PRIVACY NOTICE SOCIAL MEDIA

1. Data Controller
The data controller within the meaning of the General Data Protection Regulation (GDPR) is
i-Hotel Services Germany GmbH & Co. KG
Gissigheimer Straße 26
97922 Lauda-Königshofen
Germany
Telephone: +491627641805
Email: datenschutz@i-hotelservices.com

2. Contact details of the Data Protection Officer
You can contact the Data Protection Officer at
Proliance GmbH
www.proliance.ai
Data Protection Officer
Leopoldstr. 21
80802 Munich
Email: datenschutzbeauftragter@proliance.ai
When contacting the Data Protection Officer, please state the company to which your enquiry relates. Please also refrain from attaching sensitive information, such as a copy of your ID, to your enquiry.

3. General information on data transfers to third countries
The processing of your data may, where applicable, also take place in countries outside the European Union (EU) and the European Economic Area (EEA).
For data transfers to certain third countries, an adequacy decision by the European Commission pursuant to Article 45(1) of the GDPR may apply. Such a decision establishes that an adequate level of data protection exists in the third country. A list of previous adequacy decisions can be viewed at the following link: Data protection adequacy for non-EU countries.
The scope of an adequacy decision may also be restricted to a specific group of recipients or subject to further conditions.
For example, the adequacy decision for data transfers to the US applies only to companies certified under the EU-US Data Privacy Framework. The certification status of a participating company can be viewed via the following link: Participant Search (dataprivacyframework.gov).
When your data is transferred to recipients in third countries for which no adequacy decision exists, there is a risk that authorities in those countries may access your data for security and surveillance purposes without you being informed or being able to seek legal redress.
We therefore ensure that appropriate safeguards within the meaning of Article 46 of the GDPR are in place to guarantee an adequate level of data protection when transferring your data to recipients in such third countries.
Standard data protection clauses of the European Commission pursuant to Article 46(2)(c) of the GDPR are therefore regularly concluded either by us or by the service providers we engage. These clauses oblige the recipient of the data in the third country to process it in accordance with the European level of protection. The clauses can be viewed via the following link: Publications on the Standard Contractual Clauses (SCCs) – European Commission. Should you require further details regarding the modules of the Standard Data Protection Clauses we have concluded in specific cases or any supplementary measures, we will be happy to provide you with a copy. In this case, please simply contact us using the contact details provided above under ‘Data Controller’.
In the case of certain recipients, data transfers may also be based on binding corporate rules (BCRs) approved by the supervisory authorities in accordance with Article 46(2)(b) of the GDPR. These can be viewed at the following link: Approved Binding Corporate Rules | European Data Protection Board.
Where the Standard Data Protection Clauses or Binding Corporate Rules are insufficient to ensure the required level of protection, additional technical, contractual or organisational measures are taken to safeguard the data transfer. Furthermore, we regularly review and assess whether these additional measures continue to ensure an adequate level of data protection or whether further supplementary measures may need to be taken.
Further details on data transfers to third countries can be found in the relevant cases below, in the sections on data processing or the services used, under ‘Data processing in third countries’.

4. General information on the use of artificial intelligence
Artificial intelligence may be used in the processing of your data.
Further details on the use of Artificial Intelligence can be found in the relevant sections below, in the explanations regarding data processing or the services used, under “Use of Artificial Intelligence”.

5. Privacy information for visitors to our social media profiles
Below you will find information on how we handle your data collected through your use of our social media profiles on social networks and platforms.

5.1.  social media profiles
We maintain profiles, accounts, pages or fan pages on the following social media platforms:
Platform Profile
LinkedIn https://de.linkedin.com/company/i-hotel-services
Facebook https://www.facebook.com/ihotelservices
Instagram https://www.instragram.com/i_hotel_services/

5.2. Different responsibilities and roles
Depending on how the platform operators and we, as the website operator, are involved in the processing of your personal data, the respective responsibility or role differs.
Thus, we may be jointly responsible with the platform operator, or the platform operator may be solely responsible.

