Our website provider automatically collects and stores information in what are known as server log files, which are automatically transmitted to us by your browser. The information collected may include the

1. browser types and versions used,
2. the operating system used by the accessing system,
3. the website from which an accessing system reaches our website (known as a ‘referrer’),
4. sub-pages on our website accessed via an accessing system,
5. the date and time of access to the website,
6. an Internet Protocol address (IP address),
7. the internet service provider of the accessing system, and
8. other similar data and information used for security purposes in the event of attacks on our information technology systems.

We do not draw any conclusions about you from the use of this general data and information. Rather, this information is required in order to

1. deliver the content of our website correctly,
2. optimise the content of our website and the advertising displayed on it,
3. ensure the long-term functionality of our IT systems and the technology underpinning our website, and
4. to provide law enforcement agencies with the information necessary for criminal prosecution in the event of a cyber-attack.

We therefore analyse this data and information, on the one hand, for statistical purposes and, on the other, with the aim of enhancing data protection and data security within our organisation, ultimately to ensure an optimal level of protection for the personal data we process. The anonymous data from the server log files is stored separately from any personal data you have provided. This data is not combined with other data sources. However, if there are indications of unlawful use of our website, we may subsequently review this data.

In accordance with legal requirements, our website contains information that enables you to contact our company quickly by electronic means and to communicate directly with us; this also includes a general electronic mail address (e-mail address).

If you contact us by email or via a contact form, the personal data you provide will be stored automatically. The data required is specified in the relevant contact form. Such personal data, provided on a voluntary basis, is stored for the purposes of processing your enquiry or contacting you. This personal data will not be passed on to third parties.

We use several contact forms on our website, including

• contact forms for each department on the page
  www.koenigsstuhl.com/ueber-uns/kontakt,
• a booking enquiry form for coach groups on the page
  www.koenigsstuhl.com/besucher-zentrum-am-koenigsstuhl/gruppenangebote/busgruppen,
• a booking enquiry form for school trips on the page
  www.koenigsstuhl.com/besucher-zentrum-am-koenigsstuhl/gruppenangebote/schulklassen,
• Booking enquiry form for walking groups on the page
  www.koenigsstuhl.com/besucher-zentrum-am-koenigsstuhl/gruppenangebote/wandergruppen,
• Enquiry form for the Königsweg project on the website
  koenigsweg.koenigsstuhl.com
  / koenigsweg.koenigsstuhl.com/faq,
• Form for contact enquiries from potential partners at
  https://www.koenigsstuhl-ticket.com/Informationen/Kontakt/

In principle, you can purchase tickets anonymously by paying in cash during our opening hours. If you are claiming any concessions, you may be required to present certificates or identification documents to prove your eligibility. We use these solely to verify your eligibility when issuing the tickets. The tickets issued contain a barcode for admission control, which does not contain any personal data. If you are purchasing tickets as part of a tour group or school group, we will only collect personal data from the respective ticket purchasers as part of the ordering and payment process.

We also offer you the option of ordering tickets online, which will be sent to you by email immediately after payment. This is handled by Booqi.me BV, Velmolenweg 54a, 5404 LD, Uden, Netherlands.

Payment details are transmitted directly and exclusively to your chosen payment service provider (PayPal; Giropay; credit card payment). Through the payment provider, we have access to your first name, surname, email address and payment method solely for the purpose of accounting for the payment transactions. Your email address is required to process the order, as the ticket will be sent to you electronically. To prevent and investigate fraudulent activities at your expense, we will retain this email address for a further six months after your account has been debited and the ticket has been used for entry. We will link the ticket identification and the email address solely for this purpose and will use this data exclusively in the event of suspected fraud to clarify the matter and, where necessary, to protect our interests through legal action.

Distribution partners and those interested in a distribution partnership have the option to register on our online distribution partner system at https://www.koenigsstuhl-ticket.com/ by providing their personal data. We process our distribution partners’ data on the legal basis set out in Article 6(1)(b) of the GDPR for the purpose of fulfilling and implementing contractual and pre-contractual measures.

The personal data provided to us in this context is determined by the registration form used for registration: title, first name, surname, email address, delivery address, billing address, telephone number, fax number, website URL, company name, department, VAT number and country.

The personal data you enter is collected and stored exclusively for our internal use and for our own purposes. However, we may arrange for the data to be passed on to one or more data processors, who will then also use the personal data exclusively for internal purposes attributable to us.

Your registration is based on the voluntary provision of personal data and enables us to offer you content or services which, by their very nature, can only be made available to registered partners. Registered partners are generally free to amend the personal data provided during registration at any time or to have it completely deleted from our database, provided that the right to erasure is not restricted by law.

When you register in our sales partner system, the IP address assigned to you, as well as the date and time of registration, are also stored. This data is stored because it is the only way to prevent the misuse of our services, and, where necessary, this data enables us to investigate criminal offences that have been committed. In this respect, the storage of this data is necessary for our protection. As a general rule, this data will only be disclosed to third parties where there is a legal obligation to do so or where such disclosure is necessary for the purposes of criminal prosecution.

We will, upon request, provide you with information at any time regarding which personal data we hold about you. Furthermore, we will rectify or erase personal data upon your notification or request, provided that the rights to rectification or erasure are not restricted by law. The Data Protection Officer named in this privacy policy and all our staff are available to you as points of contact in this regard.

