Estrel Tow er Privacy
Privacy Policy
Estrel Hotel GmbH (hereinafter "we") takes the protection of personal data seriously. This privacy policy informs you about the nature, scope, and purpose of the processing of personal data on our website.
Information on Data Processing Pursuant to Article 13 GDPR
We are pleased that you are visiting our website and appreciate your interest in our company. Building relationships with our guests, customers, and prospective customers is based on trust. The trust you place in us is of the utmost importance, and we are committed to handling your personal data responsibly and protecting it against misuse.
Estrel Berlin complies in particular with the provisions of the EU General Data Protection Regulation (GDPR) and the current German Federal Data Protection Act (BDSG). When processing personal data in connection with the use of our website, we also comply with the German Telecommunications Digital Services Data Protection Act (TDDDG).
Below, we explain what information we collect during your visit to our website and how it is used.
Controller
The controller within the meaning of the GDPR and other applicable national data protection laws of the Member States, as well as other data protection regulations, is:
Estrel Hotel GmbH
Sonnenallee 225
12057 Berlin
Germany
Phone: +49 (0)30 6831 0
Email: info-tower@estrel.com
Data Protection Officer
Andreas Thurmann
DataSolution LUD GmbH
Isarstr. 13
14974 Ludwigsfelde
Germany
Email: mail@hoteldatenschutz.de
General Information on Data Processing
Scope of the Processing of Personal Data
As a general rule, we collect and process the personal data of our website users only to the extent necessary to provide a fully functional website and to deliver our content and services.
The collection and processing of personal data generally takes place only with the user's consent. An exception applies where obtaining prior consent is not feasible for practical reasons and the processing of personal data is permitted by applicable statutory provisions.
I’ve translated this into natural, legally appropriate US English while preserving the GDPR terminology commonly used on international hotel websites. If you’d like, I can continue translating the remainder of the privacy policy in the same style.
Legal Basis for the Processing of Personal Data
Where we obtain the data subject's consent for the processing of personal data, Article 6(1)(a) GDPR serves as the legal basis for such processing.
Where the processing of personal data is necessary for the performance of a contract to which the data subject is a party, Article 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations necessary to carry out pre-contractual measures.
Where the processing of personal data is necessary to comply with a legal obligation to which our company is subject (e.g., statutory reporting obligations under German law), Article 6(1)(c) GDPR serves as the legal basis.
Where processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party, and such interests are not overridden by the interests or fundamental rights and freedoms of the data subject, Article 6(1)(f) GDPR serves as the legal basis for the processing.
Data Erasure and Retention Period
Personal data will be erased or blocked as soon as the purpose for which it was stored no longer applies.
Data may be retained beyond this period where required by applicable European Union or national legislation, regulations, or other legal provisions to which the controller is subject.
The data will also be blocked or erased once any statutory retention period has expired, unless continued storage is necessary for the conclusion or performance of a contract.
Contact Form / Email Contact
Description and Scope of Data Processing
Where a contact form is available on our website, it may be used to contact us electronically. If you choose to use this option, the data entered into the contact form will be transmitted to us and stored. This may include:
- Salutation
- First and last name
- Postal address
- Email address
- Telephone number
- Your inquiry or message
Alternatively, you may contact us using the email address provided on our website. In this case, any personal data transmitted with your email will be stored.
Legal Basis for Data Processing
The legal basis for processing your data is initially our legitimate interest in responding to inquiries submitted by website users.
Where your inquiry is intended to initiate or conclude a contract, the additional legal basis for processing is Article 6(1)(b) GDPR, as the processing is necessary for the implementation of pre-contractual measures or the performance of a contractual relationship.
Purpose of Data Processing
The personal data collected will be used exclusively for the purpose of processing and responding to your inquiry.
The personal data entered into the contact form is processed solely to handle your request. Where you contact us by email, our legitimate interest likewise consists of processing and responding to your inquiry.
Any additional personal data processed during the submission process is used to prevent misuse of the contact form and to ensure the security of our information technology systems.
Retention Period
Your personal data will be deleted as soon as it is no longer required for the purpose for which it was collected.
For personal data transmitted by email, this is generally the case once the respective correspondence with you has been concluded. A conversation is considered concluded when the circumstances indicate that the matter in question has been fully resolved.
If your inquiry relates to a pre-contractual relationship (e.g., a request for a quotation or reservation), the data you provide will also be stored in our hotel and/or event management system and used to facilitate the potential contractual relationship. If no contract is concluded, your personal data will be deleted at the end of the calendar year following one year after receipt.
Right to Object
You have the right to object to the processing of your personal data at any time. To exercise this right, please contact us at:
Please note that if you object to the processing of your personal data, we may no longer be able to continue our correspondence with you or prepare quotations, reservations, or similar services.
In such cases, all personal data collected during the course of the communication will be deleted.
Collection, Processing, and Use of Personal Data at Estrel Berlin
Description and Scope of Data Processing
The purpose of processing personal data is the operation of our hotel, the organization of events within our Congress Center, and the provision of our entertainment offerings, including Stars in Concert. Personal data is collected, processed, and used solely for these business purposes.
Estrel Berlin is the controller responsible for processing reservations. To enhance our services, all customer data received is managed within our centralized hotel management system.
Booking information is accessible only to authorized personnel. Guest master data may be used, for example, to make future reservations, modify existing reservations, or carry out centralized marketing activities. Central departments, including Reservations and Marketing, access this information where necessary.
The legal basis for this processing is our legitimate interest in the centralized administration and use of customer and business partner data.
Guest contact details may also be used for future marketing communications, primarily by email. Any marketing emails will only be sent where the guest has provided the required consent.
Your personal data will not be processed for purposes other than those described above unless such further processing is permitted under Article 6(4) GDPR and is compatible with the original purpose of collection. Where applicable, we will inform you before any such further processing takes place.
Legal Basis for Data Processing
The legal basis for processing your personal data is the conclusion and performance of an accommodation contract between you and Estrel Berlin.
