Privacy policy

Email: kontakt@hotels-an-der-messe.de

The controller has no establishment in the European Union. The following has been designated as representative under Article 27 GDPR:

Data subjects and supervisory authorities can contact this representative in addition to the controller.

Without your consent, Hotels an der Messe sets no statistics or advertising cookies and loads nothing from third-party statistics or advertising services; we do not embed third-party font services at all. Only if you consent in the banner do we use Google Analytics and Google Ads (more under “Google Analytics and Google Ads”); we store your choice itself in a cookie. Only the map in our hotel search is loaded by your browser from third parties: the MapLibre map library from unpkg.com, and the map images including labels from OpenFreeMap (more under “Hotels, hotel photos and prices for your dates”). We count visits ourselves, without an identifier in your browser. If you click on an offer, you go to the provider; from then on, their privacy policy applies.

As with every visit to a website, your browser transmits technical details that arise during operation: IP address, date and time, the address requested, the amount of data transferred, and browser and operating system details. They are used to deliver the site and to detect faults and attacks.

The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR). These details are not combined with other data. They are created as logs at our host and are deleted there automatically, after 30 days at the latest.

We count how often our pages are viewed. Nothing is stored on your device for this and nothing is read from it — no cookie, no browser storage, no counting script. That is why we do not ask for your consent for it: § 25(1) TDDDG concerns precisely the storing of information on, and the reading of it from, end devices, and neither happens here.

Only what your browser sends anyway when you visit is evaluated: the address requested, the page you came from (only its domain, never the full address), the browser identifier, the preferred language and your IP address. From the IP address, our host Vercel determines country, region and city before the request reaches us; we adopt these details but do not query a location service of our own. If you arrive via a tagged link (for example from an ad), we store the campaign details from the address (utm parameters) and the name of the ad network whose click identifier was in it — but not the click identifier itself.

We do not store the IP address. Together with the browser identifier and a random value that changes daily, it is converted into an identifier. This makes it possible to recognise that two visits on the same day belong together — nothing more. After two days, we delete the random value and the identifier and cut the time down to the full hour; after 180 days, the rows are deleted completely. We count location only as a daily total (day, country, city, number), separately from all other details.

The legal basis is our legitimate interest in knowing whether and from where visitors come (Art. 6(1)(f) GDPR). We do not use any third-party tool for this, and the figures are kept in our database in Frankfurt am Main.

If you consent in the banner, we use Google Analytics 4 (statistics) and Google Ads conversion tracking (advertising). You choose each one separately. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Before you consent, nothing loads from Google and nothing is stored on your device for it. Hotels an der Messe is measured in its own Analytics property, separate from other websites.

Why: With “Statistics” we see which pages are visited, for how long, where visitors come from (search engine, ad, link) and from which region. With “Advertising”, Google Ads measures whether a click on one of our ads led to a visit and to a click through to one of our partners. We do not use personalised advertising (remarketing), and Google Signals — the link to Google accounts — is switched off.

Which data: a random identifier in a cookie, pages viewed and the times of viewing, and the page you came from (in each case only the path of the address, without search details such as destination, travel dates, number of guests or search terms — we remove these before the measurement leaves your device), campaign details and the click identifier of an ad, clicks through to partners (only the partner’s name and domain, not the address of the offer), device, browser, language and the approximate location that Google derives from the IP address. According to Google, Google Analytics 4 does not store IP addresses.

Cookies: _ga and _ga_… (statistics, up to two years), _gcl_… (advertising, up to 90 days). We store your choice itself for six months in the cookie einwilligung; after that, we ask again.

The legal basis is your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future: Cookie settings, also at the bottom of every page. When you withdraw it, we delete the Google cookies in your browser.

USA: Google may transfer data to Google LLC in the USA. Google is certified under the EU-US Data Privacy Framework, for which the European Commission determined an adequate level of protection on 10 July 2023 (Art. 45 GDPR). Google processes the data as a processor under the Google Ads Data Processing Terms.

Retention at Google: Google Analytics deletes event data after 14 months at the latest. More from Google: policies.google.com/privacy.

The hotels on this site come from Google's hotel search (Google Ireland Limited, Ireland). Our server queries it itself at regular intervals (roughly every one to two weeks); nothing about you is sent to Google in the process. The locations of the exhibition entrances, stops and stations come from OpenStreetMap; your browser doesn't connect to anyone for those either.

Hotel photos. The photos of the hotels (from Google's hotel search) are served by our own server. Your browser doesn't connect to Google for them, and Google learns neither your IP address nor which photo you viewed.

Prices for your dates. The button on each hotel opens our hotel search with that hotel and the dates of a trade fair. What the hotel search requests and from whom is described below under “The hotel search”.

