Data Privacy | Therme Euskirchen

Contents

• 1. Name and address of the data controller 1
• 2. Name and address of the data protection officer 2
• 3.0.General information on data processing 2
  • 3.1 Scope of the processing of personal data 2
  • 3.2 Legal basis for the processing of personal data 2
  • 3.3 Data erasure and retention period 2
• 4 Provision of the website and creation of log files 3
  • 4.1 Description and scope of data processing 3
  • 4.2 Legal basis for data processing 3
  • 4.3 Purpose of data processing 3
  • 4.4 Retention period 3
  • 4.5 Options to object and have data erased 4
• 5 Use of cookies 4
  • 5.1 Description and scope of data processing 4
  • 5.2 Legal basis for data processing 5
  • 5.3 Purpose of processing 5
  • 5.4 Retention period 5
  • 5.5 Right to object and right to erasure 5
• 6 Newsletter 6
  • 6.1 Description and scope of data processing 6
  • 6.2 Legal basis for data processing 6
  • 6.3 Purpose of data processing 6
  • 6.4 Duration of storage 6
  • 6.5 Right to object and right to erasure 6
• 7 Registration 6
  • 7.1 Description and scope of data processing 6
  • 7.2 Legal basis for data processing 7
  • 7.3 Purpose of data processing 7
  • 7.4 Duration of storage 7
  • 7.5 Right to object and right to erasure 7
• 8 Contact form and contacting us by email 8
  • 8.1 Description and scope of data processing 8
  • 8.2 Legal basis 8
  • 8.3 Purpose of data processing 8
  • 8.4 Duration of storage 8
  • 8.5 Right to object and right to erasure 9
• 9 Third-party applications integrated into the website 9
  • 9.1 Marketing automation with HubSpot 9
  • 9.2 Google Tag Manager 11
  • 9.3 Web tracking with Google Analytics (GA 4) 11
  • 9.3.1 Scope of the processing of personal data 11
  • 9.3.2 Legal basis for the processing of personal data 12
  • 9.3.3 Purpose of data processing 12
  • 9.3.4 Duration of storage 12
  • 9.3.5 Options to object and have data erased 12
  • 9.3.6 Google Signals 13
  • 9.4 Google Web Fonts 13
  • 9.5 DoubleClick by Google 13
  • 9.6 Use of Cookiebot 14
  • 9.7 CloudFront 14
  • 9.8 Delivr.js 14
  • 9.9 Facebook 15
  • 9.10 Instagram 15
  • 9.11 Walls.io 15
  • 9.12 Meta Pixel 16
  • 9.13 Conversions API 16
  • 9.14 ajax.googleapis.com / jQuery 17
  • 9.15 Cloudflare.com 17
  • 9.16 Google Maps 17
  • 9.17 Google Remarketing 18
  • 9.18 Google reCAPTCHA 18
  • 9.19 The Trade Desk 18
  • 9.20 Userlike 19
  • 9.21 Use of YouTube videos 19
  • 9.22 Netigate 20
  • 9.23 Use of TikTok Ads 20
• 10 Social media presence 21
  • 10.1 Presence on Facebook 21
  • 10.2 Presence on Instagram 22
  • 10.3 Presence on TikTok 23
  • 10.4 Presence on YouTube 23
• 11 Online shop 24
• 12 Thermensquad application 25
  • 12.1 Description and scope of data processing 25
  • 12.2 Legal basis 25
  • 12.3 Purpose of data processing 25
  • 12.4 Duration of storage 26
• 13 Payment services 26
  • 13.1 Payment by Mastercard 26
  • 13.2 Payment by Visa 26
  • 13.3 Payment by PayPal 26
  • 13.4 Payment by Sofortüberweisung 27
  • 13.5 Payment by Amazon Pay 27
  • 13.6 Payment by Apple Pay 28
• 14 Direct marketing 28
  • 14.1 Description and scope of data processing 28
  • 14.2 Legal basis for data processing 28
  • 14.3 Purpose of data processing 29
  • 14.4 Duration of storage 29
  • 14.5 Options to object and have data erased 29
• 15 Processing outside the scope of joint responsibility 29
  • 15.1 Registration for recruitment days 29
    • 15.1.1 Description and scope of data processing 29
    • 15.1.2 Legal basis for data processing 29
    • 15.1.3 Purpose of data processing 30
    • 15.1.4 Duration of storage 30
    • 15.1.5 Right to object and right to erasure 30
  • 15.2 Application for a Thermencard / Premiumcard 30
    • 15.2.1 Handling of processing 30
    • 15.2.2 Legal basis for data processing 30
    • 15.2.3 Recipients 31
    • 15.2.4 Retention period 31
    • 15.2.5 Transfer to third countries 31
    • 15.2.6 Provision mandatory or necessary 31
• 16 Legal defence and enforcement 32
  • 16.1 Description and scope of data processing 32
  • 16.2 Purpose of data processing 32
  • 16.3 Duration of storage 32
  • 16.4 Options for objection and erasure 32
• 17 Categories of recipients 32
• 18 Rights of data subjects 32
  • 18.1 Right of access 32
  • 18.2 Right to rectification 33
  • 18.3 Right to restriction of processing 33
  • 18.4 Right to erasure 34
  • 18.5 Right to be informed 35
  • 18.6 Right to data portability 35
  • 18.7 Right to object 36
  • 18.8 Right to withdraw consent under data protection law 36
  • 18.9 Automated decision-making in individual cases, including profiling 36
  • 18.10 Right to lodge a complaint with a supervisory authority 37
• 19 Note on the privacy policy 37

1) Contact details of the controller

WUND Holding GmbH, Badeparadies Schwarzwald TN GmbH, Badewelt Sinsheim GmbH, Thermen & Badewelt Euskirchen GmbH and BLUPHORIA GmbH act as joint controllers with regard to the processing of personal data in the area of 'Central Customer Management' in accordance with Article 26 of the GDPR.
Your point of contact for the purposes of the European General Data Protection Regulation (GDPR) and other national data protection laws of the Member States, as well as other data protection provisions, are:

Thermen & Badewelt Euskirchen GmbH
Thermenallee 1 (Stresemannstraße 999)
D-53879 Euskirchen
Telefon: +49 (0) 2251 / 1485-0
E-Mail: info@badewelt-euskirchen.de 

Badeparadies Schwarzwald TN GmbH

Am Badeparadies 1
79822 Titisee-Neustadt
Telefon: +49 (0) 7651 / 9360-333
shop@badeparadies-schwarzwald.de 

WUND Holding GmbH
Bergheimer Straße 3
88677 Markdorf
Telefon: +49 (0) 7541 / 206-0
E-Mail: info@wund.de 

Badewelt Sinsheim GmbH
Badewelt 1
94889 Sinsheim
Telefon: +49 (0) 7261 / 4028-0
E-Mail: info@badewelt-sinsheim.de 

Therme Horizon GRS (ehem. BLUPHORIA GmbH)
Luisenstr. 14
80333 München
Telefon: +49 (0) 7544 / 96591-0
E-Mail: info@bluphoria.de 

(hereinafter referred to as "we" or "our")

2) Contact details of the data protection officer

The protection of your personal data is of great importance to us. To express this importance, we have commissioned a consulting firm specializing in data protection and data security to take on these central issues. We are advised by:

actago GmbH
Weidenstraße 66
94405 Landau an der Isar

E-Mail: datenschutz@wund.de

3) General information on data processing

3.1 Scope of the processing of personal data
As a general rule, we process your personal data only to the extent necessary for the provision of our services. The processing of your personal data is normally carried out solely on the basis of your consent. An exception applies in cases where it is not possible to obtain consent in advance for practical reasons, or where the processing of your personal data is permitted by law.

3.2 Legal basis for the processing of personal data
Where we seek your consent to process personal data, Article 6(1)(a) of the GDPR serves as our legal basis.
Where the processing of personal data is necessary for the performance of a contract between you and us, Article 6(1)(b) of the GDPR serves as our legal basis. This also applies to processing operations necessary for the implementation of pre-contractual measures.
Where the processing of personal data is necessary to comply with a legal obligation to which we are subject, Article 6(1)(c) of the GDPR serves as our legal basis.
Where the processing of personal data is necessary to protect your vital interests or those of another natural person, Article 6(1)(d) of the GDPR serves as our legal basis.
Where processing is necessary to safeguard a legitimate interest of ours or of a third party, and your interests, fundamental rights and freedoms do not override the former interest, Article 6(1)(f) of the GDPR serves as the legal basis for the processing.

3.3 Data erasure and retention period
Your personal data will be erased or blocked as soon as the purpose for which it was stored no longer applies. Data may also be retained if this is provided for by European or national legislation in EU regulations, laws or other provisions to which we are subject. Data will also be blocked or deleted when a retention period prescribed by the aforementioned standards expires, unless there is a need to continue storing the data for the conclusion or performance of a contract.

 

4) Provision of the website and creation of log files

4.1 Description and scope of data processing
Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing device. The following data is collected in this process:
• the browser types and versions used,
• the operating system used by the accessing system,
• the website from which an accessing system reaches our website (known as a referrer),
• the sub-pages on our website accessed via an accessing system,
• the date and time of access to the website,
• an Internet Protocol address (IP address),
• the Internet service provider of the accessing system, and
• other similar data and information used for security purposes in the event of attacks on our information technology systems.

The data is also stored in our system's log files. This data is not stored together with any other personal data relating to the user.

4.2 Legal basis for data processing
The legal basis for the processing of your personal data in connection with the provision of the website and the creation of log files is Article 6(1)(f) of the GDPR.
4.3 Purpose of data processing
The temporary storage of your personal data by us is necessary to enable the website to be delivered to your computer. To this end, your personal data must be stored for the duration of the session.
Your personal data is stored in log files to ensure the website functions properly. Furthermore, we use your personal data to optimise the website and to ensure the security of our IT systems. Your personal data is not analysed for marketing purposes in this context.
These purposes also constitute our legitimate interest in data processing pursuant to Article 6(1)(f) of the GDPR.