The personal data provided will be stored in our hotel management system and used for the administration and fulfillment of the contractual relationship.
Categories of Data Subjects and Personal Data Processed
For the purposes described above, we collect, process, and use the following categories of personal data:
- Guest data, including in particular:
- First and last name
- Postal address
- Contact information
- Reservation details
- Guest preferences and special requests
- Billing information
- Customer data, including in particular:
- Address information
- Billing and service-related information
- Prospective customer data, including in particular:
- Accommodation inquiries
- Contact and address information
Categories of Recipients
Your personal data may be disclosed to the following categories of recipients where necessary:
- Internal departments involved in the performance of our business operations, including:
- Central Reservations
- Accounting
- Sales & Marketing
- Information Technology
- Public authorities where disclosure is required by law, such as:
- Law enforcement authorities
- Other governmental agencies
- External service providers acting as processors pursuant to Article 28 GDPR
- Other external recipients, including:
- Financial institutions
- Other companies where you have provided your written consent or where disclosure is permitted based on an overriding legitimate interest
Purpose of Data Processing
The primary purpose of collecting, processing, and using personal data is the administration, accommodation, and hospitality services provided to our guests in connection with the accommodation contract.
Retention Period
Various statutory retention periods apply under applicable law.
Once these retention periods have expired, the relevant personal data will be routinely deleted or anonymized, provided it is no longer required for the performance of the contract.
Accounting and tax-related records are generally retained for ten (10) years following the end of the relevant financial year, unless longer statutory retention periods apply or continued retention is otherwise justified.
Reservation documents may generally be deleted after six (6) years.
Registration records required under German registration law may generally be deleted at the end of the calendar year following one (1) year after their creation.
Right to Object
You have the right to object to the processing of your personal data at any time. To exercise this right, please contact us at:
Your Stay at the Hotel
Description and Scope of Data Processing
During your stay at our hotel, we collect and process guest information within our hotel management system.
Personal data may be stored for the following categories of individuals:
- Guests
- Business partners and corporate customers
- Prospective customers and individuals making inquiries (e.g., requests for quotations)
The personal data processed may include:
- First and last name
- Date of birth
- Contact details (telephone number and email address)
- Postal address
- Nationality
- Company name
- Identification or passport information, where applicable
- Information relating to services provided
- Billing information
- Payment information (e.g., credit card details)
- Video recordings collected for evidentiary purposes in connection with vandalism, burglary, robbery, or other criminal offenses
If you make your reservation through an online booking platform, tour operator, or travel agency, your personal data will be transmitted to us by that provider for the purpose of fulfilling the contractual relationship.
Purposes and Legal Basis for Data Processing
We use the personal data you provide exclusively to fulfill our contractual obligations, including the administration of reservations, guest services, accommodation, and hospitality provided under the accommodation agreement.
Your data is stored in our hotel management system as well as our reservation, billing, and payment applications. In addition to your personal information, this may include charges for food and beverages, telephone calls made from your room, and other hotel-related services.
Under the provisions of the German Federal Registration Act (Bundesmeldegesetz, Sections 29 et seq.), hotels are legally required to collect registration information from foreign guests either on-site or online. This registration includes your:
- First and last name
- Residential address
- Date of birth
- Nationality
- Accompanying family members
- Identification document number
Any additional information requested is voluntary.
Where you request additional services, we generally collect only the personal data necessary to provide those services. Any further information is provided voluntarily.
Personal data is processed solely for the provision of the requested services and to protect our legitimate business interests pursuant to Article 6(1)(f) GDPR.
Your personal data may be processed for the following purposes:
- Registration upon arrival and departure, including completion of the legally required registration form
- Issuing room key cards for you and accompanying guests
- Providing requested hotel services
- Processing payments
- Recording your preferences for future hotel stays
Your personal data will not be processed for purposes other than those described above unless such further processing is permitted under Article 6(4) GDPR and is compatible with the original purpose of collection. Where applicable, you will be informed before any such further processing takes place.
Categories of Recipients
Your personal data may be disclosed to the following categories of recipients where necessary:
- Public authorities where disclosure is required by law (e.g., law enforcement agencies or other governmental authorities)
- Internal departments involved in providing our services, including Administration, Accounting, Sales & Marketing, and Information Technology
- External service providers acting as processors pursuant to Article 28 GDPR
- Other external recipients, such as financial institutions
Data Retention
Various statutory retention periods apply under applicable law.
Once these statutory retention periods have expired, the relevant personal data will be routinely deleted provided it is no longer required for the performance of the contractual relationship.
Accounting and tax-related records are generally retained for ten (10) years following the end of the relevant financial year unless longer retention periods are required by law or justified by legitimate interests.
Reservation records may generally be deleted after six (6) years.
Registration records required under German registration law may generally be deleted at the end of the quarter following one (1) year after their creation.
Personal data that is not subject to statutory retention requirements will be deleted without undue delay once the purposes for which it was collected no longer apply.
Video Surveillance within the Hotel Complex
Description and Scope of Data Processing
As part of our video surveillance system, personal data is processed in the form of video images of employees, guests, visitors, suppliers, service providers, and, where applicable, passersby.
Video surveillance is limited exclusively to security-sensitive areas of the hotel complex, including, for example:
- Entrances and exits
- Corridors
- Building exteriors
- Storage areas
- Other locations requiring enhanced security
The cameras record video images only; no audio is recorded.
Areas outside the hotel complex that are open to the public are excluded from recording wherever possible.
Live camera feeds may only be viewed by authorized personnel.
Access to recorded footage is strictly limited to authorized individuals or public authorities for legitimate purposes, such as investigating security incidents or fulfilling legal obligations.
Every access to recorded footage is logged, including:
- Date and time of access
- Purpose of access
- Identity of the person accessing the footage
Purpose and Legal Basis for Data Processing
Video surveillance is carried out to protect the legitimate interests of the hotel.