We offer our sales partners an online shop for purchasing tickets and vouchers. Here, as a reseller for the KÖNIGSSTUHL National Park Centre, you can book individual or group tickets, as well as school group programmes, directly and download the relevant vouchers.

Registration is required to use the service; see ‘Sales Partner Registration’. The benefits of registering include the shop’s features: quick shopping, saving of data and settings, and access to your own bookings, including their processing status.

When using the online shop, you are required to provide us with your personal data, which we need to manage our business relationship for the purposes of order fulfilment, delivery, invoicing, payment processing, communication and the fulfilment of contractual obligations. The personal data provided to us in this context is specified in the registration form: title, first name, surname, email address, delivery address, billing address, telephone number, fax number, website URL, company name, department, VAT number and country.

The data we collect is generally essential for establishing and managing a business relationship, including the fulfilment of the resulting obligations. There is normally no other obligation to provide this data.

The legal basis for data processing is therefore the implementation of pre-contractual measures and the performance of the contract in accordance with Article 6(1)(b) of the GDPR.

In certain cases, we are legally obliged to process data. In such cases, we process your data in accordance with Article 6(1)(c) of the GDPR. A legal obligation may arise from a contract you have concluded with us, the fulfilment of which is the purpose of the data collection; from the legal provisions applicable to us; or – in accordance with Article 6(2) and (3) of the GDPR – from European Union law or the law of the Member States of the European Union.

Where applicable, data processing is carried out in our legitimate interest in accordance with Article 6(1)(f) of the GDPR. Where permitted by law, your personal data will be stored if this is necessary to assert or defend against legal claims. Our legitimate interest in data processing is the existence of a legal relationship between us, the prevention of fraud, measures to ensure and improve the security of IT systems, measures to protect our company against unlawful acts, the assertion of claims for damages, and internal administrative purposes.

No automated monitoring or evaluation systems are used in the processing of data within our company.

The personal data we collect is stored until the statutory retention period expires and is then deleted, unless there is an obligation to store the data for a longer period pursuant to Article 6(1), first sentence, point (c) of the GDPR due to retention and documentation obligations under tax and commercial law (under the German Commercial Code (HGB), the German Criminal Code (StGB) or the German Fiscal Code (AO)) or you have consented to storage beyond this period in accordance with Article 6(1), first sentence, point (a) of the GDPR. Subject to such retention obligations, data will be deleted once the purpose for which it was collected no longer applies. Where permitted by law, data will also be stored if this is necessary to assert or defend against legal claims.

The data we collect is also transferred to other recipients and third parties in accordance with statutory provisions. These include internal recipients such as the management and department heads. These also include external recipients such as external data processors for the destruction of records in accordance with data protection regulations; for ensuring IT functionality, maintenance and security; our own legal representatives in the event of a legal dispute; the tax authorities; and tax advisers.

For anyone interested, and for customers who do not wish to or are unable to make a decision on the spot – and, of course, for our most dedicated fans – we offer the option of ordering your chosen items from home by telephone or email. In our online shop, you’ll find a small selection of our most popular products. However, we do not currently offer an online ordering service. Consequently, online registration is not available either.

When placing an order, you will need to provide us with your personal data, which we require to manage our business relationship with you for the purposes of processing the order, delivery, invoicing, payment transactions, communication and the fulfilment of our contractual obligations. The data required includes title, first name, surname, contact details (telephone, email), full billing address and full delivery address.

The data we collect is generally essential for establishing and managing a business relationship, including the fulfilment of the resulting obligations. There is normally no other obligation to provide this data.

The legal basis for data processing is therefore Article 6(1)(b) of the GDPR for the implementation of pre-contractual measures and the performance of the contract.

In certain cases, we are legally obliged to process data. In such cases, we process your data in accordance with Article 6(1)(c) of the GDPR. A legal obligation may arise from a contract you have concluded with us, the fulfilment of which is the purpose of the data collection; from the legal provisions applicable to us; or – in accordance with Article 6(2) and (3) of the GDPR – from European Union law or the law of the Member States of the European Union.

Where applicable, data processing is carried out in our legitimate interest in accordance with Article 6(1)(f) of the GDPR. Where permitted by law, your personal data will be stored if this is necessary to assert or defend against legal claims. Our legitimate interest in data processing is the existence of a legal relationship between us, the prevention of fraud, measures to ensure and improve the security of IT systems, measures to protect our company against unlawful acts, the assertion of claims for damages, and internal administrative purposes.

No automated monitoring or evaluation systems are used in the processing of data within our company.

The personal data we collect is stored until the expiry of the statutory retention period and is subsequently deleted, unless there is an obligation to store the data for a longer period pursuant to Article 6(1), first sentence, point (c) of the GDPR due to retention and documentation obligations under tax and commercial law (under the German Commercial Code (HGB), the German Criminal Code (StGB) or the German Fiscal Code (AO)) or you have consented to storage beyond this period in accordance with Article 6(1), first sentence, point (a) of the GDPR. Subject to such retention obligations, data will be deleted once the purpose for which it was collected no longer applies. Where permitted by law, data may also be stored if this is necessary to assert or defend against legal claims.