5.3. Joint responsibility with platform operators
5.3.1. Joint controllers
There is a joint responsibility between us and the following platform operators:
Platform Platform operator
LinkedIn LinkedIn Ireland Unlimited Company, Wilton Plaza, Gardner House 4, 5, 6, Dublin 2, Ireland
Facebook Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland
As the site operator, we are jointly responsible with the providers of the respective platforms for the processing of your personal data in connection with your visit to the profile, page or fan page on the platforms, if the platform operators provide aggregated information on visitors to our profiles, pages or fan pages (e.g. so-called ‘Insights’ or ‘Analytics’).
In the event of joint responsibility, we have concluded agreements with the platform operators in accordance with Article 26 of the GDPR regarding joint responsibility for the processing of your personal data (e.g. Page Controller Addendum or Joint Controller Addendum).
These agreements specify which data processing operations we or the respective platform operator are responsible for. You can view these agreements via the following links:
Platform Joint controller agreements
LinkedIn https://legal.linkedin.com/pages-joint-controller-addendum
Facebook https://www.facebook.com/legal/terms/page_controller_addendum
Further information on data processing by the platform operators can be found in their privacy policies:
Platform Privacy Policy
LinkedIn https://www.linkedin.com/legal/privacy-policy
Facebook https://de-de.facebook.com/privacy/policy

5.3.2. Contacting the data protection officers of the platform operators
You can contact the data protection officers of the platform operators here:
Platform How to get in touch
LinkedIn You can contact LinkedIn’s data protection officers via the contact form at the following link:
https://www.linkedin.com/help/linkedin/ask/TSO-DPO .
Facebook You can contact Meta’s Data Protection Officer using the contact form at the following link:
https://help.meta.com/support/privacy/

5.3.3. Joint data processing
5.3.3.1. Access to and storage of information on end devices
When you visit our profiles on the aforementioned platforms, the platform operator uses cookies and similar technologies on your device to store data on your device or read data from it. This access or storage may involve further processing of personal data within the meaning of the GDPR.
In cases where such access to or storage of information is strictly necessary for the technically fault-free provision of the services, this is carried out on the basis of Section 25(1) sentence 1, (2) no. 2 of the TDDDG. Any subsequent data processing may take place on the basis of Article 6(1)(f) of the GDPR.
In cases where such processing serves other purposes (e.g. the needs-based design of our website), this is carried out on the basis of Section 25(1) of the TDDDG only with your consent in accordance with Article 6(1)(a) of the GDPR. Consent may be withdrawn at any time with future effect. The processing of your personal data is subject to the provisions of the GDPR and the Federal Data Protection Act (BDSG).
Further information on the use of cookies and similar technologies, as well as their legal basis, can be found in the respective privacy policy of the platform operator. Links to the respective privacy policies can be found above. If you have any further questions on this matter, please contact the operator of the respective social media platform directly.

5.3.3.2. Data processing for advertising and market research purposes
As a rule, personal data on our social media profile is primarily processed for the platform operator’s market research and advertising purposes. Insofar as data collection also takes place directly on our social media profile, we participate in the platform operator’s data processing and are therefore jointly responsible with the platform operator in this respect
Cookies and similar technologies are used in data processing, enabling the platform operator to recognise you when you visit a social media profile. In addition, for members of the social media platform, the platform operator carries out a comprehensive analysis of your interactions on the platform (clicks, comments and likes) and processes the information you have provided to the platform operator, such as your personal details, your profile picture or your profile name. In particular, demographic data (age, gender, country, industry, occupation, etc.) from your own member profile may also be processed.
User profiles can be created using the data collected. These are then used by the platform operator to display advertisements, both within and outside the platform, that are presumed to match your interests.
Although we do not have direct access to the data processed by the platform operator, we also benefit from this data processing by placing relevant advertisements within or outside the platforms based on the target groups identified by the platform operator.
The legal basis for the processing of your personal data in this context is the consent you have given to the platform operator in accordance with Article 6(1)(a) of the GDPR.
Please note that we have no influence over the collection of data or its further processing, which falls under the responsibility of the platform operators. Consequently, we are unable to provide any information regarding the extent to which, the location where, or the duration for which the data is stored by the platform operator.
Further information on this can be found in the privacy policy of the respective provider.

