Privacy policy

This is a translation for your convenience. In case of doubt the German version applies.

Summary

This website uses no analytics, tracking or advertising services. Fonts are served from our own server, not from Google. Apart from two exceptions, no third-party content is loaded without your explicit consent: the map on the contact page, which you have to release yourself, and hCaptcha, which protects our forms against abuse and is therefore loaded independently of the cookie banner.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Ballhaus Berlin GmbH
Chausseestraße 102
10115 Berlin
Deutschland
Telefon: +49 30 282 7575
E-Mail: info@ballhaus-berlin.de

For matters concerning the hostel only, Ballhaus Berlin Hostel GmbH at the same address is the controller (office@ballhausberlinhostel.de).

No data protection officer is required by law. Please direct your enquiries to the contact details above.

2. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing we base on a legitimate interest (Art. 21).

Where you have given consent, you may withdraw it at any time with effect for the future. The lawfulness of processing carried out before the withdrawal is unaffected.

You may also lodge a complaint with a supervisory authority. The one responsible for us is:
Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin, datenschutz-berlin.de

3. Visiting the website and server log files

Each time a page is requested, our server records the IP address, the date and time, the page requested, the referring page, the browser and operating system, and the amount of data transferred. This is technically necessary to deliver the site and to detect faults and attacks. The legal basis is our legitimate interest in secure and functional operation (Art. 6(1)(f) GDPR). Log data is deleted after 30 days at the latest and is not combined with other data sources.

4. Hosting

This website is operated by a service provider in Germany. The provider processes the server and access data named above solely on our behalf and is bound by a data processing agreement under Art. 28 GDPR. Processing takes place on servers within the European Union.

5. Encryption

This website is delivered exclusively over an encrypted connection (TLS). You can recognise this by the padlock symbol and the address beginning with https://. Content you send us cannot be read by third parties.

6. Cookies and consent management

We only use cookies that are necessary to operate the website. These are:

• a cookie that stores your choice of language (Polylang),
• a cookie that stores your decision in the consent banner, so that we do not have to ask you again on every visit,
• session and security cookies, which are only set when you submit a form or log in.

Necessary cookies do not require consent (Section 25(2) no. 2 TDDDG). The legal basis for the associated processing is Art. 6(1)(f) GDPR.

Consent is managed with the FAZ Cookie Manager. It runs entirely on our own server; no data is transmitted to the manufacturer or to any other third party. To document your consent (Art. 7(1) GDPR) we store the time, the content of your choice, the version of the banner and your shortened IP address. These records are deleted after twelve months.

You can change or completely withdraw your choice at any time using the icon at the bottom left of every page.

7. Fonts

All fonts used on this website (Bodoni Moda and Archivo) are served from our own server. There is no connection to Google Fonts or any other font service, and no IP address is transmitted to third parties.

8. Map on the contact page

On the contact page you can display an interactive map. It is only loaded after you release it, or after you have consented in the banner. Before that you see only a placeholder and no connection to any map service takes place.

As soon as you release the map, your IP address is transmitted to the OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom, in order to deliver the map tiles. This is a transfer to a third country. The legal basis is your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time. Privacy information: osmfoundation.org

9. Contacting us

If you contact us by email or telephone, we process your details in order to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry serves the initiation or performance of a contract, and otherwise our legitimate interest in replying (Art. 6(1)(f) GDPR).

We delete your enquiry once it has been dealt with, unless statutory retention obligations prevent this. Commercial and tax retention periods remain unaffected.

10. Forms

Forms on this website are processed with Bit Form, which runs on our own server. The details you submit are stored in our database and forwarded to us by email. To protect against automated submissions we use server-side methods (honeypot, minimum completion time) together with the hCaptcha service. The provider is Intuition Machines, Inc., 350 Alabama St, San Francisco, CA 94110, USA. When you open a page containing a form, a script is loaded from hCaptcha; your IP address and information about your browser, device and behaviour on the page are transmitted to hCaptcha and evaluated there in order to distinguish humans from automated access. The legal basis is our legitimate interest in operating our forms free of abuse (Art. 6(1)(f) GDPR). Because hCaptcha serves to prevent abuse, it is loaded independently of the cookie consent. This involves a transfer to the USA. Further information can be found in hCaptcha’s privacy policy at hcaptcha.com/privacy and in its terms of service.

11. Newsletter

For our newsletter we use Groundhogg, which runs entirely on our own server. Your data is not transmitted to an external mailing provider.

Registration uses the double opt-in procedure: after entering your address you receive an email with a confirmation link. Only when you click it do we add you to the list. If you do not confirm, the entry is deleted automatically after 30 days.

We store your email address, optionally your first name, and the time and IP address of both registration and confirmation. The latter serve solely to demonstrate a proper registration. The legal basis is your consent (Art. 6(1)(a) GDPR).

We do not measure opening or click behaviour. Every newsletter email contains an unsubscribe link at the end. After unsubscribing we delete your data, unless you have expressly agreed that we may keep it as proof.

12. Security

To protect against attacks we use Wordfence. The software runs on our server and evaluates requests in order to block malicious requests and login attempts. IP addresses and request data are processed briefly in the process. The legal basis is our legitimate interest in the security of our systems (Art. 6(1)(f) GDPR).

13. Links to ticket shops and social networks

For events we link to the ticket shops and websites of the respective promoters, and in the footer to our profiles on Instagram and Facebook. These are plain links, not embedded content. As long as you do not click such a link, no data is transmitted to the operators. Once you click, the privacy policy of the respective provider applies; we have no influence over its processing.

14. No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

15. Changes

We adapt this policy whenever the data processing on this website changes. The version published here is the one that applies.