The data we collect is also transferred to other recipients and third parties in accordance with statutory provisions. These include internal recipients such as the management and department heads. These also include external recipients such as external data processors for the destruction of records in accordance with data protection regulations; for ensuring IT functionality, maintenance and security; our own legal representatives in the event of a legal dispute; the tax authorities; and tax advisers.

If you are interested in a position with our company, you can apply to us and submit your application documents by email, post or via our social media channels. You can find relevant job vacancies on our website.

As part of the application process, you may provide us with very personal information about yourself. In this context, we process the data that you yourself provide in your application letter. We generally collect your personal data as set out below through direct contact with you. In addition, and to the extent necessary for the assessment of your application, we may process data lawfully obtained from other bodies, third parties or publicly available sources.

We process your data where this is necessary for the implementation of a pre-contractual measure for the purpose of conducting the application process in accordance with Article 6(1)(b) of the GDPR in conjunction with Section 26 of the BDSG. This includes assessing your suitability for the vacant position, evaluating your performance and conduct to the extent permitted by law, drawing up the employment contract where applicable, and pre-contractual or contract-related communication (including arranging appointments) with you.

For the purposes mentioned, we routinely process the following personal data: Title/gender, address details, personal details (name, date of birth), residential address, professional activities/current employment, nationality, professional qualifications/work experience, references, start and end dates of an employment relationship.

This data is necessary for the proper conduct of the selection process. If you do not provide us with this information, we may not be able to consider your application. There is no legal obligation to provide this data.

If an employment contract is concluded with an applicant, the data provided will be stored for the purpose of administering the employment relationship in accordance with statutory provisions. If we do not enter into an employment contract with the applicant, the application documents will be automatically deleted six months after notification of the rejection decision, provided that no other legitimate interests on our part preclude such deletion. Other legitimate interests in this context include, for example, a duty to provide evidence in proceedings under the General Equal Treatment Act (AGG).

Furthermore, we process your data if you have given us your consent in accordance with Article 6(1)(a) of the GDPR or Article 9(2)(a) of the GDPR. You may give your consent for us to obtain references from previous employers and for your application to be stored for a longer period in an applicant pool for future vacancies.

Where necessary, we will seek your consent to data processing separately. You may withdraw your consent at any time with effect for the future. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of your consent prior to its withdrawal.

Should a life-threatening emergency arise and you require medical assistance, we will process your data on the basis of Article 6(1)(d) of the GDPR to protect your vital interests. This includes, in particular, the disclosure of relevant data to paramedics, doctors or other emergency services personnel.

Where applicable, data processing is carried out in our legitimate interest in accordance with Article 6(1)(f) of the GDPR. Our legitimate interests in data processing are: fraud prevention; measures to ensure and improve the security of IT systems; measures to protect our company from unlawful acts; the assertion of claims for damages; internal administrative purposes, in particular the exchange of information within our company; asserting legal claims and defending ourselves in legal disputes – where applicable, disclosure to legal representatives acting on our behalf; ensuring consistent candidate management and uniform quality standards within our company

No automated decision-making systems are used in data processing within our company.

The data we collect is also transferred to other recipients and third parties in accordance with statutory provisions. These include internal recipients such as the management and department heads. They also include external recipients such as external data processors for the destruction of records in accordance with data protection regulations; for ensuring IT functionality, maintenance and security; our own legal representatives in the event of a legal dispute; the tax authorities; and tax advisers.

Prospective customers have the option to subscribe to our newsletter. By subscribing, you consent to receiving newsletters by email in accordance with Article 6(1)(a) of the GDPR and to the associated tracking. In this newsletter, we will keep you regularly informed about offers and news relating to the Königsstuhl and associated tourism services, as well as about our company.

To subscribe to the newsletter, we collect your data exclusively through direct contact with you. To send the newsletters, we process your email address as personal data. You can only receive our company’s newsletter if

1. you have a valid email address and
2. you have subscribed to the newsletter.

The personal data collected when you subscribe to the newsletter is used exclusively for the purpose of sending our newsletter. Furthermore, newsletter subscribers may be informed by email where this is necessary for the operation of the newsletter service or for registration purposes, as might be the case with changes to the newsletter content or alterations to the technical conditions.

We use the service provider “Brevo” (formerly Sendinblue), Sendinblue GmbH, Köpenicker Str. 126, 10179 Berlin, to send out the newsletter. We have entered into a data processing agreement with them.

You may cancel your subscription to our newsletter at any time. You may withdraw your consent to the storage of personal data that you have provided to us for the purpose of sending the newsletter at any time. Your data will only be stored for as long as you have given us your consent. To withdraw your consent, you may contact us at any time using the contact details provided on this page.

Our newsletters may contain what are known as web beacons. A web beacon is a tiny graphic embedded in emails sent in HTML format to enable log file recording and analysis. This allows us to carry out a statistical analysis of the success or failure of online marketing campaigns. Using the embedded web beacon, we can determine whether and when an email has been opened by a recipient and which links contained in the email have been clicked on by that recipient.

We store and analyse such personal data collected via the tracking pixels contained in the newsletters in order to optimise the distribution of newsletters and to tailor the content of future newsletters even more closely to the recipients’ interests. This personal data is not passed on to third parties.

Data subjects are entitled at any time to withdraw the separate declaration of consent given in this regard via the double opt-in procedure. Following withdrawal, this personal data will be deleted by the data controller, unless the right to erasure is restricted by law. We automatically interpret unsubscribing from the newsletter as a withdrawal of consent.