5.3.3.3. Data processing in the context of “Insights” or “Analytics”
In addition, your data is processed jointly in connection with so-called “Page Insights” or “Page Analytics”.
“Page Insights” or “Page Analytics” are analysis functions provided by the platform operator, through which the master data processed by you, in particular demographic data and data regarding your interactions with our profile, are collected jointly by the platform operator and us.
The platform operator then analyses this data and compiles summarised data (so-called aggregated data) for us, from which we can identify which demographic target group has visited our profile and how our profile was used by that group.
We also have no direct access to the data processed by the platform operator. This data is only made available to us by the platform operator in aggregated form. This means that we cannot identify individual visitors or recognise their interactions from the aggregated data.
We then use this aggregated data to tailor our social media profile to the target audience and, more generally, to optimise it in relation to the aforementioned advertising purposes (increasing the reach and awareness of our profile and evaluating the success of marketing campaigns).
The legal basis for the processing of your personal data in this regard is the consent you have given to the platform operator in accordance with Article 6(1)(a) of the GDPR.
Please note that we have no influence over the data collection and further processing carried out under the responsibility of the platform operators. Consequently, we are unable to provide any information regarding the extent to which, the location where, and the duration for which the data is stored by the platform operator.
Further information on this can be found in the privacy policy of the respective provider.

5.3.3.4. Data processing based on consent
If the respective platform operator asks you to consent to processing for a specific, shared purpose, the legal basis for the processing is Article 6(1)(a) and Article 7 of the GDPR. Consent that has been given may be withdrawn at any time with effect for the future.

5.3.3.5. Recipients and data transfers to third countries
Where we pass on personal data to the operators of social media platforms, the latter are recipients of the data within the meaning of Article 4(9) of the GDPR.
Platform Recipient
LinkedIn LinkedIn Ireland Unlimited Company, Wilton Plaza, Gardner House 4,5,6, Dublin 2, Ireland
LinkedIn Corp., 1000 W. Maude Ave, Sunnyvale, CA 94085, USA
Facebook Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland
Meta Platforms, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA
When you visit our social media profiles, your data may also be processed in countries outside the European Union (EU) and the European Economic Area (EEA), in third countries.
An adequacy decision by the European Commission exists for data transfers to certain third countries.
For data transfers to the USA, an adequacy decision by the European Commission exists pursuant to Article 45(1) of the GDPR with regard to companies certified under the EU-US Data Privacy Framework.
For data transfers to third countries for which no adequacy decision by the European Commission exists, standard data protection clauses are concluded or binding internal data protection regulations are used to ensure an adequate level of data protection, and further supplementary measures are taken to safeguard the data transfer.
Platform Recipients Third country Type of Safeguards for transfers to third countries
LinkedIn LinkedIn Corp USA Adequacy decision by the European Commission and certification under the EU-US Data Privacy Framework
Facebook Meta Platforms, Inc. USA EU Commission adequacy decision and certification under the EU-US Data Privacy Framework
Further information on this and additional links can be found above in the section ‘General information on data transfers to third countries’.

5.3.4. Exercising your rights in the case of joint controllership
If, as a visitor to the site, you wish to exercise your rights (access, rectification, erasure, restriction, data portability, complaint to the supervisory authority, objection or withdrawal), you may contact both the platform operator and us.
Platform Settings in your platform account
LinkedIn You can use the LinkedIn settings to restrict the visibility of your LinkedIn account (including to us).
For further information on exercising your rights, please refer to LinkedIn’s privacy policy at the following link: https://www.linkedin.com/legal/privacy-policy
Facebook You can use your Facebook settings to restrict the visibility of your Facebook account (including to us). You can also adjust your advertising settings yourself in your platform account. To do so, click on the following link and log in: https://www.facebook.com/settings?tab=ads.
For further information on exercising your rights, please refer to LinkedIn’s privacy policy at the following link: https://www.facebook.com/about/privacy.

