Website Owner:
Monika & Franz Erhardt
Alleestraße 28
82467 Garmisch-Partenkirchen

Data protection officer within the meaning of the GDPR:
info@werdenfelserei.de

Value added tax ID: DE 309800517

0. Legal information

The owner of this website is responsible for processing your personal data. Our legal notice (Impressum) contains our full company details. We attach great importance to protecting your personal data and process it exclusively in accordance with statutory data protection provisions and this privacy policy. As a rule, you can use our website without providing any personal data. Where personal data – e.g. contact details such as name, address or email address – is collected on our pages, this is, wherever possible, always done on a voluntary basis.

1. WEBHOSTING & DATA PROCESSING Agreements

This website is hosted by the external service provider IONOS, based in Montabaur, Germany. Personal data collected on this website is stored on the host’s servers. This mainly concerns IP addresses, contact enquiries, meta and communication data, website access data and other data generated through a website.

We collect the listed data to ensure a smooth connection to the website and a technically error-free provision of our services. The legal basis for this processing is our legitimate interest in the correct presentation and functionality of our website pursuant to Art. 6(1)(f) GDPR.

We have entered into a data processing agreement with the provider in accordance with Art. 28 GDPR, obliging it to protect our customers’ data and not pass it on to third parties. Your personal data is also processed with the support of further processors (e.g. our booking system, email/marketing service providers – see the following sections). These are obliged to protect your data and may not process it for any purpose other than providing the respective service. Beyond that, data is only passed on to typical business service providers such as banks, tax advisors or shipping service providers.

2. Server log files

When you access our website, it is technically necessary for data to be transmitted from your browser to our web server. The following data is recorded during an ongoing connection:

• Date and time of the request
• Name of the file requested
• Page from which the file was requested
• Access status
• Browser and operating system used
• (Full) IP address of the requesting computer
• Amount of data transferred

We collect this data to ensure a smooth connection and a comfortable use of our website. The log file is also used to evaluate system security and stability, and for administrative purposes. The legal basis for this temporary storage is Art. 6(1)(f) GDPR.

For reasons of technical security, in particular to defend against attacks on our web server, this data is stored briefly. We cannot draw any conclusions about individual persons from this data. At the latest after seven days, the data is anonymised by shortening the IP address at domain level. In anonymised form, the data may also be processed further for statistical purposes. This data is never combined with other personal data, matched against other data sets, or passed on to third parties.

3. SSL encryption

For security reasons and to protect the transmission of confidential content, such as bookings, orders or enquiries that you send to us, our site uses SSL encryption. You can recognise an encrypted connection by the fact that the page address starts with “https”, and by the lock symbol in your browser bar. Active SSL encryption ensures that data you enter and transmit to us cannot be read by third parties.

4. Contact form

Submitting our contact form requires your consent to the processing of the personal data you enter. This involves collecting data such as your name, address and contact details (e.g. phone number and email address) so that we can process and respond to your enquiry and refer back to it for any follow-up questions. There is no statutory or contractual obligation to provide this personal data. If you do not give your consent, we simply cannot forward and process your enquiry. You have the right to withdraw your consent at any time with effect for the future. This processing is carried out pursuant to Art. 6(1)(a) GDPR.

To protect our contact form against spam and automated misuse, we additionally use Google reCAPTCHA; see Section 10 for details.

5. Direct booking via the website

5.1. Booking via OnePageBooking

To process room bookings made through our website, we use the external booking engine OnePageBooking, provided by HotelNetSolutions GmbH, Genthiner Straße 8, 10785 Berlin, Germany. When you click “Book now”, you are redirected to this provider’s booking flow, where you enter your booking and, where applicable, payment details directly. Where HotelNetSolutions acts as our processor, we have entered into a data processing agreement with it pursuant to Art. 28 GDPR.

Personal data requested from you in connection with a room booking is stored only for as long as necessary for the performance of the contract and any subsequent contract-related correspondence (generally one year), or, in the case of documents relevant under commercial or tax law that contain personal data, for as long as required by the statutory retention periods under the German Commercial Code (HGB) and the Fiscal Code (AO) (generally 6 to 10 years). The legal basis is Art. 6(1)(b) GDPR. We also process your booking data pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interests in fraud prevention, the enforcement of legal claims, and for accounting and risk-management purposes, and pursuant to Art. 6(1)(c) GDPR to comply with legal obligations (e.g. retention obligations under commercial and tax law, or the disclosure of data pursuant to a final court order or an official order).

