PRIVACY AT A GLANCE
General information
The following information provides a simple overview of what happens to your personal data when you visit our website. Personal data means any data that can be used to identify you personally. Detailed information on data protection can be found in the privacy notices below.
Data collection on our website
Who is responsible for collecting data on this website?
Data processing on this website is carried out by the website operator:
Gastro-Team Albiez GmbH
Hotel Hanauerhof
Ortenauer Straße 50
77767 Appenweier
Tel.: (07805)9566 -0
Fax: (07805)95 66 -66
E-mail: info(at)hanauer-hof.de
Website: www.hanauer-hof.de
Managing Director: Patrick Ernst
Data Protection Officer:
Annika Ernst
Telephone: 07805 95660
E-mail: a.ernst(at)hanauer-hof.de
How do we collect your data?
On the one hand, your data is collected when you provide it to us. This may include, for example, data that you enter in a contact form or booking enquiry.
Other data is collected automatically by our IT systems when you visit the website. This is primarily technical data (e.g. your internet browser, operating system or the time at which the page was accessed). This data is collected automatically as soon as you access our website.
What do we use your data for?
Some of the data is collected to ensure that the website is provided without errors. Other data is used to process your enquiries and bookings. We use data to analyse your user behaviour and for advertising purposes only if you have given your consent via our cookie banner.
What rights do you have regarding your data?
You have the right at any time to obtain information free of charge about the origin, recipients and purpose of your stored personal data. You also have the right to request the rectification, restriction of processing or erasure of this data. You can contact us at any time at the address provided in the legal notice with regard to this and any other questions concerning data protection. You also have the right to lodge a complaint with the competent supervisory authority. For us, this is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg, Heilbronner Straße 35, 70191 Stuttgart.
Analytics tools and tools provided by third parties
When you visit our website, personal data may be processed through cookies and similar technologies. For this purpose, we use the cookie consent technology provided by vioma GmbH, Industriestraße 27, 77656 Offenburg. This technology is used to obtain, manage and document your consent to the use of cookies and similar technologies. If analytics or marketing services are used on our website, your personal data is processed in accordance with the applicable data protection provisions. Where consent is required for this, the relevant services are activated only after you have expressly given your consent. Information about your user behaviour, browser, device and IP address may be processed in this context. You may withdraw or change any consent you have given at any time, with effect for the future, via the cookie settings on our website. The lawfulness of processing carried out before the withdrawal remains unaffected. Further information about the individual services used, their respective processing purposes and the applicable legal bases can be found in the relevant sections of this Privacy Policy.
Withdrawal of your consent to data processing
Many data processing operations are only possible with your express consent. You may withdraw consent that you have already given at any time, with effect for the future. You can change or withdraw your consent to the use of cookies and similar technologies at any time via the cookie settings on our website. To withdraw other forms of consent, an informal notification by e-mail to info(at)hanauer-hof.de is sufficient. The lawfulness of data processing carried out up to the time of withdrawal remains unaffected by the withdrawal. Many data processing operations are only possible with your express consent. You may withdraw consent that you have already given at any time, with effect for the future.
Right to lodge a complaint with the competent supervisory authority
Without prejudice to any other administrative or judicial remedy, every data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work or the place of the alleged infringement, if the data subject considers that the processing of their personal data infringes the General Data Protection Regulation (GDPR).
The supervisory authority responsible for us is:
The State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg
Heilbronner Straße 35
70191 Stuttgart
Telephone: 0711 615541-0
E-mail: poststelle(at)lfdi.bwl.de
Website: www.baden-wuerttemberg.datenschutz.de
Right to data portability
You have the right to have data that we process automatically on the basis of your consent or in fulfilment of a contract handed over to you or to a third party in a commonly used, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done where technically feasible.
TLS encryption
For security reasons and to protect the transmission of confidential content, such as bookings or enquiries that you send to us as the website operator, this website uses TLS encryption (formerly also known as SSL). You can recognise an encrypted connection by the fact that the browser address bar begins with “https://” and a padlock symbol or a comparable security symbol is displayed. When TLS encryption is enabled, the data you transmit to us cannot be read by third parties.
Encrypted payment transactions on this website
If you make a paid booking with us or use a service, we process the personal data required to handle the payment. This includes, in particular, your name, billing details and the payment information required for the respective payment method.