5.4. Responsibility of the platform operators
If your personal data is processed by one of the social media platform operators listed below, this processing is carried out under the sole responsibility of the platform operator within the meaning of Article 7(4) of the GDPR.
Platform Platform operator
Instagram Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland
YouTube Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
X Twitter International Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland
We have no influence over the data processing carried out by the platform operators. For further information, please consult the privacy policy of the respective platform operator:
Platform Privacy Policy
Instagram http://instagram.com/about/legal/privacy
YouTube: https://policies.google.com/privacy
X https://x.com/de/privacy
To exercise your data subject rights, please note that these can be most effectively exercised with the respective providers. Only they have access to the data collected from you. Should you nevertheless require assistance, please feel free to contact us at any time.

5.5. Our own responsibility
We are solely responsible for the following data processing activities via our social media profiles.

5.5.1. Data processing through the operation of the social media profile
When you visit or interact with our social media profile, we process your personal data.
This may include information that you actively provide (comments, likes, and information you have made publicly available, such as your profile picture or name). Depending on the provider and your settings on the provider’s platform, we may also be informed of who has viewed our profile within the platform.
The legal basis for the processing of personal data in connection with the operation of our social media profile is Article 6(1)(f) of the GDPR.
The legitimate interest lies in addressing visitors for promotional purposes and in providing an effective means of communication and interaction with our company on the social media platform.

5.5.2. Data processing when contacting us
We collect personal data ourselves when you contact us, for example via a contact form or through a messaging function on the respective platform.
The data collected depends on the information you provide and the contact details you have provided or shared. This data is stored by us for the purpose of processing your enquiry and in the event of follow-up questions.
The legal basis for processing the data is our legitimate interest in responding to your enquiry in accordance with Article 6(1)(f) of the GDPR.
Your data will be deleted once your enquiry has been fully processed, provided that this does not conflict with any statutory retention obligations. We assume that processing has been fully completed if the circumstances indicate that the matter in question has been conclusively resolved.

5.5.3. Data processing for the purpose of contract fulfilment
If your contact via a social network or other platform is aimed at concluding a contract with us for the supply of goods or the provision of services, we process your data for the purpose of fulfilling the contract or carrying out pre-contractual measures, or for the provision of the requested services.
The legal basis for the processing of your data in this case is Article 6(1)(b) of the GDPR.
Your data will be deleted when it is no longer required for the performance of the contract or when it is established that the pre-contractual measures will not lead to the conclusion of a contract corresponding to the purpose of the contact.
Please note, however, that even after the contract has been concluded, it may be necessary to store personal data of our contractual partners in order to comply with contractual or legal obligations.

5.5.4. Data processing based on consent
If we ask you for consent to processing for a specific purpose, the legal basis for the processing is Article 6(1)(a) and Article 7 of the GDPR. Consent given may be withdrawn at any time with effect for the future.

5.5.5. Retention period
The personal data we collect is deleted from our system when it is no longer required for the purposes specified at the time of collection or when you have exercised your right to withdraw consent or object. Statutory retention periods remain unaffected. We have no influence over the retention period of your data stored by social media providers for their own purposes. For further details, please contact them directly.

