1. Controller
The controller for data processing on this website is:
Vogel family
Hotel Engelbracht
Am Schieferstein 2
34508 Willingen (Upland)
Phone: +49 5632 6589
Email: info@hotel-engelbracht.de
The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.
2. General
We process personal data only to the extent necessary to provide this website and our services, or where you have given your consent. Transmission is encrypted via HTTPS.
Your rights at a glance
- Information about the data stored about you (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection to processing (Art. 21 GDPR)
- Withdrawal of consent given, with effect for the future
- Complaint to a supervisory authority (Art. 77 GDPR)
For Hesse, this is the Hessian Commissioner for Data Protection and Freedom of Information, PO Box 3163, 65021 Wiesbaden.
3. Hosting
This website is operated by a service provider in the European Union. The provider processes data arising when the website is accessed on our behalf. The basis is a data processing agreement under Art. 28 GDPR.
Server log files
When a page is accessed, the following information is automatically recorded and stored for a limited time:
- Browser type and browser version
- Operating system used
- Referrer URL
- Host name of the accessing computer
- Time of the server request
- IP address
This data is technically necessary to deliver the website reliably and securely. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in trouble-free operation. The data is not combined with other data sources.
4. Cookies and consent
We use technically necessary cookies so that the website works. These do not require consent (Section 25(2) TDDDG).
All procedures beyond this, in particular reach measurement, only start once you have given your consent in the notice window. We store your choice locally in your browser. You can change your decision at any time by deleting the website data in your browser. The notice window will then appear again.
5. Getting in touch
Contact form
If you write to us via the form, we process the information entered there in order to deal with your enquiry. Mandatory fields are your email address and your message. Further information is voluntary.
The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to a booking or reservation, otherwise Art. 6(1)(f) GDPR. We keep the data until your enquiry has been dealt with and delete it afterwards, unless statutory retention periods prevent this.
Phone and email
If you call us or write us an email, we process your details in order to deal with your request. The legal basis is the same as for the contact form.
6. Easy Booking booking process
For online booking we use the booking process of easybooking GmbH. When the booking page is accessed, a component is loaded from the provider's servers. In doing so, your IP address is transmitted to the provider.
If you make a booking, the provider processes the information required for this on our behalf, in particular name, address, contact details, travel dates and room request. The legal basis is Art. 6(1)(b) GDPR, performance of the accommodation contract.
For embedding the component, the legal basis is Art. 6(1)(f) GDPR, our legitimate interest in a working booking option. If you wish to avoid this, book by phone on +49 5632 6589.
7. Reach measurement with Google Analytics 4
Only with your consent do we use Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use it to evaluate how our pages are used so that we can improve them.
- Legal basis
- Art. 6(1)(a) GDPR, your consent
- IP anonymisation
- active
- Consent Mode
- Version 2, default state declined
- Transfer to third countries
- possible to the USA on the basis of the standard contractual clauses and the EU-US Data Privacy Framework
You withdraw your consent by deleting this website's data in your browser and declining in the notice window that appears. The withdrawal takes effect for the future.
8. Maps from OpenStreetMap
On the contact page we embed a map from the OpenStreetMap Foundation. The map is only loaded when you click the corresponding button. Only then is your IP address transmitted to OpenStreetMap. The legal basis is Art. 6(1)(a) GDPR.
9. Fonts
We deliver the fonts used from our own server. There is no connection to third-party servers.
10. Social networks
We link to our profiles on Instagram and Facebook. These are simple links, not embedded content. Data is only transmitted to the providers when you click the link. The platform operators are responsible for processing on the platforms.
11. Booking and stay
During your stay we process the information we are legally required to collect, in particular under Section 29 of the Federal Registration Act (Bundesmeldegesetz) (registration form). The legal basis is Art. 6(1)(c) GDPR. The retention period for registration forms is one year; for invoice records, the retention periods under commercial and tax law of up to ten years apply.
12. Changes to this policy
We adapt this policy if the website's technology or the legal situation changes. The version published here applies in each case.
As of: September 2026