You have the option to leave a review of our company via social media channels and review sites.

We are happy to feature the reviews you have published, crediting the author, on our website. This means that your first name, surname, town, date and any other details you have provided may be displayed. In principle, it is also possible to submit a review without providing your personal data, for example under a pseudonym. No further processing will take place. Our legitimate interest pursuant to Article 6(1)(f) of the GDPR lies in providing a truthful representation of our company based on the reviews of our visitors and customers. If you do not wish for your review to be displayed on our website, you may object at any time using the contact details provided on this page.

We have integrated the Google Analytics component (with anonymisation function) into our website. Data processing takes place with your prior consent in accordance with Article 6(1)(a) of the GDPR. You may withdraw your consent at any time.

The operator is Google LLC; 1600 Amphitheatre Parkway; Mountain View, CA 94043; USA, represented in the EU by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. 

Google Analytics is a web analytics service. Web analytics refers to the collection, gathering and analysis of data regarding the behaviour of website visitors. Among other things, a web analytics service records data on which website a data subject came from (known as the referrer), which subpages of the website were accessed, and how often and for how long a subpage was viewed. 
The purpose of the Google Analytics component is to analyse visitor traffic on our website. Google uses the data and information obtained, amongst other things, to evaluate the use of our website, to compile online reports for us showing activity on our website, and to provide other services related to the use of our website.

Google Analytics places a cookie on your system. Each time you visit a page on this website that incorporates a Google Analytics component, your web browser is automatically prompted by that component to transmit data to Google for the purposes of online analysis. As part of this technical process, Google obtains personal data, such as your IP address, in order to trace the origin of visitors and clicks. The cookie is used to store personal information, such as the time of access, the location from which access originated and the frequency of your visits to our website. Each time you visit our website, this personal data, including the IP address you are using, is transmitted to Google. This personal data is stored by Google. 

When IP anonymisation is enabled, your IP address is truncated by Google. The IP address transmitted by your browser as part of Google Analytics is not combined with other data held by Google.

In accordance with COMMISSION IMPLEMENTING DECISION (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, the transfer of data to the USA is based on standard contractual clauses, see here business.safety.google/gdprcontrollerterms/ and here business.safety.google/gdprcontrollerterms/sccs/.

You can prevent cookies from being set at any time by adjusting the settings of your web browser accordingly, thereby permanently objecting to the setting of cookies.

Furthermore, you have the option to object to the collection of data generated by Google Analytics relating to your use of this website, as well as to the processing of this data by Google, and to prevent such processing. To do this, you must download and install a browser add-on from the link tools.google.com/dlpage/gaoptout.

Further information and Google’s applicable privacy policy can be found at policies.google.com/privacy and policies.google.com/terms. Google Analytics is explained in more detail at www.google.com/intl/de_de/analytics/.

As part of our website, for example to help you locate our company’s sites, we use interactive maps provided by the ‘Google Maps API’ mapping service; the associated data processing is carried out with your prior consent in accordance with Article 6(1)(a) of the GDPR. You may withdraw your consent at any time.

The operator is Google LLC; 1600 Amphitheatre Parkway; Mountain View, CA 94043; USA, represented in the EU by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland.

When using this service, information regarding your use of the website, as well as your IP address, is transmitted to and stored on Google’s servers.

In accordance with COMMISSION IMPLEMENTING DECISION (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, the transfer of data to the USA is based on standard contractual clauses, see here https://business.safety.google/gdprcontrollerterms/ and here https://business.safety.google/gdprcontrollerterms/sccs/.

We cannot rule out the possibility of Google transferring your data to third parties, for example in the case of transfers required by law or the processing of data by third parties on Google’s behalf. Further information and Google’s applicable privacy policy can be found at https://policies.google.com/privacy and https://policies.google.com/terms.

As part of our website, for example to help users locate our company’s premises, we provide links to Google Maps on the basis of a legitimate interest pursuant to Article 6(1)(f) of the GDPR.

The operator is Google LLC; 1600 Amphitheatre Parkway; Mountain View, CA 94043; USA, represented in the EU by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland.

To use this service, click on the link to be redirected to Google’s interactive map. Only after clicking on the link will your personal data, such as your IP address, be transmitted to Google and processed by them. Use of the map service is voluntary. We have no influence whatsoever on Google’s data processing or on the transfer of data by Google to third parties. If you do not wish your data to be transferred, please do not use the link.

Further information and Google’s applicable privacy policy can be found at https://policies.google.com/privacy and https://policies.google.com/terms.

We use Google Tag Manager on our website, which allows website tags to be managed via a single interface. This triggers other tags. No cookies are used and no personal data is collected in the process. Please note that the tags triggered may themselves collect data; however, this data is not used by Tag Manager. You can find relevant information about these respective providers in this privacy policy.

If you have disabled cookies, this setting will apply to all tracking tags implemented using Google Tag Manager. The tool does not alter your cookie settings.

Data processing by Google on our website takes place with your prior consent in accordance with Article 6(1)(a) of the GDPR. You may withdraw your consent at any time.

The data controller is Google LLC; 1600 Amphitheatre Parkway; Mountain View, CA 94043; USA, represented in the EU by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland.

