Privacy Policy

1.1 We are pleased that you are visiting our website and thank you for your interest. In the following, we will inform you in detail about the collection, processing and use of your personal data when you use our website. Personal data is all data with which you can be personally identified.

1.2 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is

Baden-Baden Kur & Tourismus GmbH

Schloss Solms, Solmsstraße 1
76530 Baden-Baden
T +49 (0) 7221 275266
F +49 (0) 7221 275261
bbt@baden-baden.com

The controller of personal data is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

1.3 This website uses SSL or TLS encryption for security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or enquiries to the controller). You can recognise an encrypted connection by the character string "https://" and the lock symbol in your browser line.

When you visit our website, we only collect the data that your browser transmits to our server (so-called "server log files"). Certain information is automatically collected that is required for the technical provision and optimisation of our web content:

• Our visited website
• Date and time at the time of access
• Amount of data sent in bytes
• Source/reference from which you reached the page
• Browser used
• Operating system used
• IP address used (if applicable: in anonymised form)

Processing is carried out in accordance with Art. 6 para. 1 lit. f GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data is not passed on or used in any other way. However, we reserve the right to check the server log files retrospectively if there are concrete indications of illegal use.

You can configure your browser to notify you when cookies are set, allow cookies only in individual cases, accept cookies for specific cases or generally exclude them, and activate the automatic deletion of cookies when you close your browser. Each browser is different in the way it manages cookie settings. This is described in the Help menu of each browser, which explains how you can change your cookie settings.

You can find this information for the respective browsers at the following links:

• Firefox: https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences
• Chrome: https://support.google.com/chrome/answer/95647?hl=en&hlrm=en
• Safari: https://support.apple.com/en-us/guide/safari/sfri11471/mac
• Opera: https://help.opera.com/en/latest/web-preferences/#cookies
• Internet Explorer/Edge: https://support.microsoft.com/en-us/windows/manage-cookies-in-microsoft-edge-view-allow-block-or-delete-cookies-168dab11-0753-043d-7c16-ede5947fc64d

Please note that disabling cookies may limit the functionality of our website.

4.1 General contact

Personal data is collected when you contact us (e.g. via contact form or email). Which data is collected in the case of a contact form can be seen from the respective contact form. This data is stored and used exclusively for the purpose of responding to your enquiry or for contacting you and the associated technical administration. The legal basis for the processing of this data is our legitimate interest in responding to your request in accordance with Art. 6 para. 1 lit. f GDPR. If your contact is aimed at concluding a contract, the additional legal basis for the processing is Art. 6 para. 1 lit. b GDPR. Your data will be deleted after your enquiry has been processed. This is the case when it can be inferred from the circumstances that the matter in question has been conclusively clarified and provided that there are no statutory retention obligations to the contrary.

5.1 Subscribe to our e-mail newsletter

If you subscribe to our e-mail newsletter, we will send you regular information about our offers. The only mandatory information for sending the newsletter is your e-mail address. The provision of further data is voluntary and is used to address you personally. We use the so-called double opt-in procedure for sending the newsletter. This means that we will only send you an e-mail newsletter if you have expressly confirmed to us that you consent to receiving the newsletter. We will then send you a confirmation e-mail asking you to confirm that you wish to receive the newsletter in future by clicking on a corresponding link.

By activating the confirmation link, you give us your consent to the use of your personal data in accordance with Art. 6 para. 1 lit. a GDPR. When you register for the newsletter, we store the date and website from which you registered and the time of registration in order to be able to trace any possible misuse of your email address at a later date. The data collected by us when you register for the newsletter will be used exclusively for the purpose of advertising by means of the newsletter. You can unsubscribe from the newsletter at any time using the link provided in the newsletter or by sending a message to news@baden-baden.com. Your data will then be noted on an unsubscribe list and you will no longer receive this newsletter in future. Your e-mail address will be immediately removed from our newsletter distribution list in the event of a cancellation request, unless you have expressly consented to further use of your data or a legally permissible use beyond this is given, about which we inform you in this data protection declaration.

5.2 Newsletter dispatch via Agnitas

Our e-mail newsletters are sent via the technical service provider Agnitas.

6.1 Use of YouTube videos

With your consent, this website uses the YouTube embedding function to display and play videos from the provider "YouTube", which belongs to Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google").