4.4 Duration of storage
Your personal data will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected. Where your personal data is collected for the purpose of providing the website, this is the case as soon as the relevant session has ended.
Where your personal data is stored in log files, it will be deleted after seven days at the latest. Storage beyond this period is possible. In this case, your personal data will be deleted or anonymised so that it is no longer possible to identify the client that accessed the site.
4.5 Options to object and have data removed
The collection of your personal data for the purpose of providing the website and the storage of your personal data in log files is strictly necessary for the operation of the website. Consequently, you have no right to object.

5) Use of cookies

5.1 Description and scope of data processing
Our website uses cookies. Cookies are text files that are stored in the web browser or by the web browser on the user's computer system. When a user visits a website, a cookie may be stored on the user's operating system. This cookie contains a distinctive string of characters that enables the browser to be uniquely identified when the website is visited again.
When you access this website, we store cookies (text files) on your device that remain valid for the duration of your visit to the website ('session cookies'). We use these exclusively whilst you are visiting our website. Once your visit has ended, your browser will automatically delete these cookies.
When you access this website, we store cookies on your device. These are valid for:

Name: Storage period:
• TDCPM 1 Jahr
• TDID 1 Jahr
• _fbp 3 Monate
• _ga 2 Jahre
• _ga_# 2 Jahre
• _gat_ 1 Tag
• _gid 1 Tag
• collect Ende der Session
• ads/ga-audiences Ende der Session
• CookieConsent 1 Jahr
• PHPSESSID Ende der Session
• SERVERID Ende der Session
• AWSALBCORS 6 Tage
• rc::a Persistent
• rc::c Ende der Session
• __cf_bm 1 Tag
• loglevel:userlike Persistent
• accomodationIds-# 1 Tag
• td Ende der Session
• __ptq.gif Ende der Session
• mtpConfigFeed# Persistent
• mtpConfigFeedBase# Persistent
• mtpDeckchairSprite# Persistent
• mtpTemplates# Persistent
• mtpTranslations# Persistent
• mtracking.gif Ende der Session
• __hssc Ende der Session
• __hssrc Ende der Session
• __hstc 6 Monate
• hubspotutk 6 Monate

We use these to improve the user experience on the website and to offer visitors more features. Most browsers are set to accept cookies, but you can disable this function via your browser settings, either for the current session or permanently.
5.2 Legal basis for data processing
The legal basis for the processing of your personal data in connection with the use of technically necessary cookies is Section 25(2)(2) of the TTDSG and Article 6(1)(f) of the GDPR.
For cookies that are not technically necessary, the legal basis is derived from Section 25(1) of the TTDSG and Article 6(1)(a) of the GDPR.

5.3 Purpose of processing
The use of technically necessary cookies serves to make it easier for you to use our website. Some functions of our website cannot be provided without the use of cookies. For these, it is necessary for your web browser to be recognised even after you have navigated to another page. The user data collected by technically necessary cookies is not used to create user profiles.
Analytics cookies are used to improve the quality of our website and its content. These cookies enable us to understand how the website is used, allowing us to continuously optimise our service.
These purposes also constitute our legitimate interest in processing your personal data in accordance with Article 6(1)(f) of the GDPR.
5.4 Duration of storage
Your personal data will be erased as soon as it is no longer required to fulfil the purpose for which it was collected; this is particularly the case when cookies are deactivated.

5.5 Option to object and delete
Cookies are stored on your computer and transmitted from it to our website. You therefore have full control over the use of cookies. By changing the settings in your web browser, you can disable or restrict the transmission of cookies. You can delete cookies that have already been stored at any time. This can also be done automatically. If cookies are disabled for our website, you may no longer be able to make full use of all the website's functions.
The transmission of Flash cookies cannot be prevented via your web browser settings. To do this, you will need to change the settings in Adobe Flash Player.

6 Newsletter
6.1 Description and scope of data processing
Our website offers a newsletter through which we keep you informed about news and special offers. If you wish to subscribe to the newsletter, you must provide a valid email address. By subscribing to the newsletter, you agree to receive it and to the procedures set out herein.
The following details must be provided to subscribe to the newsletter:
• Email address (mandatory field)
• Title
• First name
• Surname
• Date of birth
The newsletter is sent by the provider HubSpot, based at 25 First Street, Cambridge, MA 02141, USA. Information on the mailing service provider's privacy policy is available at: https://legal.hubspot.com/de/privacy-policy
6.2 Legal basis for data processing
The legal basis for the processing of your personal data in connection with the newsletter is, where consent has been given, Article 6(1)(a) of the GDPR, or, following the sale of goods or services, the statutory authorisation under Section 7(3) of the Unfair Competition Act (UWG).
6.3 Purpose of data processing
The collection of your personal data serves the purpose of sending you the newsletter. The purpose of processing your personal data in connection with the newsletter is to promote the sale of goods or services.

6.4 Duration of storage
Your personal data will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected. Your personal data will therefore be stored for as long as your newsletter subscription remains active.
6.5 Right to object and right to erasure
You may cancel your newsletter subscription at any time. A link for this purpose is included in every newsletter. Cancelling your subscription also allows you to withdraw your consent.

7) Registration

7.1 Description and scope of data processing
You must register on our website to speed up the conclusion of the contract. The processing of your personal data therefore contributes to the performance of the contract or to the implementation of pre-contractual measures.
The following data is stored during registration:
• Title*
• First name*
• Surname*
• Email*
• Confirm email*
• Telephone*
• Street*
• House number*
• Postcode*
• Town/city*
• Country*
*Mandatory field
Reference is made to this privacy policy in relation to the processing of data as part of the registration process. Registration is carried out via the provider HubSpot, with its registered office at 25 First Street, Cambridge, MA 02141, USA. Information on the service provider's privacy policy is available at: https://legal.hubspot.com/de/privacy-policy
7.2 Legal basis for data processing
The legal basis for the processing of your personal data as part of the registration process is Article 6(1)(b) of the GDPR.
7.3 Purpose of data processing
Your registration facilitates the conclusion of contracts between you and us. The processing of your personal data as part of the registration process is therefore necessary for the performance of a contract between you and us or for the implementation of pre-contractual measures.

7.4 Duration of storage
Your data will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected. In the case of data collected during the registration process for the purpose of fulfilling a contract or carrying out pre-contractual measures, this is the case when your personal data is no longer required for the performance of the contract. Even after the contract has been concluded, it may still be necessary to store the contractual partner's personal data in order to comply with contractual or statutory obligations.
7.5 Right to object and right to erasure
You may cancel your registration at any time. You may have your stored personal data amended at any time. If your personal data is required for the performance of a contract or for the implementation of pre-contractual measures, early deletion of your personal data is only possible insofar as no contractual or statutory obligations preclude such deletion.

8 Contact form and contacting us by email
8.1 Description and scope of data processing
Our website features a contact form which can be used to contact us electronically. If you use this option, the data entered in the form will be transmitted to us and stored. This data comprises:
• First name*
• Surname*
• Street
• House number
• Town/city
• Postcode
• Country
• Email address*
• Telephone number
• Your message*
*Mandatory field
Your consent to the processing of this data is obtained as part of the submission process, and reference is made to this privacy policy.
Alternatively, you may contact us via the email address provided. In this case, the personal data you provide in your email will be stored. In this context, the data will not be passed on to third parties. The data will be used exclusively for the purpose of handling the correspondence.
8.2 Legal basis
The legal basis for the processing of your personal data, which is transmitted when you contact us via the contact form or by email, is Article 6(1)(f) of the GDPR. If the purpose of contacting us via the contact form or by email is to conclude a contract, Article 6(1)(b) of the GDPR constitutes an additional legal basis for the processing.

8.3 Purpose of data processing
The processing of your personal data when you contact us via the contact form or by email is carried out solely for the purpose of handling your enquiry.
8.4 Retention period
Your personal data will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected.
For personal data entered via the contact form and that sent by email, this is the case once the conversation has ended. The conversation is deemed to have ended when it is clear from the circumstances that the matter in question has been conclusively resolved.
Any additional personal data collected during the submission process will be deleted no later than seven days after submission.
8.5 Options to object and have data erased
You may at any time object, with future effect, to the processing of your personal data in connection with contacting us via the contact form or by email. In such a case, the conversation between you and us cannot be continued. All personal data stored in the course of establishing contact will be deleted in this instance.

9 Third-party applications integrated into the website
9.1 Marketing automation with HubSpot
We use the HubSpot service on this website for various purposes. HubSpot is a US-based software company with its registered office at 25 First Street, Cambridge, MA 02141, USA.
HubSpot is an integrated software solution that enables us to manage various aspects of our online marketing. These include, amongst others:
• Email marketing / newsletter distribution via various subscription models
• Social media publishing & reporting
• Reporting
• Contact management (e.g. user segmentation & CRM)
• Landing pages
• Contact forms
• 'MyBLUPHORIA' loyalty points programme

Our registration service enables visitors to our website to find out more about our company, download content and provide their contact details and other demographic information. This information, together with the content of our website, is stored on servers belonging to the Thermengruppe Josef Wund in Germany. Access by HubSpot is permitted only under strict conditions. We may use this data to contact visitors to our website and to determine which of our company's services are of interest to them. All information we collect is subject to this privacy policy. We use all collected information solely to optimise our marketing activities and to contact interested visitors to our website.
HubSpot tracks visitors using browser cookies. Every time a visitor lands on your website, the HubSpot software checks whether a tracking cookie is present. If no cookie is present, one is assigned to the user. This cookie logs all the pages that the user subsequently visits.
As part of the optimisation of our marketing activities, the following data may be collected and processed via HubSpot:

Geographical location
• Browser type
• Navigation information
• Referrer URL
• Performance data
• Information about how often the application is used
• Mobile app data
• Login details for the HubSpot subscription service
• Files viewed on the site
• Domain names
• Pages viewed
• Aggregated usage
• Operating system version
• Internet service provider
• IP address
• Device identifier
• Duration of visit
• Where the application was downloaded from
• Operating system
• Events occurring within the application
• Access times
• Clickstream data
• Device model and version
In addition, we also use HubSpot to provide contact forms.
The legal basis for the processing is your consent in accordance with Article 6(1)(a) of the GDPR. If you do not wish the aforementioned data to be collected and processed via HubSpot, you may withhold your consent or withdraw it at any time with future effect.

