PROTECTING YOUR DATA
Privacy policy
This privacy policy explains how we process personal data when you visit our website, contact us or make an enquiry.
As of: September 2026
1. Controller
Studentenmühle Hotel-Restaurant
Carmen & Désirée Herz GbR
Studentenmühle 1
56412 Nomborn
Germany
Telephone: +49 6485 9122-0
Email:
2. General information and legal bases
Personal data means any information relating to an identified or identifiable natural person. We process personal data only to the extent necessary to provide this website, handle your enquiry, take steps prior to entering into a contract or fulfil legal obligations.
Depending on the processing activity, we rely in particular on the following legal bases:
- Article 6(1)(a) GDPR, where you have given us your consent;
- Article 6(1)(b) GDPR, where processing is necessary for the performance of a contract or to take steps prior to entering into a contract;
- Article 6(1)(c) GDPR, where we are subject to a legal obligation;
- Article 6(1)(f) GDPR, where processing is necessary for our legitimate interests and your interests or fundamental rights do not override those interests.
You may withdraw your consent at any time with effect for the future. This does not affect the lawfulness of processing carried out before the withdrawal.
3. Hosting and server logs
When you access our website, the web server automatically processes technical access data. This may include, in particular, your IP address, the date and time of access, the address requested, the page previously visited, your browser type and version, operating system, the hostname of the device accessing the website, the volume of data transferred and the HTTP status code.
This processing is necessary to make the website technically available, ensure its stability and security, analyse errors and prevent misuse. It is based on Article 6(1)(f) GDPR. Our legitimate interest is the secure and functional operation of our website.
We may use hosting and IT service providers as processors to operate the website. Log data is deleted or anonymised as soon as it is no longer required for the purposes described. It is retained for longer only where necessary to investigate a specific security incident, pursue legal action or fulfil legal obligations.
4. Encrypted transmission
Our website uses TLS encryption. This protects data that you send to us against unauthorised access by third parties during transmission. You can usually recognise an encrypted connection by a web address beginning with “https://”.
5. Cookies and consent management
Our website uses technically necessary cookies and comparable technologies. These are required to provide basic website functions, secure the website and store the choice you make in the consent banner. The legal basis is Section 25(2), no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG). Where personal data is processed in this context, processing is based on Article 6(1)(f) GDPR.
Your choice in the consent banner may be stored for up to 180 days. Optional external content is loaded only on the basis of your consent under Section 25(1) TDDDG and Article 6(1)(a) GDPR. You may change your choice or withdraw consent at any time using the “Cookie settings” link provided on the website.
6. Contacting us, contact form and room enquiries
If you contact us using the contact form, by email or by telephone, we process the data you provide to handle your enquiry and communicate with you. The contact form may process, in particular, your company, name, email address, enquiry, telephone number and message. A room enquiry may also involve processing your arrival and departure dates and the number of adults and children.
Required information is marked as such. Without this information, we cannot handle your enquiry through the form. Integrated spam protection is used to detect and prevent automated or abusive submissions.
If your contact relates to a booking, reservation or another contractual service, processing is based on Article 6(1)(b) GDPR. We handle general enquiries on the basis of Article 6(1)(f) GDPR. Our legitimate interest is to respond appropriately to your enquiry and maintain our business relationships. Where you have expressly given consent, Article 6(1)(a) GDPR provides an additional legal basis.
The data is deleted once your enquiry has been fully dealt with and there are no contractual, statutory or liability reasons for retaining it further. Data from a booking or business correspondence may be retained for longer in accordance with statutory retention obligations.
7. OpenStreetMap
Our contact page includes map content from OpenStreetMap. The provider is the OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom (“OSMF”).
When you allow the map to load, your browser establishes a direct connection to OSMF servers. This may involve processing, in particular, your IP address, browser and device information, operating system, referrer, date and time, and information about the map areas requested. OSMF may use a worldwide network of cache servers to deliver map data.
The map is loaded on the basis of your consent under Section 25(1) TDDDG and Article 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future through “Cookie settings”. An adequacy decision by the European Commission under Article 45 GDPR applies to data transfers to the United Kingdom.
Further information is available in the OpenStreetMap Foundation privacy policy.
8. Fonts and Font Awesome
The text fonts and Font Awesome icons used on this website are provided exclusively from our own web server. Visiting the website therefore does not establish a connection to servers operated by Fonticons, Inc. or other font or icon providers. No personal data is transferred to these providers in this context.
9. Google Maps and virtual 360° tour
Our website includes a virtual 360° tour through Google Maps. For users in the European Economic Area, the service is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
The tour is loaded only once you have allowed Google Maps in the consent banner. Your browser then establishes a direct connection to Google servers. This may involve processing, in particular, your IP address, browser and device information, the date and time, the referring URL and information about your use of the tour.
The tour is loaded on the basis of your consent under Section 25(1) TDDDG and Article 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future through “Cookie settings”.
Data may be processed outside the European Economic Area, particularly in the United States. Google explains the mechanisms it uses for international data transfers in its information on international data transfers. Further information about the processing of personal data is available in the Google privacy policy.
10. External links and social networks
Our website contains links to external services, including Facebook, Instagram, OpenStreetMap, HRS, Yovite and tourism services in the region. These are ordinary links, not embedded social media plugins. As a general rule, displaying a link alone does not transfer any data to the provider concerned. Only when you follow such a link do you leave our website and your browser establish a connection to the provider. That provider is responsible for the subsequent processing of data.
11. Recipients of personal data
Within our business, only those people who need personal data to handle your enquiry or fulfil our legal and contractual obligations have access to it. Hosting, IT, email and other technical service providers that we engage may also receive data as processors. Data is disclosed to other recipients only where necessary to perform a contract, required by law, covered by your consent or permitted by another legal basis.
12. Retention period
We retain personal data only for as long as necessary for the relevant purpose. The data is then deleted or anonymised unless statutory retention obligations, legitimate interests in retaining evidence or the establishment, exercise or defence of legal claims require longer retention. In particular, retention obligations under commercial and tax law and statutory limitation periods are relevant.
13. Your rights
Subject to the conditions laid down by law, you have in particular the following rights:
- Access to the personal data we process about you (Article 15 GDPR);
- Rectification of inaccurate data or completion of incomplete data (Article 16 GDPR);
- Erasure of your personal data (Article 17 GDPR);
- Restriction of processing (Article 18 GDPR);
- Data portability (Article 20 GDPR);
- Objection to processing based on Article 6(1)(e) or (f) GDPR (Article 21 GDPR);
- Withdrawal of consent with effect for the future (Article 7(3) GDPR).
You may exercise your rights by contacting us using the details provided in section 1. If you believe that the processing of your personal data infringes data protection law, you also have the right to lodge a complaint with a data protection supervisory authority.
14. Competent data protection supervisory authority
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz
Hintere Bleiche 34
55116 Mainz
Germany
Telephone: +49 6131 8920-0
Email:
Website: www.datenschutz.rlp.de
15. Automated decision-making
This website does not involve decision-making based solely on automated processing, including profiling, within the meaning of Article 22 GDPR.
16. Updates to this privacy policy
We update this privacy policy when our website, the services used or legal requirements change. The version published on this website at the time applies.
Questions about data protection?
If you have questions about the processing of your personal data, please contact us at