This data is processed for the performance of the contract in accordance with Art. 6(1)(b) GDPR. Where we are legally required to retain certain payment and accounting data, processing is also carried out on the basis of Art. 6(1)(c) GDPR.
We use the payment service provider Stripe to process online payments.
Payment service provider:
Stripe Payments Europe, Limited
1 Grand Canal Street Lower
Grand Canal Dock
Dublin 2
Ireland
If you make a payment via Stripe, the personal data required to process the payment is transmitted to Stripe. This may include, in particular, your name, payment details, the invoice amount and other information required to process the payment.
Further information about the processing of your personal data by Stripe can be found in the provider's Privacy Policy:
To protect your data, transmission via our website takes place using TLS encryption. You can recognise an encrypted connection by the fact that the internet address begins with “https://” and a padlock symbol or a comparable security symbol is displayed in your browser's address bar.
Encryption protects the data you transmit against unauthorised access by third parties during transmission.
My assessment: The wording of this section is complete. Before publication, it should still be checked whether Stripe acts as an independent controller or partly as a processor in your specific booking process. This is relevant to the legally correct description of the data processing.
Access, rectification, restriction and erasure
Within the framework of the applicable legal provisions, you have the right at any time to obtain information free of charge about the personal data concerning you that we have stored. This includes, in particular, information about the origin of the data, its recipients and the purposes of processing. In addition, you have the right to request the rectification of inaccurate personal data, the erasure of your data or the restriction of processing, provided that the legal requirements for this are met. You can contact us at any time to exercise your rights or if you have any further questions about data protection. Our contact details can be found in the legal notice on this website. You can also contact our Data Protection Officer directly.
Objection to unsolicited advertising
We hereby object to the use of contact details published as part of the legal notice requirements for sending advertising and information materials that have not been expressly requested. We expressly reserve the right to take legal action in the event of unsolicited transmission of advertising information, for example through spam e-mails.
DATA COLLECTION ON OUR WEBSITE
Cookies
Our website uses cookies. These are small text files that are stored on your device and managed by your browser. Cookies do not cause any damage to your device and do not contain viruses. They help make our website more user-friendly, effective and secure. Some of the cookies we use are so-called session cookies. These are automatically deleted at the end of your visit. Other cookies remain stored on your device until they expire or you delete them. For example, they enable us to recognise your browser when you visit our website again. Detailed information about the cookies used, their purposes and storage periods can be found in the overview of cookies within our cookie settings. You can configure your browser to notify you when cookies are set, to allow cookies only in individual cases or to generally exclude the acceptance of cookies. You can also activate the automatic deletion of cookies when you close your browser. Please note that disabling cookies may mean that certain functions of our website are no longer fully available.
Necessary cookies
Necessary cookies are cookies that are absolutely essential for the technical operation and basic functions of our website. These include, for example, cookies that enable the booking process, store your language selection or manage your cookie settings. Some of these cookies are so-called session cookies. They are automatically deleted at the end of your visit or when you close your browser. Other necessary cookies may remain stored on your device for a longer period. The storage or retrieval of these cookies is based on Section 25(2)(2) TDDDG, provided this is absolutely necessary to provide a digital service expressly requested by you. In these cases, prior consent is not required. The subsequent processing of personal data is carried out on the basis of the relevant legal basis, for example Art. 6(1)(f) GDPR, where we have a legitimate interest in ensuring the technically flawless provision of our website.
Non-essential cookies
Non-essential cookies are cookies and similar technologies that go beyond the technically necessary functions of our website. They may, for example, be used to evaluate user behaviour, measure the reach of our website or display personalised advertising.
These include, in particular:
- Analytics cookies for statistical evaluation and reach measurement
- Tracking and marketing cookies for advertising purposes
- Cookies from social media services
These cookies and similar technologies are only used if you have given your express consent in advance. The legal basis for storing or accessing information on your device is Section 25(1) TDDDG. The subsequent processing of personal data is based on your consent in accordance with Art. 6(1)(a) GDPR.
You may withdraw your consent or change your selection at any time, with effect for the future. This can be done via the cookie settings on our website.
Server log files
When you visit our website, our hosting provider automatically collects and stores information in so-called server log files. This information is automatically transmitted by your browser to our server.
The following information is collected in particular:
- Browser type and browser version
- Operating system used
- Referrer URL (previously visited website)
- Hostname of the accessing computer
- Date and time of the server request
- IP address
As a rule, this data is not combined with other personal data. This data is processed on the basis of Art. 6(1)(f) GDPR. Our legitimate interest is to ensure the technically flawless provision, stability and security of our website and to be able to identify and rectify potential technical faults or attacks.
