Privacy

Privacy Policy

H-Hotels GmbH is pleased to welcome you to our career page and appreciates your interest in our company. We take the protection of your personal data very seriously and want you to feel comfortable when visiting our website. Protecting your privacy when processing personal data is an important concern for us, which we take into account in our business processes.

We process the data collected during your visit to our website in accordance with the provisions of the General Data Protection Regulation (GDPR). If you have any further questions about how we handle your personal data, you are welcome to contact our data protection officer.

1. Responsible Entity

The responsible entity for the collection, processing, and use of your personal data is:

H-Hotels GmbH
Braunser Weg 12
34454 Bad Arolsen
Tel.: +49 (0) 5691 8780
Email: karriere@h-hotels.com

For any questions regarding data protection, you may contact our external data protection officer:

Stefan Burghardt
RKM Data GmbH
Geiststraße 3
37085 Göttingen
Tel.: +49 (0) 551 3057100
Email: info@rkm-data.de

2. Provision of the Website

If you use our website for informational purposes only, without registering or providing information via other means (e.g., contact form), we collect the following technical data (log file data):

• Operating system of the device used to access our website
• Browser (type, version & language settings)
• Amount of data retrieved
• Current IP address of the device used to access our website
• Date and time of access
• URL of the previously visited website (referrer)
• URL of the (sub)page accessed on our website
• Internet service provider of the accessing system

The collection of this data is technically necessary to display our website and ensure stability and security. As a rule, we (and our service provider) do not know who is behind an IP address. We do not merge the above data with other data.

The legal basis for storing data/log files is Art. 6(1) sentence 1(f) GDPR. The storage in log files ensures the proper functioning of the website and serves to improve and secure our systems. Further evaluation of this data (e.g., for marketing purposes) does not take place. Data stored by H-Hotels AG is deleted once it is no longer necessary for its collection purpose, usually after six weeks. Further storage is possible in anonymized form.

3. Hosting Provider Noris Network AG

Our website is hosted via rexx Systems, which uses the services of noris network AG (hereinafter "noris"), Thomas-Mann-Straße 16–20, 90471 Nuremberg, as a subcontractor. During your visit, certain access data is automatically processed by noris servers to ensure the secure and stable operation of the website.

Data processed by noris includes:

• IP address of the requesting device
• Date and time of access
• Hostname of the accessing system
• Referrer URL (previously visited website)
• Browser type and version as well as operating system
• Server log files for system maintenance and error analysis

Data processing serves the following purposes:

• Ensuring the technical operation and IT security of the website
• Error detection and resolution
• Protection against unauthorized access and attacks (e.g., DDoS attacks)
• Compliance with legal requirements for access logging

The processing of this data is based on Art. 6(1)(f) GDPR, as we have a legitimate interest in the secure and efficient provision of our website. If log data storage is required for legal compliance, processing is also based on Art. 6(1)(c) GDPR. Server log files are stored for a limited time and automatically deleted unless further retention is required for security or legal reasons.

Our contractual relationship is exclusively with rexx Systems, with whom we have concluded a data processing agreement under Art. 28 GDPR. Noris network AG acts as a subcontractor for rexx Systems. This contract ensures that rexx Systems is obligated to establish adequate data protection agreements when involving subcontractors such as noris network AG.

For more information on data processing by noris network AG, please refer to their privacy policy: https://www.noris.de/de/datenschutz.

4. Contact Form and Email Communication

We provide a contact form on our website to facilitate easy communication. The data entered in the form is transmitted to and stored by H-Hotels GmbH. Additionally, the user's IP address, date, and time of transmission are recorded. Alternatively, you may contact us via the provided email address. In this case, the personal data transmitted in the email is stored. No data is shared with third parties, and the data is used solely to process the inquiry.

The legal basis for processing is Art. 6(1)(a) GDPR if the user has given consent, or Art. 6(1)(f) GDPR if processing is based on our legitimate interest in responding to inquiries. If contact is made for the purpose of entering into a contract, Art. 6(1)(b) GDPR applies.

The data is deleted once it is no longer needed for its collection purpose. A conversation is deemed ended when it is clear that the matter has been fully resolved. You have the right to object to processing at any time. Your objection must be based on reasons arising from your particular situation and can be sent to us using the contact details under "Responsible Entity."

5. Application Process

To manage our application process, we use the services of our partner rexx systems GmbH, Süderstraße 75-79, 20097 Hamburg. Rexx Systems processes application data on behalf of H-Hotels GmbH. Your information will only be used to process your application.

During the application process, we process personal data, which may vary depending on the position but typically includes:

• Personal details (e.g., name, address, contact details)
• Application documents (e.g., CV, certificates, cover letter)
• Additional voluntary information provided in the application form

The legal basis for processing personal data in the application process is Art. 6(1)(a), (b), and (f) GDPR and § 26 BDSG. If no employment results, your data will be deleted no later than six months after the application process concludes, unless legal retention obligations apply or you have expressly consented to extended storage.

Applicant Pool: If you wish to be added to our applicant pool, we will process your application data to contact you for suitable vacancies. This requires your explicit consent under Art. 6(1)(a) GDPR. If we have not been in contact with you for 24 months, your data will be deleted. You can withdraw your consent at any time via karriere@h-hotels.com.

Employment and Further Processing: If hired, your application data will be transferred to our employee management system for employment purposes. Further information on employee data processing can be found in the employee privacy notice.

6. Newsletter

If you subscribe to our newsletter, we will process your email address for the purpose of sending updates about our company, services, special offers, and events. Subscription follows a double opt-in process. You can unsubscribe at any time via the link in the newsletter or by emailing karriere@h-hotels.com.

