Information for data subjects regarding a personal data breach pursuant to Art. 34 GDPR
Dear Sir or Madam,
As you can see from the subject, we are contacting you because the protection of your personal data processed at our hotel has been compromised. Below you will find all relevant information in this regard, together with our request that you accept our apologies for the breach of the protection of your personal data.
What happened?
To protect your personal data, we use technical and organizational security measures and review them regularly.
Unauthorized access to the IT systems of a service provider used by us, which operates our system for managing hotel bookings and the associated guest data, was identified. According to the information currently available, booking data may also have been accessed, thereby compromising the protection of your personal data.
As part of the investigations subsequently initiated, the service provider identified a technical vulnerability through which such unauthorized access was possible. This vulnerability was identified on 19 September 2026 and closed immediately.
According to our current state of knowledge, booking data relating to some of the bookings made since January 2026 may be affected by the incident.
What does this mean for you?
For good reason, protecting your data is a matter of great importance to us. Disclosure of this data may result in consequential risks for you. The data that may be affected primarily comprises the following data and data categories:
- Booking information: hotel name, booking number, arrival and departure dates, booking costs
- Basic and contact data of hotel guests: name, email address and telephone number
According to our current state of knowledge, no customer credit card data or other payment data is affected.
As third parties may have gained access to this data and criminal intent cannot be ruled out, there is an increased risk that you may become the target of attempted fraud. Due to unauthorized access by third parties to the booking information and contact details, unknown third parties may contact you in this connection. Their aim may be to obtain payment information or to ask you to pay the booking costs.
Please note that Hotel Fulda Mitte does not ask guests via messenger services (e.g. WhatsApp) to disclose their payment information and does not contact guests for this purpose.
What are we doing to prevent these adverse effects?
To prevent the adverse effects described above, we are taking the following measures:
- Reviewing and restoring the security of our service provider’s systems
- Informing our guests and raising their awareness
In addition, we would like to recommend that you take the following measures yourself, which, alongside the measures we have taken, are suitable for preventing adverse effects.
- Do not disclose payment data by email or messenger service
- Do not click on links or open attachments in unexpected emails or messages (e.g. WhatsApp) from unknown sources
- If you receive suspicious messages in our name, please contact us. We will help you verify their authenticity.
- If you have disclosed data or made a suspicious payment, review your transactions and contact your bank or, where appropriate, the police.
What else have we done?
After becoming aware of the data breach, we immediately involved our Data Protection Officer.
You can contact the Data Protection Officer at: Hotel Fulda Mitte, Venus Hotel- und Gaststättenbetriebsgesellschaft mbH & Co. KG, Attn. Data Protection Officer, Lindenstrasse 45, 36037 Fulda
Tel.: +49 661 29698090 Email: datenschutz@berisda.de
In cooperation with the Data Protection Officer, we reported the personal data breach to the supervisory authority responsible for us, the Hessian Commissioner for Data Protection and Freedom of Information.
What happens next?
The affected service provider has initiated measures to investigate and follow up on the incident. In particular, the causes and scope of the incident are being investigated further, and additional security measures are being reviewed and implemented.
We are in contact with our service provider in this regard and are reviewing the existing technical and organizational protective measures in order to further increase the level of security and, as far as possible, prevent comparable incidents in the future.
We have also implemented additional security measures internally so that our IT systems are protected as effectively as possible.
How can you obtain further information?
If you still have any questions or require further information, please feel free to contact us using the following contact details:
Venus Hotel- und Gaststättenbetriebsgesellschaft mbH & Co. KG
Hotel Fulda Mitte
Lindenstrasse 45
36037 Fulda
Telephone: +49 661 8330-0
Email: datenschutz@hotel-fulda-mitte.de
In addition, our Data Protection Officer is available to assist you using the contact details stated above.
We would like to offer our sincere apologies for the inconvenience caused and for the effort this has required on your part.
Please note that the information provided is based on our current state of knowledge regarding the breach of the protection of your personal data. Should there be any changes that affect you, we will inform you without being asked.
Your Hotel Fulda Mitte