Photos of the cities. The photos of the trade fair cities and alternative bases (from Wikimedia Commons) are served by our own server, in our own crops. Your browser doesn't connect to Wikimedia for them.

Calendar files. “Add to calendar” saves a file that is already part of the page. Your browser doesn't ask anyone for it – neither us nor others.

Trade fair premium. If you tap “Check the trade fair premium” on a hotel, your browser sends the identifiers of the hotel and the trade fair to our server. It works out the travel dates itself and asks Google's hotel search about two date ranges – like the hotel search, via our server, without any personal information about you. We don't store the result.

The hotel search. In our hotel search you can find accommodation and prices for any destination. Your search — destination, arrival and departure, the number of adults, the ages of children travelling with you, the number of rooms, and filters and sorting — goes to our server. With it, the server asks the Google hotel search for accommodation, prices, photos and reviews, and checks for each property in the offer comparison of the Google hotel search which of our partners offers it for your travel dates; only as a fallback, if Google does not respond, does it ask SerpApi (SerpApi, LLC, USA). These requests go through our server: the providers see neither your IP address nor anything else about you. We answer identical requests from a cache for a while, the same for all visitors; we store nothing about you in the process. Photos and the providers’ logos are also delivered by our own server here. The hotel search stores nothing on your device — no saved list, no recently searched destinations.

Suggestions in the “Destination” field. When you type there, what you type goes to our server from the second letter onwards. The server looks for matching places on Google Maps and for accommodation in our own hotel directory; here, too, Google learns nothing about you.

The hotel search map. On a large screen it sits next to the list; on a phone it appears when you tap “Map”. For this, your browser loads the MapLibre map library from unpkg.com and the map images, including the font of their labels, from OpenFreeMap (tiles.openfreemap.org). Both services learn your IP address and which part of the map you are looking at, as with any retrieval of a file from the internet. No cookies are set for this, and we pass nothing on to them. Where the properties are on the map comes from our server.

So that nobody triggers the queries en masse, our server counts how often requests come from the same IP address. The counter is held only in the server's memory, lasts one minute and is not stored anywhere.

The legal basis is our legitimate interest in being able to show you hotels and prices for your travel dates, including their location on the map (Art. 6(1)(f) GDPR).

If you click on an offer, you leave Hotels an der Messe and arrive at the provider concerned — often first at a partner network that counts the click and forwards you. In the process, an identifier is passed on that only says that the click came from this site, so that the provider can attribute a booking to our recommendation; this is how our commission arises. It contains nothing about you as a person. This only happens when you click yourself; before that, this site loads nothing from providers or networks.

From the click onwards, the network and the provider are responsible for the processing; their privacy policies apply. They decide for themselves which data they collect and whether they set cookies. We count the click itself (day, page, provider), without any details about you. If you have consented in the banner, the click also goes to Google Analytics, only with the partner’s name (see “Google Analytics and Google Ads”).

If you write to us using the contact form or by email, your name, your email address, the subject and your text go to our inbox. We use them only to reply to you and do not pass them on to anyone. The basis is our legitimate interest in being reachable (Art. 6(1)(f) GDPR).

So that the form is not flooded by machines, our server briefly checks, when you send it, how often messages have been sent from the same origin. For this, your IP address is immediately converted into a hash value; the plain text is not stored, and the hash value is kept only in working memory and is gone after one hour at the latest. We keep the message itself until the matter has been dealt with, for three years at most.

With the switch at the top of every page, you choose a light or a dark appearance. We do not store this choice — neither as a cookie nor in your browser’s storage, and it is not transmitted to us either. It applies until you reload the page; after that, the appearance follows your device’s setting again.

The font in the logo is on our own server. Your browser loads it from there, not from Google Fonts or any other service. All other text on the site is shown in your device’s font.

We do not run the site on our own computers. These service providers process data exclusively on our behalf and according to our instructions:

• Vercel — operation of the website. The pages and interfaces run in the Frankfurt am Main region.
• Neon — the database that holds the visit counts. Location: Frankfurt am Main.
• united-domains — our email inbox, that is, everything you write to us.

Vercel and Neon are companies based in the USA; access from there cannot be technically ruled out. The basis for this is the European Commission’s adequacy decision on the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.

The controller is based in Georgia. There is no adequacy decision of the European Commission for Georgia. The operation of the site and the database, on the other hand, are located in the European Union (Frankfurt am Main). We access them from Georgia only to operate the site and to answer your enquiries. What goes to Google, and possibly to the USA, with your consent is set out under “Google Analytics and Google Ads”.

You have the right of access, rectification, erasure, restriction of processing and data portability, and the right to object to processing based on a legitimate interest. An informal message to the address given above is enough; we reply within one month.

You can also complain to a data protection supervisory authority — as a rule, the authority where you live or the authority at the seat of our EU representative.