections 29 and 30 of the German Federal Registration Act. Registration records are kept for one year from the day of departure and destroyed or deleted within three months after that period.

8. Enquiry forms

On the Weddings, Celebrations and Business pages, and via the enquiry window that can be opened on any page, you can send us an enquiry.

We process: first name, last name, e-mail address, telephone number and occasion (mandatory) as well as preferred date, number of guests and your message (optional). Mandatory fields are marked in the form. Without this information we cannot handle your enquiry; optional information is not required.

The data is processed on our server and delivered by e-mail to our mailboxes info@schwarzeskreuz.com and anja.cinar@schwarzeskreuz.com. It is not stored permanently in the website database.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures), for general enquiries Art. 6(1)(f) GDPR. We use a technical check against automated submissions that works without cookies.

9. Google Maps (two-click solution)

On the contact page we embed a Google Maps map (Google Ireland Limited, Dublin). The map does not load automatically. Only when you click „Karte laden“ is a connection to Google established, transmitting among other things your IP address, possibly to the USA. Legal basis: Art. 6(1)(a) GDPR, Section 25(1) TDDDG.

10. Fonts

This website uses only fonts stored locally on our server. No connection to Google Fonts or other third-party providers is established when a page is opened.

11. Social networks

In the footer we link to our profiles on Instagram and Facebook. These are plain text links – no content is loaded and no data is transmitted unless you click them.

We operate our own profiles there. If you contact us via these profiles, comment or interact with our posts, we process your information in order to answer your request (Art. 6(1)(f) GDPR). For the evaluation of anonymous page statistics („Insights“) we are jointly responsible with Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland; the essential content of this arrangement is available at facebook.com/legal/terms/page_controller_addendum.

12. No automated decision-making

Automated decision-making including profiling within the meaning of Art. 22 GDPR does not take place.

13. Retention periods

14. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing based on legitimate interests (Art. 21). You may withdraw consent at any time with effect for the future.

You also have the right to lodge a complaint with a supervisory authority: Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.

15. Changes to this policy

We will update this policy if the services we use or the legal situation change.

Last updated: September 2026