Privacy Policy

1. Scope

This Privacy Policy explains how personal data is processed when you visit the website en-hospitality.com (includingwww.en-hospitality.com) and use the functions offered there. "Personal data" means any information relating to an identified or identifiable natural person.

The website is operated for audiences in the European Union — including Germany — and in Japan. Processing is carried out in accordance with the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (Bundesdatenschutzgesetz — BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG), and, where applicable, Japan's Act on the Protection of Personal Information (APPI). Section 21 contains additional information for data subjects in Japan.

2. Controller

The controller responsible for data processing on this website is:

Apex Reach Media
Sole proprietorship (Einzelunternehmen), owner Lars Hartog
Haselweg 7c
48703 Stadtlohn
Germany
Telephone: +49 163 1720322
Email: hello@en-hospitality.com

"EN." is a brand of Apex Reach Media. Further provider information is set out in our Legal Notice.

3. Data Protection Officer

We are not required to appoint a Data Protection Officer under § 38 BDSG and have not appointed one. Please address all data protection enquiries to the controller named in Section 2.

4. Your rights

As a data subject you have the following rights under the GDPR:

• Access (Art. 15 GDPR) — to obtain confirmation of whether we process data about you and, if so, a copy of that data.
• Rectification (Art. 16 GDPR) — to have inaccurate data corrected and incomplete data completed.
• Erasure (Art. 17 GDPR) — to have your data deleted where one of the grounds in Art. 17 applies.
• Restriction of processing (Art. 18 GDPR).
• Data portability (Art. 20 GDPR) — to receive data you provided in a structured, commonly used, machine-readable format.
• Objection (Art. 21 GDPR) — see the highlighted notice below.
• Withdrawal of consent (Art. 7 (3) GDPR) — where processing is based on consent, you may withdraw it at any time with effect for the future.
• Complaint to a supervisory authority (Art. 77 GDPR) — see Section 4.2.

To exercise these rights, contact us using the details in Section 2. We respond without undue delay and in any event within one month.

4.1 Right to object (Art. 21 GDPR)

Where we process your personal data on the basis of our legitimate interests (Art. 6 (1) (f) GDPR), you have the right to object at any time, on grounds relating to your particular situation, to that processing. If you object, we will no longer process the personal data concerned unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

4.2 Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement. The authority competent for the controller is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestraße 2–4, 40213 Düsseldorf, Germany
www.ldi.nrw.de

5. Legal bases for processing

Depending on the situation, we rely on the following legal bases:

• Art. 6 (1) (a) GDPR — your consent (e.g. for non-essential cookies).
• Art. 6 (1) (b) GDPR — performance of a contract or steps taken at your request prior to entering into a contract (e.g. handling an enquiry about our services).
• Art. 6 (1) (c) GDPR — compliance with a legal obligation (e.g. statutory retention periods).
• Art. 6 (1) (f) GDPR — our legitimate interests or those of a third party (e.g. secure and stable operation of the website, protection against abuse), provided your interests do not override them.

Where personal data is stored on, or read from, your device (e.g. via cookies or local storage) and this is not strictly necessary, we obtain your consent under § 25 (1) TDDDG in conjunction with Art. 6 (1) (a) GDPR. Storage or access that is strictly necessary to provide a service you have expressly requested is based on § 25 (2) no. 2 TDDDG.

6. Hosting and server log files

This website is hosted on Firebase Hosting, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"), with Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA acting as a sub-processor.

When you access the site, your browser automatically transmits data that is stored by the hosting infrastructure in server log files, in particular:

• your IP address (abbreviated or in full, as applicable);
• date and time of the request;
• the page or file requested and the amount of data transferred;
• HTTP status code;
• the referring URL;
• browser type and version, operating system and language.

This processing is based on Art. 6 (1) (f) GDPR. Our legitimate interest is the secure, stable and functional provision of the website, the analysis of system security and stability, and defence against attacks. Log data is not merged with other data sources.

A data processing agreement pursuant to Art. 28 GDPR is in place with Google in the form of the Google Cloud / Firebase Data Processing Addendum, which applies to our account. Google's processing of data in the USA is addressed in Section 15.

7. Fonts

This website uses the "Hanken Grotesk" and "Instrument Serif" typefaces (open-source, SIL Open Font License). The font files arehosted on our own server and loaded directly from it. No connection to Google servers or other third parties is established for the purpose of displaying fonts, and no personal data is transmitted to third parties in this context.

8. Cookies, local storage and consent

A cookie is a small text file stored by your browser; "local storage" is a similar browser mechanism. We distinguish:

• Strictly necessary storage. When you make a choice in our cookie banner, we store that choice in your browser's local storage (keyen_cookie_consent) so that we do not ask you again on every visit. This entry contains only your consent settings, a version number and a timestamp. It is stored on the basis of § 25 (2) no. 2 TDDDG and Art. 6 (1) (f) GDPR (documenting and honouring your choice) and is not transmitted to any third party.
• Non-essential cookies and technologies. The website currently uses no analytics, tracking, advertising or other non-essential cookies. Our consent tool provides "functional", "analytics" and "marketing" categories for the future; all of them are switched off by default and are only activated after you give your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). You can withdraw your consent at any time with effect for the future via the"Cookie settings" link in the footer.

You can also configure your browser to refuse or delete cookies. Disabling strictly necessary storage may mean the consent banner reappears on every visit.

9. Contact form

If you use the contact form, we process the data you enter: yourname, your email address and yourmessage. Providing a name and email address is required in order for us to respond; the message field is optional.

