Privacy Policy – Hotel Skjern

Last updated: 11 November 2026

1. Data Controller

Hotel Skjern ApS is the data controller responsible for processing personal data in connection with hotel stays, reservations, events, our website, newsletters and other communications with our business.

Hotel Skjern ApS
Bredgade 58
6900 Skjern
Denmark
CVR no. (Danish company registration number): 36701129
Email: info@hotelskjern.dk
Website: www.hotelskjern.dk

2. What Personal Data Do We Process?

Depending on your interaction with us, we may process the following personal data:

  • Name, address, telephone number and email address.
  • Reservation details, dates of stay and room category.
  • Payment, invoicing and company information.
  • Correspondence relating to reservations, stays and enquiries.
  • Special requests, including dietary preferences and allergies.
  • Information relating to the use of our website and newsletters.
  • Access information for the hotel's electronic locking system.
  • CCTV recordings from monitored areas.

We only collect personal data that is relevant and necessary for the specific purpose.

3. Purposes and Legal Basis for Processing

We process personal data for the following purposes:

  • Managing reservations and providing hotel accommodation.
  • Communicating with guests before, during and after their stay.
  • Processing payments, invoices and accounting records.
  • Managing access to the hotel and guest rooms.
  • Responding to enquiries, complaints and requests.
  • Sending newsletters where valid consent has been obtained.
  • Protecting hotel premises, guests and employees.
  • Complying with legal obligations and establishing, exercising or defending legal claims.

Depending on the purpose, processing is based on Article 6(1)(b) of the General Data Protection Regulation (GDPR), performance of a contract; Article 6(1)(c), compliance with a legal obligation; Article 6(1)(f), legitimate interests; or Article 6(1)(a), consent.

If we exceptionally process health-related information, such as information about food allergies, we will only do so where an appropriate legal basis exists under applicable data protection legislation.

4. Reservations and Guest Administration

We use Octopus PMS to manage reservations, guest information, payments and hotel stays.

Reservations may be made directly with Hotel Skjern or through external booking platforms, including Booking.com, Expedia and Amadeus.

We use RoomCloud as an integration service for relevant reservations transferred from Amadeus to Octopus PMS.

When you book through an external booking platform, the booking provider may also process your personal data as an independent data controller in accordance with its own terms and privacy policy.

5. Retention of Reservation and Guest Information

Guest and reservation information in Octopus PMS is retained in accordance with our established deletion and anonymisation procedures.

We have configured Octopus PMS to automatically anonymise relevant guest information after 30 months.

Information required for accounting or other statutory purposes is retained in accordance with applicable legislation.

Personal data may be deleted or anonymised earlier when it is no longer necessary and there is no other lawful basis for continued retention.

Guests may contact us to request access to, correction of or deletion of their personal data.

6. Email Correspondence and Automatic Deletion

We use Microsoft 365 to manage email correspondence, including our shared mailbox info@hotelskjern.dk.

General email correspondence is retained only for as long as necessary for the purpose for which it was received or sent.

We have implemented an automatic deletion policy for our shared mailbox, under which emails are generally deleted once they are older than 60 months (5 years).

The deletion policy applies to the inbox, sent items and other email folders within the relevant mailbox.

Emails may be deleted earlier when the information is no longer required.

Where correspondence is necessary to document an ongoing dispute, complaint or legal claim, relevant information may be retained separately for a longer period where a lawful basis exists.

Invoices and accounting records are stored separately in our hotel management and accounting systems and are therefore not dependent on the retention period of our shared mailbox.

Automatic deletion in Microsoft 365 may be subject to technical processing periods and applicable statutory retention requirements.

7. Payments and Invoicing

We use relevant payment service providers and payment solutions to process payments.

Payment card details are generally processed by the payment service provider and are not stored as complete card details in our ordinary email system.

We use Netaxept for relevant payment processes.

For payments involving virtual credit cards, we receive an email containing a link to a secure service where the card details can be accessed. The link is time-limited and expires automatically. The actual card details are not included in the email. This reduces the security risk associated with retaining the email in our mailbox.

Invoices, payment records and accounting documents are retained in accordance with the Danish Bookkeeping Act, which generally requires records to be retained for five years from the end of the financial year to which they relate.