It is used to:
- Protect individuals, property, and buildings against theft, vandalism, and unauthorized access
- Investigate and preserve evidence relating to security incidents
- Document operational processes, such as goods receiving and loading activities
- Enforce the hotel's house rules
- Prevent and respond to security risks
- Support legal proceedings and cooperation with law enforcement authorities
The processing of video recordings is based on Article 6(1)(f) GDPR, as the hotel has a legitimate interest in ensuring safety, security, and the protection of persons and property throughout the hotel complex.
Where recordings must be retained or disclosed in order to comply with legal obligations—particularly in connection with statutory duties of care or requests from law enforcement authorities—the processing is additionally based on Article 6(1)(c) GDPR.
According to the case law of the Court of Justice of the European Union (CJEU), wearing eyeglasses may, in certain circumstances, reveal information relating to an individual's health and may therefore constitute a special category of personal data within the meaning of Article 9(1) GDPR.
Where video recordings incidentally capture such special categories of personal data—for example, individuals wearing eyeglasses, mobility aids, or other medical devices—such data is processed only where necessary for the establishment, exercise, or defense of legal claims in accordance with Article 9(2)(f) GDPR.
Retention Period
Video recordings are generally retained for 72 hours and are then automatically deleted unless a security-related incident has been identified.
In exceptional circumstances, such as periods of heightened security requirements—for example, during events with increased visitor numbers—the retention period may be extended where necessary.
Where a security incident has occurred or where recordings must be preserved to comply with legal obligations, the relevant footage will be secured separately and may be retained for up to one (1) month.
At the end of the applicable retention period, the recordings are permanently deleted or overwritten.
Longer retention will occur only where required by applicable law or where necessary for the establishment, exercise, or defense of legal claims.
Online Booking via Our Website
Description and Scope of Data Processing
Our website allows you to book rooms and packages at Estrel Berlin. If you choose to make a reservation through our website, the information you enter into the booking form will be transmitted to us and stored.
This information may include:
- First name
- Last name
- Email address
- Telephone number
- Billing address
- Contact person (for corporate customers)
- Number, names, and contact details of accompanying guests, where applicable
- Arrival details
- Special requests
- Payment information
- Date and time of the booking
Online reservations made through our website are processed using the online reservation system provided by TravelClick, Inc., 7 Times Square, 38th Floor, New York, NY, USA.
All booking information you provide is transmitted using encrypted connections. Our service provider is contractually obligated to process your personal data in compliance with applicable data protection laws and has implemented appropriate technical and organizational measures to protect your information.
Legal Basis for Data Processing
The legal basis for processing your personal data is the conclusion and performance of an accommodation agreement pursuant to Article 6(1)(b) GDPR.
The information you provide is stored in our hotel management system and used to perform the contractual relationship.
If no accommodation agreement is ultimately concluded, your personal data will be deleted at the end of the calendar year following one year after receipt.
Purpose of Data Processing
The personal data entered into the booking form is processed exclusively for:
- Processing your reservation request
- Managing your booking
- Processing payment transactions
Retention Period
Your personal data will be deleted once it is no longer required for the purposes for which it was collected.
Where a contractual relationship exists, your personal data will be retained only for as long as required to comply with applicable statutory, commercial, tax, contractual, or other legal retention obligations.
Right to Object
You have the right to object to the processing of your personal data at any time by contacting:
Please note that if you object to the processing of your personal data, we may be unable to complete your reservation or continue processing your booking request.
Online Booking via Third-Party Websites
Description and Scope of Data Processing
Estrel Berlin also enables guests to book rooms and packages through third-party hotel reservation platforms.
If you make a reservation through one of these booking platforms, the personal data collected by that provider will be transmitted to us to the extent permitted under the respective provider's privacy policy.
The data transmitted may include:
- First name
- Last name
- Email address
- Telephone number
- Postal address
- Number of accompanying guests
- Expected arrival time
- Special requests
- Payment information (e.g., credit card details)
Legal Basis for Data Processing
The legal basis for processing your personal data is the conclusion and performance of an accommodation agreement pursuant to Article 6(1)(b) GDPR.
The transmitted data will be stored in our hotel management system and used solely for the administration and performance of your reservation.
If no contractual relationship is established, the personal data will be deleted at the end of the calendar year following one year after receipt.
Purpose of Data Processing
Your personal data is processed exclusively for:
- Processing your reservation
- Managing your booking
- Processing payment transactions
Retention Period
Your personal data will be deleted once it is no longer required for the purposes for which it was collected.
Where a contractual relationship exists, your personal data will be retained only for as long as required by applicable statutory, commercial, tax, contractual, or other legal retention obligations.
Please note that Estrel Berlin has no control over the retention periods applied by the respective third-party booking platform.
Right to Object
You have the right to object to the processing of your personal data at any time by contacting:
Please note that if you object to the processing of your personal data, we may be unable to complete your reservation or continue processing your booking request.
Online Check-in, Guest Communication, and Chatbot
We send a pre-arrival welcome email to guests whose email address we have received as part of their reservation or who have previously provided it to us.
A few days before arrival, these guests receive a reservation summary by email and are invited to complete their registration online. The information collected during the online check-in process may be used to generate the legally required electronic registration form.
These communications are provided through the Code2Order platform operated by straiv GmbH, Industriestraße 23, 70565 Stuttgart, Germany.
straiv is contractually committed to processing your personal data in accordance with applicable data protection laws and has implemented appropriate technical and organizational safeguards to protect your information.
For additional information, please refer to straiv's Privacy Policy:
https://straiv.io/legal/datenschutz/
Categories of Personal Data Processed
Depending on the services used, the following categories of personal data may be processed:
- Identity and communication data
- First and last name
- Email address
- Telephone number
- Address information
- Street
- House number
- ZIP/postal code
- City
- Country
- Reservation and travel information
- Arrival and departure dates
- Reservation number
- Room number
- Registration information
- Nationality
- Date of birth
- Passport number
- Digital signature
- Billing information
- Billing address
- Prices
- Booked services (e.g., parking, fitness facilities)
- Usage information
- Start, duration, and end of system use
- Features used
- Language selected
- Browser and operating system
- Location data
- Only when GPS functionality is used to limit services to a defined area surrounding the hotel
Not every category of personal data listed above is collected during every use of the software. The data collected depends on the services we have activated and configured.
