Privacy Policy
a) Introduction
We take the protection of your data very seriously and strictly adhere to the applicable data protection laws. Personal data is only collected on this website to the extent technically and organizationally necessary. Under no circumstances will your data be passed on to third parties. The following statement provides you with an overview of how we ensure the protection of your personal data and what type of data is collected for what purpose.
To ensure the security of your data during the transmission process, we also use state-of-the-art SSL/TLS encryption methods.
b) Responsible body, data protection officer
Name and address of the responsible person
The person responsible within the meaning of the basic data protection regulation and other national data protection laws of the member states as well as other data protection regulations is the:
Northern Black Forest Tourism GmbH
Sonnenweg 5
75378 Bad Liebenzell
Phone: +49 7052 8169770
Fax: +49 7052 8169775
info@mein-schwarzwald.de
www.mein-schwarzwald.de
Represented by business executive:
René Skiba
c) General information on data processing
Extent of processing of personal data
In principle, we process personal data of our users only insofar as this is necessary to provide a functioning website and our content and services. The processing of personal data of our users takes place regularly only with the consent of the user. An exception applies to cases in which prior consent can not be obtained for reasons of fact and the processing of the data is permitted by law.
Legal basis for the processing of personal data
Insofar as we obtain the consent of the data subject for the processing of personal data, Art. 6 Para. 1 lit. a EU General Data Protection Regulation (GDPR) serves as the legal basis.
When processing personal data that is necessary for the performance of a contract to which the data subject is a party, Article 6 (1) lit. b GDPR as the legal basis. This also applies to processing operations that are necessary to carry out pre-contractual measures.
Insofar as the processing of personal data is necessary to fulfill a legal obligation to which our company is subject, Art. 6 Para. 1 lit. c GDPR as the legal basis.
In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6 para. 1 lit. d GDPR serves as the legal basis.
If processing is necessary to safeguard a legitimate interest of our company or a third party and if the interests, fundamental rights and freedoms of the person concerned do not outweigh the first-mentioned interest, Article 6 (1) lit. f GDPR as the legal basis for processing.
Data erasure and storage duration
The personal data of the data subject will be deleted or blocked as soon as the purpose of the storage is deleted. In addition, such storage may be provided for by the European or national legislator in EU regulations, laws or other regulations to which the controller is subject. Blocking or deletion of the data also takes place when a storage period prescribed by the standards mentioned expires, unless there is a need for further storage of the data for conclusion of a contract or fulfillment of the contract.
d) Creation of log files
Description and scope of data processing
Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing device. The web server access logs record which pages were accessed and when. They contain the following data: IP address, directory protection user, date, time, pages accessed, protocols, status code, data volume, referrer, user agent, and hostname accessed.
The IP addresses are stored anonymously. For this purpose, the last three digits are removed, i.e., 127.0.0.1 becomes 127.0.0.*. IPv6 addresses are also anonymized. The anonymized IP addresses are retained for 60 days. Information about the directory protection user is anonymized after one day.
Error logs, which record failed page requests, are deleted after seven days. These logs contain the error messages, the accessing IP address, and, depending on the error, the requested web page.
This data will not be stored together with other personal data of the user.
Legal basis for data processing
The legal basis for the temporary storage of the data and the log files is Article 6, Paragraph 1, Letter f GDPR.
Purpose of data processing
The IP address is stored in log files to ensure the website's functionality. We also use this data to optimize the website and to ensure the security of our IT systems. The data is not used for marketing purposes.
Our legitimate interest in data processing in accordance with Art. 6 Paragraph 1 lit. f GDPR.
Duration of storage
In the case of data being stored in log files, this occurs after a maximum of 90 days.
Opposition and removal possibility
The collection of data for the provision of the website and the storage of data in log files is essential for the operation of the website. Therefore, there is no possibility for the user to object.
e) Consent Management Platform
We use the Consent Management Tool Cookiebot from the company Cybot A/S, Havnegade 39, 1058 Copenhagen, Denmark, a company of Usercentrics A/S (hereinafter: Cookiebot) on our website.
Cookiebot is used to obtain and store your consent to the use of cookies. You can withdraw this consent at any time. The consent is stored for 12 months.