The extended data protection mode is used here, which, according to the provider, only initiates the storage of user information when the video(s) is/are played. If the playback of embedded YouTube videos is started, the provider "YouTube" uses cookies to collect information about user behaviour. According to information from "YouTube", these are used, among other things, to record video statistics, improve user-friendliness and prevent abusive behaviour. If you are logged in to Google, your data will be assigned directly to your account when you click on a video. If you do not wish your data to be associated with your YouTube profile, you must log out before activating the button. Google stores your data (even for users who are not logged in) as usage profiles and analyses them. Such an evaluation is carried out in particular in accordance with Art. 6 para. 1 lit. f GDPR on the basis of Google's legitimate interests in the display of personalised advertising, market research and/or the needs-based design of its website. You have the right to object to the creation of these user profiles, whereby you must contact YouTube to exercise this right. When using YouTube, personal data may also be transmitted to the servers of Google LLC. in the USA.

Irrespective of playback of the embedded videos, a connection to the Google network is established each time this website is accessed, which may trigger further data processing operations without our influence.

Further information on data protection at "YouTube" can be found in the provider's privacy policy at https://policies.google.com/privacy.

Insofar as legally required, we have obtained your consent to the processing of your data as described above in accordance with Art. 6 para. 1 lit. a GDPR. You can revoke your consent at any time with effect for the future. To exercise your cancellation, you can deactivate this service here.

7.1 Meta (Facebook and Instagram)

With your consent, we use content and technologies from Meta Platforms Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland ("Meta") on our website, including the Meta pixel, to measure user activity on our website and track conversions.

Instagram and Facebook content:

When you access content from Instagram or Facebook on our website, a direct connection is established between your browser and Meta's servers. As a result, Meta receives information that you have visited our site with your IP address. If you are logged into your Instagram or Facebook account, Meta can assign the visit to our pages to your user account. We do not receive any knowledge of the content of the transmitted data and its use by Meta.

Meta-Pixel:

We also use meta pixels on our website. This enables us to track the behaviour of website visitors after they have been redirected to our website by clicking on a Facebook or Instagram ad. This allows us to measure the effectiveness of Facebook and Instagram adverts for statistical and market research purposes. The data collected in this way is anonymous to us, which means that we do not see the personal data of individual users. However, this data is stored and processed by Meta, which is why Meta can link it to your Facebook or Instagram profile. Meta may also use this data for its own advertising purposes, in accordance with Meta's Data Use Policy.

Data processing and purpose:

The use of the meta pixel enables us to place targeted adverts (so-called "Facebook Ads" and "Instagram Ads") and to improve the user experience on our website. The processing of data by Meta is based on our legitimate interest in accordance with Art. 6 para. 1 lit. f GDPR in order to analyse and improve the effectiveness of our advertising measures. If you have given your consent to the use of the Meta pixel, the processing is carried out on the basis of Art. 6 para. 1 lit. a GDPR.

Data transmission:

The data collected by the Meta Pixel may also be transferred by Meta to servers in the USA or other countries outside the EU and stored there. Meta ensures that when personal data is transferred outside the European Economic Area (EEA), appropriate protective measures are taken to ensure the protection of your data in accordance with the requirements of the GDPR.

Further information on data processing by Meta as well as your rights and settings options for protecting your privacy can be found in Meta's privacy policy:

• Facebook: Facebook Privacy Policy
• Instagram: Instagram Privacy Policy

Consent and cancellation:

Insofar as legally required, we have obtained your consent to the processing of your data as described above in accordance with Art. 6 para. 1 lit. a GDPR. You can deactivate your consent at any time here.

8.1 Use of Google Ads conversion tracking

Auf unserer Website verwenden wir nach Ihrer Einwilligung das Online-Werbeprogramm "Google Ads" und im Rahmen von Google Ads uses the conversion tracking of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). We use Google Ads to draw attention to our attractive offers with the help of advertising material (so-called Google Adwords) on external websites. We can determine how successful the individual advertising measures are in relation to the advertising campaign data. Our aim is to show you adverts that are of interest to you, to make our website more interesting for you and to achieve a fair calculation of the advertising costs incurred.

The cookie for conversion tracking is set when a user clicks on an Ads advert placed by Google. Cookies are small text files that are stored on your end device. These cookies generally lose their validity after 30 days and are not used for personal identification. If the user visits certain pages of this website and the cookie has not yet expired, Google and we can recognise that the user clicked on the ad and was redirected to this page. Each Google Ads customer receives a different cookie. Cookies can therefore not be tracked via the websites of Google Ads customers. The information collected using the conversion cookie is used to generate conversion statistics for Google Ads customers who have opted for conversion tracking. Customers learn the total number of users who clicked on their advert and were redirected to a page with a conversion tracking tag. However, they do not receive any information that can be used to personally identify users. If you do not wish to participate in tracking, you can block this use by deactivating the Google Conversion Tracking cookie via your Internet browser under the keyword "User settings". You will then not be included in the conversion tracking statistics. We use Google Ads on the basis of our legitimate interest in targeted advertising in accordance with Art. 6 para. 1 lit. f GDPR. As part of the use of Google Ads, personal data may also be transmitted to the servers of Google LLC. in the USA.

