Privacy Policy for revo-hospitality-group.com

This Privacy Policy explains how we process your personal data and what rights you have under data protection laws. The terms “personal data” and “processing” are defined in Article 4 of the General Data Protection Regulation (GDPR).

1. Data Controller

The data controller responsible for the processing of personal data within the scope of this Privacy Policy is:

HRG Hospitality B.V. & Co. KG
Hauptstraße 66
12159 Berlin
Germany
Email: dataprivacy@revo-h.com

2. Data Protection Officer

You can contact our external Data Protection Officer at:

intersoft consulting services AG
Beim Strohhause 17
20097 Hamburg
Email: DSB-HRG-Hotels@intersoft-consulting.de

You may contact our Data Protection Officer directly with any questions regarding data protection or the exercise of your rights as a data subject.

3. Scope of This Privacy Policy

This Privacy Policy applies to the use of the website revo-hospitality-group.com as well as to the social media accounts operated by the data controller.

The website serves as the corporate and portfolio website of the Revo Hospitality Group and contains information about the company, hotels, brands, and other offerings in the portfolio.

To the extent that our website contains overviews or links to individual hotels, hotel brands, or external websites, you will be redirected to the website of the respective provider when you click on the relevant link. The respective operator is responsible for the processing of personal data on the respective destination page. The privacy notices provided there apply.

This privacy policy does not apply to the processing of personal data in connection with a hotel stay, in particular not to the performance of the accommodation contract, check-in and check-out, registration forms, on-site billing, or other services provided during the stay. The respective hotel operator is solely responsible for such processing within the meaning of the GDPR. Information regarding the processing of your data in connection with hotel stays can be found here .

Additional information on the processing of personal data in connection with our social media presence can be found in the section “Social Media Presence.”

4. Security

We take appropriate technical and organizational measures to protect personal data from unauthorized access, misuse, loss, alteration, or destruction. Our security measures are reviewed and adapted in line with technological developments.

5. Legal Bases for Processing

We process personal data only to the extent that there is a legal basis for doing so. Depending on the processing operation, the following provisions apply in particular: Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR (pre-contractual measures in connection with your inquiry), Article 6(1)(c) of the GDPR (legal obligation), and Article 6(1)(f) of the GDPR (legitimate interests).

6. Your Rights

Subject to the statutory requirements, you are entitled to the following rights in particular:

  • Right of access to the personal data we process (Art. 15 GDPR),
  • Right to rectification of inaccurate personal data or to have incomplete personal data completed (Art. 16 GDPR),
  • Right to erasure of personal data, provided the conditions of Art. 17 of the GDPR are met,
  • Right to restriction of processing in accordance with Art. 18 of the GDPR,
  • Right to data portability under the conditions set forth in Art. 20 of the GDPR,
  • Right to object to processing in accordance with Art. 21 of the GDPR,
  • Right to withdraw consent with future effect (Art. 7(3) GDPR),
  • Right to lodge a complaint with a data protection supervisory authority (Art. 77 of the GDPR).

If personal data is processed for direct marketing purposes, you may object to this processing at any time without providing a reason. To exercise your rights, you may contact us using the contact information provided in Sections 1 or 2.

The competent supervisory authority for the data controller is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, email: mailbox@datenschutz-berlin.de.

7. Recipients of Personal Data

We disclose personal data only to the extent that there is a legal basis for doing so and the disclosure is necessary for the provision of the website, the processing of your inquiry, the implementation of pre-contractual measures in connection with your inquiry, the fulfillment of legal obligations, the protection of legitimate interests, or based on your consent. Legal bases may include, in particular, Article 6(1)(b) of the GDPR, Article 6(1)(c) of the GDPR, Article 6(1)(f) of the GDPR, or Article 6(1)(a) of the GDPR.

Depending on the function used, the purpose of the processing, and the specific processing operation, recipients of personal data may include, in particular, the following entities:

  • technical service providers, in particular hosting, infrastructure, security, maintenance, and IT service providers,
  • service providers for website functions, forms, communication, and consent management,
  • providers of analytics, statistics, marketing, push notifications, or similar services, to the extent that these are used,
  • affiliated companies, to the extent necessary for central administrative, communication, or support processes related to this website,
  • professional advisors such as attorneys, tax advisors, and auditors, as well as courts, government agencies, or other public authorities, to the extent necessary in individual cases.

To the extent that recipients process personal data on our behalf, this is done on the basis of corresponding data processing agreements in accordance with Article 28 of the GDPR. Other recipients process personal data independently, to the extent that they themselves are responsible for such processing. To the extent that recipients are independently responsible, their own privacy notices or statutory disclosure obligations apply in addition.

8. Transfers to Third Countries

We process personal data primarily within the European Union or the European Economic Area. In cases where data is transferred to recipients in third countries, we ensure compliance with the requirements of Articles 44 et seq. of the GDPR. This may occur, in particular, on the basis of an adequacy decision by the European Commission, appropriate safeguards such as EU Standard Contractual Clauses, or, to the extent permitted by law, on the basis of your consent. Further information on specific transfers to third countries, particularly regarding individual service providers, can be found in the respective sections of this Privacy Policy as well as in the Cookie Notice.