In this context, your browser may transmit personal data to cookiebot.com. The legal basis for this data processing is Article 6(1)(f) GDPR. The legitimate interest lies in ensuring the website functions correctly. The data will be deleted as soon as the purpose for which it was collected has been fulfilled. Further information on how the transmitted data is handled can be found in cookiebot.com's privacy policy: https://www.cookiebot.com/de/privacy-policy/
f) Contact form and email contact
Description and scope of data processing
There is a contact form on our website that can be used to contact us electronically. If a user makes use of this option, the data entered in the input mask will be transmitted to us and saved.
The following data is also stored at the time the message is sent: date and time the form was sent.
For the processing of the data in the context of the sending process your consent is obtained and referred to this privacy statement.
Alternatively, you can contact us via the provided email address. In this case, the personal data you transmit with your email will be stored. Please note, however, that the confidentiality of emails or other forms of electronic communication on the internet cannot be guaranteed. For confidential information, we therefore recommend using postal mail.
In this context, there is no disclosure of the data to third parties. The data is used exclusively for processing the conversation.
Legal basis for data processing
The legal basis for processing the data is Art. 6 Para. 1 lit. a GDPR.
The legal basis for the processing of the data that is transmitted in the course of sending an email is Art. 6 Para. 1 lit. f GDPR. If the aim of the email contact is to conclude a contract, the additional legal basis for processing is Art. 6 Para. 1 lit. b GDPR.
Purpose of data processing
The processing of the personal data from the input mask serves us only to process the contact. In the case of contact via e-mail, this also includes the required legitimate interest in the processing of the data.
The other personal data processed during the sending process serve to prevent misuse of the contact form and to ensure the security of our information technology systems.
Duration of storage
The data will be deleted as soon as it is no longer necessary for the purpose of its collection. For the personal data from the input form of the contact form and those sent by e-mail, this is the case when the respective conversation with the user has ended. The conversation is ended when it can be inferred from the circumstances that the relevant facts have been finally clarified.
Opposition and removal possibility
The user has the possibility at any time to revoke his consent to the processing of the personal data. If the user contacts us by e-mail, he may object to the storage of his personal data at any time. In such a case, the conversation can not continue.
The user also has the option to object to the storage of their personal data by post.
All personal data stored during the contact process will be deleted in these cases.
g) Order brochures
Description and scope of data processing
Our website includes a contact form that can be used to order informational materials electronically. If a user uses this option, the data entered in the input form will be transmitted to us and stored.
The following data is also stored at the time the message is sent: date and time the form was sent.
For the processing of the data in the context of the sending process your consent is obtained and referred to this privacy statement.
In this context, no data will be shared with third parties. The data will be used exclusively for contacting you by telephone.
Legal basis for data processing
The legal basis for processing the data is Art. 6 Para. 1 lit. a GDPR.
Purpose of data processing
The processing of personal data from the input form serves solely to process your contact request.
Duration of storage
The data will be deleted as soon as it is no longer needed for the purpose for which it was collected. For personal data from the contact form, this is the case when the respective conversation with the user has ended. A conversation is considered ended when it is clear from the circumstances that the matter in question has been resolved.
Opposition and removal possibility
The user has the right to withdraw their consent to the processing of their personal data at any time. In such a case, the conversation cannot be continued.
The user also has the option to object to the storage of their personal data by post.
All personal data stored during the contact process will be deleted in these cases.
h) Disclosure of personal data to third parties
CleverReach
We offer you the opportunity to subscribe to our newsletter on our website. If you have given us separate consent to inform you by email about our company's products and services, this processing is based on Article 6 Paragraph 1 Sentence 1 Letter a of the GDPR. By subscribing to the newsletter, you consent to us measuring your click and open behavior in order to optimize our newsletter delivery for you. If we process your personal data based on your consent, you can withdraw your consent at any time without affecting the lawfulness of the processing carried out before the withdrawal. If consent is withdrawn, we will cease the corresponding data processing.
If you no longer wish to receive our newsletter, you can easily unsubscribe at any time. This can be done via the unsubscribe link found in every newsletter email. Your data used for newsletter distribution will be deleted within 3 months of you unsubscribing, unless legal retention obligations prevent its deletion.