Personal data will be retained for as long as is necessary to fulfil the purpose of processing. The data will be deleted as soon as it is no longer required to fulfil that purpose. In the context of processing via HubSpot, data may be transferred to the USA.
The new data protection framework ('EU-US Data Privacy Framework') promotes secure data transfers between the EU and the US, thereby addressing the data protection concerns that have existed since the European Court of Justice's Schrems II ruling. However, this only applies if the companies or organisations to which personal data is transferred are certified under the new agreement. Through certification, US companies undertake to comply with certain data protection obligations, which are modelled on those set out in the European GDPR. HubSpot is a certified company under the new agreement. You can view this here: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?id=a2zt0000000TN8pAAG&status=Active

Furthermore, the security of the transfer is also safeguarded by so-called standard contractual clauses, which ensure that the processing of personal data is subject to a level of security that complies with the GDPR. Should the standard contractual clauses prove insufficient to ensure an adequate level of security, your consent may serve as the legal basis for the transfer to third countries in accordance with Article 49(1)(a) of the GDPR.
The personal data we collect via HubSpot may be used for all affiliated Therme within the Josef Wund Therme Group (WUND Holding GmbH, Badeparadies Schwarzwald, Ther-men & Badewelt Sinsheim, Thermen & Badewelt Euskirchen, Therme Horizon GRS (formerly BLUPHO-RIA GmbH) (within the meaning of Article 26 of the GDPR as joint controllers) for the purpose of sending cross-site marketing communications, etc. The legal basis for this is Article 6(1)(a), (b) and (f) of the GDPR. Processing takes place only within the scope of the consent given for the respective thermal Therme whose newsletters you have subscribed to.
Further information on HubSpot can be found at: https://legal.hubspot.com/de/privacy-policy

9.2 Google Tag Manager
We use Google Tag Manager, provided by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; "Google"), on our website. If you are habitually resident in the European Economic Area or Switzerland, Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) is the data controller responsible for your data. Google Ireland Limited is therefore the Google affiliate responsible for processing your data and ensuring compliance with applicable data protection laws.
This application manages JavaScript tags and HTML tags, which are used in particular to implement tracking and analytics tools. The purpose of data processing is to tailor the design of our website to users' needs and to optimise it.
Google Tag Manager itself does not store cookies, nor does it process personal data. However, it enables the triggering of other tags that may collect and process personal data.
Further information on terms of use and data protection can be found here: https://www.google.com/intl/de/tagmanager/use-policy.html

9.3 Web tracking with Google Analytics (GA 4)
9.3.1 Scope of the processing of personal data
This website uses Google Analytics 4, Google's latest web analytics service. This is provided by Google Ireland Limited (Gordon House, 4 Barrow Street, Dublin, D04 E5W5, Ireland). We use Google Analytics to analyse our users' browsing behaviour.
Google Analytics uses so-called 'cookies', which are text files stored on your computer that enable an analysis of your use of the website.

The information generated by the cookie regarding your use of this website is usually stored on a server within the EU and transmitted to a Google server in the USA. With Google Analytics 4, IP address anonymisation is enabled by default. As a result of IP anonymisation, your IP address is truncated by Google within Member States of the European Union or in other signatory states to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there. By using the code "anonymizeIp", we enable the anonymised collection of IP addresses (so-called IP masking). The software runs exclusively on our website's servers. Users' personal data is stored only there. The data is not passed on to third parties.
During your visit to the website, your user behaviour is recorded in the form of 'events'. Events may include:

• Page views
• First visit to the website
• Start of the session
• Your 'click path', interaction with the website
• Scrolls (whenever a user scrolls to the bottom of the page (90%))
• Clicks on external links
• Internal search queries
• Interaction with videos
• File downloads
• Adverts viewed / clicked on
• Language setting
The following is also recorded:
• Your approximate location (region)
• Your IP address (in truncated form)
• Technical information about your browser and the devices you use (e.g. language setting, screen resolution)
• Your internet service provider
• The referrer URL (the website or advertising channel via which you arrived at this website)
We use Google Signals. This enables Google Analytics to collect additional information about users who have enabled personalised adverts (interests and demographic data), and adverts can be served to these users in cross-device remarketing campaigns.
9.3.2 Legal basis for the processing of personal data
The legal basis for the processing of your personal data is Article 6(1)(a) of the GDPR.

9.3.3 Purpose of data processing
On behalf of the operator of this website, Google will use this information to evaluate your use of the website and to compile reports on website activity. The reports provided by Google Analytics are used to analyse the performance of our website and the success of our marketing campaigns.
9.3.4 Retention period
The data we send, which is linked to cookies, is automatically deleted after 14 or 26 months. Data that has reached the end of its retention period is automatically deleted once a month.
9.3.5 Options to object and delete
You may withdraw your consent at any time with future effect by accessing your browser's cookie settings and changing your selection there. The lawfulness of the processing carried out on the basis of your consent up until the time of withdrawal remains unaffected.

You can also prevent cookies from being stored in the first place by adjusting the settings in your browser software accordingly. However, if you configure your browser to reject all cookies, this may result in restricted functionality on this and other websites. You can also prevent the collection of data generated by the cookie and relating to your use of the website (including your IP address) by Google, as well as the processing of this data by Google, by:
• do not give your consent to the setting of the cookie, or
download and install the browser add-on to disable Google Analytics (https://tools.google.com/dlpage/gaoptout?hl=de).
• Further information on the terms of use for Google Analytics and Google's privacy policy can be found at https://marketingplatform.google.com/about/analytics/terms/de/ and at https://policies.google.com/?hl=de

9.3.6 Google Signals
This website actively uses Google Signals in conjunction with Google Analytics 4. This updates the existing Google Analytics features (advertising reports, remarketing, cross-device reports and interest-based reports, including demographic characteristics) to create a consolidated profile of your anonymised data, provided you have enabled personalised adverts in your Google Account.
This constitutes cross-device tracking. This means that your data can be analysed across different devices. By enabling Google Signals, data is collected and linked to your Google Account. Thanks to the activation of Google Signals, we can launch cross-device marketing campaigns.
These analyses also help us to better assess your behaviour, preferences and interests. This enables us to optimise and tailor our services and products. The data collected is stored for 14 months and then expires. Please note that this data collection only takes place if you have enabled personalised advertising in your Google Account. The data is always stored anonymously and transferred to the USA. You can also manage or delete this data in your Google Account.
Further information on the terms of use and data protection can be found at:
https://policies.google.com/privacy?hl=de

9.4 Google Web Fonts
To ensure consistent font display, this website may use what are known as Google Web Fonts.
When these fonts are used, your browser downloads the required fonts from our website system. These are then temporarily stored in what is known as the browser cache to ensure the fonts are displayed correctly.
Your browser does not establish a connection to Google's servers in the process. This ensures that Google does not gain any knowledge of your visit or your IP address.

9.5 DoubleClick by Google
This website contains components from DoubleClick by Google. DoubleClick is a trademark of Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), under which specialised online marketing solutions are marketed to advertising agencies and publishers.

DoubleClick by Google transmits data to the DoubleClick server with every impression, as well as with clicks or other activities. Each of these data transmissions triggers a cookie request to your browser. If the browser accepts this request, DoubleClick sets a cookie on your IT system. The purpose of the cookie is to optimise and display advertising. Among other things, the cookie is used to serve and display adverts relevant to the user, as well as to generate reports on advertising campaigns or to improve them. Furthermore, the cookie serves to prevent the same advert from being displayed multiple times.
DoubleClick uses a cookie ID, which is required to carry out the technical process. The cookie ID is needed, for example, to display an advert in a browser. DoubleClick can also use the cookie ID to record which adverts have already been displayed in a browser, in order to prevent duplicate displays. Furthermore, the cookie ID enables DoubleClick to track conversions.

A DoubleClick cookie does not contain any personal data. However, a DoubleClick cookie may contain additional campaign identifiers. A campaign identifier is used to identify the campaigns with which you have already come into contact.
Each time you visit one of the individual pages on this website, which is operated by us and on which a DoubleClick component has been integrated, the internet browser on your IT system is prompted by the relevant DoubleClick component to transmit data to Google for the purposes of online advertising and commission settlement. As part of this technical process, Google receives data which it also uses to calculate commission payments. Among other things, Google can track that you have clicked on certain links on our website.
You can prevent DoubleClick and our website from setting cookies at any time by adjusting the settings in your web browser accordingly. Furthermore, cookies that have already been set can be deleted at any time via your web browser or other software programmes.
You have given your consent to this via our opt-in cookie banner in accordance with Article 6(1)(a) of the GDPR.
Further information and the applicable privacy policy of DoubleClick by Google can be found at www.google.com/intl/de/policies/.

