Which data arises when you visit this website, who receives it and what rights you have.
This is a translation for your convenience. The German version is the legally binding one.
Hotel Tusculum
Owner: Holger Möller
Gutenbergstrasse 25
35037 Marburg, Germany
Phone: +49 6421 22778
Email: info@tusculum.de
The controller is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data.
We take the protection of your personal data seriously and treat it confidentially and in accordance with the law. Please note that data transmission over the internet – for example when communicating by email – can have security gaps. Complete protection of data against access by third parties is not possible.
Where you have given consent, we process your data on the basis of Art. 6(1)(a) GDPR, and for the storage of cookies or access to information on your device additionally on the basis of section 25(1) TDDDG. Where you have expressly consented to a transfer to third countries, we additionally rely on Art. 49(1)(a) GDPR. Where your data is needed to perform a contract or for pre-contractual measures, we rely on Art. 6(1)(b) GDPR; for legal obligations on Art. 6(1)(c) GDPR; otherwise on our legitimate interest under Art. 6(1)(f) GDPR. Which basis applies in a particular case is stated in the relevant section.
Unless a more specific period is stated here, your personal data remains with us until the purpose of the processing no longer applies. If you make a legitimate request for deletion or withdraw your consent, your data will be deleted unless statutory retention periods prevent this; in that case deletion follows once they expire.
Some of the services named below may transfer data to the USA or other countries outside the EU. There, a level of data protection comparable to the EU cannot be guaranteed; in particular, authorities may under certain circumstances access data without you having an effective legal remedy against it. We have no influence on this processing. Embedded content from such providers is only loaded after you have given your consent or clicked on it. With payment services and WhatsApp, a transfer takes place when you use these services yourself; the respective basis is stated in the relevant section.
We work with external parties and only pass on personal data where this is necessary to perform a contract, where we are legally obliged to do so (for example towards tax authorities), where we have a legitimate interest under Art. 6(1)(f) GDPR or where another legal basis permits it. We only pass data to processors on the basis of a data processing agreement. Data is not passed on to third parties for advertising purposes.
This site uses SSL or TLS encryption throughout. You can tell by the “https://” in the address bar and the padlock symbol in your browser. What you send us therefore cannot be read by third parties.
We hereby object to the use of the contact details published in the legal notice for sending advertising that has not been expressly requested. We expressly reserve the right to take legal action in the event of unsolicited advertising.
This website is hosted by IONOS SE, Elgendorfer Strasse 57, 56410 Montabaur, Germany. The servers are located in Germany. IONOS processes the data arising when these pages are called up on our behalf. The legal basis is our legitimate interest in providing the website securely and reliably (Art. 6(1)(f) GDPR). A data processing agreement under Art. 28 GDPR is in place with IONOS.
When the website is called up, data is automatically stored in log files: the address requested, date and time, amount of data transferred, notification of successful retrieval, browser type and version, operating system, the page visited before, the host name of the accessing computer and the IP address. This data is not merged with other data sources and serves solely the operation and security of the website. The legal basis is our legitimate interest in presenting the website without technical errors (Art. 6(1)(f) GDPR).
The statistics function IONOS WebAnalytics of IONOS SE (address above) runs on our web space. It evaluates how many pages are viewed, how long visits last, which pages visitors come from, roughly where they access the site from and with which browser, operating system and device type. For this purpose, in particular the page visited before, the page or file requested, browser type and version, operating system, device type, time of access and the IP address in anonymised form are processed; the IP address is only used to determine the approximate location of access. According to IONOS, the evaluation is fully anonymised so that it cannot be traced back to any individual. No cookies are set and nothing is stored on your device.
The legal basis is our legitimate interest in statistical evaluation in order to improve our website (Art. 6(1)(f) GDPR). This processing is covered by the data processing agreement with IONOS. Further information: ionos.de/terms-gtc/datenschutzerklaerung.
This website itself does not set any cookies when it is called up. Cookies – small packets of data stored on your device – may, however, be set by embedded services once you allow or use them (third-party cookies), for example when paying. They do no harm on your device. Session cookies are deleted automatically after your visit; permanent cookies remain until you delete them or your browser does it for you. Your browser’s local storage works in a similar way; your consent decision, for example, is kept there (see section 5).
We store technically necessary cookies on the basis of our legitimate interest in providing the site without errors (Art. 6(1)(f) GDPR). All other cookies are stored only with your consent (Art. 6(1)(a) GDPR, section 25(1) TDDDG), which you can withdraw at any time. You can also set your browser to accept cookies only in individual cases or not at all; the functionality of this website may then be limited.
To manage your consent we use the consent technology of CCM19. The
provider is Papoo Software & Media GmbH, Auguststrasse 4, 53229 Bonn, Germany. When
the page is called up, a script is loaded from cloud.ccm19.de.