Additional messages about similar services you have used may be sent based on our legitimate interest under Art. 6(1)(f) GDPR in conjunction with § 7(3) UWG. You may object at any time.

"Session cookies" are automatically deleted from your hard drive at the end of your browser session. Other cookies remain on your computer system and allow us to recognize your system on your next visit (so-called persistent cookies). When accessing the website, users are informed about the use of cookies and their consent to the processing of personal data is obtained.

No personal data is stored in the cookies used. Based on the cookies, we only receive anonymized information. Of course, you can reject cookies at any time if your browser allows it. Please note that certain functions of this website may not be available or only available to a limited extent if your browser is set to not accept cookies (from our website).

The legal basis for possible processing of personal data through cookies and their storage duration may vary. If you have given us consent, the legal basis is Art. 6 para. 1 sentence 1 lit. a GDPR. If data processing is based on our overriding legitimate interests, the legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR. In this case, the specified purpose corresponds to our legitimate interest.

Technically necessary cookies are used to simplify the use of websites. The user data collected through technically necessary cookies is not used to create user profiles.

The use of analytics cookies is intended to improve the quality of the website and its content. Through analytics cookies, we learn how the website is used and can continuously optimize our offerings.

Cookies are stored on the user's computer and transmitted from there. Therefore, users also have full control over the use of cookies. By changing the settings in your internet browser, you can disable or restrict the transmission of cookies. Already stored cookies can be deleted at any time. This can also be done automatically. If cookies for our website are disabled, not all functions of the website may be fully available.

The cookie banner allows you to individually configure cookies and similar technologies and to change or withdraw your consent at any time. When visiting our website for the first time, you are prompted to set your preferences regarding the use of cookies. The tool differentiates between the following categories:

• Necessary cookies (essential for website operation),

• Functional cookies (for convenience and personalization features),

• Analytical cookies (for statistical analysis of user behavior),

• Marketing cookies (for personalized advertising).

Your selection is stored in a consent cookie, allowing you to adjust settings at any time in the cookie management tool. The following data is collected and stored through the use of the Rexx cookie banner:

• Your consent preferences,

• Timestamp of consent,

• IP address (anonymized),

• Device and browser settings,

• URL of the visited website.

Data processing through the cookie banner is based on Art. 6 para. 1 lit. a GDPR, as we are legally required to ensure verifiable user consent. Additionally, processing is based on Art. 6 para. 1 lit. f GDPR, as our legitimate interest lies in the privacy-compliant management and documentation of consents.

Your consent is stored for an appropriate period unless you withdraw it beforehand. You can adjust your cookie settings at any time via your browser settings or manually delete stored cookies to revoke a given consent.

Further information on data processing by Rexx Systems GmbH can be found in their privacy policy at: https://www.rexx-systems.com/datenschutz.

Your data will only be shared with affiliated companies and service providers acting on our behalf and supporting H-Hotels GmbH in providing its services. The processing of your personal data by commissioned service providers occurs within the framework of order processing according to Art. 28 GDPR. These service providers have access only to personal information necessary for fulfilling their respective tasks. They are prohibited from disclosing or using your personal information for other purposes, especially for their own advertising purposes.

If external service providers come into contact with your personal data, we have ensured compliance with applicable data protection regulations through legal, technical, and organizational measures as well as regular audits.

A commercial transfer of your personal data to other companies does not take place.

We prioritize processing your data within the EU/EEA. However, it may occur that we use service providers who process data outside the EU/EEA. In such cases, we ensure that an adequate level of data protection is in place at the recipient before transferring your personal data, in accordance with EU standards. This may be achieved through EU standard contracts, binding corporate rules, or specific agreements to which the company adheres.

Matomo is an open-source software that enables statistical evaluations on our website, particularly regarding visitor access, page views, downloads, previously visited websites, and the measurement of search engine entry success. The analyzed information and statistics are processed exclusively on our own web servers or databases. Matomo collects, analyzes, and categorizes incoming information from the user's device through technologies such as fingerprinting regarding the use of our website, interactions with our website, and access data, particularly IP address, browser information, previously visited websites, as well as the date and time of the server request for statistical analysis and search engine ad reach measurement.

Regarding the storage of and access to information on your device, your consent is the legal basis under § 25 para. 1 TDDDG; further processing is also based on your consent under Art. 6 para. 1 sentence 1 lit. a GDPR. We use Matomo with an extension that processes IP addresses in a shortened form to make direct personal reference more difficult. The storage duration is six months.

By changing your internet browser settings, you can disable or restrict the transmission of cookies. Stored cookies can be deleted at any time, including automatically. If cookies for our website are disabled, not all website functions may be fully available. Further information on Matomo's privacy settings can be found at: https://matomo.org/docs/privacy/.

Kununu provides us with aggregated data to evaluate our company as an employer. However, we have no influence over the content of the submitted reviews or how third parties use the published information. Please note that reviews on Kununu are publicly accessible.

Further information on Kununu's data processing can be found at: https://privacy.xing.com/en/privacy-policy.

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to withdraw consent (Art. 7(3) GDPR)
• Right to data portability (Art. 20 GDPR)

To exercise your rights, please contact us using the contact details provided in the "Controller" section. You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR):

Hessian Commissioner for Data Protection and Freedom of Information

P.O. Box 31 63

65021 Wiesbaden,

Germany

Phone: +49 611 1408-0

Further information about our company, including hotel services and promotions, can be found at: https://www.h-hotels.com/en/privacy-policy