9.6 Use of Cookiebot
We use features provided by Cookiebot on our website. Cookiebot is operated by Usercentrics A/S, Havnegade 39, 1058 Copenhagen, DK. Among other things, Cookiebot enables us to provide you with a comprehensive cookie notice (also known as a cookie banner or cookie notice). By using this feature, data relating to you may be sent to, stored by and processed by Cookiebot or Cybot.
You have the right to access and delete your personal data at any time. You can prevent the collection and storage of data, for example, by refusing the use of cookies via the cookie notice.
Further information can be found at: https://www.cookiebot.com/de/privacy-policy/

9.7 CloudFront
This website uses the CloudFront Content Delivery Network (CDN). This is a service provided by Amazon Web Services Inc., 410 Terry Avenue North, Seattle, WA 98109-5210. The CloudFront CDN makes copies of a website's data available on various Amazon Web Services (AWS) servers distributed worldwide. This results in faster website loading times, greater reliability and enhanced protection against data loss. Some of the images and videos embedded on this website are retrieved from the CloudFront CDN when the page is accessed. When this occurs, information about your use of our website (such as your IP address) is transferred to Amazon's servers outside the EU and stored there. This takes place as soon as you access our website. The legal basis for the use of CloudFront is the user's consent in accordance with Article 6(1)(a) of the GDPR. The current privacy policy of Amazon Web Services can be found at: https://aws.amazon.com/de/privacy/

9.8 Delivr.js
This site uses a so-called "Content Delivery Network" (CDN) provided by jsDelivr. The provider is Prospect One sp.z o.o., Królewska 65A/1, 30-081 Kraków, Poland (hereinafter referred to as "JSDelivr").
A CDN is a service that enables the content of our website – in particular large media files such as graphics or scripts – to be delivered more quickly via a network of regionally distributed servers connected via the internet. Technically, this involves routing the transfer of information between your browser and our website via the JSDelivr network. This enables JSDelivr to analyse the data traffic between your browser and our website and to act as a filter between our servers and potentially malicious data traffic from the internet. In doing so, JSDelivr may also use cookies; however, these are used solely for the purpose described here. User data is processed for the aforementioned purposes and to maintain the security and functionality of the CDN.

To this end, the browser you are using must establish a connection to the CDN's servers. As a result, the CDN becomes aware that our website has been accessed via your IP address.
The legal basis for the use of Delivr.js is the user's consent in accordance with Article 6(1)(a) of the GDPR. Further information can be found in jsDelivr's privacy policy: https://www.jsdelivr.com/privacy-policy-jsdelivr-com
9.9 Facebook
Our website uses plugins from the Facebook network, which is operated by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ('Meta').
When you click on the Facebook button, the plugin establishes a direct connection between your browser and the Facebook server. This transmits information to Facebook that you have visited our site using your IP address.
We are not aware of the purpose and scope of the data collection, nor of the further processing and use of this data by Facebook. In this regard, and with regard to your rights and settings options for protecting your privacy, we ask you to refer to Instagram's relevant privacy policy: https://de-de.facebook.com/privacy/policy

 9.10 Instagram
Our website uses plugins from the Instagram network, which is operated by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ('Meta').
When you click on the Instagram button, the plugin establishes a direct connection between your browser and the Instagram server. This transmits information to Instagram that you have visited our site using your IP address.
We are not aware of the purpose and scope of the data collection, nor of the further processing and use of this data by Instagram. We ask you to refer to Instagram's privacy policy for further information on this matter, as well as regarding your rights and settings options for protecting your privacy: https://privacycenter.instagram.com/policy

9.11 Walls.io
Our website uses social media plugins and widgets from Walls.io. When these plugins are accessed, your IP address and cookie information are transmitted to Walls.io; this is done solely for technical reasons necessary to provide the service. This data is stored by Walls.io in Europe only and is not passed on to third parties.
We use Walls.io plugins to display a social media wall on our website. Walls.io aggregates content from over 15 platforms, including Facebook, Twitter, Instagram, YouTube and Pinterest. This content is published live on our website. For further information on data processing by Walls.io, please refer to Walls.io's privacy policy at https://walls.io/privacy. Walls.io is operated by 'Die Socialisten' Social Software Development GmbH, Andreasgasse 6, Top 1, 1070 Vienna, Austria. By using our website, you consent to the collection and processing of information by Social Software Development GmbH as described above. You can restrict or completely prevent Walls.io from running on our websites by adjusting your browser settings. However, you will then not be able to use the social media wall on our website.

9.12 Meta Pixel
Provided that you have given us your explicit consent (Art. 6(1)(a) GDPR) by clicking the button provided for this purpose, we use the "Meta Pixel" from Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, on our website. This enables us to track users' behaviour after they have viewed or clicked on a Facebook advert.

This process is used to evaluate the effectiveness of Facebook adverts for statistical and market research purposes and can help to optimise future advertising campaigns. The data collected is anonymous to us; therefore, it does not allow us to identify individual users. However, the data is stored and processed by Facebook, meaning that a link to the relevant user profile is possible and Facebook may use the data for its own advertising purposes, in accordance with the Facebook Data Use Policy (https://www.facebook.com/about/privacy/).
By giving your consent, you allow Facebook and its partners to display adverts on and off Facebook. A cookie may also be stored on your computer for these purposes. Consent to the use of the Meta Pixel may only be given by users aged 16 or over. If you are younger, please ask your parents or guardians for permission. To object to the use of cookies on your computer in general, you can configure your web browser so that no further cookies can be stored on your computer in future, or so that cookies already stored are deleted. However, disabling all cookies may mean that some functions on our website can no longer be used. You can also disable the use of cookies by third-party providers, such as Meta, on the following Digital Advertising Alliance website: http://www.aboutads.info/choices/
9.13 Conversions API
We use the Conversions API on this website. This is a server-side event tracking tool. The service is provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland.
With the Conversions API, data is still collected on the client side and processed further on our web server – however, data collection via the API continues to function even if the Meta pixel is blocked on the client side. A tracking code is then executed on the server, which sends the collected events to the actual API on Meta's servers.
The legal basis for the processing of your personal data in connection with the use of the Conversions API is Article 6(1)(a) of the GDPR.

This is where the data from the API and that from the Meta Pixel are combined – the Conversions API therefore complements the tracking carried out by the Meta Pixel. Further information can be found at: https://www.facebook.com/business/help/2041148702652965?id=818859032317965
Further information from the third-party provider regarding data protection can be found on the following Facebook website: https://www.facebook.com/about/privacy. Information on the Facebook Pixel can be found on the following Facebook website: https://www.facebook.com/business/help/651294705016616

9.14 ajax.googleapis.com / jQuery
We use the jQuery JavaScript library on our website. To speed up the loading of our website and thereby provide you with a better user experience, we use Google's CDN (content delivery network) to load this library.
It is highly likely that you have already used jQuery on another site via the Google CDN. In that case, your browser can access the copy stored in the cache and it does not need to be downloaded again.
If your browser does not have a copy stored in the cache or downloads the file from the Google CDN for any other reason, data will again be transmitted from your browser to Google Inc. ("Google").
For further information on data processing by Google, please refer to Google's privacy policy, currently available at: https://www.google.de/intl/de/policies/privacy/

9.15 Cloudflare.com
This website uses services provided by 'Cloudflare' (provider: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA).
Cloudflare operates a Content Delivery Network (CDN) and provides security features for the website (Web Application Firewall). Data is transferred between your browser and our servers via Cloudflare's infrastructure, where it is analysed to ward off attacks. Cloudflare uses cookies for this purpose to enable you to access our website. Cloudflare is used in the interests of ensuring the secure use of our website and defending against malicious external attacks. The legal basis for the use of Cloudflare.com is the user's consent in accordance with Article 6(1)(a) of the GDPR.
Further information can be found in Cloudflare's privacy policy:
https://www.cloudflare.com/de-de/privacypolicy/

9.16 Google Maps
This website uses the Google Maps mapping service via an API. The provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
In order to use the functions of Google Maps, it is necessary to store your IP address. This information is usually transmitted to a Google server in the USA and stored there. The provider of this website has no influence over this data transfer.
Google Maps is used in the interests of presenting our online services in an appealing manner and to make it easy to locate the places listed on our website.
The use of Google Maps is based solely on consent in accordance with Article 6(1)(a) of the GDPR.
Further information on the handling of user data can be found in Google's Privacy Policy: https://www.google.de/intl/de/policies/privacy/

9.17 Google Remarketing
Google's remarketing technology is used to re-engage users who have previously visited our websites through interest-based advertising on sites within the Google Partner Network. Cookies are used to analyse users' interests whilst they are visiting the website, which can then be used to display relevant product advertisements.
Provided that users have consented to Google linking their web and app browsing history to their Google Account and to using information from our Google Account to personalise the adverts they see on the web, Google uses data from these logged-in users, together with Google Analytics data, to create and define audience lists for cross-device remarketing. To support this function, Google Analytics collects Google-authenticated IDs for these users. This personal data from Google is temporarily linked to our Google Analytics data in order to form audiences.
Further information and options for disabling this ad serving can be found at http://www.google.com/settings/u/0/ads/anonymous?hl=de (click on 'Ad settings', then 'Opt out').