5.2. Table reservations via OpenTable

For table reservations at the Werdenfelserei restaurant, we embed a reservation form provided by OpenTable on our “Reserve a table” page (OpenTable GmbH, Warschauer Platz 12, 10245 Berlin, Germany; part of the Booking Holdings group). When you open this page, a connection is established to OpenTable’s servers and the form is embedded directly in our page. OpenTable processes the data you provide for your table reservation (e.g. name, email address, phone number, date and party size), as well as technical usage data, and sets its own cookies for this purpose.

The form is only loaded once you have consented to the use of this service via our cookie consent tool (see Section 7). The legal basis is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG (German Telecommunications and Digital Services Data Protection Act). Further information on how OpenTable handles your data is available in OpenTable’s privacy policy: https://www.opentable.de/legal/privacy-policy.

6. Newsletter

By subscribing to our newsletter and ticking the corresponding box for our privacy terms, you consent to the processing of the personal data you enter for the purpose of informing you about our current offers by email newsletter, until you withdraw your consent or object. There is no statutory or contractual obligation to provide this personal data. If you do not give your consent, you simply will not receive an email newsletter from us. You have the right to withdraw your consent at any time by an informal message to us or by clicking the unsubscribe link in the newsletter. This processing is carried out pursuant to Art. 6(1)(a) GDPR.

The newsletter sign-up form – including the pop-up window shown on our homepage – is technically provided via the platform of our service provider ADDITIVE. For details on the provider and the processing involved in sending the newsletter, see Section 14 (ADDITIVE+ Newsletter).

7. COOKIES

Like almost all service providers, we also use cookies on this website. Cookies make websites more user-friendly and efficient. A cookie is a small text file placed on your computer or mobile device by your browser, which allows your device to be recognised – potentially across different websites. You can find further information on cookies on the Verbraucherzentrale (German consumer advice centre) website.

7.1. Our cookie consent tool and changing your cookie settings

When you first visit our website, you are asked via a cookie consent banner for your consent to the use of non-essential cookies. For this we use the consent management tool Borlabs Cookie by Borlabs GmbH, Hamburg. Only once you have consented to individual services or categories are the corresponding cookies set or the relevant scripts loaded. You can change or withdraw your choice at any time, with effect for the future, via the “Cookie settings” link in the footer of our website. Your decision itself is stored in a cookie named “borlabs-cookie” for 60 days, so that you are not asked again on every visit; the legal basis for this is our legitimate interest and our legal obligation to document your consent, Art. 6(1)(c), (f) GDPR.

Independently of this, you can also determine via your browser’s settings how it handles cookies. If you restrict the use of cookies, it is possible that you will no longer be able to use all the features of this website to their full extent.

7.2. These are the cookies and services we use on our website

This table is reviewed by us regularly for accuracy; the settings in our cookie consent tool are always decisive for which cookies are actually active.

8. Google Analytics

This website uses Google Analytics 4 (GA4), a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), as well as Google Tag Manager to manage the measurement codes used for this and other services. Both services are only used once you have given your consent via our cookie consent tool (see Section 7). The legal basis is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG.

GA4 uses an event-based measurement model and records, among other things, page views, time spent on the page, clicks and similar interactions. According to Google, no full IP addresses are permanently stored; they are only used briefly for approximate location determination and are then shortened or discarded. The cookies set by GA4 (including “_ga”, “_ga_*”) have a lifetime of up to 2 years; the user-related analytics data stored by Google is automatically deleted after 14 months at our instruction.

Since Google also operates servers in the USA and other third countries, personal data may be transferred to the USA as part of this processing. Google LLC states that it is certified under the EU-U.S. Data Privacy Framework (DPF); in addition, Google has agreed to Standard Contractual Clauses (Art. 46(2)(c) GDPR). We note that the validity of the adequacy decision on the Data Privacy Framework is currently legally contested and subject to judicial review; should the decision be overturned, we would rely on whichever equally recognised safeguards (in particular Standard Contractual Clauses) then apply.

For further information on how Google handles your data, see the Google Analytics privacy policy.

 8.1. Use of Google Web Fonts

For the purpose of presenting and optimising our pages appropriately, we use typefaces (fonts) provided externally by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Your browser establishes a connection to Google’s servers for this purpose, during which technical data (including your IP address) may be transmitted to Google. If you have a Google account and are logged in, your data may be linked to your account; we have no influence over this.