9. Retention Period

We store personal data only for as long as is necessary for the respective processing purposes or as required by statutory retention, proof, or documentation obligations. Once the respective purpose no longer applies, the data will be deleted or its processing restricted, unless legal obligations or legal claims preclude deletion. If specific retention periods are specified in this Privacy Policy for individual processing operations, those periods take precedence. Further information on the retention periods for individual cookies and similar technologies can be found in the Cookie Notice.

10. Provision of the Website and Server Log Files

You may use our website for purely informational purposes without actively providing any personal information. When you access individual pages, technically necessary access data is automatically processed so that the website can be displayed on your device. In particular, the following data may be processed:

  • browser type and browser version,
  • operating system used,
  • language and version of the browser software,
  • date and time of access,
  • referrer URL,
  • pages or files accessed,
  • IP address.

The processing of this data is necessary to ensure the availability, stability, functionality, and security of the website. The legal basis is Article 6(1)(f) of the GDPR. Our legitimate interest lies in the secure, stable, and technically error-free provision of our online services.

The data will be deleted as soon as it is no longer necessary for these purposes. Longer storage may occur to the extent necessary to investigate a security-related incident or to comply with legal obligations.

Right to Object: You may object to the processing for reasons arising from your particular situation.

11. Contact and Forms

When you contact our company, for example, via email, by phone, or through a contact form provided on the website, we process the personal data you provide in order to handle and respond to your inquiry. This may include, in particular, your name, contact information, company details, and the content of your message. For business inquiries, we may also process professional contact information, details about your company, your job title, and the content of the business communication. When you submit a form, technical data, in particular your IP address and the date and time of the request, may also be processed.

The legal basis for the processing is Article 6(1)(f) of the GDPR. Our legitimate interest lies in processing and responding to your inquiry. To the extent that the contact is aimed at pre-contractual measures in connection with your inquiry, the legal basis is Article 6(1)(b) of the GDPR. We process any additional information you voluntarily provide based on your consent pursuant to Article 6(1)(a) of the GDPR.

We will delete the data processed in connection with your inquiry as soon as its storage is no longer necessary for processing and there are no legal retention obligations or legitimate grounds for further storage.

Right to Object: To the extent that processing is based on Article 6(1)(f) of the GDPR, you may object to the processing on grounds relating to your particular situation.

12. Inquiries Regarding Meetings and Events

If you request information about meetings and events via our website or submit a corresponding inquiry to us, we process the contact, company, event, and communication data you provide to handle your inquiry. Depending on the desired event location, your inquiry may be forwarded to the relevant department so that it can be processed further. If you provide us with personal data of other contacts or participants, this data originates from you.

The legal basis is Article 6(1)(b) of the GDPR, insofar as the processing is necessary for the implementation of pre-contractual measures. In all other cases, processing is based on Article 6(1)(f) of the GDPR.

Right to Object: To the extent that processing is based on Article 6(1)(f) of the GDPR, you may object to the processing on grounds relating to your particular situation.

13. Job Applications

The application process takes place via a standalone application page or a separate application portal. Information regarding the processing of personal data in connection with applications can be found in the privacy policy provided there. To the extent that this website merely links to the application portal, we do not process any application data ourselves via this website as part of the application process.

14. Newsletter

We do not currently offer a newsletter service. No further newsletters will be sent.

To the extent that personal data is still stored in connection with a previous newsletter subscription, we process it only to the extent necessary to handle the hiring process, address outstanding matters, or fulfill legal documentation and retention obligations.

The legal bases are Article 6(1)(b) of the GDPR, to the extent that processing is necessary to handle previous user relationships or outstanding matters, and Article 6(1)(c) of the GDPR, to the extent that statutory documentation or retention obligations exist.

15. Cookies and Similar Technologies

When you use our website, cookies and similar technologies may be used that store information on your device or access information stored there. These technologies may be necessary to provide the website, ensure its security, enable efficient navigation, save language settings or other preferences, perform statistical analyses, or display content and advertising tailored to your interests.

Technically necessary or functional technologies are required for the operation and basic functions of the website. These include, in particular, technologies for consent management as well as the storage of the selected language setting, for example via a cookie such as “wp-wpml_current_language.” To the extent that the storage of information or access to information on your device is absolutely necessary for this purpose, this is done on the basis of Section 25(2) of the TDDDG. The associated processing of personal data is based on Article 6(1)(f) of the GDPR. Our legitimate interest lies in the secure, stable, and functional provision of our website.

In addition, technologies for preferences, statistics, and marketing may be used. These are used only with your prior consent, to the extent that consent is required for this purpose. The legal basis is Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG, to the extent that information is stored on or read from your device. For more information on the specific cookies and similar technologies used, including providers, purposes, categories, retention periods, and activation, please see our Cookie Notice.

You may modify or withdraw your consent at any time with future effect using the consent management feature provided on the website. You may also delete cookies that have already been stored via your browser settings or prevent cookies from being stored. Please note that certain features of the website may not be available or may be available only to a limited extent if technically necessary cookies are deactivated.