The software can generally be used without creating a user account.
Legal Basis for Data Processing
The legal basis for processing personal data in connection with online check-in and reservation management is the performance of an accommodation agreement or the implementation of pre-contractual measures pursuant to Article 6(1)(b) GDPR.
For personal data processed as part of guest communications, our legal basis is our legitimate interest pursuant to Article 6(1)(f) GDPR, provided the communication does not directly relate to the performance of the accommodation agreement. This legitimate interest includes compliance with legal requirements, internal quality assurance, and responding appropriately to guest inquiries.
The personal data collected during online check-in is used to supplement your guest profile within our hotel management system for the performance of the accommodation agreement.
Where available, your information may also be used to enable mobile room access through a smartphone application.
The system also verifies whether you are authorized to request or use specific hotel services.
Where we are legally required to collect and retain personal data—for example, registration information under Sections 29 et seq. of the German Federal Registration Act (Bundesmeldegesetz – BMG)—the processing is based on Article 6(1)(c) GDPR (compliance with a legal obligation).
Where we request your consent for specific processing activities, the legal basis is Article 6(1)(a) GDPR.
You may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of any processing carried out before the consent was withdrawn.
Purpose of Data Processing
Our communications are intended to provide you with useful information before your stay, including the opportunity to complete your online check-in and submit the required electronic registration form in advance.
Categories of Recipients
Your personal data may be disclosed to the following recipients where necessary:
- straiv, as the provider of the software, together with its sub-processors for services such as hosting, SMS delivery, email distribution, and chatbot functionality. These sub-processors process personal data within the European Union. Transfers to third countries (such as the United States) generally occur only where you have expressly consented to specific functions (e.g., WhatsApp; see below). straiv enters into data processing agreements with its sub-processors to ensure GDPR-compliant processing.
- Other service providers engaged by us, including providers of hotel reservation systems, door access systems, chatbot services, and operations and communication software.
- Payment service providers.
- Other external recipients where you have given your consent or where disclosure is permitted based on overriding legitimate interests.
- Public authorities where disclosure is required by law. Where we are legally obligated to disclose information to competent public authorities or law enforcement agencies, the legal basis is Article 6(1)(c) GDPR.
Retention Period
Your personal data will be deleted once it is no longer required for the purposes for which it was collected.
Statutory retention periods (for example under commercial, tax, or German registration law) remain unaffected. Once these legal retention periods expire, the relevant data will be deleted.
Cookies and Similar Technologies Used by straiv
The software uses cookies and similar technologies to improve usability.
You may prevent the storage of cookies through your browser settings and may adjust your cookie preferences within the system at any time.
The following technically necessary cookies and Local Storage technologies are used:
- swVersion – stores the current Service Worker version (retention period: 1 year)
- current_version – stores the current software version (retention period: 1 year)
- current_guest – stores the current guest session (retention period: 1 year)
- current_business – stores hotel information, including hotel name, address, geolocation, time zone, media links, contact information, and enabled languages (retention period: 1 year)
- secure_ls__metadata – stores encryption metadata (retention period: 1 year)
The legal basis for these technologies is our legitimate interest in providing a secure and fully functional application.
The following third-party analytics technologies may also be used:
- Google Maps (retention period: 3 months)
- Datadog (log monitoring and system diagnostics; retention period: session only; data processed within the EU)
Where these technologies are not strictly necessary, they are used only with your consent pursuant to Article 6(1)(a) GDPR and Section 25(1) TDDDG.
You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to the withdrawal of consent.
WhatsApp Communications
Where you consent to receiving communications via WhatsApp, you voluntarily authorize us to send you messages—including marketing communications relating to the topics you have selected—and to communicate with you through the WhatsApp messaging service.
Based on your consent, we process your personal data (such as your name, telephone number, and message content) using the services of WhatsApp Ireland Limited, Dublin, Ireland.
To provide this service, straiv engages Bird B.V., Amsterdam, Netherlands, as a processor pursuant to Article 28 GDPR.
In certain circumstances, WhatsApp LLC in the United States may receive personal data—particularly communication metadata—from WhatsApp Ireland Ltd. Such data may also be processed on servers located outside the European Union.
WhatsApp LLC is certified under the EU–U.S. Data Privacy Framework, providing an adequate level of data protection as recognized by the European Commission.
You may withdraw your consent at any time by adjusting your notification settings, sending the message "WITHDRAW CONSENT", or contacting us via one of the email addresses listed above.
Chatbot
Please note: This chatbot is an AI-powered system. You are communicating with artificial intelligence rather than with a human representative, as required by Article 50 of the EU AI Act.
We may provide a chatbot on our website operated by straiv GmbH, Stuttgart, Germany.
The chatbot is intended to answer questions relating to our hotel and your stay.
To improve the quality of its responses, the chatbot may process the following personal data:
- First name
- Age
- Reservation number
- Arrival date
- Departure date
If you voluntarily enter additional personal information into the chat, that information will also be processed.
To provide its AI functionality, straiv engages sub-processors located within the European Union, including OpenAI Ireland Ltd., Google Cloud EMEA Ltd., and LangChain Inc.
Neither the AI model provider nor the underlying models permanently retain your conversations, nor are your conversations used for AI training purposes.
straiv acts solely as our processor and processes your personal data exclusively for responding to your inquiries.
Chat records are retained for one (1) year and then deleted.
The legal basis for this processing is your consent pursuant to Article 6(1)(a) GDPR.
You may withdraw your consent at any time by closing the chat window. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
Right to Object
You may object to the processing of your personal data at any time by contacting:
Pre-Arrival Emails
Description and Scope of Data Processing
Before your arrival, we send a welcome email to guests whose email address we have received as part of their reservation.
A few days before arrival, you will receive a reservation summary together with information about your booking and available additional services.
These emails are sent using the Guest Management Solution provided by TravelClick Inc., New York, USA.
