Privacy & Security

  1.  Information on the processing of personal data
    With the following information, we aim to give you an overview of the processing of your personal data associated with the use of our website at and to inform you of your rights under data privacy law, in accordance with art. 13 and 14 of the GDPR.

    1.    Responsibility for data processing
    The party responsible for data processing on this website in accordance with art. 4, no. 7 GDPR and the provider of this website (service provider) pursuant to the German Teleservices Act (TMG) is

    Steigenberger Hotels AG
    Lyoner Straße 25
    60528 Frankfurt am Main
    Telephone: +49 69 66564-01
    Fax: +49 69 66564-888

    2.    Contact details for the Data Privacy Officer
    You can reach our Data Privacy Officer via

    TÜV Informationstechnik GmbH
    Langemarckstr. 20
    45141 Essen
    E-mail address:

    3.    Objective and legal basis of the processing of personal data
    We process your personal data in compliance with the provisions of the EU General Data Protection Regulation (GDPR), the new German Federal Data Protection Act (BDSG-neu), and all other applicable laws, for the following purposes and on the following legal basis:

    (a)    For the handling and administration of reservation requests and reservations as well as for the fulfillment of our services including payments – the legal basis for this is art. 6, para. 1, clause 1, point b) of the GDPR.

(b)  In order to fulfill a legal duty our company is underlying (i.e. tax laws, accounting obligations etc.) – the legal basis for this is art. 6, para. 1, clause1, point c) of the GDPR.

Minors may not submit any personal data to us without permission from a parent or guardian. We do not knowingly process any personal data acquired from minors within the scope of our internet offering.

4.    Categories of recipients of personal data
Where necessary for the purposes outlined above in point 3, we disclose your personal data to the following recipients or categories of recipients pursuant to art. 4, no. 9 of the GDPR:

Within our company, your data will only be viewed or accessed by those departments that require it (in the scope required in each case) to fulfil our contractual and statutory obligations.

Service providers (e.g. as part of our order processing in line with art. 28 GDPR) and performing agents commissioned by us can also receive access to personal data for these purposes. These are companies that provide recruitment services (currently dvinci HR-Systems GmbH).

5.    Forwarding of personal data to a third country
Personal data will not be forwarded to offices in countries outside of the European Union (so-called third countries).

6.    Duration of personal data storage and criteria for establishing such duration
We adhere to the principles of data reduction and data economy. We therefore store your personal data only as long as it is necessary for the purposes stated here, or in line with the various storage deadlines stipulated by the legislator. Once the relevant purpose no longer applies or such deadlines expire, the relevant data is routinely blocked or deleted in line with the statutory provisions.

7.    Your rights as an affected person
Every person affected whose personal data is processed has a right under art. 15 of the GDPR to information from those responsible about the relevant personal data, as well as a right to rectification of such data under art. 16 of the GDPR, a right to erasure under art. 17 of the GDPR, a right to restriction of its processing under art. 18 of the GDPR, a right to object to its processing under art. 21 of the GDPR, and a right to data portability under art. 20 of the GDPR. In terms of the right to information and the right to erasure, the limitations pursuant to sections 34 and 35 of the BDSG-neu also apply.

Where the processing of your personal data is based on consent given to us, you have the right to withdraw such consent at any time, whereby this will not affect the legitimacy of the processing carried out based on such consent up to the point of its withdrawal.

Furthermore, there is also a right to lodge a complaint with the relevant supervisory authority in line with art. 77 of the GDPR in conjunction with section 19 of the BDSG-neu.

8.    Obligation to provide data
When using our website, you are under no obligation to provide personal data. If you want us to make contact with you, we will need (i) your name, and (ii) your telephone number or your e-mail address at the very least. All further indications are optional.

9.    Automated decision-making and profiling
In the establishment and execution of our contractual relationship, you will not be subject to any automated individual decision-making, including profiling, which produces legal effects concerning you or similarly significantly affects you pursuant to art. 22 of the GDPR.

10.    Additional information about your right to object pursuant to art. 21 of the GDPR
You have the right to object, for reasons arising from your specific situation, to the processing of personal data relating to you at any time based on art. 6, para. 1, clause 1, point e) of the GDPR (data processing in the public interest) or art. 6, para. 1, clause 1, point f) of the GDPR (processing necessary for the purposes of legitimate interests); this also applies to any profiling based on this provision according to art. 4, para. 4 of the GDPR.

If you lodge an objection, we will no longer process your personal data, unless we can prove it is absolutely necessary for protective reasons that outweigh your interests, rights and freedoms, or such processing serves the assertion, exercise or defence of legal claims.

If your personal data are processed by us in order to carry out direct advertising, you have the right to object to the processing of personal data relating to you for the purposes of such advertising at any time; this also applies for profiling where this is in connection with direct advertising.

Objection can be made in any form and should be directed to our data privacy officer using the contact details stated in point 2.

11.    Incorporation of services and content of third-party providers (e.g. YouTube and Google Maps)
The internet offer incorporates content from third parties, e.g. videos from YouTube and map resources from Google Maps (hereinafter referred to as “third-party providers”). Use of such content makes transfer of the user’s IP address to the relevant third-party provider necessary for technical reasons. After all, without the IP address the third-party providers would not be able to send the content incorporated into the website to the browser of the relevant user. We have no influence over whether or not a third-party provider stores the IP address or uses it in any other way, e.g. for statistical purposes.

If you make use of the offer from third-party provider CompanyMatch ( as incorporated into our application portal, the data privacy provisions of this third-party provider apply to the processing of the personal data you enter here.

Status and updating of the data privacy statement

This data privacy statement is valid from 22 May 2018.

We will update this data privacy statement from time to time in the event of relevant changes to our website, the processing of personal data or statutory provisions. The revised version will then be valid from the published date on which it comes into force.  Where there are fundamental changes to this data privacy statement, we will inform you promptly before the changes come into force with a notification on our website.  We will also inform our guests, where relevant, about the changes via e-mail or in another way.