In accordance with COMMISSION IMPLEMENTING DECISION (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, the transfer of data to the USA is based on standard contractual clauses, see here https://business.safety.google/gdprcontrollerterms/ and here https://business.safety.google/gdprcontrollerterms/sccs/.

Further information and Google’s applicable data protection policies can be found at https://policies.google.com/privacy and https://policies.google.com/terms.

Our website uses Google Conversion Tracking for advertising campaigns via Google Ads to promote our services and attract the attention of potential customers and interested parties. Data processing by Google on our website takes place with your prior consent in accordance with Article 6(1)(a) of the GDPR. You may withdraw your consent at any time.

The data controller is Google LLC; 1600 Amphitheatre Parkway; Mountain View, CA 94043; USA, represented in the EU by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland.

In accordance with COMMISSION IMPLEMENTING DECISION (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, the transfer of data to the USA is based on standard contractual clauses, see here https://business.safety.google/gdprcontrollerterms/ and here https://business.safety.google/gdprcontrollerterms/sccs/.

Google Ads is an online advertising service that allows advertisers to place adverts both in Google’s search engine results and on the Google Display Network. Google Ads enables an advertiser to specify certain keywords in advance, so that an advert is displayed in Google’s search engine results only when a user enters a search query containing those keywords. Within the Google Display Network, adverts are distributed across thematically relevant websites using an automated algorithm and in accordance with the pre-defined keywords.

If you access our website via a Google advert, Google will place a so-called conversion cookie on your system. A conversion cookie expires after thirty days and is not used to identify you. Provided the cookie has not yet expired, the conversion cookie is used to track whether certain sub-pages – such as the shopping basket in an online shop system – have been accessed on our website. The conversion cookie enables both us and Google to track whether you arrived at our website via an Ads advert and generated a transaction – that is, whether you completed or abandoned a purchase.

The data and information collected through the use of the conversion cookie are used by Google to compile visitor statistics for our website. We, in turn, use these visitor statistics to determine the total number of users who were referred to us via Google Ads, i.e. to assess the success or failure of the respective Google Ads and to optimise our Google Ads for the future. Neither our company nor other Google Ads advertisers receive any information from Google that could be used to identify you.

The conversion cookie is used to store personal information, such as the web pages you have visited. Consequently, each time you visit our website, personal data, including your IP address, is transmitted to Google. This personal data is stored by Google.

Further information and Google’s applicable privacy policy can be found at https://policies.google.com/privacy and https://policies.google.com/terms.

You can prevent cookies from being set at any time by adjusting the settings in your web browser, thereby permanently objecting to the setting of cookies. To do this, you can either disable the automatic setting of cookies generally or specifically block cookies from the domain googleleadservices.com.

Furthermore, the data subject has the option to object to interest-based advertising by Google. To do so, please use the following link: adssettings.google.com.

The website also incorporates social media platforms such as Facebook, Twitter and Instagram. These platforms sometimes contain buttons and plugins which transmit data to the operators of the respective social media platforms as soon as the page loads – that is, without any further action on the part of the user. Nevertheless, to ensure the best possible protection of your personal data, we use the two-stage Shariff solution, which only transmits data with the user’s consent: by default, buttons are used that do not establish contact with the servers of Facebook and other social media networks. The relevant button therefore does not initially transmit any data to third parties. Only when you, as the user, activate the relevant button and thereby give your consent to communicate with Facebook, Twitter or Google do the buttons become active and establish a connection. With a second click, you can then share your recommendation with your own network. By clicking on one of the buttons to activate it, you are giving your consent for data to be transmitted to the respective social network operator. If you are already logged in to the relevant social network at the time of activating the button, sharing on that network takes place – as far as current technology allows – without a further window appearing. On Twitter, a pop-up window appears in which you can still edit your tweet.

We have integrated the Shariff component into our website. Shariff is an open-source programme developed by c’t and heise online.

The Shariff component provides a practical two-click solution for social media buttons, ensuring that the script required for sharing is loaded with just one click. Direct contact between the website visitor and the social media network is only established once the share button is actively clicked. This prevents the processing of the visitor’s personal data on the website before they actively click a social media button. Typically, the button solutions provided by social networks already transfer personal data to the respective social network as soon as a user visits a website on which a social media button has been integrated. By using the Shariff component, personal data is only transmitted to social networks once a website visitor actively clicks one of the social media buttons.

We have integrated components from Facebook into this website. Facebook is a social network. A social network is a social meeting place operated on the internet – in other words, an online community that generally enables users to communicate with one another and interact in a virtual space. A social network can serve as a platform for exchanging opinions and experiences, or enable the online community to share personal or business-related information. Among other things, Facebook allows users of the social network to create private profiles, upload photos and connect with others via friend requests.

Clicking on third-party websites such as Facebook will redirect you to the respective third party, over which we have no control.

Data processing on our website by Facebook takes place with your prior consent in accordance with Article 6(1)(a) of the GDPR. You may withdraw your consent at any time.

Facebook is operated by Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025, USA. Where a data subject resides outside the USA or Canada, the data controller for the processing of personal data is Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

In accordance with COMMISSION IMPLEMENTING DECISION (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, data transfers to the USA are based on standard contractual clauses; see here www.facebook.com/help/566994660333381.