Google Web Fonts
This site uses so-called web fonts provided by Google for the uniform display of fonts. When you call up a page, your browser loads the required web fonts into your browser cache in order to display text and fonts correctly.
For this purpose, the browser you are using must connect to the Google servers. This gives Google knowledge that our website was accessed via your IP address. Google Web Fonts are used in the interest of a uniform and appealing presentation of our online offering. This represents a legitimate interest within the meaning of Article 6 (1) (f) GDPR.
If your browser does not support web fonts, a standard font will be used by your computer.
Further information about handling user data, can be found at https://developers.google.com/fonts/faq and in Google's privacy policy at https://www.google.com/policies/privacy/.
Font Awesome
Our website uses web fonts and icons provided by Fonticons, Inc. for the consistent display of fonts and icons. When you access a page, your browser loads the necessary web fonts and icons into its browser cache to display text, fonts, and icons correctly.
For this purpose, the browser you are using must connect to the servers of Fonticons, Inc. This allows Fonticons, Inc. to know that our website was accessed via your IP address. The use of Font Awesome is in the interest of a consistent and appealing presentation of our online content. This constitutes a legitimate interest within the meaning of Article 6(1)(f) GDPR.
If your browser does not support Font Awesome, a standard font from your computer will be used. For more information about Font Awesome, see [link to Font Awesome information]. https://fontawesome.com/help and in the privacy policy of Fonticons, Inc.: https://fontawesome.com/privacy.
Google translator
This website uses the Google Translate API to translate and display the text used on the page in other languages. When using this API, Google (Google Inc., 1600 Amphitheatre Parkway, Mountain View, California, 94043) also collects, processes, and uses data about how visitors use the features. For more information about Google's data processing, please see Google's privacy policy, which can be accessed at www.google.com/privacypolicy.html.
my.toubiz / TOMAS®
This website uses an interface to the mein.toubiz module from land in sicht AG (Wiesentalstr. 5, 79115 Freiburg) to allow users to book individual accommodations. The data collected during the booking process is used exclusively for providing this service.
Further information about data processing can be found in the privacy policy of land in sicht, which you can access at https://www.land-in-sicht.de/datenschutz can retrieve.
outdoor active
This website uses an interface to outdooractive (Outdooractive GmbH & Co. KG, Missener Straße 18, 87509 Immenstadt) to display hiking offers. Data is transferred via this interface for quantitative analysis. No personal data is collected.
Walls.io
Our website uses social media plugins and widgets from Walls.io . When these plugins are accessed, your IP address and cookie information are transmitted to Walls.io. Walls.io is operated by " Die Socialisten" Social Software Development GmbH in Vienna, Austria. You can find Walls.io's privacy policy at: https://walls.io/privacy . The privacy policy of "Die Socialisten" can be found at: https://die.socialisten.at/privacy/.
Google Analytics
General procedure for using Google Analytics
This website uses Google Analytics, a web analytics service provided by Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; "Google"). The service uses Universal Analytics. This allows data, sessions, and interactions across multiple devices to be assigned to a pseudonymous user ID, enabling the analysis of a user's activities across devices.
Google Analytics uses cookies. These are text files that are stored on your computer and enable an analysis of your use of the website. The information generated by the cookie about your use of this website is generally transmitted to and stored on a Google server in the USA.
In the case of IP anonymization activated on this website, your IP address will be shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity, and to provide other services relating to website activity and internet usage to the website operator. Our legitimate interest in data processing also lies in these purposes.
The legal basis for the use of Google Analytics is Section 15 Paragraph 3 of the German Telemedia Act (TMG) and Article 6 Paragraph 1 Letter f of the GDPR. The data we send, which is linked to cookies, user identifiers (e.g., user ID), or advertising IDs, is automatically deleted after 14 months. Data whose retention period has expired is automatically deleted once a month.
For more information about Terms of Use and Privacy, please see https://www.google.com/analytics/terms/de.html or https://policies.google.com/?hl=de.