You can find more information about Google's privacy policy at the following Internet address: https://www.google.com/policies/privacy/.

You can permanently object to the setting of cookies by Google Ads Conversion Tracking by downloading and installing the browser plug-in from Google available at the following link: https://www.google.com/settings/ads/plugin?hl=en.

Please note that certain functions of this website may not be available or may only be available to a limited extent if you have deactivated the use of cookies.

Insofar as legally required, we have obtained your consent to the processing of your data as described above in accordance with Art. 6 para. 1 lit. a GDPR. You can revoke your consent at any time with effect for the future. To exercise your revocation, deactivate this service at any time here, or alternatively follow the option described above to make an objection.

If you wish to object to participation in this tracking process, you can deactivate cookies for conversion tracking by setting your browser to block cookies from the domain www.googleadservices.com (see https://www.google.de/settings/ads), whereby this setting will be deleted if you deactivate your cookies. Alternatively, you can obtain information about the setting of cookies from the Digital Advertising Alliance at the Internet address www.aboutads.info and make your desired settings. Finally, you can set your browser so that you are informed about the setting of cookies and decide individually whether to accept them or to exclude the acceptance of cookies for certain cases or in general. If you do not accept cookies, the functionality of our website may be restricted.

You can obtain further information about the data protection provisions of GMP by Google at the following Internet address: https://www.google.de/policies/privacy/

Insofar as legally required, we have obtained your consent to the processing of your data as described above in accordance with Art. 6 para. 1 lit. a GDPR. You can revoke your consent at any time with effect for the future here.

8.2 Google Tag Manager

This website uses Google Tag Manager. This service allows website tags to be managed via an interface. The Google Tag Manager itself does not set cookies, but only tags and does not collect any personal data. The service triggers other tags, which in turn may collect data. However, Google Tag Manager does not access this data. If deactivation has been carried out at domain or cookie level, this remains in place for all tracking tags that are implemented with Google Tag Manager.

9.1 Google Analytics 4

This website uses Google Analytics 4, a service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"), which can be used to analyse the use of websites.

When using Google Analytics 4, so-called "cookies" are used by default. Cookies are text files that are stored on your end device and enable your use of a website to be analysed. The information collected by cookies about your use of the website (including the IP address transmitted by your device, shortened by the last digits, see below) is usually transmitted to a Google server, where it is stored and processed. This may also result in information being transmitted to the servers of Google LLC based in the USA and further processing of the information there.

When using Google Analytics 4, the IP address transmitted by your end device when you use the website is always collected and processed in anonymised form by default and automatically, so that the information collected cannot be directly linked to a person. This automatic anonymisation is achieved by Google truncating the IP address transmitted by your device within member states of the European Union (EU) or in other signatory states to the Agreement on the European Economic Area (EEA).

Google uses this and other information on our behalf to evaluate your use of the website, to compile reports on your website activity and usage behaviour and to provide us with other services relating to your use of the website and the Internet. The abbreviated IP address transmitted by your device as part of Google Analytics 4 will not be merged with other Google data. The data collected as part of the use of Google Analytics 4 is stored for 2 months and then deleted.

Google Analytics 4 also enables the creation of statistics with statements about the age, gender and interests of website users on the basis of an evaluation of interest-based advertising and with the help of third-party information via a special function, the so-called "demographic characteristics". This makes it possible to determine and differentiate between user groups of the website for the purpose of target group-optimised marketing measures. However, data collected via the "demographic characteristics" cannot be assigned to a specific person and therefore cannot be assigned to you personally. This data collected via the "demographic characteristics" function is stored for two months and then deleted.

All processing described above, in particular the setting of Google Analytics cookies for the storage and reading of information on the terminal device used by you for the use of the website, will only take place if you have given us your express consent to do so in accordance with Art. 6 para. 1 lit. a GDPR. Without your consent, Google Analytics 4 will not be used during your use of the website. You can revoke your consent at any time with effect for the future. To exercise your cancellation, please deactivate this service here.