Purpose: to receive and respond to your enquiry.
Legal basis: Art. 6 (1) (b) GDPR where your enquiry relates to a contract or pre-contractual measures; otherwise Art. 6 (1) (f) GDPR (our legitimate interest in responding to enquiries). A hidden anti-spam field ("honeypot") is used to filter out automated submissions on the basis of Art. 6 (1) (f) GDPR.

Processor: form submissions are transmitted and delivered to us by email through Web3Forms, a service operated by[Web3Forms operating entity and address]("Web3Forms"). Web3Forms receives the form fields, forwards them to our mailbox and does not use them for its own purposes. Web3Forms operates from the United States; see Section 15. [Confirm that a data processing agreement pursuant to Art. 28 GDPR has been concluded with Web3Forms.]

Email delivery and storage: the resulting email is delivered to our mailbox at hello@en-hospitality.com, which is operated via Google Workspace (Google Ireland Limited / Google LLC).

Retention: we store your enquiry and our correspondence for up to 6 months after it has been dealt with, and then delete it, unless statutory retention obligations (e.g. under commercial or tax law, generally 6 or 10 years) require longer storage or the data is needed to establish, exercise or defend legal claims.

10. Contact by email

If you contact us directly by email, we process the data contained in your message (including name, email address and any further information you provide) in order to handle your request. The legal basis is Art. 6 (1) (b) GDPR for contract-related enquiries and otherwise Art. 6 (1) (f) GDPR. The same retention principles as in Section 9 apply.

11. External links and social media

Our website contains plain hyperlinks to external services, in particular our profile on Instagram and a reference toLinkedIn. These are ordinary links —no social media plug-ins, pixels or embedded content are loaded. No data is transmitted to the operators of those platforms until you actively click a link and leave our site. Once you do, the privacy policy of the respective provider applies:

• Instagram / Meta Platforms Ireland Limited — privacycenter.instagram.com/policy
• LinkedIn Ireland Unlimited Company — linkedin.com/legal/privacy-policy

12. Newsletter

[A newsletter is described on the site but is not yet active. Before launching it, add: the email service provider used, the double opt-in procedure, the legal basis (Art. 6 (1) (a) GDPR), logging of the opt-in, the right to unsubscribe at any time, and any success/open measurement.]

13. Events

[EN. Social organises gatherings. If registration, guest lists, photography at events or waiting lists involve personal data, describe here what is collected, the purpose, the legal basis and the retention period. Until an events registration process is live on the website, no such data is processed through this site.]

14. Recipients of personal data

Personal data may be disclosed to the following categories of recipients:

• our hosting provider (Google — Firebase Hosting);
• our form and email infrastructure providers (Web3Forms; Google Workspace);
• IT service providers acting as processors on our behalf, where engaged;
• public authorities and courts, where we are legally obliged to disclose data;
• advisors (e.g. lawyers, tax advisors) where necessary to establish, exercise or defend legal claims.

We do not sell personal data and do not use it for third-party advertising.

15. Transfers to third countries

Some of the providers named above process personal data in theUnited States or grant access from there:

• Google LLC (Firebase Hosting, Google Workspace) is certified under the EU–U.S. Data Privacy Framework (DPF), which the European Commission recognises (adequacy decision of 10 July 2023) as providing an adequate level of protection. In addition, EU Standard Contractual Clauses are agreed.
• Web3Forms processes data in the United States.[State the transfer mechanism: DPF certification if available, otherwise EU Standard Contractual Clauses pursuant to Art. 46 (2) (c) GDPR, plus supplementary measures.]

Where a transfer is not covered by an adequacy decision, it is based on Standard Contractual Clauses (Art. 46 (2) (c) GDPR). You may request a copy of the relevant safeguards from us using the contact details in Section 2.

16. Storage duration

We store personal data only for as long as necessary for the purposes described, or as required by statutory retention periods (under German commercial and tax law, generally 6 or 10 years). Server log data is retained only for a short period for security purposes and then deleted or anonymised. Consent settings remain in your browser until you change or delete them.

17. Data security

This website is delivered exclusively over an encryptedTLS/HTTPS connection. We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss and manipulation, and review these measures regularly.

18. Automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

19. Obligation to provide data

You are under no statutory or contractual obligation to provide personal data. However, we cannot respond to an enquiry without at least a name and a way to reach you.

20. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes to our processing activities or to the legal framework. The current version is always available on this page; the date at the top indicates when it was last revised.

21. Additional information for data subjects in Japan (APPI)

Where we handle personal information of individuals in Japan, we do so in accordance with the Act on the Protection of Personal Information (APPI). The following supplements the sections above:

• Business operator (personal information handling business operator): Apex Reach Media (sole proprietorship, owner Lars Hartog), Haselweg 7c, 48703 Stadtlohn, Germany. Contact for personal information matters:hello@en-hospitality.com.
• Purpose of use: to operate the website securely, to respond to enquiries you send us, and to provide and administer the services and events described on the site. We do not use personal information beyond the scope necessary to achieve these purposes without your consent.
• Provision to third parties: we provide personal information to the processors named in Sections 9 and 14 for the purposes described. We do not otherwise provide personal information to third parties without your consent, except where permitted or required by law.
• Cross-border transfer: your personal information is processed in the European Union and may be processed in the United States by the providers named in Section 15. Information about the data protection systems of those countries and the measures taken is available from us on request.
• Security control measures: we take organisational, human, physical and technical security control measures, including encrypted transmission (TLS) and access controls. Further details are available on request.
• Your requests: you may request disclosure, correction, addition, deletion, suspension of use or suspension of provision to third parties of your retained personal data, and disclosure of records of third-party provision. Contact us at the address above; we will respond within a reasonable period after verifying your identity.
• Complaints: if your concern is not resolved, you may contact the Personal Information Protection Commission of Japan (PPC),ppc.go.jp/en.