The following data is transmitted to CCM19: your consent or its withdrawal,
your IP address, information about your browser and device, and the time of your visit.
Your decision is kept in your browser’s local storage (entry ccm_consent)
so that it can be recognised on your next visit. It stays there until you change it,
clear your browser storage or the purpose no longer applies. The legal basis is our legal obligation to be able to demonstrate consent
(Art. 6(1)(c) GDPR). A data processing agreement is in place with Papoo Software
& Media GmbH.
If you contact us by email or telephone, we process your details in order to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where the enquiry relates to a contract, otherwise our legitimate interest in answering it (Art. 6(1)(f) GDPR). We delete the data as soon as it is no longer needed and no statutory retention obligations prevent this.
To communicate with guests and other contacts we use, among other things, WhatsApp Business. The provider is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. WhatsApp is not embedded on this website, so no data is transmitted to WhatsApp unless you write to us via WhatsApp yourself.
Messages are end-to-end encrypted, so WhatsApp cannot read their content. WhatsApp does, however, receive metadata arising from the communication, such as sender, recipient and time, and according to its own statement shares personal data with its parent company Meta in the USA. WhatsApp bases transfers to the USA on the standard contractual clauses of the European Commission (whatsapp.com/legal/business-data-transfer-addendum); the company is also certified under the EU-U.S. Data Privacy Framework. Further information: whatsapp.com/legal.
Our WhatsApp account is set up so that no automatic synchronisation with the address book of the smartphones in use takes place. Processing on our behalf is governed by the WhatsApp Business data processing terms. The legal basis is our legitimate interest in quick and simple communication (Art. 6(1)(f) GDPR); where we ask for consent, solely that consent (Art. 6(1)(a) GDPR), which you can withdraw at any time. Messages remain with us until you request deletion, withdraw your consent or the purpose no longer applies; statutory retention periods remain unaffected.
For room enquiries and bookings we use the hotel system igumbi. Both of them –
the enquiry form and the booking process – open in a layer on top of this
page. They are components provided by igumbi that load into our page; you stay on
tusculum.de while using them. Neither is loaded until you click on it, not
already when the page is opened. So if you neither enquire nor book, no contact with
igumbi takes place at all.
The booking bar on the home page is a third route: if you choose arrival and
departure there and submit the search, igumbi’s booking page
(tusculum.igumbi.com) opens in a new window. The dates you selected and
your IP address are transmitted to igumbi in the process.
When they open, scripts are loaded from www.igumbi.net and the images of
the room categories from s3.amazonaws.com (Amazon Web Services); your IP
address is transmitted to these providers in the process.
What is transmitted is what you enter yourself: for an enquiry your travel dates, room category and number of people, plus form of address, name, email address, telephone number, postal address and your remarks; for a booking additionally the details required for the contract and the payment. We then handle the enquiry like any other contact. The legal basis is Art. 6(1)(b) GDPR.
The provider is igumbi (igumbi.com), based in Vienna, Austria. The
processing therefore takes place within the European Union; no transfer to a third
country is involved.
Payments in connection with a booking are handled through the payment service Stripe. For customers within the EU the provider is Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Stripe processes the data required for the payment, such as name, amount and means of payment.
Since the booking process is embedded in our page (see section 8), you enter your
payment details in a form displayed on tusculum.de. The input fields for
the card details are provided by Stripe itself (“Stripe Elements”). Your full card
number is transmitted to Stripe only; neither we nor the hotel system igumbi
receive it. What is passed on to igumbi is only the last four digits, the card brand,
the expiry date, the cardholder’s name and an identifier for the payment issued by
Stripe. The legal basis is the performance of the contract under Art. 6(1)(b) GDPR and
our legitimate interest in a secure payment process (Art. 6(1)(f) GDPR). Stripe’s own
privacy terms apply in addition:
stripe.com/privacy.
Where data is transferred to the USA, Stripe relies on the standard contractual clauses
of the European Commission.
In addition to credit cards, Stripe offers further payment methods during checkout. If you choose one of them, the respective provider receives the data it needs directly from you or from Stripe, for example because you log in or confirm your payment there. That provider’s terms then apply in addition. The legal basis is Art. 6(1)(b) GDPR; where a provider asks for consent for individual steps, Art. 6(1)(a) GDPR.
In the section “What our guests say” we embed reviews from review portals. Content is loaded from the following servers, and your IP address is transmitted to the respective provider:
apps.elfsight.com,
core.service.elfsight.com, service-reviews-ultimate.elfsight.com,
static.elfsight.com, universe-static.elfsightcdn.comapps.expediapartnercentral.comwww.jscache.com, www.tripadvisor.de,
static.tacdn.comThis content is only loaded once you have given your consent. The legal basis is your consent under Art. 6(1)(a) GDPR. You can withdraw it at any time via the privacy settings.