6. Data protection information regarding data processing for compliance with data protection regulations
6.1. Documentation of consents and implementation of data subjects’ rights
Description of data processing and purpose
Where you provide us with a declaration of consent, we process your personal data regarding the circumstances and time of submission (where applicable, signature, email address, telephone or fax number or IP address) in order to be able to demonstrate, within the scope of our accountability obligation under Article 5(2)(f) of the GDPR, that you have consented to the data processing in question. The same applies to the withdrawal of your consent.
Where you exercise your data subject rights under the GDPR vis-à-vis us, we also process your personal data in order to be able to demonstrate, within the framework of the accountability obligation under Article 5(2)(f) of the GDPR, that we have complied with the GDPR when processing your request.
Legal basis for data processing
Processing is carried out in each case on the basis of Article 6(1)(c) GDPR in conjunction with Article 5(2) GDPR or Article 6(1)(f) GDPR. Our legitimate interest lies in being able to document compliance with the requirements of the GDPR as part of our accountability.
Recipients
In the course of data processing, your data will be transferred to the following categories of recipients whom we engage in the course of data processing to achieve the stated purposes:
• External Data Protection Officer,
• Software service providers who provide us with solutions for internal and external communication, for the creation and editing of documents, and for the management of data sets.
These recipients include, in particular:
• Proliance GmbH, Leopoldstr. 21, 80802 Munich, Germany
• Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA.
• Microsoft Ireland Operations, Ltd, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland.
Retention period
We store your data for as long as is necessary to achieve the aforementioned purpose. We generally store data relating to consent given for a period of 3 years from the end of the year in which we last made use of it. Data that we process in connection with the exercise of data subject rights is generally stored for a period of 3 years from the end of the year in which you exercised your data subject rights.
We will then delete your data, unless data processing, including in other systems where applicable, remains permissible on another legal basis or is mandatory for us (e.g. in the case of statutory retention obligations).

6.2. Maintaining an advertising opt-out list
Description of data processing and its purpose
If you object to data processing for advertising purposes on the basis of legitimate interests, we will regularly add your contact details (e.g. first name and surname, email address, telephone number, address) to our advertising opt-out list.
We maintain this list to ensure permanently that you will no longer be contacted for advertising purposes in the future, even if we collect and process your data again in accordance with the GDPR.
Thus, only by cross-referencing this list can we ensure that your data is not used again for advertising purposes after it has been otherwise deleted from the active data stock of our operational systems – for example, because you are re-registered as a customer in our systems, or because we collect your data again from other data sources, or receive it again from third parties, including processors.
You will also be added to the advertising opt-out list if, in addition to objecting, you exercise your right to erasure, unless it is explicitly important to you – or it is clear to us that it is important to you – that your data be erased and the permanent implementation of your right to object is not the primary concern.
Legal basis for data processing
Processing is carried out in each case on the basis of Article 6(1)(f) of the GDPR. Our legitimate interest lies in being able to permanently and effectively implement compliance with the right to object under the GDPR, as well as the right to object within the meaning of Section 7(3) of the Unfair Competition Act (UWG) in cases of direct marketing or marketing to existing customers, beyond the mere deletion of the data.
Recipients
In the course of data processing, your data is transferred to the following categories of recipients whom we engage in the course of data processing to achieve the stated purposes:
• Marketing and email marketing service providers,
• Software service providers who provide us with solutions for internal and external communication, for the creation and editing of documents, and for the management of data sets.
These recipients include, in particular:
• Cleverreach GmbH & Co. KG, Schafjücken 2, 26180 Rastede, Germany
• Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA.
• Microsoft Ireland Operations, Ltd, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland.
Retention period
We store your data in the advertising opt-out list for as long as is necessary to achieve the aforementioned purpose. This is generally for as long as we, as a company, are active in the market and advertise our products, goods, services, offers and events.