You can prevent the storage of cookies by adjusting your browser settings; however, please note that in this case you may not be able to fully utilize all the functions of this website. Furthermore, you can prevent Google from collecting and processing data generated by the cookie and related to your use of the website (including your IP address) by downloading and installing the "Google Analytics Opt-out Browser Add-on" provided by Google ( https://tools.google.com/dlpage/gaoptout?hl=de ).
Opt-out cookies prevent the future collection of your data when you visit this website. To prevent tracking by Universal Analytics across multiple devices, you must perform the opt-out on all systems you use. Clicking here will set the opt-out cookie:
Disable Google Analytics
Google Ads, remarketing, enhanced conversions, audience lists and Google Signals
On our website we use various services within the framework of Google Ads, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).
Google Ads and Conversion Tracking
We use Google Ads to place advertisements in Google search results and on the Google Display Network. As part of Google Ads, we use conversion tracking to measure the success of our advertising campaigns. A cookie is set as soon as a user clicks on a Google ad. These cookies expire after 30 days and are not used for personal identification.
Enhanced Conversions
We also use Google Ads with enhanced conversions to more accurately attribute ad clicks to conversions. This may involve transmitting certain previously collected and hashed personal data (e.g., email address) to Google. This data is transmitted only in encrypted form and used solely to improve conversion measurement.
Google Remarketing & Audience Lists
Using Google Remarketing, we can show targeted ads to users who have already visited our website on other websites within the Google advertising network. To do this, a cookie is set when the user visits our website in order to recognize them.
Additionally, we use audience lists in Google Ads to target specific audiences based on their behavior or demographic characteristics. This data is pseudonymized and does not allow any direct identification of you personally.
Google signals
This website uses Google Signals, a feature of Google Analytics. This provides Analytics with additional information about users who have enabled personalized ads (e.g., cross-device user recognition and interest-based audiences). The data is aggregated and anonymized; no personally identifiable information is shared.
Legal basis
Your data is processed based on your consent pursuant to Art. 6 para. 1 lit. a GDPR, which you can grant via our cookie consent banner. You can withdraw your consent at any time.
Data transfer to third countries
Google may also process your data in the USA. There is currently an adequacy decision by the EU Commission ("EU-US Data Privacy Framework"), which Google LLC has joined. Nevertheless, a residual risk cannot be completely ruled out.
Further information
You can find more information about data protection at Google here:
https://policies.google.com/privacy?hl=de
etracker
The provider of this website uses services from etracker GmbH from Hamburg, Germany (www.etracker.com) for analyzing usage data. We do not use cookies for web analytics by default. If we do use analytics and optimization cookies, we will obtain your explicit consent separately beforehand. If this is the case and you agree, cookies will be used that enable statistical reach analysis of this website, performance measurement of our online marketing measures, and testing procedures to, for example, test and optimize different versions of our online offering or its components. Cookies are small text files that are stored on the user's device by the internet browser. etracker cookies do not contain any information that allows for the identification of a user.
The data generated by etracker is processed and stored by etracker exclusively in Germany on behalf of the provider of this website and is therefore subject to strict German and European data protection laws and standards. etracker has been independently audited and certified in this regard and has been awarded the data protection seal of approval. ePrivacyseal .
Data processing is carried out on the basis of the legal provisions of Article 6 Paragraph 1 Letter f (legitimate interest) of the General Data Protection Regulation (GDPR). Our legitimate interest within the meaning of the GDPR is the optimization of our online services and our website. Because the privacy of our visitors is important to us, data that could potentially identify an individual, such as IP addresses, login credentials, or device identifiers, is anonymized or pseudonymized as soon as possible. This data is not used for any other purpose, combined with other data, or shared with third parties.
You can object to the aforementioned data processing at any time. This objection will have no adverse consequences.
Further information on data protection at etracker can be found here. here.
Integration of Google reviews via the Elfsight plugin
The website provider uses embeds from the plugin provider Elfsight to display Google reviews.
The operator of Elfsight is Elfsight LLC, Russia, Tula, Lunacharskogo 1
The operator of Google is Google Ireland Limited, Ireland, Dublin 4
When you access Google reviews via the "View Google Reviews" button (opt-in), data is transferred to and from Elfsight and Google servers. This includes information about which of our pages you have visited.