Right to Object: To the extent that processing is based on Article 6(1)(f) of the GDPR, you may object to the processing for reasons arising from your particular situation.

16. Technical Services, External Content, and Analytics and Marketing Technologies

Technical services may be used to operate and provide our website, in particular hosting, infrastructure, security, maintenance, library, or content delivery services. In addition, we use a consent management system to store and implement your preferences regarding cookies and similar technologies. These services serve to ensure the secure, stable, efficient, and error-free provision of the website, as well as the legally compliant management of your consents. The legal basis is Article 6(1)(f) of the GDPR; to the extent that processing is necessary to fulfill statutory record-keeping and documentation obligations, the legal basis is Article 6(1)(c) of the GDPR.

In addition, external content as well as analytics, statistics, preference, or marketing technologies may be used on the website. As specified in the cookie notices, these include, in particular, technologies for language settings, statistical web analytics, and the provision and management of browser push notifications. To the extent that these technologies are not technically necessary, they are used only on the basis of your consent.

The legal basis for technologies requiring consent is Article 6(1)(a) of the GDPR in conjunction with Section 25(1) of the TDDDG, to the extent that information is stored on or retrieved from your device. Details regarding the cookies and similar technologies used can be found in the Cookie Notice.

To the extent that third-party providers are involved, they may process personal data, depending on the arrangement, as data processors, joint controllers, or independent controllers. Further information can be found in the respective privacy policies of the providers.

Right to Object: To the extent that processing is based on Article 6(1)(f) of the GDPR, you may object to the processing for reasons arising from your particular situation.

17. Social Media Presence

We maintain publicly accessible profiles on the following social networks:

  • Facebook: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland; Privacy Policy: https://www.facebook.com/privacy/policy/
  • Instagram: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland; Privacy Policy: https://privacycenter.instagram.com/policy/
  • LinkedIn: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; Privacy Policy: https://www.linkedin.com/legal/privacy-policy/
  • YouTube: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Privacy Policy: https://policies.google.com/privacy
  • XING: New Work SE, Am Strandkai 1, 20457 Hamburg, Germany; Privacy Policy: https://privacy.xing.com/de/datenschutzerklaerung
  • TikTok: TikTok Technology Limited, The Sorting Office, Ropemaker Place, Dublin 2, Ireland; Privacy Policy: https://www.tiktok.com/legal/page/eea/privacy-policy/de

Purpose: Public relations, providing information about our offerings, communicating with prospects, customers, and users, as well as for marketing purposes, such as measuring reach and displaying targeted content.

Categories of data processed:

  • Identifying information, e.g., name, username, profile picture,
  • Communication and content data, e.g., comments, posts, messages, attachments,
  • Usage data, e.g., content viewed, interactions,
  • technical data/metadata, e.g., IP address, timestamps, device data.

The specific data collected and processed depends on your usage behavior and the settings in your respective user account.

Joint controllership (Art. 26 GDPR): Depending on the platform and its specific design, joint controllership within the meaning of Art. 26 GDPR may apply, particularly for statistical analyses or similar functions related to the use of our profiles. Information on possible agreements or responsibilities of the platform operators can be found here in particular:

  • Facebook and Instagram: https://www.facebook.com/legal/terms/page_controller_addendum
  • LinkedIn: https://legal.linkedin.com/pages-joint-controller-addendum
  • TikTok: https://www.tiktok.com/legal/page/global/tiktok-analytics-joint-controller-addendum/en

Legal Basis:

  • legitimate interest in a contemporary public image and effective communication (Art. 6(1)(f) GDPR),
  • Performance of a contract, to the extent that communication takes place within the framework of a contractual relationship or for the purpose of entering into such a relationship (Art. 6(1)(b) GDPR),
  • Your consent, to the extent that you have consented to specific processing activities with the platform operator or with us (Art. 6(1)(a) GDPR). You may revoke this consent at any time with future effect.

Right to Object and Right to Withdraw Consent: You may object to processing based on legitimate interests at any time (Art. 21 GDPR). You may withdraw any consent you have given at any time with future effect.

Transfers to Third Countries: Many platform operators have their headquarters or servers located, in part, outside the EU/EEA. According to their own statements, these providers rely on appropriate safeguards for this purpose, such as adequacy decisions or standard contractual clauses. Please refer to the privacy policies of the respective platform operators for details.

Exercising Your Rights: You may exercise your data subject rights both with us and with the respective platform operator. Since the platform operators have direct access to the usage data, it is often most effective to exercise your rights directly with the respective platform operator.

18. Provision of Personal Data

You can use the website for informational purposes only without actively providing personal data; however, technically necessary access data is required to provide and secure the website. For forms, mandatory fields are required so that we can process the respective request; additional information is voluntary.

19. Automated Decision-Making

No decision-making based solely on automated processing, including profiling as defined in Article 22 of the GDPR, takes place within the scope of the processing described herein.

20. Changes to This Privacy Policy

We may update this Privacy Policy if our data processing activities, the services we use, or the applicable legal framework change. The current version published on the website applies.

Effective: September 1, 2026