7. Privacy information for other data processing
7.1. Fulfilment of other legal obligations
Description of data processing and purpose
We process personal data where this is necessary to fulfil a legal obligation. The scope of the data to be processed is determined by the legal obligation with which we must comply.
Legal basis for data processing
In these cases, the legal basis for the processing of your data is Article 6(1)(c) of the GDPR in conjunction with the relevant legal provision imposing such an obligation on us.
These may include, for example, provisions of the German Fiscal Code (AO), e.g. Section 147 AO, the German Commercial Code (HGB), e.g. Section 257 HGB, or the Code of Criminal Procedure (StPO).
Recipients
In the course of data processing, your data is transferred to the following categories of recipients whom we engage in the course of data processing to achieve the stated purposes:
• Tax advisers, auditors, Tax or investigative authorities, solicitors, experts, courts.
Retention period

We store your data to the extent necessary for as long as is required to achieve the aforementioned purpose. The storage period is determined by specific statutory provisions which oblige us to retain or process data for up to 10 years, with the specific start date of the retention periods being determined by the relevant specific law.
We will then delete your data, unless data processing, including in other systems where applicable, remains permissible on the basis of another legal ground.

7.2. Exercise or defence of legal claims
Description of data processing and purpose
In addition, we process your data in individual cases for the purpose and in the interest of asserting legal claims, for example to enforce our claims arising from unpaid invoices, provided your data is relevant to a legal dispute.
We also process your data in individual cases for the purpose and in the interest of defending against legal claims brought against us, for example in the event of claims for liability for material defects, provided your data is relevant to a legal dispute.
Legal basis for data processing
The legal basis for the processing of your data is Article 6(1)(f) of the GDPR.
Recipients
As part of our data processing activities, your data will be disclosed to the following categories of recipients, whom we engage in the course of data processing to achieve the stated purposes:
• Tax advisers, auditors, tax or investigative authorities, solicitors, experts, courts.
Retention period
We store your data on a case-by-case basis to the extent necessary, for as long as this is required to achieve the aforementioned purpose. We will then delete your data, unless data processing, including in other systems where applicable, remains permissible on another legal basis or is mandatory for us (e.g. in the event of statutory retention obligations).

8. Your rights
Below you will find information on the data subject rights granted to you by applicable data protection law vis-à-vis the controller with regard to the processing of your personal data:
The right, pursuant to Article 15 of the GDPR, to request information about your personal data processed by us. In particular, you may request information regarding the purposes of processing, the categories of personal data, the categories of recipients to whom your data has been or will be disclosed, the intended storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the origin of your data where it was not collected by us, as well as the existence of automated decision-making, including profiling, and, where applicable, meaningful information regarding its details.
The right, pursuant to Article 16 of the GDPR, to request the immediate rectification of inaccurate personal data or the completion of your personal data stored by us.
The right, pursuant to Article 17 of the GDPR, to request the erasure of your personal data stored by us, unless processing is necessary for the exercise of the right to freedom of expression and information, to comply with a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of legal claims.
The right, pursuant to Article 18 of the GDPR, to request the restriction of the processing of your personal data, provided that you contest the accuracy of the data, the processing is unlawful but you oppose its erasure and we no longer require the data, but you require it for the establishment, exercise or defend legal claims, or you have objected to the processing in accordance with Article 21 of the GDPR.
The right, pursuant to Article 20 of the GDPR, to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, or to request that it be transmitted to another controller.
The right to lodge a complaint with a supervisory authority in accordance with Article 77 of the GDPR. As a rule, you may contact the supervisory authority of the federal state in which our registered office is located, as stated above, or, where applicable, that of your usual place of residence or workplace.
The right to withdraw consent pursuant to Article 7(3) of the GDPR: You have the right to withdraw your consent to the processing of data at any time with effect for the future. In the event of withdrawal, we will delete the relevant data without delay, provided that further processing cannot be based on a legal ground for processing without consent. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent prior to withdrawal.
Right to object
Where we process your personal data on the basis of legitimate interests pursuant to Article 6(1)(f) of the GDPR, you have the right under Article 21 of the GDPR to object to the processing of your personal data , provided this is for reasons arising from your particular situation. Where the objection relates to the processing of personal data for the purposes of direct marketing, you have a general right to object without the need to specify a particular situation.
If you wish to exercise your right to withdraw consent or object, please contact us using the contact details provided above under ‘Data Controller’.

9. Status of the privacy policy
This privacy policy was last amended on 7th of October 2026 .