9.18 Google reCAPTCHA
Google's reCAPTCHA may be used to protect against form abuse. In this case, the optional "remoteip" parameter is not set in the AI query. When reCaptcha is used, the data required for this is downloaded from Google by your browser. In doing so, your browser establishes a connection to Google's servers, meaning that Google becomes aware of the request and your IP address via our website. The website operator has no influence over this data transfer.
The use of Google reCAPTCHA is in the interest of preventing the misuse of forms and is intended to affect the user-friendliness of the website as little as possible. The CAPTCHA offers mostly automatic recognition and a wide range of functions.
When Google reCAPTCHA is called up, Google's separate data protection provisions apply. Further information can be found at https://www.google.de/intl/de/policies/privacy/

9.19 The Trade Desk
On our website, we use the tool 'The Trade Desk' provided by The UK Trade Desk Ltd. (Co. No. 8539108), 10th Floor, 1 Bartholomew Close, London EC1A 7BL, United Kingdom. The Trade Desk offers a technology known in the advertising industry as a Demand Side Platform (DSP). Put simply, this means that digital advertising campaigns can be managed across a wide range of channels, such as websites, apps, audio platforms and smart TVs.
Cookies are used to collect pseudonymised data and data that cannot be used to identify individuals, which is then transmitted to The Trade Desk. This includes, in particular but not exclusively, your truncated and therefore pseudonymised IP address, the date and time of your visit to the website, the location of the device you are using to access our website (e.g. via the GPS signal of the device used, Bluetooth or the Wi-Fi signal), page views and interaction with the page and the referring page (referrer).This data is transmitted to the Demand Side Platform, where it is linked to your pseudonymous ID. This takes place across websites on all platforms that use this technology. The purpose of data collection and processing is to deliver only those advertisements to you that are tailored to your previous interests and are therefore more relevant to you. Your personal data is pseudonymised before being transferred to The Trade Desk's Demand Side Platform. A transfer to a third country, namely the USA, takes place. The new data protection framework ('EU-US Data Privacy Framework') promotes the secure transfer of data between the EU and the US, thereby addressing the data protection concerns that have existed since the European Court of Justice's Schrems II ruling. However, this only applies if the companies or organisations to which personal data is transferred are certified under the new agreement. Through certification, US companies undertake to comply with certain data protection obligations, which are modelled on those set out in the European GDPR. The Trade Desk Inc. is a certified company under the new agreement. You can view this here: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?id=a2zt0000000TN8pAAG&status=Active
Further information on the technology used by The Trade Desk and on data protection can be found at the following link: http://thetradedesk.com/general/privacy-policy
When collecting data, we rely on your consent under Article 6(1)(a) of the GDPR for the relevant data processing, which you may withdraw at any time by changing your privacy settings.

9.20 Userlike
This website uses Userlike's live chat software. Userlike uses cookies to store the content of the chat whilst you are waiting on the site and to connect you, where possible, to the same operator. The data collected is not used to personally identify visitors to the website; it is only combined with the personal data of the holder of the pseudonym if personal data is voluntarily provided for the live chat whilst using the tool. Userlike's privacy policy can be found here: https://www.userlike.com/de/privacy_policy

9.21 Use of YouTube videos
Videos from the external video platform YouTube are embedded on our website. By default, only deactivated images from the YouTube channel are embedded; these do not establish an automated connection to YouTube's servers. This means that the operator does not receive any data from the user when the web pages are accessed.
You can decide for yourself whether the YouTube videos should be enabled. Only when you authorise the videos to play by clicking on 'Permanent activation' do you give your consent for the necessary data (including the web address of the current page and the user's IP address) to be transmitted to the operator.
To save the user's preferred settings, we set a cookie that stores the parameters. However, when setting these cookies, we do not store any personal data; they contain only anonymised data for customising the browser. The videos are then active and can be played by the user. If you wish to disable the automatic loading of YouTube videos again, you can uncheck the consent box under the privacy icon. This will also update the cookie settings.

YouTube is a service provided by YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA, a subsidiary of Google Inc., 1600 Amphitheatre Parkway, Mountain View, California 94043, USA. Further information on the purpose and scope of data processing (including outside the European Union and outside the USA), as well as information on privacy settings, can be found in the privacy policy: https://policies.google.com/privacy?hl=de&gl=de

9.22 Netigate
This website uses Netigate to send Net Promoter Score emails. The provider is Netigate Deutschland GmbH, Untermainkai 27–28, 60329 Frankfurt am Main, Germany.
Net Promoter Score emails enable us to carry out customer surveys. This allows us, for example, to analyse whether, and how likely it is, that customers will recommend us to others.
For detailed information on Netigate's functions, please refer to the following link: https://www.netigate.net/de/.
Personal data may be processed during the customer survey.
Data processing is carried out on the basis of a legitimate interest pursuant to Article 6(1)(f) of the GDPR in conjunction with Section 7(3) of the German Unfair Competition Act (UWG). You may object to this data processing at any time. The lawfulness of any data processing operations that have already taken place remains unaffected by the objection.
The data you have provided to us for the purpose of sending emails will be stored by us or by Netigate until you object, and will be deleted following your objection.
For further details, please refer to Netigate's privacy policy at: https://www.netigate.net/de/impressum/#legal
We have concluded a data processing agreement (DPA) with Netigate in accordance with Article 28 of the GDPR.

9.23 Use of TikTok Ads
We use the TikTok Ads service to draw attention to our offerings through advertisements. The service provider is TikTok Technology Limited, Ropemaker Place, Dublin 2, Dublin, D02 HD23, Ireland. We aim to use our adverts to draw attention to our services and to better plan, implement and optimise our advertising campaigns. When you visit our TikTok profile, information about your interaction is collected and analysed via tracking cookies or similar technologies. This enables TikTok to display relevant adverts to its users. You can enable or disable the display of personalised adverts in the TikTok settings within the app.

The advertising content is delivered by TikTok via so-called 'ad servers'. To this end, we and other websites use so-called ad server cookies, which enable us to measure certain performance metrics, such as the number of times adverts are displayed or the number of clicks by users. The TikTok Ads cookies stored on our website allow us to obtain information about the performance of our advertising campaigns. We cannot identify you personally via these cookies. The analysis data typically stored for this cookie includes the unique cookie ID, the number of ad impressions per placement (frequency), the last impression (relevant for post-view conversions) and opt-out information (indicating that a user no longer wishes to be targeted).

The cookies set by TikTok enable TikTok to recognise your web browser or device. If a user visits specific pages belonging to an Ads client and the cookie stored on their computer has not yet expired, TikTok and we can recognise that the user has clicked on the advert and been redirected to that page. Each Ads client is assigned a different cookie, so the cookies cannot be tracked across the websites of other Ads clients. By integrating TikTok Ads, TikTok receives information that you have accessed the relevant part of our profile or clicked on one of our adverts. If you are registered with TikTok, TikTok can link the visit to your account. Even if you are not registered with TikTok or have not logged in, it is possible that the provider may obtain and store your IP address.

Due to the marketing tools used, your browser automatically establishes a direct connection to TikTok's server. We do not ourselves collect personal data independently as part of the advertising measures mentioned, but merely provide TikTok with the means to collect such data. TikTok merely provides us with a pseudonymised, statistical analysis which provides information on how to measure the campaign's success. We do not receive any further data resulting from the use of the advertising materials; in particular, we cannot identify users on the basis of this information.
Further information on this can be found at: https://www.tiktok.com/legal/page/global/partner-privacy-policy/de.
The legal basis for processing where consent has been given is Article 6(1)(a) of the GDPR.

10 Social media presence
10.1 Facebook page
To expand our online presence, we operate a Facebook page. This is a service provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.
Please note that you use this Facebook page and its features at your own risk. This applies in particular to the use of interactive features (e.g. commenting, sharing, rating).
When you visit our Facebook page, Facebook collects, amongst other things, your IP address and other information stored on your computer in the form of cookies. This information is used to provide us, as the operators of the Facebook pages, with statistical information regarding the use of the Facebook page. Facebook provides further information on this at the following link: https://de-de.facebook.com/help/pages/insights

The data collected about you in this context is processed by Meta Platforms Ireland Limited and may be transferred to countries outside the European Union. Facebook describes in general terms, in its Data Use Policy, what information it receives and how it is used. There you will also find information on how to contact Facebook and on the options available for managing ad settings. The Privacy Policy is available at the following link: https://de-de.facebook.com/about/privacy
Facebook does not provide a clear and definitive explanation of how it uses data from visits to Facebook pages for its own purposes, to what extent activities on the Facebook page are attributed to individual users, how long Facebook stores this data, or whether data from a visit to the Facebook page is passed on to third parties; we are not aware of this information.

When you access a Facebook page, the IP address assigned to your device is transmitted to Facebook. According to Facebook, this IP address is anonymised (in the case of 'German' IP addresses) and deleted after 90 days. Facebook also stores information about its users' devices (e.g. as part of the 'Login Notification' feature); where applicable, this may enable Facebook to link IP addresses to individual users.
If you are currently logged into Facebook, there is a cookie on your device containing your Facebook ID. This enables Facebook to track that you have visited this page and how you have used it. This also applies to all other Facebook pages. Through Facebook buttons embedded in websites, Facebook is able to record your visits to these websites and link them to your Facebook profile. Based on this data, content or advertising can be tailored to you.

If you wish to avoid this, you should log out of Facebook or disable the 'stay logged in' function, delete the cookies stored on your device, and close and restart your browser. This will delete any Facebook information that could be used to identify you directly. This allows you to use our Facebook page without your Facebook ID being revealed. If you access interactive features on the page (such as 'Like', 'Comment', 'Share' or 'Messages'), a Facebook login screen will appear. Once you have logged in, Facebook will once again be able to recognise you as a specific user.

You can find information on how to manage or delete information held about you on the following Facebook Support pages: https://de-de.facebook.com/about/privacy#
As the provider of this information service, we also collect and process the following data resulting from your use of our service: publicly visible data from the data subject's user profile. This includes, for example, the username, profile picture and the content of comments posted on our posts.
Further information about Facebook and other social networks, and how you can protect your data, can also be found at https://youngdata.de/

10.2 Instagram presence
To expand our online presence, we operate an Instagram page. This is a service provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.
Please note that you use this Instagram page and its features at your own risk. This applies in particular to the use of interactive features (e.g. commenting, sharing, rating).
When you visit our Instagram page, Instagram collects, amongst other things, your IP address and other information stored on your computer in the form of cookies. This information is used to provide us, as the operators of the Facebook pages, with statistical information regarding the use of the Facebook page. Instagram provides further information on this via the following link: https://help.instagram.com/1896641480634370?ref=ig

The data collected about you in this context is processed by Meta Platforms Ireland Limited and may be transferred to countries outside the European Union. Instagram describes in general terms, in its Data Use Policy, what information it receives and how it is used. There you will also find information on how to contact Instagram and on the options available for managing ad settings. The Data Use Policy is available via the following link: https://privacycenter.instagram.com/policy
Facebook does not provide a clear and definitive explanation of how Instagram uses data from visits to Instagram pages for its own purposes, to what extent activity on the Instagram page is attributed to individual users, how long Facebook stores this data, or whether data from a visit to the Instagram page is passed on to third parties; we are not aware of this information.