TravelClick is contractually committed to processing your personal data in accordance with applicable data protection laws and has implemented appropriate technical and organizational safeguards.
Legal Basis for Data Processing
The legal basis is our legitimate interest in processing your reservation and managing the pre-contractual relationship.
Purpose of Data Processing
The purpose of these communications is to give guests the opportunity to conveniently book additional services prior to arrival.
Retention Period
Your personal data will be deleted once it is no longer required for the purposes for which it was collected.
Right to Object
You may object to the processing of your personal data at any time by contacting:
Corporate Customer Relationship Management
Description and Scope of Data Processing
To manage, advise, and market our services to corporate customers, we collect and process business contact information, including:
- Contact person's name
- Telephone number
- Postal address
This information may be obtained through inquiries (by email or telephone), trade fairs, business events, business cards, or other legitimate business contacts.
Your personal data will not be disclosed to third parties in this context.
Legal Basis for Data Processing
The legal basis for processing is our legitimate interest in maintaining business relationships.
Where the communication relates to the negotiation or conclusion of a contract, processing is additionally based on the performance of pre-contractual measures or contractual obligations.
To improve our services, all customer information is managed within the CRM module of our centralized hotel management system.
Purpose of Data Processing
Your business contact information is used exclusively for our own business purposes and to tailor our sales and customer relationship activities.
Retention Period
As a general rule, no fixed retention period applies.
However, if our Sales Department has had no contact with a corporate contact for a period of three (3) years, it will determine whether the contact information should be deleted.
Where the communication relates to a quotation, booking, or reservation request, the information will also be stored in our hotel management system for the performance of the contractual relationship.
If no contractual relationship is established, the data will be deleted at the end of the calendar year following one year after receipt.
Right to Object
As a corporate contact, you may object to the processing of your personal data at any time by contacting:
In this case, all personal data relating to the respective business contact will be deleted.
Online Reviews
Description and Scope of Data Processing
Following check-out, former guests may submit a review of their stay at our hotel.
To facilitate this, we may send you an email within 14 days after your departure inviting you to leave a hotel review.
If you wish, your review may be published anonymously.
If your experience at our hotel did not meet your expectations, we would also like the opportunity to contact you directly to discuss your feedback.
These review invitation emails are sent via the dailypoint platform provided by Toedt, Dr. Selk & Coll. GmbH, Augustenstraße 79, 80333 Munich, Germany.
The service provider is contractually committed to processing your personal data in accordance with applicable data protection laws and has implemented appropriate technical and organizational measures to protect your information.
If you choose to submit a review, the following personal data may be processed:
- Email address
- Voluntary information such as:
- First name
- Last name
- Preferred language
- Review content and rating
Your personal data will not be disclosed to any additional third parties in connection with this process.
Legal Basis for Data Processing
The legal basis for processing your personal data is our legitimate interest pursuant to Article 6(1)(f) GDPR.
Purpose of Data Processing
Guest reviews are collected to:
- Publish guest experiences on our website
- Enable prospective guests to make informed decisions about our services
- Support our internal quality management processes
Your personal data is used exclusively for publishing your review and, where necessary, for resolving issues arising from negative reviews.
Retention Period
Review data is not automatically deleted.
Right to Object / Right to Erasure
You may request the removal of your published review at any time in accordance with your right to erasure ("right to be forgotten").
Please contact:
When making your request, please indicate which review you would like us to remove.
Newsletter Service
Description and Scope of Data Processing
Our website provides several ways to subscribe to our newsletter service.
If you subscribe, the information entered into the registration form will be transmitted to us and stored.
This may include:
- Email address
- Salutation
- First name
- Last name
- Company
- Postal address
- Newsletter preferences or newsletter category
Newsletter subscriptions made through our website are managed using dailypoint, provided by Toedt, Dr. Selk & Coll. GmbH, Munich, Germany.
The provider is contractually committed to handling your personal data in accordance with applicable data protection laws and has implemented appropriate technical and organizational safeguards.
If we receive your email address through another channel and you clearly request to receive our newsletter, we will also register your subscription through our website.
Your personal data will not be disclosed to third parties in connection with the newsletter service.
Legal Basis for Data Processing
The legal basis for processing is your consent pursuant to Article 6(1)(a) GDPR.
Your consent is verified through a double opt-in procedure.
Purpose of Data Processing
Your personal data is processed solely for sending personalized newsletters.
Retention Period
Your personal data will be deleted once you unsubscribe from the newsletter service.
Right to Withdraw Consent
You may withdraw your consent at any time by:
- Clicking the unsubscribe link included in every newsletter, or
- Contacting us at:
Please include the email address used for your newsletter subscription.
Job Applications
Description and Scope of Data Processing
You may apply for advertised positions through our website or through online recruitment platforms.
If you submit an application, we may collect and process the following personal data:
- Salutation
- First and last name
- Postal address
- Contact details (email address and telephone number)
- Cover letter
- Attached application documents, including your résumé and supporting documents
Applications submitted through our website are processed using the online recruitment platform provided by Workday Limited, Dublin, Ireland.
All application data is transmitted using encrypted connections.
Further information is available in Workday's Privacy Policy.
Your personal data is used exclusively for evaluating your application.
Access is limited to employees directly involved in the recruitment process, all of whom are required to maintain strict confidentiality.
Your personal data will not be disclosed to third parties unless:
- You have expressly consented to such disclosure; or
- We are legally required to disclose the information.
If we believe your application is suitable for another open position, we will first request your consent before forwarding your application.
In that case, your application will also be stored in our applicant pool.
Legal Basis for Data Processing
The legal basis is the implementation of pre-contractual measures in connection with a potential employment relationship pursuant to Article 6(1)(b) GDPR.
Your consent will be obtained before your application is transferred to another position or stored in our applicant pool.
Purpose of Data Processing
Your personal data is processed exclusively for:
- Evaluating your application
- Communication during the recruitment process
Retention Period
Your application documents will be deleted as soon as they are no longer required for the recruitment process and no later than six (6) months after your application has been rejected.
