Privacy Policy
Maison Marsil Boutique Hotel
Last updated: October 2026
1. Data Controller
The controller responsible for processing personal data on this website is:
Maison Marsil Boutique Hotel
home made GmbH
Marsilstein 25–27
50676 Cologne
Germany
Phone: +49 (0)221 57 00 1160
Fax: +49 (0)221 57 00 1162
Email: hotel@marsil.de
Website: https://www.marsil.de
VAT ID: DE215667651
2. General Information
We take the protection of your personal data seriously and process it in accordance with applicable data protection laws, in particular the European General Data Protection Regulation (GDPR) and the German Telecommunications Digital Services Data Protection Act (TDDDG).
This Privacy Policy explains how we process personal data when you visit our website, contact us, book accommodation or make payments.
3. Website Hosting and Server Logs
When you visit our website, certain technical information is processed to ensure the website functions correctly and securely.
This information may include:
- IP address
- Date and time of access
- Pages and files accessed
- Browser type and operating system
- Amount of data transferred
- Referring website, where applicable
Processing is based on our legitimate interest in maintaining a secure and reliable website pursuant to Art. 6(1)(f) GDPR.
Server logs are retained only for as long as necessary for these purposes.
Our website is hosted by Keppler IT GmbH, Am Weichselgarten 7, 91058 Erlangen-Tennenlohe, Germany (https://www.keppler-it.de). The hosting provider processes the data mentioned above on our behalf.
4. Contacting Us
When you contact us by email, telephone or through a contact form, we process the information you provide, including your name, contact details and the content of your enquiry.
We use this information to respond to your request.
The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a booking or potential contract. For general enquiries, processing is based on Art. 6(1)(f) GDPR.
Your data will be deleted when it is no longer required, unless statutory retention obligations apply.
5. Room Bookings via Mews
We use the Mews hotel management and booking system to manage reservations for our rooms and our suite.
The personal data processed may include:
- First and last name
- Address and contact details
- Arrival and departure dates
- Room category
- Number of guests
- Booking and billing information
- Payment information
- Voluntary requests and additional information
Processing is necessary to manage your reservation and perform the accommodation contract pursuant to Art. 6(1)(b) GDPR, as well as to comply with legal obligations pursuant to Art. 6(1)(c) GDPR.
Where Mews processes personal data on our behalf, this is governed by a data processing agreement pursuant to Art. 28 GDPR.
Further information:
https://www.mews.com/de/privacy
6. Online Payments via Stripe
We use Stripe to process online payments associated with bookings made through Mews.
Depending on the transaction, payment amounts, transaction details, billing information, payment information and technical data required for payment security may be processed.
Processing is based on Art. 6(1)(b) GDPR for contract performance and, where applicable, Art. 6(1)(c) GDPR for compliance with legal obligations.
Stripe may also process certain information under its own responsibility for fraud prevention, payment security and compliance with legal requirements.
Further information:
https://stripe.com/de/privacy
7. Card Payments at the Hotel via TeleCash (Fiserv)
For Girocard, debit card and credit card payments made directly at Maison Marsil, we use TeleCash payment terminals, a service offered by Fiserv.
The data required to process a transaction may include payment amounts, card information, transaction times and technical payment information.
Processing is based on Art. 6(1)(b) GDPR for contract performance and, where applicable, Art. 6(1)(c) GDPR for compliance with legal obligations.
Further information:
https://www.fiserv.com
8. Cookies and Similar Technologies
Our website may use cookies and similar technologies to provide technical functionality.
Strictly necessary technologies may be used for functions such as language preferences, website security or booking system functionality.
Where storing information on your device or accessing such information is not strictly necessary, we will obtain your consent in accordance with Section 25(1) TDDDG.
Where personal data is processed on the basis of consent, the legal basis is Art. 6(1)(a) GDPR.
You may withdraw your consent at any time with effect for the future through the cookie settings.
9. Website Analytics and Visitor Statistics
We may use website analytics services, such as Google Analytics or comparable tools, to understand how visitors use our website and to improve our services.
Depending on the service, information about page views, visit duration, devices used, approximate geographic location and interactions with website features may be processed.
Analytics services requiring consent will only be activated after you have given your consent.
The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR.
You may withdraw your consent at any time with effect for the future.
10. External Service Providers
We may engage external service providers for website hosting, technical maintenance, development and related services.
Where these providers process personal data on our behalf, appropriate data processing agreements are concluded in accordance with Art. 28 GDPR.
Personal data is shared only where there is an appropriate legal basis.
11. Fonts and External Content
Our website may use fonts, maps, videos and other external content.
Where possible, we prefer to host fonts locally to avoid unnecessary data transfers to third parties.
When external content is loaded, personal data such as IP addresses may be transmitted to the respective providers.
Where consent is legally required, such content will only be loaded after consent has been obtained.
12. Social Media and External Links
Our website may contain links to external websites and social media profiles, including our profile on GoSee.news:
Simply displaying an ordinary external link does not automatically transmit personal data to the linked provider.
When you follow an external link, the privacy policies of the respective provider apply.
On our contact page we link to Google Maps; data is only transmitted to Google once you click the link, and Google’s privacy policy applies (https://policies.google.com/privacy).
13. Recipients of Personal Data
Where necessary, personal data may be shared with service providers, including:
- Hosting and IT service providers
- Booking and hotel management systems
- Payment service providers
- Website analytics providers, where applicable
- Other service providers necessary for contract performance
Data is shared only on an appropriate legal basis.
14. International Data Transfers
Certain service providers may process personal data outside the European Economic Area.
Such transfers take place only in accordance with the requirements of Art. 44 et seq. GDPR, for example on the basis of an adequacy decision by the European Commission or appropriate safeguards such as Standard Contractual Clauses.
15. Data Retention
We retain personal data only for as long as necessary for the purposes for which it was collected.
Statutory retention obligations, particularly those arising under tax and commercial law, remain unaffected.
Data will be deleted once the applicable retention periods have expired, unless another legal basis requires continued storage.
16. Your Rights
Subject to the applicable legal requirements, you have the following rights:
- Right of access under Art. 15 GDPR
- Right to rectification under Art. 16 GDPR
- Right to erasure under Art. 17 GDPR
- Right to restriction of processing under Art. 18 GDPR
- Right to data portability under Art. 20 GDPR
- Right to object under Art. 21 GDPR
- Right to withdraw consent under Art. 7(3) GDPR
To exercise your rights, please contact:
17. Right to Lodge a Complaint
You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates applicable data protection laws.
The supervisory authority responsible for our company is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
18. Data Security
We implement appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access.
Our website uses encrypted HTTPS connections.
19. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes in legal requirements, website functionality or service providers.
The version published on our website at the relevant time shall apply.