Privacy.

01

Who is responsible

The controller for the processing of personal data on cincinhotels.com is Samuel Renner, Franz-Fischer-Str. 5, 81677 München, Deutschland. You can reach us at info@cincinhotels.com.

We have not appointed a data protection officer because we are not required to. Privacy questions go to the same address.

02

Your rights

Where we process data about you, you have the right

• to know what data we hold about you and to receive a copy (Art. 15 GDPR),
• to have incorrect or incomplete data corrected (Art. 16 GDPR),
• to erasure (Art. 17 GDPR) or, where we still have to keep data, to restriction of processing (Art. 18 GDPR),
• to receive your data in a common format (Art. 20 GDPR),
• to object to processing based on our legitimate interest (Art. 21 GDPR),
• to withdraw any consent you have given at any time, with effect for the future (Art. 7(3) GDPR).

A short email is enough. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bavarian Data Protection Authority (BayLDA).

03

Hosting and server logs

What is technically needed for the site to reach you.

The website runs on Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you open a page, Vercel processes technically necessary details: IP address, time, address requested, volume transferred, browser and operating system. These logs serve delivery and security of the site and are deleted automatically after a short time.

The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). We have a data processing agreement with Vercel. Data may be transferred to the USA; Vercel is certified under the EU-US Data Privacy Framework, and the European Commission’s standard contractual clauses apply in addition. More in Vercel’s privacy policy.

04

Database and images

The website’s content and images are stored by Supabase Inc. in a data centre in Frankfurt am Main (region eu-central-1). When your browser loads an image directly from there, your IP address is transmitted. The legal basis is our legitimate interest in fast delivery (Art. 6(1)(f) GDPR). We have a data processing agreement with Supabase.

05

Visitor statistics

No cookies and no stored IP addresses.

Page views. When a page opens, it sends the page path (e.g. /en/hotels/…), the referring website and, where present, a campaign name to our server. We store only the path, the name of the referring website (e.g. “google”), the language, whether a phone or a computer was used, and the time.

Clicks to hotels. The button to a hotel’s website goes through an address of our own (cincinhotels.com/out/…). We store which hotel was clicked, when, in which language and from which of our pages.

Links in emails. In emails to hotels and business partners we use personal links (cincinhotels.com/m/…). We store which link was opened and when, to see whether our message arrived.

Travel dates. If you enter arrival, departure and number of guests on the home page, the hotel overview or a hotel page, we store these details together with the page, the hotel whose booking page you open (if any), the language, whether you use a phone or a computer, and the time. This shows us which periods people are planning trips for. The dates are only passed on in the page address and are not stored on your device.

Departure airport and location. For flight suggestions you can type where you are flying from or let your location find the nearest airport. Your browser only asks for your location after you allow it; it is compared with a list of airports inside your browser and is not sent to us. The chosen departure point only appears in the page address (?von=…) and is neither counted nor stored. “Find flights” opens Google Flights, where Google’s privacy policy applies.

In all these cases no cookie is set, nothing is stored on your device and no IP address is stored. To filter out automated requests (such as link checkers in email programs), the server briefly looks at your browser’s identifier but keeps only “phone” or “computer”. Website visitors cannot be recognised individually. Personal email links are the exception: they show us that a link we sent to a specific person was opened. Hotels receive only aggregated figures from us.

The legal basis is our legitimate interest in knowing the site’s reach and in showing hotels how many visitors we send them (Art. 6(1)(f) GDPR). You can object at any time.

06

Vercel statistics, only with consent

If you choose “Accept” in the notice, we additionally load Vercel Web Analytics and Vercel Speed Insights. Web Analytics counts visits without cookies; a visit is recognised only through a hash of the request data, which is discarded after 24 hours. Speed Insights measures how fast pages load, together with page, device type and browser. Both help us make the site better and faster.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). If you choose “Only necessary”, none of this loads. You can change your choice at the bottom of this page at any time.

07

Cookies and browser storage

CINCIN sets no cookies while you read. In your browser’s storage we keep only what the site itself needs:

• your choice in the statistics and cookie notice (permanently, until you change it or clear your browser storage),
• whether you have already seen the short opening animation and where you were on a page (only until you close the tab).

This is strictly necessary for the service you requested (§ 25(2) no. 2 TDDDG). Cookies are only set if you sign in (see “Sign-in”).

08

Maps and fonts

The map of Europe on the home page is a graphic we generate ourselves; no map service is loaded for it.

On the hotel portraits (“View map”) and in the hotel overview (“Map”) you can open an interactive map. It is provided by Mapbox, Inc., 50 Beale Street, Suite 900, San Francisco, CA 94105, USA, and only loads once you click it. Before that there is no connection to Mapbox. After the click your browser loads map data, fonts and code from Mapbox; Mapbox receives your IP address, details about your browser and device and the map area shown, and counts the map view. Mapbox sets no cookies for this but stores a random identifier in your browser storage to count map views. Data may be transferred to the USA; Mapbox is certified under the EU-US Data Privacy Framework. The legal basis is your consent given by the click (Art. 6(1)(a) GDPR, § 25(1) TDDDG); it only applies to that view. More in the Mapbox privacy policy. Map data © Mapbox and © OpenStreetMap.

In the map window, “Open in Google Maps” and “Get directions” lead to Google Maps. They are ordinary links; Google only learns anything if you click one of them.