In connection with this website, the Google Signals service is also used as an extension of Google Analytics 4. With Google Signals, we can have Google create cross-device reports (so-called "cross-device tracking"). If you have activated "personalised ads" in your Google account settings and linked your internet-enabled devices to your Google account, Google can analyse usage behaviour across devices and create database models based on this if you have given your consent to the use of Google Analytics 4 in accordance with Art. 6 para. 1 lit. a GDPR. The logins and device types of all website users who were logged into a Google account and carried out a conversion are taken into account. The data shows, among other things, on which device you clicked on an advert for the first time and on which device the relevant conversion took place. We do not receive any personal data from Google, but only statistics compiled on the basis of Google Signals. You have the option of deactivating the "personalised ads" function in the settings of your Google account and thus deactivating the cross-device analysis in connection with Google Signals.

Further information on Google Signals can be found at the following link: https://support.google.com/analytics/answer/7532985?hl=de

We have concluded a so-called order processing contract with Google for our use of Google Analytics 4, which obliges Google to protect the data of our website users and not to pass it on to third parties.

To ensure compliance with the European level of data protection, including in the event of any transfer of data from the EU or the EEA to the USA and possible further processing there, Google relies on the so-called standard contractual clauses of the European Commission, which we have contractually agreed with Google.

Further legal information on Google Analytics 4, including a copy of the aforementioned standard contractual clauses, can be found at the following link: https://policies.google.com/privacy?hl=de&gl=de

Details on the processing triggered by Google Analytics 4 and how Google handles data from websites can be found here: https://policies.google.com/technologies/partner-sites

10.1 Google Ads Remarketing

With your consent, we use the Google Ads Remarketing functions on our website to advertise this website in Google search results and on third-party websites. The provider is Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). For this purpose, Google sets a cookie in the browser of your end device, which automatically enables interest-based advertising by means of a pseudonymous cookie ID and on the basis of the pages you visit. The processing is based on our legitimate interest in the optimal marketing of our website in accordance with Art. 6 para. 1 lit. f GDPR.

Any further data processing will only take place if you have consented to Google linking your internet and app browsing history to your Google account and using information from your Google account to personalise ads that you view on the web. In this case, if you are logged in to Google while visiting our website, Google will use your data together with Google Analytics data to create and define target group lists for cross-device remarketing. For this purpose, Google temporarily links your personal data with Google Analytics data to create target groups. As part of the use of Google Ads Remarketing, personal data may also be transmitted to the servers of Google LLC. in the USA.

You can permanently object to the setting of cookies by Google Ads Remarketing by downloading and installing the browser plug-in from Google available at the following link:
https://www.google.com/settings/ads/onweb/

Further information and the data protection provisions regarding advertising and Google can be viewed here:

https://www.google.com/policies/technologies/ads/

Insofar as legally required, we have obtained your consent to the processing of your data as described above in accordance with Art. 6 para. 1 lit. a GDPR. You can revoke your consent at any time with effect for the future. To exercise your cancellation, deactivate this service here or alternatively follow the option described above to make an objection.

10.2 Use of Google's retargeting technology

With your consent, we use the retargeting technology of Google, Inc, Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google") on our website. This function is used to present interest-based adverts to visitors to the website as part of the Google advertising network.

The website visitor's browser stores so-called "cookies", text files which are stored on your computer and which make it possible to recognise the visitor when he or she visits websites that belong to the Google advertising network. On these pages, the visitor can then be presented with adverts that relate to content that the visitor has previously accessed on websites that use Google's retargeting technology. According to Google, it does not collect any personally identifiable information during this process.

Insofar as legally required, we have obtained your consent to the processing of your data as described above in accordance with Art. 6 para. 1 lit. a GDPR. You can revoke your consent at any time with effect for the future. To exercise your cancellation, deactivate this service here.

Further information on Google's retargeting technology and Google's privacy policy can be found at: https://policies.google.com/privacy

11.1 Microsoft Teams

We use the "Microsoft Teams" service from Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399 USA (hereinafter "Microsoft Teams") to hold online meetings, video conferences and/or webinars.

When using Microsoft Teams, different data is processed. The scope of the data processed depends on the data you provide before or during participation in an online meeting, video conference or webinar. When using Microsoft Teams, data of the communication participants is processed and stored on Microsoft Teams servers. This data may include, in particular, your login data (name, email address, telephone (optional) and password) and meeting data (topic, participant IP address, device information, description (optional)). In addition, visual and audio contributions from participants as well as voice input in chats can be processed.

