1. Controller

JBK Hospitality GmbH
Wandsbeker Königstraße 9
22041 Hamburg

Telephone: +49 155 10201619
Email: info@cozy9.de
Website: www.cozy9.de

Represented by the Managing Directors:
Jessica Bortolusso, Karin Nikolaides

Contact Person for Data Protection Inquiries:
Jessica Bortolusso

VAT Identification Number (USt-IdNr.):
DE454048491

2. General information on data processing

We take the protection of your personal data very seriously. Personal data means any information that can be used to identify you personally.

We treat your data confidentially and in accordance with the applicable data protection laws and this Privacy Policy.

The use of our website is generally possible without providing personal data. If personal data (e.g., name, address, or email address) is collected on our pages, this is done—where possible—on a voluntary basis.

3. Collection and processing of personal data

a) Bookings via booking portals

If you make a booking through external booking portals (e.g., Booking.com, HRS, Expedia), data collection and processing are primarily carried out by the respective portal.

We receive from these portals only the data necessary to process your booking (e.g., name, arrival date, contact details, payment information) and use them exclusively to execute and manage the accommodation contract.

Legal basis: Article 6 (1) (b) GDPR (Performance of a contract)

b) Direct bookings or inquiries

If you contact us directly by phone, email, or through a contact form, we use your data solely to handle your request and, if applicable, to process a booking.

Your data will only be shared with third parties where necessary for processing your request (e.g., payment or IT service providers).

Legal basis: Article 6 (1) (b) GDPR (Performance of a contract)

For general inquiries: Article 6 (1) (f) GDPR (Legitimate interest in customer communication)

c) Registration requirement

Under § 29 of the German Federal Registration Act (BMG), we are legally required to record certain guest information upon arrival (e.g., name, address, date of birth, nationality, travel dates).

These data are processed solely to fulfil legal obligations and are deleted after the legally required retention period.

Legal basis: Article 6 (1) (c) GDPR (Legal obligation)

d) Server log files

The provider of this website automatically collects and stores information in so-called server log files that your browser automatically transmits to us. This includes:

These data cannot be assigned to specific individuals. A combination of this data with other data sources does not take place.

The collection of these data serves to ensure a secure and error-free operation of the website.

Legal basis: Article 6 (1) (f) GDPR (Legitimate interest in secure website operation)

  • Browser type and version
  • Operating system used
  • Referrer URL
  • Hostname of the accessing computer
  • Time of the server request

4. Transfer of data to third parties

Personal data will only be transferred to third parties if:

• it is necessary to fulfil a contract,

• there is a legal obligation, or

• you have given your explicit consent.

Examples:

  • Transmission to booking portals for online reservations
  • Tax advisors or authorities within the framework of legal requirements

5. Data processing by third parties (processors)

If we engage external service providers (e.g., IT or web hosting providers), we have concluded data processing agreements with them in accordance with Article 28 GDPR.

Our hosting provider processes data exclusively on our behalf and according to our instructions.

6. Cookies

Our website may use cookies. Cookies do not harm your computer and do not contain viruses. They help make our services more user-friendly, efficient, and secure.

You can configure your browser to inform you when cookies are set, to allow cookies only in specific cases, or to automatically delete them after closing the browser.

Legal basis: Article 6 (1) (f) GDPR (Legitimate interest in user-friendly website design)

7. Your rights

State Commissioner for Data Protection of Lower Saxony (LfD Niedersachsen)

Prinzenstraße 5, 30159 Hannover

www.lfd.niedersachsen.de

You have the right at any time to:

If you have given consent to data processing, you may withdraw it at any time with effect for the future.

You also have the right to lodge a complaint with a data protection supervisory authority.

Supervisory authority responsible for Lower Saxony:

  • Request information about your stored data (Art. 15 GDPR)
  • Request correction of inaccurate data (Art. 16 GDPR)
  • Request deletion of your data (Art. 17 GDPR)
  • Request restriction of processing (Art. 18 GDPR)
  • Request data portability (Art. 20 GDPR)
  • Object to specific types of processing (Art. 21 GDPR)

8. Data security

We implement appropriate technical and organizational measures to protect your data against unauthorized access, loss, or misuse.

Our security measures are regularly reviewed and adapted in line with technological developments.

9. Changes to this Privacy Policy

We reserve the right to amend this Privacy Policy at any time to comply with current legal requirements or to reflect technical changes.

The latest version is always available on our website.

Last updated: December 2025

Scroll to Top