Each time you access one of the individual pages of this website, which is operated by us and on which a Facebook component (Facebook plug-in) has been integrated, the web browser on your system is automatically prompted by the respective Facebook component to download a representation of the corresponding Facebook component from Facebook. A complete overview of all Facebook plug-ins can be found at developers.facebook.com/docs/plugins/. As part of this technical process, Facebook is informed of which specific subpage of our website you are visiting.

If you are logged into Facebook at the same time, Facebook recognises which specific subpage of our website you are visiting each time you access our website and throughout the entire duration of your visit to our website. This information is collected by the Facebook component and linked by Facebook to your Facebook account. If you click on one of the Facebook buttons integrated into our website, such as the ‘Like’ button, or post a comment, Facebook associates this information with your personal Facebook account and stores this personal data. Depending on your privacy settings, your preferences may thus become visible to your Facebook friends.

Facebook always receives information via the Facebook component that you have visited our website if you are logged into Facebook at the same time as you access our website; this occurs regardless of whether you click on the Facebook component or not.

If you do not wish for this information to be transmitted to Facebook, you can prevent this by logging out of your Facebook account before visiting our website.

Facebook’s privacy policy, which is available at de-de.facebook.com/about/privacy/, provides information on the collection, processing and use of personal data by Facebook. It also explains the settings options Facebook offers to protect your privacy. In addition, various applications are available that allow you to prevent data from being transmitted to Facebook, such as the Facebook blocker from Webgraph, which can be downloaded from webgraph.com/resources/facebookblocker/. You may use such applications to prevent data from being transmitted to Facebook.

Insight Data Analysis

The Conference of Independent Data Protection Authorities of the Federal Government and the Länder (Data Protection Conference – DSK) has pointed out that Facebook is obliged to obtain valid consent to the use of data from all visitors to its Facebook page. Operators of a Facebook fan page, on the other hand, are obliged to obtain the necessary information regarding Facebook’s use of data. These requirements have now been met.

When you visit our fan page, Facebook collects users’ personal data within the scope of its responsibility. Such data collection by Facebook may also take place in the case of visitors to this page who are not logged in to Facebook or registered as members. Information on data collection and further processing by Facebook, as well as information on exercising your rights and options, can be found in Facebook’s privacy policy.

By using the Facebook platform, we accept no responsibility for the processing of personal data or its transfer outside the European Union; in particular, we accept no responsibility for the exercise of data subjects’ rights or the validity of consent.

We have no influence over the scope of the data collected, nor do we have full access to the collected data or your profile information. You determine what information we receive – under Facebook’s sole responsibility – via your Facebook settings or your browser settings when visiting a publicly accessible page. Furthermore, in your Facebook settings, you have the option to actively hide your ‘likes’ or to stop following the fan page. Your profile will then no longer appear in the list of fans of this fan page.

We receive anonymous statistics from Facebook regarding the use and engagement with the fan page. The following information is provided, for example (so-called ‘Insights’ data):

• Followers: The number of people following our fan page – including growth and trends over a defined period.
• Reach: The number of people who see a specific post on our fan page and the number of interactions with a post.
• Ad performance: The number of people who have seen an advert.
• Demographics: Average age of visitors, gender, location, language.

We use these statistics – from which we cannot draw any conclusions about individual users – to continuously improve our online presence on Facebook and to better cater to our users’ interests. We cannot link this statistical data to our fans’ profile data. You can use your Facebook settings to decide how targeted adverts are displayed to you.

We have entered into a joint controller agreement with Facebook regarding the processing of personal data in accordance with Article 26 of the GDPR.

Consequently, Facebook is the sole data controller with regard to the processing of Insights data. In this regard, Facebook is responsible for fulfilling the information obligations under Articles 12 and 13 of the GDPR, for ensuring that data subjects’ rights under Articles 15 to 22 of the GDPR are upheld, for data security, and also for reporting data protection breaches (Articles 32 to 34 of the GDPR). Furthermore, Facebook remains the sole data controller for the processing of other personal data.

We receive personal data via Facebook if you actively provide it to us via a private message on Facebook, or if you use a form to submit the data to us and actively send the data to us by clicking a button. We use the data you provide (e.g. first name, surname) to respond to your enquiry, where necessary.

We have integrated features from the Instagram service into our website. Instagram is a service that qualifies as an audiovisual platform and enables users to share photos and videos, as well as to repost such content on other social networks. Data processing on our website by Instagram takes place with your prior consent in accordance with Article 6(1)(a) of the GDPR. You may withdraw your consent at any time.

The operator of the Instagram services is Instagram LLC, 1 Hacker Way, Building 14 First Floor, Menlo Park, CA, USA. Instagram is a subsidiary of Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025, USA, represented in the EU by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

Each time you visit one of the individual pages on our website on which an Instagram component (Insta button) has been integrated, the web browser on your system is automatically prompted by the respective Instagram component to download a display of the corresponding Instagram component. As part of this technical process, Instagram is informed of the specific subpage of our website that you are visiting.

If you are logged into Instagram at the same time, Instagram recognises which specific subpage you are visiting each time you access our website and throughout the duration of your visit to our website. This information is collected by the Instagram component and linked to your Instagram account by Instagram. If you click on one of the Instagram buttons integrated into our website, the data and information transmitted in this way will be linked to your personal Instagram user account and stored and processed by Instagram.

Instagram always receives information via the Instagram component that you have visited our website if you are logged into Instagram at the same time as you visit our website; this occurs regardless of whether you click on the Instagram component or not.