The legal basis for the processing of personal data for the fulfilment of a contract with you or for the implementation of pre-contractual measures is Art. 6 para. 1 lit. b GDPR. If you have given us your consent to process your data, the processing is carried out on the basis of Art. 6 para. 1 lit. a GDPR. You can withdraw your consent at any time with effect for the future.

In addition, the legal basis for data processing when conducting online meetings, video conferences, or webinars is our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR in the effective conduct of the online meeting, webinar, or video conference. Further information on data use by Microsoft Teams can be found in the Microsoft Teams privacy policy at https://privacy.microsoft.com/en-US/privacystatement.

11.2 Integration via iFrames

With your consent, this website uses inline frames ("iFrames"), which are used to display non-proprietary web content in a specific area of our website.

Among other things, we use iFrames from the tourism data management platform mein.toubiz. Details on the data processing carried out in connection with the services can be found in the provider's privacy policy.

Insofar as legally required, we have obtained your consent to the processing of your data as described above in accordance with Art. 6 para. 1 lit. a GDPR. You can revoke your consent at any time with effect for the future. To exercise your revocation, deactivate this service here.

11.3 Applications for job advertisements by e-mail

We advertise current vacancies on our website in a separate section, for which interested parties can apply by e-mail to the contact address provided.

In order to be included in the application process, applicants must provide us with all personal data required for a well-founded and informed assessment and selection together with their application by e-mail. The required information includes general personal information (name, address, telephone or electronic contact details) as well as performance-specific proof of the qualifications required for a position. Health-related information may also be required, which must be given special consideration under labour and social law in the interests of the applicant's social protection.

The components that an application must contain in order to be considered in individual cases and the form in which these components are to be submitted by e-mail can be found in the respective job advertisement.

After receipt of the application sent using the email contact address provided, the applicant data will be stored by us and analysed exclusively for the purpose of processing the application. For any queries arising in the course of processing, we use either the e-mail address provided by the applicant with their application or a telephone number provided, at our discretion.

The legal basis for this processing, including contacting us for queries, is generally Art. 6 para. 1 lit. b GDPR (for processing in Germany in conjunction with § 26 para. 1 BDSG), in the sense of which the application process is considered to be the initiation of an employment contract.

Insofar as special categories of personal data within the meaning of Art. 9 para. 1 GDPR (e.g. health data such as information on severely disabled status) are requested from applicants as part of the application procedure, processing is carried out in accordance with Art. Art. 9 para. 2 lit. b. GDPR, so that we can exercise the rights arising from labour law and social security and social protection law and fulfil our obligations in this regard.

Cumulatively or alternatively, the processing of special categories of data may also be based on Art. 9 para. 1 lit. h GDPR if it is carried out for the purposes of preventive health care or occupational medicine, for the assessment of the applicant's fitness for work, for medical diagnostics, health or social care or treatment or for the management of health or social care systems and services.

If the applicant is not selected in the course of the evaluation described above or if an applicant withdraws their application prematurely, their data transmitted by email and all electronic correspondence, including the original application email, will be deleted after 4 months at the latest following a corresponding notification. This period is based on our legitimate interest in being able to answer any follow-up questions about the application and, if necessary, to fulfil our obligations to provide evidence under the regulations on equal treatment of applicants.

In the event of a successful application, the data provided will be processed on the basis of Art. 6 para. 1 lit. b GDPR (for processing in Germany in conjunction with Section 26 para. 1 BDSG) for the purposes of implementing the employment relationship.

 11.4 Use of Yumpu

Our website uses the Yumpu service, a provider for embedding page-flipping PDFs. The provider is i-magazine AG, Gewerbestrasse 3, 9444 Diepoldsau, Switzerland.

When you visit our website, on which Yumpu is integrated, the following data is transmitted to Yumpu:

• IP Adress
• Browser type and version
• Operating System
• Referrer URL (the previously visited page)
• Host name of the accessing computer
• Time of the server request

The use of Yumpu is in the interest of an appealing presentation of our online offers. This constitutes a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR.

The data will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected.

Further information on the handling of user data can be found in the Yumpu privacy policy.

11.5 Use of TWS session tokens (My.IRS)

The TWS session token from My.IRS is used in our booking route. This token is critical to maintaining a stable and secure session throughout the booking process. It ensures that all user data is transferred securely and consistently across multiple pages so that the booking can be completed without any interruptions or security risks. By storing relevant session data such as the session ID and IP address, the TWS session token ensures the protection of sensitive information and the integrity of transactions.