This integration only takes place once you have given your consent via our cookie consent tool (see Section 7); the legal basis is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. Any transfer of personal data to the USA is based on the EU-U.S. Data Privacy Framework or supplementary Standard Contractual Clauses (see Section 8). For further information on the purpose and scope of data collection and your rights, see Google’s privacy policy: https://policies.google.com/privacy.

8.2. Opting out of Analytics

Since we only use Google Analytics with your consent, the most effective way to prevent your data from being collected is simply not to give your consent via our cookie consent tool (Section 7), or to withdraw it at any time with effect for the future.

In addition, Google offers a browser add-on to disable Google Analytics on all websites; you can download and install it here: https://tools.google.com/dlpage/gaoptout. Alternatively, you can set an opt-out cookie via your browser that prevents your data from being collected on future visits to our website: https://support.google.com/analytics/answer/181881.

9. Meta Pixel & other meta marketing services and functions

We embed the “Meta Pixel” on our website, provided by Meta Platforms, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA. Within the European Union (EU) and the European Economic Area (EEA), the service is offered by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

9.1. Description of the processing and its purpose

We use the Meta Pixel and other Meta marketing services and features such as Meta Custom Audiences, Meta Conversion Tracking, Meta Retargeting and the Meta Ads Manager to place and manage audience-targeted advertisements for our products and services on the Meta platforms Facebook and Instagram, and to measure their success.

Data is collected via a JavaScript code (the “Meta Pixel”) that is loaded and executed in your browser when you visit a page. This may store cookies on your device and read various information from your device and from cookies already stored there – allowing us to pseudonymously recognise visitors and the devices they use; visitors with their own Meta account may also be identified across devices. The information read out in particular includes data contained in your browser’s HTTP header (e.g. IP address, browser used, pages accessed, referral link), characteristics of your device, any existing Meta cookies (e.g. the marketing cookies “_fbp” and “fr”), and data on buttons clicked on our pages (e.g. for product enquiries, downloads or appointment bookings).

From this information, Meta creates statistics for us in the Meta Ads Manager (conversion tracking), which allow us to see how users have responded to our advertisements and to optimise our advertising strategy accordingly. We also create so-called Meta Custom Audiences in order to place audience-targeted advertising (retargeting) – for example, for people who had previously shown an interest in our offers and visited our website.

9.2. Legal basis for the processing

The legal basis for embedding and using this service is your consent, provided that you have given it via our cookie consent tool “Borlabs Cookie” (see Section 7). The use of cookies and similar technologies is based on Section 25(1) TDDDG. The subsequent processing is based on Art. 6(1) sentence 1(a) GDPR. As Meta also processes personal data in the USA, this transfer is based on the EU-U.S. Data Privacy Framework, to which Meta Platforms, Inc. states it is certified, as well as supplementary Standard Contractual Clauses.

9.3. Disabling the Meta Pixel

• You can most effectively prevent your data from being collected by not consenting to this service via our cookie consent tool, or by withdrawing your consent at any time.
• You can additionally prevent the Meta Pixel from collecting your data specifically on this website by setting an opt-out cookie: Disable Facebook Pixel.

10. Google ReCaptcha

To protect our forms (e.g. the contact form) against abusive, automated use, we use the reCAPTCHA service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). This check serves to distinguish whether an input is made by a human or through abusive, automated processing. In doing so, your IP address and, where applicable, other data required by Google for reCAPTCHA are transmitted to and evaluated by Google.

reCAPTCHA is only loaded once you have given your consent via our cookie consent tool (see Section 7). The legal basis is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. Any transfer of personal data to the USA is based on the EU-U.S. Data Privacy Framework or supplementary Standard Contractual Clauses. According to Google, the IP address transmitted by your browser as part of reCAPTCHA is not merged with other Google data. Further information on Google’s privacy policies is available at https://www.google.com/intl/en/policies/privacy/.

11. ADDITIVE+ LANDINGPAGE – Online Marketing und Landingpages

In addition to our website, we operate optimised sales landing pages in the field of online hotel marketing. To process your enquiry, booking, order, activation, sign-up or any other form submitted on such a landing page, and to store and retain your data, we use standard cloud services and CRM systems as well as software provided by ADDITIVE GmbH, Zona industriale 1/5 – Eurocenter, 39011 Lana (BZ), Italy (“ADDITIVE”). The appropriate level of data protection results from the data processing agreements concluded with the respective companies.