If you are logged into your Elfsight account, you are allowing Elfsight to directly associate your browsing behavior with your personal profile. You can prevent this by logging out of your Elfsight account.
The use of Google reviews via the Elfsight plugin is in our legitimate interest in presenting our online offerings in an appealing manner, as defined in Article 6(1)(f) of the GDPR. Data is only exchanged after you have given your consent (opt-in).
Further information on how user data is handled can be found in Elfsight's privacy policy: https://elfsight.com/privacy-policy and in Google's privacy policy: https://policies.google.com/privacy?hl=de
The Trade Desk website pixel
The website provider uses the technology of The Trade Desk (TheTrade Desk Ltd, 1 Bartholomew Close, London EC1A 7BL, United Kingdom, https://www.thetradedesk.com/The Trade Desk collects and stores data for analysis, marketing, and optimization purposes. Pseudonymized user profiles are created from this data by The Trade Desk. Browser cookies may be used for this purpose. Pseudonymous online identification numbers (online IDs), such as cookie IDs, IP addresses, and advertising IDs, are used for data collection. No unique user-related data, such as name or address, is stored. The Trade Desk does not use the data collected using its technology to personally identify visitors to this website. The collected data may be used for remarketing purposes.
Further information on The Trade Desk's data protection policy can be found here: https://www.thetradedesk.com/general/privacy
Data collection and storage can be revoked at any time with effect for the future. You can object to this. To do so, click on the link and install the opt-out cookie. https://www.adsrvr.org/
This cookie only affects the browser on which it was installed and must not be deleted as long as data collection is objected to.
The pseudonymized data will be stored for 18 months.
Timetable widget from BEWEGT
On our website, we offer a timetable information service, a service provided by MENTZ GmbH (Grillparzerstraße 18, 81675 Munich). The following non-personal data may be provided when using the form:
Mobility restrictions
Start and finish locations
Departure/Arrival Time
Travel period
Transportation
Taking bicycles with you
Transfer information
Mobility restrictions
Furthermore, when using the form, the data specified under section IV. Use of our website, General Information will be processed.
Furthermore, the local storage of the respective browser is used to access the full functionality of the electronic timetable information system. In particular, the following information is stored, depending on the function used:
saveSettings: signals to the SL3+ on reload that search options have been saved and are located in local storage.
Settings: Search options such as desired means of transport, type of connection, maximum walking time, etc.
The last used map size in a detailed view (mobile view only)
The last used map size in the default view (desktop view only)
favorites: the suggestions declared as favorites in the start and destination input
lastODVSelected: the last selected elements in the start and destination input
Status of the "Update every minute" checkbox (departure monitor)
We embed the iFrame on our website based on our legitimate interest (Art. 6 para. 1 sentence 1 lit. f GDPR) in order to offer users the advantages of direct timetable queries.
You can delete the additional data collected and stored in local storage for improved usability by clearing the stored data in your browser. This is possible in the browser settings, depending on your browser provider. Furthermore, anonymous statistics are generated using the information you provide about your starting and destination stops, desired departure or arrival times, and the time of the query. No personal information can be linked to this data.
Further information on the processing of personal data by Mentz can be found here: https://www.mentz.net/datenschutz/
Use of an AI chatbot (guest bot)
Specific details regarding the use of an AI-powered chatbot (guest bot)
Affected data:
Chat input from users as well as technical data (e.g. IP address, timestamp, browser information).
Purpose of processing:
Provision of the AI-powered chatbot and automated responses based on previous inputs; ensuring technical operation and IT security.
Legal basis:
Consent pursuant to Art. 6 para. 1 lit. a GDPR; legitimate interests pursuant to Art. 6 para. 1 lit. f GDPR (efficient user communication as well as prevention, defense and tracking of attacks).
Categories of recipients:
Website operator; Gastbot (Rozaliia Tarnovetckaia) as data processor pursuant to Art. 28 GDPR; external service providers or other contractors (e.g. hosting or AI service providers).
Third country transfers:
As part of the contract execution, processors located outside the European Union (e.g., the USA) may also be used. This transfer is based on appropriate safeguards in accordance with Article 46 GDPR (in particular, EU Standard Contractual Clauses).