If we wish to retain your application beyond this period, we will request your consent beforehand.
Where an employment relationship is established, your personal data will be retained in accordance with applicable statutory and contractual retention requirements.
Right to Object
You may object to the processing of your personal data at any time by contacting the department to which you submitted your application.
Provision of the Website and Creation of Log Files
Description and Scope of Data Processing
Each time you access our website, our systems automatically collect information from your device.
The following information may be collected:
- Browser type and version
- Operating system
- IP address
- Date and time of access
- Referring website
- Pages accessed on our website
This information is also stored in our server log files.
The data is not combined with other personal data.
No personal user profiles are created.
The information is evaluated solely for statistical purposes.
Legal Basis for Data Processing
The legal basis is our legitimate interest pursuant to Article 6(1)(f) GDPR.
Purpose of Data Processing
Temporary storage of the IP address is necessary to deliver the website to your device.
The storage of log files serves to:
- Ensure the functionality of the website
- Optimize website performance
- Maintain the security of our information technology systems
The data is not used for marketing purposes.
These purposes constitute our legitimate interest under Article 6(1)(f) GDPR.
Retention Period
Where data is processed solely for providing the website, it is deleted when the browsing session ends.
Server log files are generally deleted after no more than seven (7) days.
Longer retention is possible where necessary.
In such cases, IP addresses are deleted or anonymized so that the individual user can no longer be identified.
Right to Object
The collection of personal data for the operation of the website and the storage of server log files are technically necessary.
Accordingly, users do not have the option to object to this processing.
Use of Cookies and Scripts
Description and Scope of Data Processing
Cookies are small text files that enable us to store information on your device while you visit our website.
Cookies help us to determine:
- How frequently our website is used
- The number of visitors
- How to make our website more user-friendly and efficient
In addition, we use cookies that allow us to analyze how visitors use our website.
These cookies may collect information such as:
- Search terms entered
- Frequency of page visits
- Use of website features
The data collected through these technologies is pseudonymized using technical safeguards.
As a result, the information can no longer be directly attributed to an individual user.
This data is not combined with other personal data.
When you first visit our website, you will be informed about the use of analytical cookies and asked to provide your consent to the processing of personal data in this context.
You will also be referred to this Privacy Policy for additional information.
Overview of Cookies Used
|
Name |
Type |
Retention Period |
Provider |
Purpose |
|
_ga |
First-party (session) |
1 year |
Google Analytics |
Analytics |
|
_ga_ZX9C7PXKC4 |
First-party (session) |
1 year |
Google Analytics |
Analytics |
|
CookieConsent |
First-party (persistent) |
30 days |
Cookiebot |
Consent management |
Legal Basis for Data Processing
The legal basis for the processing of personal data using strictly necessary cookies is our legitimate interest pursuant to Article 6(1)(f) GDPR.
The legal basis for the processing of personal data using analytics cookies is your consent pursuant to Article 6(1)(a) GDPR, where such consent has been provided.
Purpose of Data Processing
Strictly necessary cookies are used to facilitate the use of our website.
Certain website functions cannot be provided without the use of cookies. These cookies enable your browser to be recognized as you navigate between pages.
Personal data collected through strictly necessary cookies is not used to create user profiles.
Analytics cookies are used to improve the quality of our website and its content. They enable us to better understand how visitors use our website so that we can continuously optimize our services.
Retention Period, Objection, and Removal
Cookies are stored on your device and transmitted to our website.
You therefore have full control over the use of cookies.
You can disable or restrict the transmission of cookies by changing your browser settings. Cookies that have already been stored may be deleted at any time, including automatically through your browser settings.
Please note that disabling cookies may prevent certain functions of our website from operating properly.
Cookie Banner
Description and Scope of Data Processing
Our website uses the consent management platform provided by Cybot A/S, Havnegade 39, 1058 Copenhagen, Denmark ("Cookiebot").
We use this service both to ensure the proper functionality of our website and to manage the legally compliant use of marketing and tracking technologies.
When Cookiebot is loaded, your browser may transmit personal data to Cookiebot.
Legal Basis and Purpose
The legal basis is our legitimate interest pursuant to Article 6(1)(f) GDPR in ensuring the reliable operation of our website.
The data collected is deleted once it is no longer required for its intended purpose.
Further information is available in Cookiebot's Privacy Policy.
You may also prevent the collection of data by disabling JavaScript in your browser or by installing a script-blocking extension.
Information Stored by Cookiebot
The following information is stored within our Cookiebot account:
- The user's anonymized IP address (last three digits replaced with "0")
- Date and time consent was provided
- Browser information
- URL from which consent was submitted
- An anonymous, randomly generated, encrypted identifier
- The user's consent status as proof of consent
The encrypted identifier and consent status are also stored in the CookieConsent cookie within your browser.
This enables our website to recognize and honor your cookie preferences during future visits for up to 12 months.
You may review or modify your consent preferences at any time using the cookie settings available at the bottom of our website.
Strictly necessary cookies may be stored on your device without your consent.
All other categories of cookies require your prior consent.
Some cookies are placed by third-party providers whose services appear on our website.
You may change or withdraw your consent at any time through the Cookie Declaration available on our website.
Live Webcam (webcam-profi.de)
Our website includes a live webcam that allows visitors to view the construction progress and current view of the Estrel Tower.
The live images and time-lapse videos are provided by webcam-profi.de.
When you access the webcam page, your browser establishes a connection with the webcam provider's servers in order to retrieve the live content.
As a result, technical connection data—including your IP address, browser type, referrer, and timestamp—is transmitted to the provider.
We have only limited control over the data collected and processed by the webcam provider.
The webcam captures only panoramic images of the construction site and surrounding building area.
The identification of individual persons is neither intended nor, in our assessment, reasonably possible.
The legal basis for integrating the webcam is your consent pursuant to Article 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG.
You may withdraw your consent at any time through the cookie settings on our website.
Where no consent is required for access to information stored on your device, the processing of technical connection data is based on our legitimate interest pursuant to Article 6(1)(f) GDPR in presenting the construction progress of the Estrel Tower.