When you access an Instagram page, the IP address assigned to your device is transmitted to Instagram. According to Instagram, this IP address is anonymised (in the case of 'German' IP addresses) and deleted after 90 days. Instagram also stores information about its users' devices (e.g. as part of the 'login notification' feature); which may enable Instagram to link IP addresses to individual users.
If you are currently logged in to Instagram, there is a cookie on your device containing your Instagram ID. This enables Instagram to track that you have visited this page and how you have used it. This also applies to all other Instagram pages.
If you wish to avoid this, you should log out of Instagram or disable the 'stay logged in' function, delete the cookies stored on your device, and close and restart your browser. This will delete any Instagram information that could be used to identify you directly. This allows you to use our Instagram page without your Instagram ID being revealed. If you access interactive features on the page (such as 'Like', 'Comment', 'Share' or 'Messages'), an Instagram login screen will appear. Once you have logged in, Instagram will once again recognise you as a specific user.

You can find information on how to manage or delete the information we hold about you on the following Instagram Help pages: https://help.instagram.com/519522125107875/? helpref=hc_fnav&bc[0]=Instagram Help Centre&bc[1]=Privacy%20and%20Security
As the provider of this information service, we also collect and process the following data resulting from your use of our service: publicly visible data from the data subject's user profile. This includes, for example, the username, profile picture and the content of comments posted in response to our posts.
Further information on Instagram and other social networks, and how you can protect your data, can also be found at https://youngdata.de
10.3 Presence on TikTok
We use the TikTok platform to upload our own videos and make them publicly available. TikTok is a service provided by a third party not affiliated with us, namely TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland.
Please note that TikTok may use its own tracking tools, for which TikTok itself is responsible; please refer to TikTok's privacy policy for further details: https://www.tiktok.com/legal/privacy-policy?lang=de

10.4 Presence on YouTube
We use the YouTube.com platform to upload our own videos and make them publicly available. YouTube is a service provided by a third party not affiliated with us, namely Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Some web pages on our website contain links to YouTube. As a general rule, we are not responsible for the content of websites to which links are provided. However, should you follow a link to YouTube, please note that YouTube stores its users' data (e.g. personal information, IP address) in accordance with its own data usage policies and uses it for commercial purposes.
YouTube content is embedded only in 'enhanced privacy mode'. YouTube provides this mode itself and thereby guarantees that YouTube does not initially store any cookies on your device. However, when you access the relevant pages, your IP address and the other data mentioned in section 4 are transmitted, thereby revealing, in particular, which of our web pages you have visited. However, this information cannot be linked to you unless you have logged in to YouTube or another Google service (e.g. Google+) before visiting the page, or are permanently logged in.

As soon as you start playing an embedded video by clicking on it, YouTube's enhanced privacy mode ensures that only cookies that do not contain any personally identifiable data are stored on your device, unless you are currently logged in to a Google service. These cookies can be prevented by adjusting your browser settings or using browser extensions.
Address and link to the third-party provider's privacy policy:
Google/YouTube: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland – Privacy Policy: https://policies.google.com/privacy
Opt-out: https://adssettings.google.com/authenticated

11 Online Shop
Purchase of vouchers, products, packages and admission tickets:
Where you book a date-specific Therme admission, purchase vouchers or buy other products via our online shop on our website, the data you provide will be processed for the following purposes:
• To enable us to identify you as a customer and to process, fulfil and complete your order
• To carry out necessary correspondence with you for the fulfilment of the contract
• For invoicing and the handling of any liability claims that may arise
• To assert, exercise and defend legal claims against you
In doing so, we process the following personal data:
• Title
• Surname, first name
• Street, postcode, town/city, country
• Telephone number
• Email address
• Password (optional, only if you create a customer account)
• Booking history
Our processing therefore serves to fulfil a contract within the meaning of
Article 6(1)(b) of the GDPR.

We also process and use your data
• to create a customer account (optional; only if you choose to create a customer account);
• to contact you, provided you have requested this, or where necessary in the context of a contractual relationship, or where permitted by law.
• for electronic marketing in accordance with Section 7(3) of the German Unfair Competition Act (UWG) for the same or similar services offered by Thermen & Badewelt Sinsheim via email, provided that we have received your email address from you in connection with the sale of a service and you do not object to the use of your email address. You may object to this use of your email address at any time without incurring any costs other than the transmission costs in accordance with standard rates. Should this legal provision not justify electronic advertising, we will instead seek your consent in accordance with Article 6(1)(a) of the GDPR. You may withdraw this declaration of consent at any time by clicking on the unsubscribe link at the end of the relevant email newsletter.

The personal data we collect will only be disclosed to third parties where this is necessary for the performance of the contract or required by law:
• A contract in accordance with Article 28 of the GDPR has been concluded with any data processors involved in order to ensure that data processing is carried out securely and in compliance with data protection regulations.
• The personal data we collect is passed on to the transport company responsible for delivery as part of the fulfilment of the contract, insofar as this is necessary for the delivery of the goods.
• We pass on your payment details to the designated bank as part of the payment processing. Data is only transferred to state institutions or authorities where required by mandatory national legislation.

12 Thermensquad Application
12.1 Description and scope of data processing
Our website features a form that can be used to apply to join the Thermensquad at Badewelt. The Thermensquad is a campaign run by Badewelt in which 30 selected participants are awarded a partnership agreement with Badewelt based on the evaluation of a video posted on social media. To apply, you must provide personal data. This data includes:
• First name and surname*
• Email address*
• Place of residence*
• Business tax number*
• Instagram or TikTok account*
*Mandatory field

• Your video*
*Mandatory field

12.2 Legal basis
The legal basis for the processing of your personal data in connection with your application is Article 6(1)(b) of the GDPR.
12.3 Purpose of data processing
The processing of your personal data when you contact us via the registration form is used solely for the purpose of processing your application.
12.4 Retention period
Your personal data will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected.
Should your application be unsuccessful, your personal data will be deleted no later than 6 months after the conclusion of the application process.

13 Payment services
13.1 Payment by Mastercard
When paying by credit card (Mastercard), we pass on your payment details to Mastercard Inc. as part of the payment processing procedure. For the European region, the company responsible is Mastercard Europe SA (Chaussée de Tervuren 198A, B-1410 Waterloo, Belgium).
You can find out more about the data processed when using Mastercard in the privacy policy at: https://www.mastercard.de/de-de/datenschutz.html
13.2 Payment by Visa
When paying by credit card (Visa), we pass on your payment details to Visa Inc. as part of the payment processing procedure. For the European region, the company responsible is Visa Europe Services Inc. (1 Sheldon Square, London W2 6TT, United Kingdom).
You can find out more about the data processed when using Visa in the privacy policy at: https://www.visa.de/nutzungsbedingungen/visa-globale-datenschutzmitteilung/mitteilung-zu-zustandigkeitsfragen-fur-den-ewr.html

13.3 Payment via PayPal
When paying via PayPal, by credit card via PayPal, by direct debit via PayPal or – where available – via PayPal's "Buy on Account" service, we will pass on your payment details to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter "PayPal").
PayPal reserves the right to carry out a credit check for the payment methods credit card via PayPal, direct debit via PayPal or – where offered – "purchase on account" via PayPal. PayPal uses the result of the credit check – specifically the statistical probability of payment default – to decide whether to make the respective payment method available.
The credit report may contain probability values (so-called 'score' values). Where such score values form part of the credit report's result, they are based on a scientifically recognised mathematical and statistical method. Address data, amongst other things, is included in the calculation of the score values. For further information regarding data protection, including details of the credit reference agencies used, please refer to PayPal's Privacy Policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full is required to provide certain content and services on our website.
The legal basis for this is Article 6(1)(a) and (b) of the GDPR.

13.4 Payment via Sofortüberweisung
On our website, we offer, amongst other options, payment via "Sofortüberweisung". This payment service is provided by Sofort GmbH, Theresienhöhe 12, 80339 Munich (hereinafter "Sofort GmbH").
Using the "Sofortüberweisung" process, we receive a payment confirmation from Sofort GmbH in real time and can immediately begin fulfilling our obligations.
If you have chosen the "Sofortüberweisung" payment method, you will provide Sofort GmbH with your PIN and a valid TAN, which it can use to log in to your online banking account. After logging in, Sofort GmbH automatically checks your account balance and carries out the transfer to us using the TAN you have provided. It then sends us a transaction confirmation immediately. After logging in, your transaction history, your overdraft limit and the existence of other accounts, along with their balances, are also automatically checked.
In addition to your PIN and TAN, the payment details you have entered and your personal details are also transmitted to Sofort GmbH. Your personal details include your first name and surname, address, telephone number(s), email address, IP address and, where applicable, any further data required for payment processing. The transmission of this data is necessary to verify your identity beyond doubt and to prevent attempts at fraud.