8. Electronic Access and Self Check-in

Hotel Skjern uses electronic access systems for guest rooms and shared entrance doors, including TTLock.

In connection with a stay, guests may receive their room number and an individual PIN code by email or SMS.

This information is used to manage access to the hotel and enable guests to use our self check-in facilities.

Any access logs are processed only to the extent necessary for operations, security and troubleshooting.

9. CCTV Surveillance

Hotel Skjern operates CCTV surveillance in selected areas for security purposes, crime prevention and the protection of guests, employees and property.

We use EZVIZ-based surveillance equipment.

Recordings are generally retained for no longer than 30 days and are subsequently deleted automatically.

Recordings may be retained for longer where necessary in connection with a specific incident, police investigation or legal claim.

CCTV surveillance is carried out in accordance with applicable legislation, and monitored areas are clearly signposted.

10. Newsletters and Marketing

We use Campaign Monitor to manage and distribute newsletters.

When you subscribe, we process your email address and any additional information you voluntarily provide.

Newsletters are sent on the basis of your consent, unless another lawful basis applies.

You may unsubscribe at any time using the unsubscribe link included in our newsletters.

Once you unsubscribe, we will stop sending marketing emails. We may retain the information necessary to record your unsubscribe request and ensure that you are not contacted again without a valid legal basis.

11. Website, Cookies and Analytics

Our website uses technical functions that are necessary for its operation.

We use or have integrated solutions for analytics and marketing, including Google Analytics, Google Ads and potentially Meta-related services.

The use of non-essential cookies and similar tracking technologies generally requires prior consent.

Information about the specific cookies used, their purposes, providers and retention periods must be provided in the website's cookie information.

You can manage or delete cookies through your browser settings.

12. Bookings Through External Platforms

When you make a reservation through Booking.com, Expedia, Amadeus or other external booking platforms, we receive the information necessary to process and fulfil your reservation.

This information is transferred to our reservation system and processed in accordance with this Privacy Policy.

External booking platforms may process personal data for their own purposes. We therefore also refer you to the privacy policy of the relevant booking platform.

13. Data Processors and Service Providers

We use external service providers for purposes including:

  • Hotel administration and reservation management.
  • Payment processing.
  • Email services and Microsoft 365.
  • Website hosting and operation.
  • Newsletters and communications.
  • Electronic access systems.
  • Technical support and system integrations.

Relevant providers include Octopus PMS, Microsoft, Campaign Monitor, RoomCloud, Netaxept and providers responsible for our website and access systems.

Where service providers process personal data on our behalf, we enter into data processing agreements where required by law.

14. Transfers Outside the EU/EEA

Some of our IT service providers may process personal data in, or provide access to personal data from, countries outside the European Union or European Economic Area.

Where such transfers occur, we ensure that an appropriate legal transfer mechanism is in place, such as an adequacy decision by the European Commission or the European Commission's Standard Contractual Clauses, together with any necessary supplementary safeguards.

15. Data Security

We implement appropriate technical and organisational security measures to protect personal data against unauthorised access, loss, alteration and misuse.

These measures include access controls, individual login credentials, restrictions on employee access and regular reviews of our data retention and deletion procedures.

Only employees and service providers with a legitimate work-related need are granted access to relevant personal data.

16. Your Rights

Under applicable data protection legislation, you have a number of rights, including:

  • The right to access personal data we process about you.
  • The right to have inaccurate personal data corrected.
  • The right to request deletion of personal data where the relevant conditions are met.
  • The right to restrict processing in certain circumstances.
  • The right to object to certain types of processing.
  • The right to data portability where applicable.
  • The right to withdraw your consent at any time.

You can contact us at info@hotelskjern.dk if you wish to exercise your rights.

Certain information may be exempt from deletion where we are legally required to retain it.

17. Complaints to the Danish Data Protection Agency

If you believe that we are processing your personal data in violation of applicable data protection legislation, you are welcome to contact us.

You also have the right to lodge a complaint with:

Datatilsynet (Danish Data Protection Agency)
Carl Jacobsens Vej 35
2500 Valby
Denmark
www.datatilsynet.dk

18. Changes to This Privacy Policy

We update this Privacy Policy whenever changes to our systems, procedures or applicable legislation make it necessary.

The current version is always available on our website.

Last updated: 11 November 2026.