For further information, please refer to the webcam provider's Privacy Policy.
Use of Google Services
Please note that the use of certain Google services may involve the transfer of personal data to countries outside the European Economic Area, including the United States.
Where personal data is transferred to the United States, such transfers are based on an adequacy decision adopted by the European Commission pursuant to Article 45(1) GDPR where the receiving organization is certified under the EU–U.S. Data Privacy Framework (DPF).
Where no adequacy decision exists, we have implemented appropriate safeguards in accordance with Articles 44 et seq. GDPR, typically by entering into the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914).
Where required, we also obtain your explicit consent pursuant to Article 49(1)(a) GDPR before transferring your personal data.
Please note that international data transfers may involve risks that cannot always be fully assessed, including potential access by public authorities in the destination country.
Google Tag Manager
Our website uses Google Tag Manager, a service provided by Google Ireland Limited, Dublin, Ireland.
Google Tag Manager is used solely to manage and deploy website tags through a centralized interface.
Google Tag Manager itself does not collect personal data for analytics or marketing purposes and does not place its own cookies.
However, loading the Tag Manager container requires your browser to connect to Google's servers, during which your IP address and technical connection data are transmitted.
Any additional Google services managed through Tag Manager (such as Google Analytics or Google Ads) are activated only after the corresponding consent has been provided.
The legal basis for using Google Tag Manager as a technical management tool is our legitimate interest pursuant to Article 6(1)(f) GDPR.
Services triggered through Tag Manager are processed only on the legal basis applicable to each individual service, particularly your consent pursuant to Article 6(1)(a) GDPR and Section 25(1) TDDDG.
Google may transfer technical connection data to the United States under the EU–U.S. Data Privacy Framework or other appropriate safeguards such as the Standard Contractual Clauses.
Google Analytics 4
Our website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Dublin, Ireland.
Google Analytics helps us analyze how visitors use our website so that we can continuously improve our online services.
When you visit our website, Google Analytics establishes connections to Google's servers and may process:
- Truncated IP address
- Pseudonymous user/client ID
- Pages visited
- Time spent on the website
- Referrer URL
- Website interactions
- Approximate geographic location (based on the shortened IP address)
- Date and time of access
- Browser and device information
Your IP address is shortened before processing so that it cannot be directly associated with you.
The legal basis for this processing is your consent pursuant to Article 6(1)(a) GDPR together with Section 25(1) TDDDG.
You may withdraw your consent at any time through your cookie settings.
Google may transfer your personal data to the United States under the EU–U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses.
We have entered into a Data Processing Agreement (DPA) with Google pursuant to Article 28 GDPR.
Social Media
We maintain official pages, accounts, and channels on various social media platforms to provide information about our hotel, communicate with guests, and offer additional ways to contact us.
Below we explain which personal data we process and which data may be processed by the respective social media platforms.
Personal Data We Process
If you contact us through a social media messenger service or by direct message, we generally process:
- Your username
- Any additional information you voluntarily provide that is necessary to process and respond to your inquiry
The legal basis for this processing is our legitimate interest pursuant to Article 6(1)(f) GDPR.
Aggregated Usage Statistics
Social media platforms provide us with anonymous statistical information ("Insights") about our accounts.
These statistics may include:
- Total page views
- Likes and reactions
- Page activity
- Engagement with posts
- Reach
- Video views
- Aggregate demographic information such as the proportion of male and female followers
These statistics are aggregated and do not allow us to identify individual users.
Data Processed by Social Media Platforms
You do not need to maintain an account with a social media platform merely to view our public profiles.
However, social media providers may still collect information from visitors without user accounts, including technical information and cookies or similar technologies.
We have no control over these processing activities.
If you wish to interact with our content—for example by liking, commenting, sharing posts, or sending us messages—you will generally be required to create an account with the respective platform and provide personal information.
To the best of our knowledge, social media platforms process personal data primarily for:
- Providing their services
- Analyzing user behavior
- Delivering personalized advertising within and outside their platforms
This processing may involve cookies, tracking pixels, web beacons, and similar technologies.
Personal data may also be processed outside the European Union or European Economic Area and disclosed to third parties.
Further information regarding:
- the scope and purposes of processing,
- retention periods,
- cookie usage,
- your rights, and
- available objection mechanisms
can be found in the respective privacy and cookie policies of the relevant social media platform.
When you visit our Facebook page, Meta collects your IP address and other information stored in cookies on your device. This information is used to provide us, as the operator of the Facebook page, with anonymous statistical information ("Page Insights") regarding the use of our page.
The statistics provided do not allow us to identify individual users. We use this information solely to better understand the interests of our audience, continuously improve our online presence, and maintain the quality of our content.
We process your personal data through our Facebook page only to facilitate communication and interaction with you. This generally includes:
- Your name
- Messages you send us
- Comments you post
- Public profile information that you choose to make available
The legal basis for this processing is our legitimate interest pursuant to Article 6(1)(f) GDPR in providing an effective communication and information channel.
Where you have provided consent directly to Meta for data processing, the legal basis is Article 6(1)(a) and Article 7 GDPR.
As the actual processing of personal data is carried out by Meta, our ability to access your personal data is limited.
Only Meta has full access to your personal data and is therefore responsible for fulfilling requests relating to your rights as a data subject (such as requests for access, deletion, or objection). Consequently, such requests are generally most effectively addressed directly to Meta.
For the operation of our Facebook Page, we and Meta Platforms Ireland Limited act as joint controllers with respect to Page Insights processing.
Meta bears primary responsibility under the GDPR for the processing of Insights data and fulfills all obligations relating to that processing.
We do not determine how Insights data is processed or how long cookies remain stored on users' devices.
Further information is available in Meta's Page Controller Addendum, Privacy Policy, and Cookie Policy.
Facebook Fan Page
Our official Facebook page is available at:
https://www.facebook.com/estreltower.berlin/
When you visit our Facebook page, data relating to your visit may be transmitted to Meta's servers.
