Privacy Policy

We are pleased that you are visiting our website and thank you for your interest in our hotels. The protection of personal data is important to us. We therefore process personal data in accordance with applicable European and national legislation.

This privacy policy applies to little BIG hotels Holding GmbH (hereinafter referred to as "we", "us", etc.).

Definitions

Our privacy policy is based on the terminology of the EU General Data Protection Regulation (GDPR). The key terms:

• Personal data – any information relating to an identified or identifiable natural person.
• Processing – any operation performed in connection with personal data (collection, storage, modification, transmission, deletion, etc.).
• Controller – the natural or legal person who determines the purposes and means of processing.
• Consent – any freely given, specific, informed and unambiguous indication of the data subject's wishes.

Your rights

You have the following rights at any time:

• Right of access (Art. 15 GDPR) – right to confirmation and information about your stored data.
• Right to rectification (Art. 16 GDPR) – right to immediate correction of inaccurate data.
• Right to erasure (Art. 17 GDPR) – right to deletion ("right to be forgotten"), unless statutory retention obligations apply.
• Right to restriction of processing (Art. 18 GDPR).
• Right to data portability (Art. 20 GDPR).
• Right to object (Art. 21 GDPR) – right to object to processing on grounds relating to your particular situation.
• Right to withdraw consent at any time with effect for the future.
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR).

The supervisory authority responsible for us:

Security & Encryption

This site uses SSL/TLS encryption for security reasons. An encrypted connection is indicated by "https://" in the address bar and the padlock symbol in your browser. Data transmitted in encrypted form cannot be read by third parties.

Collection of general data

Our website automatically collects general data (server log files) each time it is accessed: IP address, date/time, pages visited, referrer, operating system, browser type. This data is used exclusively for the technically error-free display and security of the website (Art. 6(1)(f) GDPR) and is not merged with personal data.

Contact enquiries (form, e-mail, telephone)

When you contact us via form, e-mail or telephone, your enquiry including all resulting personal data is stored and processed for the purpose of handling your request. Data is not passed on without your consent.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract / pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest). Form data is transmitted via our own server endpoint and is not passed on to third parties.

Data is deleted as soon as it is no longer required for the purpose for which it was collected, or when you request deletion. Statutory retention periods remain unaffected.

Booking system (HotelNetSolutions)

For online room reservations we use the OnePageBooking service provided by HotelNetSolutions GmbH, Genthiner Straße 8, 10785 Berlin. Clicking a booking link opens a browser window redirecting you to OnePageBooking. Personal data entered there (name, payment details, etc.) is processed for the purpose of contract fulfilment (Art. 6(1)(b) GDPR). A data processing agreement with HotelNetSolutions GmbH is in place.

Privacy information from HotelNetSolutions: hotelnetsolutions.de/Datenschutz/

Newsletter (Bookboost)

When you subscribe to our newsletter, we process your email address on the basis of your explicit consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You may withdraw your consent at any time with future effect, for example via the unsubscribe link in every newsletter or by emailing stay@littleBIGhotels.com.

We use Bookboost (Bookboost AB, Kungsgatan 8, 411 19 Gothenburg, Sweden) for newsletter delivery and management. Bookboost acts as a data processor within the meaning of Art. 28 GDPR; a data processing agreement is in place. Data processing takes place within the EU / EEA. Further information: bookboost.io/privacy-policy/

Analytics & Tracking

Google Analytics 4

This website uses Google Analytics 4 (Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5). Processing only takes place with your explicit consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). IP addresses are anonymised. Collected data is deleted after 2 months. You can withdraw your consent at any time via the cookie consent tool.

etracker

We use etracker (etracker GmbH, Hamburg) for privacy-friendly analytics. No cookies are set by default. If analytics cookies are used, this only takes place with explicit consent. All data is processed exclusively in Germany. Further information: etracker.com/datenschutz/

Review widgets

Trustindex.io

We use Trustindex.io (Trustindex Ltd., Budapest) to embed Google reviews. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in direct marketing). Further information: trustindex.io

Google Fonts & Maps

This website uses Google Fonts and Google Maps (Google Ireland Limited). Use is based on your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can prevent processing by declining consent when entering the website.

Cookies

Our website uses cookies (small text files on your device). You can configure your browser to generally reject cookies or to be notified in advance. The cookie consent tool (CCM19) allows you to manage your consents individually.

Social media profiles

We maintain profiles on Facebook (Meta Platforms Ireland Limited), Instagram, Twitter/X and YouTube (Google Ireland Limited) as well as TripAdvisor (Tripadvisor LLC). When you visit our social media presences, data processing operations relevant to privacy are triggered over which we have no full control. Please refer to the privacy policies of the respective platforms for details.

Video surveillance

Our hotels use video surveillance to protect employees, guests and property (Art. 6(1)(f) GDPR). Image data is generally deleted within 72 hours at the latest.

Data Protection Officer

Controller

Internal Whistleblowing System

We operate an internal whistleblowing system based on the software CONFDNT, through which employees can confidentially report potential violations of legal requirements or internal policies. The system is available exclusively to employees.

The legal basis for processing personal data in connection with reports is Art. 6(1)(c) GDPR in conjunction with § 10 of the German Whistleblower Protection Act (HinSchG). The confidentiality of incoming reports and the identity of reporting persons is guaranteed. Further information is available to employees through internal channels.

Changes to this privacy policy

We reserve the right to update this privacy policy to reflect changes in legislation or new technical circumstances. Last updated: May 2026.