PAYBACK - privacy notice

1. Joint Control

For certain data processing tasks related to your membership of the PAYBACK programme, the PAYBACK Rabattverein e.V., PAYBACK GmbH and H-Hotels GmbH (hereinafter referred to as H-Hotels) are joint controllers. Where this is the case, they have specified in arrangements which of them fulfils which data protection obligations. The key details of these arrangements can be found here. You can find contact details for PAYBACK here. Processing carried out by PAYBACK is governed by PAYBACK's privacy policy.

2. PAYBACK at H-Hotels

2.1 Collecting PAYBACK Points

If you want to collect PAYBACK points, you can enter your PAYBACK customer number during the booking process on our website. When you settle your account during check-out, your PAYBACK customer number together with information about the hotel, booking, services provided and the sums on your account will be transmitted to PAYBACK GmbH.

If you did not book your room online or if you did not supply your PAYBACK customer number when booking, you can provide us with your customer number during check-out, so we can transmit the aforementioned data to PAYBACK GmbH.

Providing your customer number is voluntary, as is the transmission of the data to PAYBACK. However, both are necessary if you wish to collect PAYBACK points. The basis for this in law is Art. 6(1)(b) of the GDPR.

2.2 Redeeming PAYBACK Points

You also have the option, on checking out at reception, of redeeming your PAYBACK points for hotel services – either paying your entire bill or a portion thereof with your PAYBACK points (points can be redeemed at participating hotels).

In order to redeem your points, you need to authenticate for PAYBACK at the payment terminal. This data is shared between you and PAYBACK directly. The data is deleted from the terminal as soon as it has been transmitted to PAYBACK. H-Hotels has no access to either the data shared or to its processing by PAYBACK. Once the points have been redeemed, H-Hotels merely receives a report containing the card number, place and time of redemption, and the points and amount. The legal basis for this is Art. 6(1)(b) of the GDPR.

2.3 H-Hotels.com PAYBACK Card

2.3.1 Applying for a PAYBACK Card

You can apply for a PAYBACK card from H-Hotels.com by filling in the application form available at the hotel or by registering with PAYBACK online and selecting the H-Hotels partner card. You can either return the application form to PAYBACK by post or hand it to an H-Hotels employee for forwarding to PAYBACK.

2.3.2 Notifications from PAYBACK

If you apply for a PAYBACK card through H-Hotels.com, PAYBACK will share with us your basic data (name, date of birth and address), the scope of consent given by you, any information you provided voluntarily and, where applicable, any changes. If you have given your consent, PAYBACK will also provide us with additional information relating to your household. The legal basis for this is Art. 6(1)(a) and (b) of the GDPR.

2.4 Advertising and Market Research

If you have given PAYBACK your consent for advertising and market research, PAYBACK may use this data for advertising and market research for H-Hotels. H-Hotels selects the categories of recipients to whom the advertising is to be sent. The advertising measures themselves are executed exclusively by PAYBACK. PAYBACK alone has access to recipients’ data. H-Hotels is not given access to this data. H-Hotels only receives an anonymised analysis of the advertising campaign once the campaign has ended.

The legal basis for this data processing is the consent you have granted to PAYBACK (see Art. 6(1)(a) of the GDPR). You are free to withdraw your consent for advertising and market research at any time by either contacting the PAYBACK Service Centre or writing to PAYBACK GmbH, Postfach 23 21 02, 85330 Munich.

2.5 eCoupons

If you select an eCoupon from PAYBACK, only PAYBACK will process it. H-Hotels will not receive any personal data. H-Hotels will only receive an anonymised analysis after the transaction has been completed.

3. Data Processing

In order to operate the PAYBACK programme, and in particular for collecting and redeeming, H-Hotels uses data processors who are bound by contracts in accordance with Art. 28 of the GDPR and who may only process the data on behalf of and on the instruction of H-Hotels.