Duration of data storage:
The data will only be stored for as long as is necessary for the aforementioned purposes and will then be deleted or anonymized, unless there are legal retention obligations to the contrary.
i) Deleting and managing cookies
Depending on the browser you are using, you can manage the use of cookies. Instructions for common browsers are provided below.
Microsoft Explorer:
https://support.microsoft.com/de-de/help/17442/windows-internet-explorer-delete-manage-cookies
Firefox:
https://support.mozilla.org/de/kb/cookies-erlauben-und-ablehnen
Google Chrome:
https://support.google.com/chrome/answer/95647?hl=de&hlrm=en
Safari:
https://support.apple.com/de-de/guide/safari/sfri11471/mac
j) Rights of the data subject
right to information
You may ask the person in charge to confirm if personal data concerning you is processed by us.
If such processing is available, you can request information from the person responsible about the following information:
- the purposes for which the personal data are processed;
- the categories of personal data that are processed;
- the recipients or categories of recipients to whom the personal data relating to you have been disclosed or are still being disclosed;
- the planned duration of the storage of your personal data or, if specific information is not available, criteria for determining the duration of storage;
- the existence of a right to rectification or erasure of personal data concerning you, a right to restriction of processing by the controller or a right to object to such processing;
- the existence of a right of appeal to a supervisory authority;
- all available information on the source of the data if the personal data are not collected from the data subject;
- the existence of automated decision-making including profiling according to Art. 22 para. 1 and 4 DSGVO and - at least in these cases - meaningful information about the logic involved and the scope and intended impact of such processing on the data subject.
You have the right to request information about whether the personal data relating to you is being transmitted to a third country or to an international organization. In this context, you can request to be informed about the appropriate guarantees in accordance with. Art. 46 GDPR to be informed in connection with the transfer.
Right to rectification
You have a right to rectification and / or completion to the controller, provided the personal data you process is incorrect or incomplete. The responsible person must make the correction without delay.
Right to demand processing restrictions
You may request the restriction of the processing of your personal data under the following conditions:
- if you contest the accuracy of your personal information for a period of time that enables the controller to verify the accuracy of your personal information;
- the processing is unlawful and you refuse to delete the personal data and instead request the restriction of the use of the personal data;
- the controller no longer requires personal data for the purposes of processing, but you need them for the purposes of asserting, exercising or defending legal claims, or
- if you have filed an objection against the processing according to Art. 21 para. 1 DSGVO and it is not yet certain whether the legitimate reasons of the person responsible prevail over your reasons.
If the processing of personal data concerning you has been restricted, this data may only be used with your consent or for the purpose of asserting, exercising or defending legal claims or protecting the rights of another natural or legal person or for reasons of important public interest Union or a Member State.
If the restriction on processing has been restricted in accordance with the above conditions, the person responsible will inform you before the restriction is lifted.
Right to delete
deletion obligations
You may require the controller to delete your personal information without delay, and the controller is required to delete that information immediately if one of the following is true:
- Your personal data are no longer necessary for the purposes for which they were collected or otherwise processed.
- You revoke your consent to the processing gem. Art. 6 para. 1 lit. a or Art. 9 para. 2 lit. DSGVO and there is no other legal basis for processing.
- You gem gem. Art. 21 para. 1 DSGVO objection to the processing and there are no prior justifiable reasons for the processing, or you lay gem. Art. 21 para. 2 DSGVO objection to the processing.
- Your personal data has been processed unlawfully.
- The deletion of personal data concerning you is required to fulfill a legal obligation under Union law or the law of the Member States to which the controller is subject.
- The personal data relating to you were collected in relation to information society services offered pursuant to Art. 8 para. 1 DSGVO.