The transfer of your data to Sofort GmbH is carried out on the basis of Article 6(1)(a) and (b) of the GDPR. You have the right to withdraw your consent to data processing at any time. Withdrawal does not affect the lawfulness of data processing operations carried out prior to such withdrawal.
For details on payment via Sofortüberweisung, please refer to the following links:
https://www.sofort.de/datenschutz.html

13.5 Payment via Amazon Pay
When paying via Amazon Pay, we pass on your payment details, as part of the payment processing, primarily to Amazon Payments Europe s.c.a., and secondarily to Amazon EU SARL, Amazon Services Europe SARL and Amazon Media EU SARL, all three of which are based at 5, Rue Plaetis, L-2338 Luxembourg ("Amazon Payments").
Amazon Payments reserves the right to carry out a credit check. Amazon Payments uses the result of the credit check – specifically the statistical probability of payment default – to decide whether to make the relevant payment method available. The credit reference may contain probability values (so-called 'score' values). Where score values form part of the credit reference result, these are based on a scientifically recognised mathematical and statistical method. The calculation of the score values takes into account, amongst other things, address data.
Furthermore, Amazon Payments is entitled to disclose your data to, amongst others, unnamed third parties (banks, e-service providers, service partners, as well as auditors, analytics services, credit reference agencies, marketing partners, cloud service providers, retargeting providers and affiliated companies).
The legal basis for this is Article 6(1)(a) and (b) of the GDPR.
For further information on data protection, including details of the credit reference agencies used, please refer to Amazon Payments' Privacy Policy:
pay.amazon.com/de/help/201751600

13.6 Payment via Apple Pay
When using the 'Apple Pay' payment method provided by Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, payment is processed via the 'Apple Pay' function on your iOS, watchOS or macOS device by debiting a payment card stored with 'Apple Pay'. Apple Pay uses security features integrated into your device's hardware and software to protect your transactions. To authorise a payment, you must therefore enter a code you have previously set and verify your identity using the 'Face ID' or 'Touch ID' feature on your device.
For the purpose of processing the payment, the information you provide during the ordering process, together with details of your order, is transmitted to Apple in encrypted form. Apple then re-encrypts this data using a developer-specific key before transmitting it to the payment service provider associated with the payment card stored in Apple Pay to complete the transaction. The encryption ensures that only the website through which the purchase was made can access the payment details. Once the payment has been made, Apple sends your device account number and a transaction-specific, dynamic security code to the originating website to confirm that the payment was successful.

Where personal data is processed in connection with the transfers described, such processing is carried out solely for the purpose of payment processing in accordance with Article 6(1)(b) of the GDPR.
Apple stores anonymised transaction data, including the approximate purchase amount, the approximate date and time, and whether the transaction was successfully completed. Anonymisation completely precludes any link to an individual. Apple uses the anonymised data to improve 'Apple Pay' and other Apple products and services.
When you use Apple Pay on your iPhone or Apple Watch to complete a purchase that you initiated via Safari on your Mac, your Mac and the authorisation device communicate via an encrypted channel through Apple's servers. Apple does not process or store any of this information in a format that could be used to identify you personally. You can disable the option to use Apple Pay on your Mac in your iPhone's settings. Go to 'Wallet & Apple Pay' and turn off 'Allow payments on Mac'.
For further information on data protection with Apple Pay, please visit the following web address: https://support.apple.com/de-de/HT203027

 14 Direct marketing
14.1 Description and scope of data processing
Our company processes personal data such as your address and name in order to send you advertising by post and thereby boost sales of goods or services.
14.2 Legal basis for data processing
The legal basis for the processing of your personal data in the context of direct marketing by post is Article 6(1)(f) of the GDPR.
14.3 Purpose of data processing
The purpose of processing your personal data in the context of direct marketing by post is to promote the sale of goods or services. This purpose constitutes our legitimate interest in data processing pursuant to Article 6(1)(f) of the GDPR.
14.4 Duration of storage
Your personal data will be erased as soon as it is no longer necessary for the purpose for which it was collected; this is particularly the case upon receipt of an objection.
14.5 Options to object and have data erased
You may object at any time, with effect for the future, to the processing of your personal data for the purposes of direct marketing by post.

15 Data processing outside the scope of joint responsibility
15.1 Registration for recruitment days
15.1.1 Description and scope of data processing
On our website, you can register to take part in our recruitment days to make the application process easier for you. The processing of your personal data therefore contributes to the organisation or implementation of pre-contractual measures.
The following data is stored when you register:
• Title*
• First name*
• Surname*
• Street and house number*
• Postcode*
• Town/city*
• Country*
• Email*
• Telephone number
*Mandatory field
It is also possible to upload application documents (CV, certificates, etc.) at the time of registration. We treat these as strictly confidential and use them to prepare individually for your participation in the recruitment event.
Reference is made to this privacy policy regarding the processing of data as part of the registration process.
15.1.2 Legal basis for data processing
The legal basis for the processing of your personal data in connection with your registration for the recruitment day is Article 6(1)(b) of the GDPR in conjunction with Section 26 of the German Federal Data Protection Act (BDSG).

15.1.3 Purpose of data processing
Your registration serves to facilitate the application process and enables contracts between you and us to be concluded more easily. The processing of your personal data as part of the registration is therefore necessary for the initiation of a contract between you and us or for the implementation of pre-contractual measures.
15.1.4 Duration of storage
Your data will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected. In the event of your registration and the conduct of the recruitment day, we will in any case store your data until the recruitment process has been completed. In the event of your application being rejected or withdrawn, we will retain your documents for a maximum of 6 months for the purpose of asserting, defending and exercising legal claims, whereby their processing will be restricted so that it is limited to mere storage. Should an employment relationship be established, relevant data from your application documents will be transferred to the HR system. Should you withdraw your registration before taking part in the recruitment day, your data will be deleted immediately.

15.1.5 Right to object and right to erasure
You may cancel your registration at any time. You may request that the personal data held about you be amended at any time. If your personal data is required for the performance of a contract or for the implementation of pre-contractual measures, early deletion of your personal data is only possible insofar as no contractual or statutory obligations or legitimate interests of the company preclude such deletion.
15.2 Applying for a Thermencard / Premiumcard
15.2.1 Handling of data processing
You have the option on our website to apply for a Thermencard / Premiumcard online. We process your data for the following purposes:
• Creation, personalisation, provision and administration of the Thermencard / Premiumcard
• Participation in customer promotions (loyalty gifts, bonuses, special offers) and regular customer promotions
• Sending information regarding updates, offers and promotions relating to the Thermencard / Premiumcard (Thermencard / Premiumcard newsletter)
• Sending information by post
• Regular dispatch of the Thermen & Badewelt Euskirchen email newsletter

15.2.2 Legal basis for data processing
The processing of your data for the individual purposes is carried out in each case on the following legal basis:
• Performance of a contract pursuant to Article 6(1)(b) of the GDPR.
• Legitimate interests pursuant to Article 6(1)(f) of the GDPR in accordance with the provisions of Section 7 of the UWG.
Legitimate interests pursued by the controller:
The dispatch of printed materials and the Thermencard / Premiumcard newsletter contains information relevant to Thermencard / Premiumcard users and is based on the controller's legitimate interest in carrying out advertising. Irrespective of this, we may and will also contact you if there are any questions or concerns regarding the administration of the Thermencard / Premiumcard, provided this is necessary for the performance of the contract.
Our legitimate interest in carrying out advertising is not overridden by any overriding legitimate interest of the data subject, as we comply with the provisions of Section 7(3) of the UWG regarding email advertising. Accordingly, advertising via email is permitted even without consent if we have obtained your email address from a contractual relationship, the advertising relates only to the same or similar products, you have not objected to the use of your data for advertising purposes, and you are informed of your right to object at the time your data is collected and on every occasion it is used for advertising purposes.

 If you no longer wish to receive marketing communications from us, you may object to the use of your data for marketing purposes at any time with future effect. To do so, please contact us at:
datenschutz@badewelt-euskirchen.de or use the unsubscribe link at the end of every email newsletter.
15.2.3 Recipients
The collection and processing of your Thermencard / Premiumcard is carried out exclusively by authorised staff at Thermen & Badewelt Euskirchen, who have been bound in writing to maintain confidentiality. When processing your data for the purpose of sending electronic newsletters, we work with a data processor with whom a data processing agreement has been concluded in accordance with Article 28 of the GDPR.
15.2.4 Retention period
We store your data,
• where the processing is based on a legitimate interest on our part, for no longer than until you object to such processing.
• where we require the data to fulfil a contract, for no longer than the duration of the contractual relationship with you or for as long as statutory retention periods apply.
The data stored by us will be erased when it is no longer required for its intended purpose and there are no legitimate interests or statutory retention obligations preventing its erasure.

The data stored by us will be deleted once it is no longer required for its intended purpose and there are no legitimate interests or statutory retention obligations preventing its deletion.
Where data is not deleted because it is required for other, legally permissible purposes, its processing will be restricted. This means that the data will be blocked and not processed for any other purposes. This applies, for example, to user data that must be retained for commercial or tax law reasons.
15.2.5 Transfer to third countries
No data is transferred to third countries outside the European Union.
15.2.6 Provision of data: mandatory or necessary
The provision of your data is necessary for the creation and, where applicable, the issue of a new Thermencard / Premiumcard in the event of loss.

16 Legal defence and enforcement
16.1 Description and scope of data processing
Our company aims to protect itself against unjustified claims through legal defence. We also enforce the claims and rights to which we are entitled. To this end, it is necessary to process personal data. This consists of the legally relevant data of the data subjects.
16.2 Purpose of data processing
The purpose of processing your personal data in the context of legal defence and enforcement is to defend against unjustified claims and to legally enforce claims and rights. This purpose constitutes our legitimate interest in data processing pursuant to Article 6(1)(f) of the GDPR.
16.3 Duration of storage
Your personal data will be erased as soon as it is no longer necessary for the purpose for which it was collected.
16.4 Options to object and have data erased
The processing of your personal data in the context of legal defence and enforcement is strictly necessary for the purposes of legal defence and enforcement. Consequently, you do not have the right to object.

17 Categories of recipients
Within our company, personal data is provided to those units and departments that require it to fulfil the purposes set out above. In addition, we occasionally use various service providers and transfer your personal data to other trusted recipients. These may include, for example:

• Banks
• Scanning services
• Printers
• Mailing houses
• IT service providers
• Solicitors, courts and public authorities
The transfer of personal data to countries outside the European Economic Area (EEA) takes place only in the cases mentioned above and subject to the guarantee of an adequate level of data protection within the meaning of Article 44 et seq. of the GDPR.