If you do not wish for this information to be transmitted to Instagram, you can prevent this by logging out of your Instagram account before visiting our website.

According to COMMISSION IMPLEMENTING DECISION (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, the transfer of data to the USA is based on standard contractual clauses; see here www.facebook.com/help/566994660333381.

Further information and Instagram’s applicable data protection provisions can be found at www.instagram.com/about/legal/privacy/.

We have integrated Twitter components into this website. Twitter is a multilingual, publicly accessible microblogging service on which users can publish and share so-called ‘tweets’ – short messages limited to 140 characters. These short messages are accessible to everyone, including people who are not registered with Twitter. However, the tweets are also displayed to the user’s so-called followers. Followers are other Twitter users who follow a user’s tweets. Furthermore, Twitter enables users to reach a wide audience via hashtags, links or retweets.

Twitter is operated by Twitter, Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA.

In accordance with COMMISSION IMPLEMENTING DECISION (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, the transfer of data to the USA is based on standard contractual clauses.

Each time you access a specific page on our website that incorporates a Twitter component (Twitter button), the Twitter component automatically prompts the web browser on your system to download a representation of the relevant Twitter component. Further information on Twitter is available at https://about.twitter.com. As part of this technical process, Twitter is informed of which specific subpage of our website you are visiting.

If you are logged into Twitter at the same time, Twitter recognises which specific subpage you are visiting each time you access our website and throughout the entire duration of your visit to our website. This information is collected by the Twitter component and assigned by Twitter to your respective Twitter account. If you click on a Twitter button integrated into our website, Twitter associates this information with your personal Twitter user account and stores this personal data.

Twitter always receives information via the Twitter component that you have visited our website if you are logged in to Twitter at the same time as you access our website; this occurs regardless of whether you click on the Twitter component or not.

If you do not wish this information to be transmitted to Twitter, you can prevent this by logging out of your Twitter account before visiting our website.

Further information and Twitter’s applicable privacy policy can be found at https://twitter.com/privacy?lang=de.

We have integrated components of the YouTube service into our website. Data processing by YouTube on our website takes place with your prior consent in accordance with Article 6(1)(a) of the GDPR. You may withdraw your consent at any time.

YouTube is an online video portal that enables video publishers to upload video clips free of charge and allows other users to view, rate and comment on them, also free of charge. YouTube permits the publication of all types of videos, which is why complete films and television programmes, as well as music videos, trailers and user-generated videos, are available via the internet portal.

YouTube is operated by YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. YouTube, LLC is a subsidiary of Google LLC, 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA, represented in the EU by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland.

In accordance with COMMISSION IMPLEMENTING DECISION (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, the transfer of data to the USA is based on standard contractual clauses, see here https://business.safety.google/gdprcontrollerterms/ and here https://business.safety.google/gdprcontrollerterms/sccs/.

When you visit one of our web pages on which a YouTube video is embedded, a connection is immediately established with the servers of Google LLC or its subsidiary YouTube LLC.

Each time you access a specific page on our website on which a YouTube component (YouTube video) has been integrated, the web browser on your system is automatically prompted by the respective YouTube component to download a display of the corresponding YouTube component. As part of this technical process, YouTube and Google are informed of which specific subpage of our website you are visiting.

If you are logged into YouTube at the same time, YouTube recognises which specific subpage you are visiting each time you access our website and throughout the duration of your visit to our website. This information is collected by the YouTube component and linked to your YouTube account by YouTube. If you interact with a YouTube component integrated into our website, the data and information transmitted in this way will be associated with your personal YouTube user account and stored and processed by YouTube and Google.

YouTube and Google always receive information via the YouTube component that you have visited our website if you are logged into YouTube at the same time as you visit our website; this occurs regardless of whether you click on the YouTube component or not.

If you do not wish for this information to be transmitted to YouTube and Google, you can prevent this by logging out of your YouTube account before visiting our website.

Further information and the applicable privacy policies of YouTube and Google can be found at https://policies.google.com/privacy.

TripAdvisor is a travel advice platform that helps users plan, book and undertake trips. Travellers can find offers for accommodation, experiences, restaurants and other great places in their chosen search area.

The data controller is TripAdvisor LLC, 400 1st Avenue, Needham, MA 02494, USA.

TripAdvisor’s privacy policy can be found at https://tripadvisor.mediaroom.com/DE-privacy-policy

We use, amongst others, the provider Vimeo to embed videos. Vimeo is a video platform operated by Vimeo, LLC, headquartered at 555 West 18th Street, New York, New York 10011. Data processing by Vimeo on our website takes place with your consent in accordance with Article 6(1)(a) of the GDPR. You may withdraw your consent at any time.

In accordance with COMMISSION IMPLEMENTING DECISION (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, the transfer of data to the USA is based on standard contractual clauses.

On some of our web pages, we use plugins provided by Vimeo, which enable us to display videos directly on our website. When you visit pages on our website that feature such a plugin, a connection is established with the Vimeo servers. As a result, your personal data is transmitted to the Vimeo server: IP address, browser type, operating system, web pages visited, device information, session duration and bounce rate. If you are logged in as a Vimeo member at the time, Vimeo will associate this information with your personal user account. If you use the plugin – for example, by clicking the play button on a video – this information is also associated with your user account. You can prevent this association by logging out of your Vimeo user account before using our website and deleting the relevant Vimeo cookies.