Information to third parties
If the person responsible has made the personal data concerning you public and is acc. According to Art. 17 Para. 1 GDPR, he shall take appropriate measures, including technical measures, taking into account the available technology and the implementation costs, to inform those responsible for data processing who process the personal data that you are the data subject You have requested that you delete all links to this personal data or copies or replications of this personal data.
exceptions
The right to erasure does not exist if the processing is necessary
- to exercise the right to freedom of expression and information;
- to fulfill a legal obligation required by the law of the Union or of the Member States to which the controller is subject, or to carry out a task of public interest or in the exercise of official authority conferred on the controller;
- for reasons of public interest in the field of public health in accordance with Art. 9 para. 2 lit. h and i and Art. 9 para. 3 DSGVO;
- for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes pursuant to Article 89(1) GDPR, insofar as the right referred to in the section “Right to erasure / obligation to erase” is likely to render impossible or seriously impair the achievement of the objectives of this processing, or
- to assert, exercise or defend legal claims.
Right to information
If you have the right of rectification, erasure or restriction of processing to the controller, he / she is obliged to notify all recipients to whom your personal data have been disclosed of this correction or deletion of the data or restriction of processing, unless: this proves to be impossible or involves a disproportionate effort.
You have a right to the person responsible to be informed about these recipients.
Right to data portability
You have the right to receive personally identifiable information you provide to the controller in a structured, common and machine-readable format. In addition, you have the right to transfer this data to another person without hindrance by the person responsible for providing the personal data, provided that
- the processing on a consent acc. Art. 6 para. 1 lit. a DSGVO or Art. 9 para. 2 lit. a DSGVO or on a contract acc. Art. 6 para. 1 lit. b DSGVO is based and
- the processing is done using automated procedures.
In exercising this right, you also have the right to obtain that your personal data relating to you are transmitted directly from one person to another, insofar as this is technically feasible. Freedoms and rights of other persons may not be affected.
The right to data portability does not apply to the processing of personal data necessary for the performance of a task in the public interest or in the exercise of official authority delegated to the controller.
Right of objection
You have the right, for reasons that arise from your particular situation, to object at any time to the processing of your personal data, which is based on Art. 6 Para. 1 lit. e or f DSGVO takes place to object; this also applies to profiling based on these provisions.
The controller will no longer process the personal data concerning you unless he can demonstrate compelling legitimate grounds for processing that outweigh your interests, rights and freedoms, or the processing is intended to assert, exercise or defend legal claims.
If the personal data relating to you are processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for the purpose of such advertising; this also applies to profiling insofar as it is associated with such direct mail.
If you object to processing for direct marketing purposes, your personal data will no longer be processed for these purposes.
You have the option, in the context of the use of information society services - regardless of the 2002 / 58 / EC directive - of exercising your right of opposition through automated procedures using technical specifications.
Right to revoke the data protection consent declaration
You have the right to revoke your data protection consent declaration at any time. The revocation of consent does not affect the legality of the processing carried out on the basis of the consent until the revocation.
Automated decision on an individual basis including profiling
You have the right not to be subjected to a decision based solely on automated processing - including profiling - that will have legal effect or similarly affect you in a similar manner. This does not apply if the decision
- is required for the conclusion or performance of a contract between you and the controller,
- is permissible on the basis of Union or Member State legislation to which the controller is subject, and that legislation contains appropriate measures to safeguard your rights and freedoms and your legitimate interests, or
- with your express consent.
However, these decisions may not be based on special categories of personal data according to Art. 9 Para. 1 GDPR, unless Art. 9 Para. 2 lit. a or g GDPR applies and appropriate measures have been taken to protect your rights and freedoms and your legitimate interests.
With respect to the cases referred to in (1) and (3), the controller shall take reasonable steps to uphold the rights and freedoms and your legitimate interests, including at least the right to obtain the intervention of a person by the controller, to express his / her own position and heard on challenge of the decision.
Right to complain to a supervisory authority
Without prejudice to any other administrative or judicial remedy, you shall have the right to complain to a supervisory authority, in particular in the Member State of its residence, place of work or place of alleged infringement, if you believe that the processing of the personal data concerning you is against the DSGVO violates.
The supervisory authority to which the complaint was submitted informs the complainant about the status and the results of the complaint, including the possibility of a judicial remedy according to Art. 78 GDPR.
k) Updating the privacy policy
This privacy policy is constantly being updated to reflect current features, technologies, and applicable law. Updates are made at irregular intervals. The privacy policy published on the website at any given time applies.