18 Rights of data subjects
18.1 Right of access
You may request confirmation from the controller, in accordance with Article 15 of the GDPR, as to whether we are processing personal data relating to you.
If such processing is taking place, you may request the following information from the controller in accordance with Article 15(1) of the GDPR:
• the purposes for which the personal data are processed,
• the categories of personal data being processed,
• the recipients or categories of recipients to whom the personal data relating to you have been or will be disclosed,
• the envisaged period for which your personal data will be stored, or, if it is not possible to specify this, the criteria used to determine the storage period,
• the existence of a right to rectification or erasure of your personal data, a right to restrict processing by us, or a right to object to such processing,
• the existence of a right to lodge a complaint with a supervisory authority,
• all available information on the origin of the data, where the personal data are not collected from the data subject,

• the existence of automated decision-making, including profiling, in accordance with Article 22(1) and (4) of the GDPR and – at least in such cases – meaningful information about the logic involved, as well as the scope and intended consequences of such processing for you. You have the right to request information as to whether personal data concerning you is transferred to a third country or to an international organisation. In this context, you may request to be informed of the appropriate safeguards pursuant to Article 46 of the GDPR in connection with the transfer
If this data is transferred to a third country or to an international organisation, you have the right, pursuant to Article 15(2) of the GDPR, to be informed of the appropriate safeguards under Article 46 of the GDPR in connection with the transfer.
18.2 Right to rectification
Under Article 16 of the GDPR, you have the right to request that the controller rectify and/or complete your personal data if the personal data concerning you that is being processed is inaccurate or incomplete. We must carry out the rectification without undue delay.

18.3 Right to restriction of processing
As set out in Article 18(1) of the GDPR, you may request the restriction of the processing of your personal data under the following conditions:

• if you contest the accuracy of your personal data for a period enabling the controller to verify its accuracy (Article 18(1)(a) of the GDPR),
• where the processing is unlawful and you oppose the erasure of the personal data and instead request the restriction of the use of the personal data (Article 18(1)(b) of the GDPR),
• we no longer require the personal data for the purposes of the processing, but you require it for the establishment, exercise or defence of legal claims (Article 18(1)(c) of the GDPR),
• if you have objected to the processing in accordance with Article 21(1) of the GDPR and it has not yet been determined whether our legitimate grounds override yours (Article 18(1)(d) of the GDPR).

Where the processing of your personal data has been restricted, such data – apart from its storage – may only be processed with your consent or for the purposes of asserting, exercise or defence of legal claims, or to protect the rights of another natural or legal person, or for reasons of an important public interest of the Union or a Member State (Article 18(2) of the GDPR).
If the restriction on processing has been imposed in accordance with the above conditions, we will inform you before the restriction is lifted (Article 18(3) of the GDPR).
18.4 Right to erasure
a) Obligation to erase data
Under Article 17(1) of the GDPR, you may request that we erase personal data relating to you without undue delay. Furthermore, we are obliged to erase this data without undue delay if any of the following grounds apply:
• The personal data relating to you is no longer necessary for the purposes for which it was collected or otherwise processed (Article 17(1)(a) of the GDPR).
• You withdraw your consent on which the processing was based pursuant to Article 6(1)(a) or Article 9(2)(a) of the GDPR, and there is no other legal basis for the processing (Article 17(1)(b) of the GDPR).

• You withdraw your consent on which the processing was based pursuant to Article 6(1)(a) or Article 9(2)(a) of the GDPR, and there is no other legal basis for the processing (Article 17(1)(b) of the GDPR).
• You object to the processing in accordance with Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing in accordance with Article 21(2) of the GDPR (Article 17(1)(c) of the GDPR).
• The personal data relating to you has been processed unlawfully (Article 17(1)(d) of the GDPR).
• The erasure of the personal data relating to you is necessary for compliance with a legal obligation under Union law or the law of the Member States to which the controller is subject (Article 17(1)(e) of the GDPR).
• The personal data concerning you was collected in relation to information society services offered in accordance with Article 8(1) of the GDPR (Article 17(1)(f) of the GDPR).

b) Notification to third parties
Where we have made personal data relating to you public and are obliged to erase such data in accordance with Article 17(1) of the GDPR, we shall take appropriate measures, including technical measures, taking into account the available technology and the costs of implementation, to inform the controllers processing the personal data that you, as the data subject, have requested them to erase all links to such personal data or any copies or replicas of such personal data (Article 17(2) of the GDPR).
c) Exceptions
The right to erasure does not apply where processing is necessary for any of the following reasons:
• to exercise the right to freedom of expression and information
(Article 17(3)(a) of the GDPR).
• to comply with a legal obligation which requires processing under Union or Member State law to which we are subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in us (Article 17(3)(b) of the GDPR).

• on grounds of public interest in the area of public health in accordance with Article 9(2)(h) and (i) and Article 9(3) of the GDPR (Article 17(3)(c) of the GDPR).
• for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) of the GDPR, in so far as the right referred to in section (a) is likely to render impossible or seriously impair the achievement of the objectives of such processing (Article 17(3)(d) of the GDPR), or
• for the establishment, exercise or defence of legal claims (Article 17(3)(e) of the GDPR).
18.5 Right to be informed
If you have exercised your right to rectification, erasure or restriction of processing against us, we are obliged under Article 19 of the GDPR to notify all recipients to whom your personal data has been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves a disproportionate effort. You have the right to be informed by us of these recipients.

18.6 Right to data portability
Under Article 20(1) of the GDPR, you have the right to receive the personal data concerning you, which you have provided to the controller, in a structured, commonly used and machine-readable format. You also have the right to transmit this personal data to another controller without hindrance from us, provided that
• the processing is based on consent pursuant to Article 6(1)(a) of the GDPR or Article 9(2)(a) of the GDPR, or on a contract pursuant to Article 6(1)(b) of the GDPR (Article 20(1)(a) of the GDPR), and
• the processing is carried out by automated means (Article 20(1)(b) of the GDPR).
Under Article 20(2) of the GDPR, you also have the right to have the personal data concerning you transmitted directly by us to another controller, insofar as this is technically feasible.
Exercising the right under Article 20(1) of the GDPR does not affect the right to erasure under Article 17 of the GDPR. This does not apply to processing that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. This follows from Article 20(3) of the GDPR.
In accordance with Article 20(4) of the GDPR, this must not adversely affect the freedoms and rights of other individuals.

The right to data portability does not apply to the processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.
18.7 Right to object
In accordance with Article 21(1) of the GDPR, you have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which is carried out on the basis of Article 6(1)(e) or (f) of the GDPR; this also applies to profiling based on these provisions.
We will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.
Where personal data concerning you is processed for the purposes of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purposes of such marketing; this also applies to profiling insofar as it is related to such direct marketing (Article 21(2) of the GDPR). If you object to the processing of your personal data for direct marketing purposes, your personal data will no longer be processed for these purposes (Article 21(3) of the GDPR).
In connection with the use of information society services – notwithstanding Directive 2002/58/EC – you have the option of exercising your right to object by means of automated procedures using technical specifications (Article 21(5) of the GDPR).
You also have the right to object, on grounds relating to your particular situation, to the processing of your personal data carried out for scientific or historical research purposes or for statistical purposes in accordance with Article 89(1) of the GDPR, unless the processing is necessary for the performance of a task carried out in the public interest (Article 21(6) of the GDPR).
18.8 Right to withdraw consent
Under Article 7(3) of the GDPR, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of that consent prior to its withdrawal. You will be informed of this before giving your consent.

18.9 Automated decision-making in individual cases, including profiling
You have the right not to be subject to a decision based solely on automated processing – including profiling – which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision
1. is necessary for the conclusion or performance of a contract between you and us,
2. is permitted under Union or Member State law to which we are subject, and that law provides for appropriate measures to safeguard your rights and freedoms as well as your legitimate interests, or
3. is based on your explicit consent.
This follows from Article 22(1) and (2) of the GDPR.
However, such decisions must not be based on special categories of personal data as defined in Article 9(1) of the GDPR, unless Article 9(2)(a) or (g) of the GDPR applies and appropriate measures have been taken to safeguard your rights and freedoms as well as your legitimate interests.
With regard to the cases referred to in (1) and (3), we take appropriate measures to safeguard your rights and freedoms as well as your legitimate interests, which include, at a minimum, the right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision (Article 21(3) and (4) of the GDPR).

18.10 Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right under Article 77 of the GDPR to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or the place where the alleged infringement occurred, if you consider that the processing of personal data relating to you infringes the GDPR.
The supervisory authority to which the complaint has been lodged shall inform the complainant of the progress and outcome of the complaint, including the possibility of a judicial remedy under Article 78 of the GDPR (Article 77 of the GDPR).
The competent supervisory authority for us is:
State Commissioner for Data Protection and Freedom of Information, North Rhine-Westphalia (LDI NRW)
https://www.ldi.nrw.de/, poststelle@ldi.nrw.de
The supervisory authority to which you have lodged a complaint will inform you of the status and outcome of the complaint, including the possibility of a judicial remedy under Article 78 of the GDPR. Our Data Protection Officer is available at any time to answer any queries you may have.
Furthermore, within the framework of joint controllership, you are free to contact one of the relevant supervisory authorities of the other subsidiaries of the Thermengruppe Josef Wund.
The State Commissioner for Data Protection and Information Security in Baden-Württemberg (LfDI BaWü) https://www.baden-wuerttemberg.datenschutz.de/, poststelle@lfdi.bwl.de

19 Note on the Privacy Policy
Unless otherwise specified, the use of all information we hold about you is subject to this Privacy Policy.
The company reserves the right to amend this Privacy Policy on an ongoing basis in line with technological developments and the necessary security measures, and will announce any changes here.

Last updated: June 2026