In some journal articles we show the places mentioned on a Google Maps map (Maps JavaScript API of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). It only loads once you click “Load map”; before that there is no connection to Google. After the click your browser loads map data and code from Google; Google receives your IP address, details about your browser and device and the map area shown. Data may be transferred to the USA; Google is certified under the EU-US Data Privacy Framework. The legal basis is your consent given by the click (Art. 6(1)(a) GDPR, § 25(1) TDDDG); it only applies to that view. More in Google's privacy policy.

For these places you can see how far away they are from you. Only after you click “Use my location” does your browser ask for your location, and you decide there whether to share it. The distances are calculated in your browser only. We don't store your location and never receive it. If the Google map is loaded, your location is shown on it as a dot, and the map loads the area around your location from Google. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

On hotel portraits, region pages and journal articles about a place we show the local time and current weather. Your browser only asks our server, which fetches the forecast for the rounded coordinates of the place from the Norwegian Meteorological Institute (MET Norway). Nothing about you is passed on and no cookies are set. Weather data: MET Norway, licence CC BY 4.0.

Nearby. On the Nearby page you can enter a place or use your location. Your browser only asks for your location after you allow it. Distances to hotels, restaurants, cafés and bars are calculated in your browser only; we never receive your exact location. For the weather forecast, the page sends a position rounded to one decimal place (accurate to about 10 km) to our server, which uses it to fetch the forecast and sunrise and sunset times from MET Norway. We do not store this position. A place you type appears in the page address (?ort=…), your location never does. When you search for a place, our server sends the search term, without any information about you, to the Photon place search run by komoot GmbH (Potsdam), based on OpenStreetMap, and caches the results for each search term for up to one day.

All fonts are served from our own server. There is no connection to Google Fonts or any other font service.

09

Contact by email

When you write to us, we use your details to answer your request and, for hotels, to discuss a possible listing. The legal basis is Art. 6(1)(b) GDPR where a collaboration is concerned, otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). We delete the message once it is dealt with, unless statutory retention obligations apply.

10

Trip planner and travel folder

Your answers in the trip planner (/plan) and your travel folder stay in your browser: we keep them in browser storage (localStorage) and write them into the part of the link after the #. That part is not sent to our server. Anyone who has the link can see what is in the folder. You delete the folder with “Start a new trip” or by clearing the site data in your browser. The legal basis for storing it is § 25(2) no. 2 TDDDG, because the folder cannot work otherwise.

If you ask for personal advice or write to Samuel from the folder, we send your name, your email address, your answers and the link to the folder to us as a message, just like contact by email. We use it only to reply to you (Art. 6(1)(b) GDPR).

If you have the folder link sent to you by email or subscribe to the newsletter, we use Brevo (Sendinblue GmbH, Berlin). Brevo stores your email address, the folder link and the language and first sends you a confirmation email. You only receive further emails after confirming (double opt-in). The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via the unsubscribe link or by email.

11

CINCIN Creator Circle

If you sign up as a creator (/creators), we store the details from the questionnaire in our database at Supabase in Frankfurt am Main: name, email address, your profiles with the numbers you provide, links to examples of your work, details about your audience, topics, regions, place of residence, travel availability, how you work and your terms, your text about yourself, a profile picture and screenshots of your statistics if you upload them (kept in our storage at Supabase under addresses that cannot be guessed) and the time of your consent. We use these details to review your channels, to suggest you to suitable houses of the CINCIN selection for campaigns and to contact you about this by email. We ask you before showing your profile to a hotel.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by email; we will then delete your entry. You can have your details updated at any time by email. If we have not been in touch for 24 months, we delete your entry including profile picture and screenshots. How far visitors get in the questionnaire is counted without cookies and without any link to you (only step, language, device type and time). For the confirmation email and our notification we use the email service of Resend, Inc., San Francisco, USA, based on the European Commission’s standard contractual clauses.

12

Restaurant recommendations with data from Google

On the hotel pages and for the places in journal articles we show a photo, the rating, opening hours and the address from Google Maps (Google Places API of Google Ireland Limited, Dublin) for our recommendations. Our server requests this data from Google when you scroll to that section; the photo is also loaded through our server. Your browser does not connect to Google for this, and we do not pass on any details about you to Google. Only when you click a link to Google Maps do you leave our site; Google's privacy policy applies there.

13

Sign-in

For an account, for example to save hotels, we use the sign-in service of Clerk, Inc., San Francisco, USA. Clerk processes your email address, your name and your sign-in data and sets the cookies required for signing in. Saved hotels are stored in our database. So that the heart on the hotel pages shows what you saved, we also keep the short names of those hotels in a cookie in your browser (cincin_merkliste, one year, for this display only). Travel folders you save under “My trips” are kept in your Clerk account (in its private account data, visible only to you and us) and are deleted with the account. The legal basis is providing the account you create (Art. 6(1)(b) GDPR). The transfer to the USA is based on the European Commission’s standard contractual clauses. If you want your account deleted, an email is enough.

14

Instagram and other websites

We do not embed content or buttons from Instagram, Facebook or other social networks. If you follow a link to our Instagram profile @cincinhotels or to a hotel’s website, that provider’s privacy policy applies there.

15

Changes

If we change something on the website that affects data, we update this policy. The version published here applies.