11.6 Use of Elfsight

The cookie is used in our audio player, which is integrated via Elfsight. The audio player allows users to play audio content directly on the website. The cookie ensures that multiple counting of the same playback within 15 seconds is avoided. This is particularly important to ensure correct playback statistics and a smooth user experience. The cookie thus helps to improve the user experience by enabling a more accurate recording of listening habits and use of the audio player.

12.1 The applicable data protection law grants you comprehensive data subject rights (rights of access and intervention) vis-à-vis the controller with regard to the processing of your personal data, about which we inform you below:

- Right to information in accordance with Art. 15 GDPR: In particular, you have the right to information about your personal data processed by us, the purposes of processing, the categories of personal data processed, the recipients or categories of recipients to whom your data has been or will be disclosed, the planned storage period or the criteria for determining the storage period, the existence of a right to rectification, erasure, restriction of processing, objection to processing, complaint to a supervisory authority, the origin of your data if it was not collected by us from you, the existence of automated decision-making including profiling and, if applicable, meaningful information on the logic involved and the scope and intended effects of such processing on you, as well as your right to be informed of the guarantees pursuant to Art. 46 GDPR if your data is transferred to third countries;

- Right to rectification pursuant to Art. 16 GDPR: You have a right to immediate rectification of incorrect data concerning you and/or completion of your incomplete data stored by us;

- Right to erasure in accordance with Art. 17 GDPR: You have the right to request the erasure of your personal data if the requirements of Art. 17 (1) GDPR are met. However, this right does not apply in particular if the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims;

- Right to restriction of processing in accordance with Art. 18 GDPR: You have the right to request the restriction of the processing of your personal data as long as the accuracy of your data, which you dispute, is checked, if you refuse to delete your data due to unauthorised data processing and instead request the restriction of the processing of your data, if you need your data for the assertion, exercise or defence of legal claims after we no longer need this data after the purpose has been achieved or if you have lodged an objection for reasons of your particular situation, as long as it is not yet clear whether our legitimate reasons prevail;

- Right to information in accordance with Art. 19 GDPR: If you have asserted the right to rectification, erasure or restriction of processing against the controller, the controller is obliged to notify all recipients to whom the personal data concerning you have been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves a disproportionate effort. You have the right to be informed about these recipients.

- Right to data portability in accordance with Art. 20 GDPR: You have the right to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format or to request that it be transferred to another controller, insofar as this is technically feasible;

- Right to withdraw consent granted in accordance with Art. 7 (3) GDPR: You have the right to withdraw your consent to the processing of data at any time with effect for the future. In the event of revocation, we will delete the data concerned immediately, unless further processing can be based on a legal basis for processing without consent. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal;

- Right to lodge a complaint pursuant to Art. 77 GDPR: If you believe that the processing of personal data concerning you infringes the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, without prejudice to any other administrative or judicial remedy.

12.2 RIGHT OF OBJECTION

IF WE PROCESS YOUR PERSONAL DATA AS PART OF A BALANCING OF INTERESTS ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST, YOU HAVE THE RIGHT TO OBJECT TO THIS PROCESSING AT ANY TIME WITH EFFECT FOR THE FUTURE ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED. HOWEVER, WE RESERVE THE RIGHT TO CONTINUE PROCESSING IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.

IF YOUR PERSONAL DATA IS PROCESSED BY US FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH MARKETING. YOU CAN EXERCISE YOUR OBJECTION AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.

The duration of the storage of personal data is determined by the respective legal basis, the purpose of processing and - if relevant - additionally by the respective statutory retention period (e.g. retention periods under commercial and tax law).

When processing personal data on the basis of express consent in accordance with Art. 6 para. 1 lit. a GDPR, this data is stored until the data subject withdraws their consent.

If there are statutory retention periods for data that is processed within the framework of legal or similar obligations on the basis of Art. 6 para. 1 lit. b GDPR, this data will be routinely deleted after the retention periods have expired, provided that it is no longer required for contract fulfilment or contract initiation and/or we no longer have a legitimate interest in further storage.

When processing personal data on the basis of Art. 6 para. 1 lit. f GDPR, this data is stored until the data subject exercises their right to object in accordance with Art. 21 para. 1 GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing serves the establishment, exercise or defence of legal claims.

When processing personal data for the purpose of direct marketing on the basis of Art. 6 para. 1 lit. f GDPR, this data is stored until the data subject exercises their right to object in accordance with Art. 21 para. 2 GDPR.

Unless otherwise stated in the other information in this declaration on specific processing situations, stored personal data is deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.

Status: August 2024