Privacy Policy
PRIVACY POLICY
Munich Rooms Hotel e.K., Proprietor Selcuk Gürler
for the hotel establishments
Munich Rooms Hotel
Herzogstr. 51, 80803 Munich
Gästehaus Englischer Garten
Liebergesellstr. 8, 80802 Munich
Hotel Biederstein
Keferstr. 18, 80802 Munich
Last updated: October 2026
1. General Information
The protection of your personal data is important to us. This Privacy Policy explains which personal data we process in connection with our hotel and accommodation services, our websites, bookings, online check-in and communications with us.
Personal data means any information relating to an identified or identifiable natural person.
Personal data is processed in particular on the basis of the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG) and other applicable statutory provisions.
This Privacy Policy applies to the hotel establishments operated by Munich Rooms Hotel e.K.:
Munich Rooms Hotel
Gästehaus Englischer Garten
Hotel Biederstein
as well as to the associated websites, booking and communication channels and other digital services.
2. Controller
The controller within the meaning of Art. 4(7) GDPR is:
Munich Rooms Hotel e.K.
Proprietor: Selcuk Gürler
Herzogstr. 51
80803 Munich
Germany
Additional establishments:
Gästehaus Englischer Garten
Liebergesellstr. 8
80802 Munich
Hotel Biederstein
Keferstr. 18
80802 Munich
Email: hello@mucrooms.de
Insofar as the above-mentioned hotel establishments are operated by Munich Rooms Hotel e.K., Munich Rooms Hotel e.K. is the controller under data protection law for the processing activities described in this Privacy Policy.
3. Scope
This Privacy Policy applies in particular to personal data that we process:
when you use our websites;
when you make direct bookings via our websites;
in connection with booking enquiries made by telephone or in writing;
for bookings made via travel portals and online travel agencies (OTAs), in particular Booking.com and Expedia;
via travel agencies, companies and other intermediaries;
during online check-in and self check-in;
during your stay at our hotels;
when processing payments;
when communicating by email, telephone or via booking platforms;
in connection with enquiries, complaints and reviews;
when using Wi-Fi or other digital services, where offered;
when using electronic access and locking systems;
where statutory registration, retention or documentation obligations apply.
4. Personal Data We Process
Depending on the service concerned, we may process the following categories of data in particular:
4.1 Personal and Contact Data
First and last name
Address
Email address
Telephone number
Date of birth, where required
Nationality, where legally required
Preferred language
4.2 Booking and Stay Data
Arrival and departure dates
Hotel establishment booked
Room category
Number of guests
Names of accompanying guests, where required
Booking number
Booking source
Price and services booked
Special booking requests
Information concerning changes and cancellations
Communications relating to the reservation
Vehicle registration number, where applicable, when using our parking facilities
4.3 Payment and Billing Data
This may include in particular:
Payment method
Payment status
Billing address
Invoice and transaction data
Transaction or reference numbers
Credit card data required for payment processing, where applicable
Where payment or credit card data is processed directly by a payment service provider, booking platform or other service provider, we may receive only the information required to process and allocate the payment.
4.4 Communication Data
If you contact us, we process the information you provide, for example:
Email content
Messages sent via booking portals
Telephone number
Date and time of communication
Information relating to your booking
Complaints, requests and other communications
4.5 Technical Data
When you visit our websites, the following data in particular may be processed:
IP address
Date and time of access
Browser type and browser version
Operating system
Pages and files accessed
Referrer URL
Device information
Technical log and server data
5. Sources of Personal Data
We obtain personal data in particular:
directly from you, for example when you make a booking or enquiry, complete online check-in, contact us by telephone or email, or during your stay;
from the person making the booking if another person makes a reservation on your behalf;
from companies or organisations booking accommodation for their employees, guests or business partners;
from booking platforms and intermediaries, in particular Booking.com, Expedia, travel agencies or other distribution partners;
from technical service providers, in particular booking systems, property management systems, channel managers, online check-in systems and payment service providers.
If you provide us with personal data relating to other persons, for example accompanying guests, please ensure that you are authorised to do so and that the persons concerned have been informed about the transfer of their data.
6. Purposes and Legal Bases of Processing
6.1 Booking Enquiries and Reservations
We process personal data in order to handle booking enquiries, create and manage reservations, send booking confirmations, process changes and cancellations, provide booked services and communicate with you before, during and after your stay.
Legal basis: Art. 6(1)(b) GDPR – taking steps prior to entering into a contract and performance of a contract.
6.2 Online Check-in and Self Check-in
As part of our online and self check-in procedures, we process the booking, contact and stay data required for these purposes.
This may include registration information and the provision and management of personal access codes, PIN codes or electronic access authorisations.
Legal basis: Art. 6(1)(b) GDPR and, where information is required by law, Art. 6(1)(c) GDPR.
6.3 Provision of the Hotel Stay
We process your data in order to perform the accommodation contract and provide the services you have booked.