Our landing pages also use features of the Google Analytics web analytics service provided by Google Ireland Limited (“Google”). Google Analytics enables the analysis of how visitors use the landing pages; the information generated in this way is transferred to and stored on the provider’s servers. Your IP address is shortened immediately, so that only an approximate location can be determined. You can prevent the transmission of data relating to your use of the site to Google by downloading and installing the browser plug-in available at the following link: https://chrome.google.com/webstore/detail/google-analytics-opt-out/fllaojicojecljbmefodhfapmkghcbnh. ADDITIVE has access to the data collected via Google Analytics; this data is used exclusively to analyse the use of our websites and to evaluate our marketing and sales activities.

Our websites and landing pages also use ADDITIVE features for the cross-channel measurement of usage (e.g. landing pages, newsletters, social media presences). Information about your visits and any forms you submit is also transmitted to ADDITIVE in order to evaluate and optimise our marketing and sales activities. This processing is based on our legitimate interest pursuant to Art. 6(1)(f) GDPR in improving our offering and online presence.

Our landing pages and our website also use remarketing features from Google and from Meta Platforms. This involves informing Meta and Google that you have visited this website, in order to show you interest-based advertisements within Google’s advertising network or on Facebook and Instagram. We only use these remarketing features on the basis of your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG, which you give via the relevant cookie consent banner on the page you visit; a separate consent banner provided by ADDITIVE may be used for this purpose on our ADDITIVE landing pages. You can object to your consent at any time by visiting the cookie settings on the relevant page and declining the corresponding use.

12. ADDITIVE+ MARKETING AUTOMATION – DireCt marketing

To increase customer loyalty and to sell services and add-ons, we use hotel marketing automation software provided by ADDITIVE GmbH, Zona industriale 1/5 – Eurocenter, 39011 Lana (BZ), Italy, in the field of marketing and sales automation for hotels. Data that we collect in connection with your enquiry, booking, order, activation, sign-up or any other form submitted on the website is analysed and used to make you automated offers for services and add-ons via ADDITIVE+ Marketing Automation. The appropriate level of data protection results from the data processing agreement concluded.

You can object to the use of your data for this purpose at any time via the unsubscribe link in the respective message. This processing is carried out on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in avoiding disadvantages compared to our competitors, improving our brand awareness, and maximising our economic success through the best possible commercial use of the contacts gained.

13. ADDITIVE+ Vouchers

You have the option of purchasing vouchers via our website through an online voucher system. To process your purchase and to store and retain your data, we use voucher marketing software provided by ADDITIVE GmbH, Zona industriale 1/5 – Eurocenter, 39011 Lana (BZ), Italy.

Your data is processed and stored within the EU/EEA. The data you provide is required to perform the contract or to carry out pre-contractual measures; without this data we cannot conclude the contract with you. Your data is not passed on to third parties, except for the transmission of payment data to the payment service providers processing the transaction for the purpose of debiting the purchase price, and to our tax advisor to fulfil our tax-related obligations. This processing is carried out on the basis of Art. 6(1)(a) and/or (b) GDPR.

14. ADDITIVE+ NEWSLETTER

You have the option of subscribing to our newsletter via our website. To do so, we need your email address and your confirmation that you agree to receive the hotel newsletter via ADDITIVE GmbH, our email marketing provider for hotels. In order to provide you with targeted information, our newsletter system also collects and processes voluntarily provided details such as your areas of interest, name, birthday and region/country of origin. Once you have signed up for the newsletter, we send you a confirmation email with a link to confirm your subscription (double opt-in).

You can cancel your newsletter subscription at any time via the unsubscribe link in the respective newsletter, or by an informal message to us. To process your subscription and to deliver the newsletter to your email address, we use software provided by ADDITIVE GmbH, Zona industriale 1/5 – Eurocenter, 39011 Lana (BZ), Italy. Through these services and systems, your data is, at least in part, also processed and stored outside the EU/EEA; the appropriate level of data protection results from the data processing agreement concluded, and, where applicable, agreed Standard Contractual Clauses. The legal basis for sending the newsletter is your consent pursuant to Art. 6(1)(a) GDPR (see also Section 6).

15. Subject to change

We reserve the right to amend or update this privacy policy where necessary, in compliance with applicable data protection law – for example, to adapt it to current legal requirements or to reflect changes to our services (such as the introduction of new services or cookies). The version applicable to your visit is always the current one.

Version of this privacy policy: September 2026