The figure “4.4 from 244 Google reviews” is fetched from Google once a day by our server and stored as a small file on this website. Your browser does not contact Google; it loads the figure from our own server. No data about you is therefore transmitted to Google, and no consent is required for this.
On the home page we show a Google Maps map on request. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The map is not loaded when the page is opened, only when you click on the placeholder. Until then there is no connection to Google.
When you click, the map is loaded from www.google.com. Your IP address
is transmitted to Google and usually stored on a server in the USA; Google may also set
cookies and load its own fonts. We have no influence on this processing. The legal
basis is the consent you give by clicking (Art. 6(1)(a) GDPR, section 25(1) TDDDG); it
applies to this page visit.
Google bases transfers to the USA on the standard contractual clauses of the European Commission (privacy.google.com/businesses/gdprcontrollerterms/sccs); Google is also certified under the EU-U.S. Data Privacy Framework. Further information: policies.google.com/privacy.
On the “Parking” page we show the current occupancy figures for Marburg’s car parks.
The display is loaded from pls.marburg.de, a service of the University Town
of Marburg and Stadtwerke Marburg. Your IP address is transmitted there in the process.
The content is only loaded once you have given your consent (Art. 6(1)(a) GDPR).
The button at the bottom of the screen takes you to a chat assistant. It is operated
at workflow.zollhaus-ki.de; the server is run by Hetzner Online
GmbH, Industriestrasse 25, 91710 Gunzenhausen, in Germany. You are writing to an automated system there,
not to a person. When you open and use the chat, your messages are transmitted there in
order to answer your question; IP address, time and the course of the conversation may
also be recorded. The legal basis is Art. 6(1)(b) GDPR where it concerns initiating or
handling a booking, and otherwise your consent given by opening the chat
(Art. 6(1)(a) GDPR).
The answers are generated in the background by an AI language model (GPT-4o) which we use via Microsoft Azure. It runs in European data centres; your chat input does not leave the European Union. The messages are passed to this model so that it can answer your question. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland; the regions used are Germany West Central and Sweden Central.
The chat assistant analyses the content of your message in order to generate an answer on its own; everything you enter is processed. Your input is not used for advertising or to create user profiles. Data processing agreements are in place with Microsoft and Hetzner.
When you call us, your call may be answered by an AI-supported voice assistant (“Lena”). You are then speaking to an automated application, not to a person. The service is provided by VoiceMind, a brand of MAWI Software Solutions Matthias Wittstock, Eisenbergerstrasse 22a, 83324 Ruhpolding, Germany (office: Cosimastrasse 121, 81925 Munich). At the beginning of the call we point this out: “This call is processed with AI support.”
What is processed is your spoken input (converted into text in real time), the content of the conversation including details you give such as name, telephone number, your request or a desired appointment, and technical connection data such as telephone number, time and duration of the call. The purpose is the automated handling of your request, in particular arranging appointments and giving simple information.
Where the data is required to arrange or carry out an appointment, the legal basis is Art. 6(1)(b) GDPR. The call is recorded and transcribed only with your consent under Art. 6(1)(a) GDPR. If you do not want this, please hang up and use another way of contacting us, for example email. Transcripts are stored for a maximum of 30 days and then deleted automatically, unless longer statutory retention periods or a documented dispute prevent this. You can withdraw your consent at any time with effect for the future.
The fonts used on this website are held on our own server. There is no connection to Google Fonts or any other font service, so no data is transmitted there either.
You have the right to free information about the data stored about you, its origin, its recipients and the purpose of the processing (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18) and to data portability (Art. 20): data we process automatically on the basis of your consent or a contract will be provided to you on request in a common, machine-readable format, and on request directly to another controller where technically feasible. Simply write to info@tusculum.de.
Many processing operations are only possible with your express consent. You can withdraw consent you have given at any time with effect for the future. The lawfulness of the processing carried out until then remains unaffected.
Where processing is based on Art. 6(1)(e) or (f) GDPR, you have the right at any time to object to the processing of your personal data on grounds relating to your particular situation; this also applies to profiling based on those provisions. If you object, we will no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.
If your data is processed for direct marketing, you have the right to object to that processing at any time; your data will then no longer be used for that purpose.
You can request the restriction of processing if you dispute the accuracy of your data and we are checking it, if the processing is unlawful and you want restriction instead of erasure, if we no longer need the data but you need it for legal claims, or for as long as the balancing of interests following an objection is still pending. Apart from being stored, restricted data may only be processed with your consent or for legal claims.
You have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your residence, your place of work or the place of the alleged infringement. The authority responsible for us is:
Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
(Hessian Commissioner for Data Protection and Freedom of Information)
Postfach 3163
65021 Wiesbaden, Germany
Version: 16 September 2026