This includes, in particular, providing your room, managing your stay, handling guest requests, providing booked additional services, billing and communicating with you during your stay.
Legal basis: Art. 6(1)(b) GDPR.
6.4 Statutory Registration Obligations
Where statutory provisions require us to collect, verify or retain data relating to hotel guests or to make such data available to public authorities, processing is carried out in order to comply with these legal obligations.
This applies in particular to the special registration requirements for foreign hotel guests pursuant to Sections 29 and 30 of the German Federal Registration Act (Bundesmeldegesetz – BMG).
This may include, in particular, information concerning name, first name, date of birth, nationality, address, arrival and departure and, where required by law, passport or substitute identity document details.
Legal basis: Art. 6(1)(c) GDPR in conjunction with the applicable provisions of the German Federal Registration Act.
6.5 Payment Processing
We process the data required for payment purposes, in particular for billing accommodation and additional services, advance payments, authorisations, refunds and the handling of outstanding claims.
For this purpose, payment service providers, credit card companies, banks and payment systems provided by booking platforms may be used.
Legal basis: Art. 6(1)(b) GDPR and, where applicable, Art. 6(1)(c) GDPR.
6.6 Invoicing and Accounting
For invoicing, financial accounting and tax documentation obligations, we process in particular names, addresses, company details, invoice data, payment information and booked services.
Legal basis: Art. 6(1)(b) and (c) GDPR.
6.7 Communication and Customer Service
We process personal data for the purpose of handling general enquiries, guest requests, complaints, lost-property enquiries, claims and other correspondence.
Legal basis: Depending on the circumstances, Art. 6(1)(b) or (f) GDPR.
Our legitimate interest consists in particular in efficient guest communication and the handling of enquiries and complaints.
6.8 Protection and Enforcement of Legal Claims
Where necessary, personal data may be processed for the establishment, exercise or defence of legal claims, for example in connection with payment disputes, cancellations, damages, complaints or other legal disputes.
Legal basis: Art. 6(1)(f) GDPR.
7. Bookings via Booking.com, Expedia and Other Intermediaries
If you make a booking via an external booking platform, travel agency or other intermediary, the respective provider initially processes your personal data under its own responsibility for data protection purposes.
The data required to process your reservation is subsequently transmitted to us and/or to booking, channel management or property management systems used by us.
Any additional processing of your data by the respective provider is governed by that provider’s own privacy policy.
We have no influence over data processing carried out by a booking platform under its own responsibility outside the processing and transmission of your reservation.
8. Hotel Software, Channel Managers and Online Check-in
We use specialised IT systems and service providers to manage our hotel operations.
These may include in particular:
Property management systems (PMS)
Channel managers
Online booking systems
Online check-in systems
Electronic access and locking systems
Revenue management systems
Payment service providers
IT, hosting and communication service providers
These service providers receive only the personal data required to provide the respective service.
Where service providers process personal data exclusively on our behalf, they are contractually bound in accordance with Art. 28 GDPR.
9. Recipients of Personal Data
Where necessary, personal data may be transferred in particular to:
Booking platforms and travel intermediaries
Property management systems
Channel managers
Online check-in service providers
Payment service providers and banks
Credit card companies
IT and hosting service providers
Providers of electronic access and locking systems
Tax advisers and accounting service providers
Lawyers and other professional advisers
Authorities and public bodies where required by law
Data will only be disclosed for other purposes where there is a legal basis for doing so or where you have expressly consented to such disclosure.
10. Transfers of Data Outside the EU or EEA
Individual service providers or booking platforms used by us may process personal data outside the European Union or the European Economic Area.
Any such transfer will only take place in compliance with the requirements of Art. 44 et seq. GDPR.
Appropriate safeguards may include in particular:
an adequacy decision by the European Commission;
appropriate safeguards pursuant to Art. 46 GDPR, in particular the EU Standard Contractual Clauses;
other legally permitted transfer mechanisms.
Information concerning the safeguards used in a specific case may be requested from us.
11. Retention Periods
We store personal data only for as long as necessary for the respective processing purpose or for as long as statutory retention obligations apply.
Booking and contractual data:
For the duration of the contractual relationship and thereafter insofar as statutory retention periods or limitation periods apply.
Invoice and accounting data:
In accordance with the applicable commercial and tax-law retention obligations.
Statutory registration data:
In accordance with the specific statutory provisions of the German Federal Registration Act.
Data processed on the basis of consent:
Generally until consent is withdrawn, unless another legal basis permits or requires continued storage.
Data used for the defence of legal claims:
Where necessary, until the legitimate interest ceases to apply or until the relevant limitation periods have expired.
After expiry of the applicable periods, personal data will be deleted or anonymised unless there is a legal basis for continued processing.
12. Website and Server Log Files
When you access our websites, technical information may be processed automatically by the web server.