Further information on data processing and Vimeo’s privacy policy can be found at https://vimeo.com/privacy, vimeo.com/cookie_policy and vimeo.com/privacy.

We have integrated components of the TikTok service into our website. TikTok is a Chinese social media platform for creating short videos that are shared with the whole world. In addition to the data you voluntarily provide as a TikTok user, TikTok automatically processes further data about you via the TikTok Pixel, such as location data, IP addresses, user behaviour and device information.

The platform is provided by TikTok Pte. Limited, 1 Raffles Quay, 19-11, South Tower, SINGAPORE 048583. For the European region, the registered office of TikTok Technology Limited is at 10 Earlsfort Terrace, Dublin, D02 T380, Ireland.

Data processing by TikTok on our website takes place with your consent in accordance with Article 6(1)(a) of the GDPR. You may withdraw your consent at any time.

In accordance with COMMISSION IMPLEMENTING DECISION (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, the transfer of data to the USA is based on standard contractual clauses.

Further information and privacy notices can be found at https://ads.tiktok.com/i18n/official/policy/controller-to-controller and https://www.tiktok.com/legal/new-privacy-policy.

This website contains links to external third-party websites over whose content we have no control. We are therefore unable to accept any liability for this external content. The content of external websites linked to here does not reflect the views of the website operator, but is provided solely for information purposes and to illustrate contexts. The respective provider or operator of the linked websites is always responsible for their content. The linked pages were checked for possible legal infringements at the time the links were created. No unlawful content was identifiable at the time the links were created. However, it is not reasonable to expect us to monitor the content of the linked pages on an ongoing basis without specific evidence of a legal infringement. Should we become aware of any legal infringements, we will remove such links immediately.

We use the personal data you provide to us only for the purposes for which it is intended.

The legal basis for processing your data may, in particular,

• your consent in accordance with Article 6(1)(a) of the GDPR, for example by agreeing to the use of cookies or web analytics,
• the initiation and performance of a contract in accordance with Article 6(1)(b) of the GDPR, for example when you contact us via the form,
• our legitimate interests pursuant to Article 6(1)(f) of the GDPR, for example in the context of public relations, ensuring the necessary functionality of the website, IT and internet security, quality assurance, fraud prevention and the prosecution of criminal offences.

If you have given us consent for a specific purpose, you may withdraw this consent at any time without formalities.

Personal data will only be transferred to state institutions and authorities where required by mandatory national legislation.

The persons we have commissioned to process the data are obliged to maintain confidentiality and to process the data lawfully. Should your personal data be further processed for a purpose other than the original one, we will notify you accordingly.

We use external service providers (data processors) to assist with certain technical processes relating to data analysis, processing and/or storage. Both we and the data processor are obliged to comply with the technical and organisational measures set out in Article 32 of the GDPR, and the external service provider is also bound by a duty of confidentiality. Processing takes place exclusively on our behalf and in accordance with our instructions. Any processing of your personal data beyond the scope of this commissioned data processing shall only take place with your explicit consent or in cases required by law or ordered by a public authority or court.

Data transfers to third countries (countries outside the European Economic Area – EEA) will only take place insofar as this is necessary for the performance of a contract, is required by law, you have given your consent to the data processing, or is necessary to ensure various functionalities on the website. We will inform you separately of the details, where required by law.

In accordance with COMMISSION IMPLEMENTING DECISION (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, data transfers to the USA are based on standard contractual clauses.

In connection with the purely informational use of our website, we store the data that your browser transmits to our server for the period necessary to resolve malfunctions or error messages. This data is usually deleted within 7 days of the end of the internet connection.

Further retention periods depend on your use of the website.

If you contact us via our contact options with an enquiry, we will store the personal data collected from you from the time of collection. We will store the data collected in this way for the duration of our business relationship, which includes, amongst other things, the initiation and execution of a contract. In addition, we are subject to various retention and documentation obligations arising, amongst other things, from the German Commercial Code (HGB), the German Fiscal Code (AO) and tax law. The retention periods prescribed therein are up to ten years after the end of the year in which the contractual relationship was terminated. Finally, the retention period is also determined, with regard to the ability to defend against legal claims and to provide evidence of compliance with data protection obligations, by the statutory limitation periods, which, for example, under Sections 195 et seq. of the Civil Code (BGB), which are generally three years from the end of the year in which the claim arose.

Where further retention periods apply, you will be informed of these in this privacy policy.

Contact details of the competent supervisory authority for the company’s head office.

The State Commissioner for Data Protection and Freedom of Information, Mecklenburg-Western
Pomerania, Schloss Schwerin, Lennéstraße 1,
19053 Schwerin

Telephone: +49 (0)385 59494 0
Fax: +49 (0)385 59494 58
Email: info@datenschutz-mv.de
Website: www.datenschutz-mv.de ; www.informationsfreiheit-mv.de ; https://www.datenschutz-mv.de/kontakt/kontaktformular/ ;

You have the right at any time to contact our Data Protection Officer free of charge and, if you wish, in confidence, to assist you in exercising your data protection rights.

We reserve the right to amend this privacy policy to ensure that it always complies with the latest legal requirements, or to reflect changes to our services in the privacy policy, for example when introducing new services. The new privacy policy will then apply to your next visit.