If you are logged into your Facebook account, your interactions with our page may be associated with your personal Facebook profile.
We have no knowledge of the specific data collected or processed by Meta.
The legal basis for this processing is Article 6(1)(a) and Article 6(1)(f) GDPR.
Any person appearing in photographs published by us—or any third party depicted—may object to the publication of their personal data at any time by contacting:
This right applies particularly to future publication of photographs.
If we inadvertently publish a photograph without the necessary consent, we will promptly remove or appropriately modify the image. For group photographs, we reserve the right to blur individual faces where appropriate.
Our website may include an Instagram Button.
When you access our website, your browser establishes a direct connection to Instagram's servers.
Instagram receives information that you have visited our website through your IP address.
If you click the Instagram button while logged into your Instagram account, Instagram may associate your visit with your user account.
We have no knowledge of the content or further use of the data transmitted by Instagram.
Further information is available in Instagram's Privacy Policy.
Instagram Page
When you visit our Instagram page, Meta collects your IP address and other information stored through cookies.
This information is used to provide us with anonymous statistical information ("Instagram Insights") regarding the use of our page.
These statistics do not allow us to identify individual users.
We use them solely to improve our online presence and better understand our audience.
We process personal data received through our Instagram page only for communication and interaction with you, including:
- Your name
- Messages
- Comments
- Public profile information
The legal basis is our legitimate interest pursuant to Article 6(1)(f) GDPR.
Where you have provided consent directly to Meta, the legal basis is Article 6(1)(a) and Article 7 GDPR.
As Meta carries out the underlying processing of personal data, only Meta has full access to your information and is therefore responsible for responding to requests relating to your rights.
We and Meta Platforms Ireland Limited act as joint controllers for Instagram Insights processing.
Meta bears primary responsibility under the GDPR for processing Insights data.
We do not determine how Insights data is processed or how long cookies remain stored on users' devices.
Further information is available in Instagram's Privacy Policy, Cookie Policy, and the Meta Page Controller Addendum.
Our website may include a LinkedIn Button.
When you visit our website, your browser establishes a direct connection with LinkedIn's servers.
LinkedIn receives information that you have visited our website through your IP address.
If you click the LinkedIn button while logged into your LinkedIn account, LinkedIn may associate your visit with your LinkedIn profile.
We have no knowledge of the content or further use of the transmitted data by LinkedIn.
Additional information is available in LinkedIn's Privacy Policy.
LinkedIn Company Page
When you visit our LinkedIn page, LinkedIn may collect your IP address and other information stored through cookies in order to provide us with anonymous usage statistics ("Page Analytics").
These statistics do not enable us to identify individual users.
We use them solely to improve our online presence and better understand the interests of our audience.
We process personal data through our LinkedIn page only to facilitate communication and interaction with you.
This generally includes:
- Your name
- Messages
- Comments
- Public profile information
The legal basis is our legitimate interest pursuant to Article 6(1)(f) GDPR.
Where you have provided consent directly to LinkedIn, processing is additionally based on Article 6(1)(a) and Article 7 GDPR.
Because the primary processing of personal data is performed by LinkedIn, only LinkedIn has full access to your personal information and is therefore responsible for fulfilling your data subject rights.
For the processing of LinkedIn Page Analytics, we and LinkedIn Ireland Unlimited Company act as joint controllers.
LinkedIn bears primary responsibility for processing analytics data in accordance with the GDPR.
We do not determine how LinkedIn processes analytics data or how long cookies remain stored on users' devices.
Further information can be found in LinkedIn's Privacy Policy and Cookie Policy.
Protection of Minors
This website is intended primarily for adults
.
We do not specifically market our services to children.
Accordingly, we do not knowingly collect personal data from children under the age of 16.
We ask all visitors under the age of 16 not to submit personal information through our website.
If we become aware that a child under 16 has provided personal data, we will delete such information from our records as soon as technically feasible.
Your Rights as a Data Subject
Where we process your personal data, you are entitled to the following rights under the GDPR:
- Right of Access – You have the right to obtain information about the personal data we process concerning you, including the purposes of processing, recipients of the data, and applicable retention periods.
- Right to Rectification, Erasure, and Restriction of Processing – If your personal data is inaccurate or no longer required for the purposes for which it was collected, you may request its correction, deletion, or restriction of processing. Where technically possible, you may also review and correct certain personal information yourself.
- Right to Object – Where processing is based on our legitimate interests, you may object to the processing on grounds relating to your particular situation. We will cease processing your personal data unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms or where processing is necessary for the establishment, exercise, or defense of legal claims.
- Right to Object to Direct Marketing – Where your personal data is processed for direct marketing purposes, you have the right to object at any time. This also applies to profiling related to direct marketing. Upon objection, your personal data will no longer be processed for these purposes.
- Right to Withdraw Consent – Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
If you have any questions regarding your rights or wish to exercise them, please contact either the Controller or our Data Protection Officer.
Right to Lodge a Complaint
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a competent supervisory authority if you believe that the processing of your personal data violates applicable data protection law.
You may lodge your complaint with the supervisory authority in the Member State of your habitual residence, place of work, or the place of the alleged infringement.
The supervisory authority will inform you about the progress and outcome of your complaint, including the possibility of seeking a judicial remedy.
Further information is available from the Berlin Commissioner for Data Protection and Freedom of Information.
Processing of Personal Data Outside the European Union
Where personal data is processed outside the European Union, details of such processing and the applicable safeguards are described in the relevant sections of this Privacy Policy.
Security
Estrel Berlin has implemented appropriate technical and organizational security measures in accordance with Article 32 GDPR to protect the personal data under our control against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access.
These security measures are continuously reviewed and improved in line with technological developments.
Access to personal data is restricted to authorized personnel who require such access to perform technical, administrative, or editorial duties and who are subject to appropriate confidentiality obligations.
Updates and Amendments
We reserve the right to amend, update, or supplement this Privacy Policy at any time.
Any revised version applies only to personal data collected or modified after the revised Privacy Policy has entered into effect.
Last updated: September 2026