This may include in particular:
IP address
Date and time
Page or file accessed
Amount of data transferred
Browser type
Operating system
Referrer URL
Technical status information
The processing is carried out to ensure the secure and technically reliable provision of our websites and to detect and prevent attacks and technical disruptions.
Legal basis: Art. 6(1)(f) GDPR.
Our legitimate interest lies in the secure, stable and functional operation of our online services.
13. Cookies and Similar Technologies
Our websites may use cookies and comparable technologies.
Technically necessary cookies or comparable technologies may be used insofar as they are required for the operation, security and provision of the website or of a digital service expressly requested by you.
Where analytics, statistics, marketing or other technologies that are not technically necessary are used, they will only be used in accordance with the applicable legal requirements and, where required, only after you have given your prior consent.
Where a consent or cookie management system is provided on the respective website, you can use it to make your selection and to change or withdraw previously granted consent at any time with effect for the future.
The cookies and other technologies actually used depend on the technical configuration of the respective website.
14. Email and Electronic Communication
If you communicate with us by email or via a booking platform, we process your contact details and the content of your message in order to handle your enquiry or request.
Please do not send us complete credit card details or other particularly confidential payment information by unencrypted email.
For payment information, please use only the secure procedures provided by us or by our payment and booking service providers.
15. Direct Marketing and Newsletters
Where we offer newsletters or comparable electronic marketing communications, these are generally sent only on the basis of appropriate consent, unless another legal basis applies to the specific communication.
Consent may be withdrawn at any time with effect for the future.
Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.
Booking-related messages, in particular booking confirmations and information concerning online check-in, arrival, your stay, payments or changes to a reservation, do not constitute newsletters and may continue to be sent insofar as this is necessary for the performance of the contract.
16. Special Categories of Personal Data
We generally ask you not to provide us with special categories of personal data within the meaning of Art. 9 GDPR unless this is necessary for your stay.
If, for example, you voluntarily inform us of special requirements relating to your stay for health reasons, we will process this information only where an appropriate legal basis exists.
17. Data Relating to Children and Minors
In connection with family or group bookings, personal data relating to minor guests may also be processed insofar as this is necessary to process the reservation or comply with legal obligations.
Our websites are not specifically directed at children for the purpose of independently booking accommodation services.
18. Data Security
We implement appropriate technical and organisational measures to protect personal data against loss, unauthorised access, unlawful alteration, unauthorised disclosure or destruction.
Access to personal data is generally restricted to persons and service providers who require this information in order to perform their duties.
Our technical and organisational security measures are regularly reviewed and adapted, taking into account the state of the art, the nature and scope of the processing and the associated risks.
19. Your Data Protection Rights
Where the statutory requirements are met, you have the following rights in particular:
Right of Access – Art. 15 GDPR
You may request information as to whether and which personal data concerning you we process.
Right to Rectification – Art. 16 GDPR
You may request the correction of inaccurate personal data or the completion of incomplete personal data.
Right to Erasure – Art. 17 GDPR
You may request the deletion of your personal data where the statutory requirements are met.
The right to erasure does not apply in particular where statutory retention obligations prevent deletion.
Right to Restriction of Processing – Art. 18 GDPR
You may request restriction of processing where the statutory requirements are met.
Right to Data Portability – Art. 20 GDPR
Where the statutory requirements are met, you may receive the data you have provided in a structured, commonly used and machine-readable format.
Right to Object – Art. 21 GDPR
Where processing is based on Art. 6(1)(e) or (f) GDPR, you may object to such processing at any time on grounds relating to your particular situation.
Where personal data is processed for direct marketing purposes, you may object to such processing at any time.
Withdrawal of Consent
You may withdraw consent you have given at any time with effect for the future.
The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
20. Right to Lodge a Complaint with a Data Protection Supervisory Authority
Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes applicable data protection legislation.
For private companies based in Bavaria, the competent supervisory authority is generally:
Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18
91522 Ansbach
Germany
Email: poststelle@lda.bayern.de
You may also lodge a complaint with another competent data protection supervisory authority pursuant to Art. 77 GDPR.
21. Requirement to Provide Personal Data
Certain personal data is required in order for us to accept a reservation and perform an accommodation contract.
Without the required information, we may be unable to:
process a reservation;
properly manage a stay;
process a payment;
comply with legal obligations.
Where information is voluntary, this will be taken into account accordingly.
22. Automated Decision-Making
As a general rule, we do not carry out decision-making based solely on automated processing that produces legal effects or similarly significantly affects you within the meaning of Art. 22 GDPR, unless expressly stated otherwise for a specific service.
Automated systems may, for example, be used for pricing, availability management, booking management or fraud prevention without necessarily constituting automated decision-making within the meaning of Art. 22 GDPR.
23. Contact for Data Protection Enquiries
If you have any questions regarding data protection or wish to exercise your data protection rights, please contact:
Munich Rooms Hotel e.K.
Proprietor: Selcuk Gürler