The server log files are deleted after seven days, unless longer storage is required in an individual case to investigate security incidents or safeguard our legitimate interests.
Our website is hosted by the following provider:
Mittwald CM Service GmbH & Co. KG
Königsberger Straße 4–6
32339 Espelkamp
Germany
We have concluded a data processing agreement with our hosting provider in accordance with Art. 28 GDPR.
Enquiries by e-mail, contact form, telephone or fax
If you contact us by e-mail, contact form, telephone or fax, we process the personal data you provide in order to handle your enquiry and answer your questions. This includes, in particular, your name, contact details and the content of your message.
Your personal data will only be passed on to third parties if this is necessary to process your enquiry, if there is an appropriate legal basis or if we are legally obliged to do so. This may also include carefully selected service providers who support us, for example, with hosting or the operation of our e-mail systems and who are contractually obliged to comply with data protection requirements.
Your data is processed on the basis of Art. 6(1)(b) GDPR if your enquiry is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, processing is based on our legitimate interest in properly and efficiently handling enquiries addressed to us, in accordance with Art. 6(1)(f) GDPR.
Your personal data will be deleted as soon as your enquiry has been fully processed and there are no statutory retention obligations or other legitimate reasons for further storage. Statutory retention periods remain unaffected.
vioma BOOKING - Online bookings and booking enquiries
Our website uses the vioma BOOKING booking technology, which is provided by vioma GmbH, Industriestraße 27, 77656 Offenburg.
We have concluded a data processing agreement with vioma GmbH in accordance with Art. 28 GDPR. This ensures that your personal data is processed in accordance with the applicable data protection regulations as part of the booking process. If you make an online booking or submit a booking enquiry via our website, we process the personal data required for this purpose. This includes, in particular, your e-mail address, travel dates, the selected offer, your form of address, first name and surname.
In certain cases, we also request your telephone number so that we can contact you in the event of short-notice changes or unforeseen circumstances relating to your booking. To calculate the applicable travel price, we also require information about your planned stay, the selected offer, the number of people travelling and whether they are adults or children. If children are travelling with you, their ages may also be requested. We also ask which payment method you would like to use. If an advance payment is required for your booking, you may be redirected to the payment service provider Stripe to process the payment.
Payment service provider:
Stripe Payments Europe, Limited
1 Grand Canal Street Lower
Grand Canal Dock
Dublin 2
Ireland
If you pay via Stripe, the personal data required to process the payment is transmitted to Stripe. Further information about the processing of your data can be found in Stripe's Privacy Policy at:
You may voluntarily provide additional information that is not strictly necessary for the booking or booking enquiry.
The processing of your personal data in connection with online bookings and booking enquiries is carried out on the basis of Art. 6(1)(b) GDPR. It is necessary for the implementation of pre-contractual measures and for the performance and processing of the contract.
Your personal data is stored only for as long as necessary to process your booking enquiry, carry out your booking and fulfil the contract. In addition, data is stored where statutory retention obligations apply. In this case, storage is based on Art. 6(1)(c) GDPR in conjunction with the relevant statutory provisions, in particular Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO).
After the respective retention periods have expired, the relevant data will be deleted unless there is a further statutory obligation or other legal basis for longer storage.
vioma VOUCHER – Voucher purchases and voucher management
Our website uses the vioma VOUCHER software provided by vioma GmbH, Industriestraße 27, 77656 Offenburg, for the sale, redemption and management of online vouchers.
We have concluded a data processing agreement with vioma GmbH in accordance with Art. 28 GDPR. If you purchase a voucher via our website, we process the personal data required to handle the purchase and deliver the voucher. This includes, in particular, your e-mail address and the form of address, first name and surname of the voucher recipient. We also record the desired delivery method so that we can deliver the voucher in accordance with your instructions. If the voucher is sent by e-mail, we process the recipient's e-mail address. If it is sent by post, we require the recipient's postal address.
We use the payment service provider Stripe to process online payments.
Payment service provider:
Stripe Payments Europe, Limited
1 Grand Canal Street Lower
Grand Canal Dock
Dublin 2
Ireland
If you make a payment via Stripe, the personal data required to process the payment is transmitted to Stripe. Further information about the processing of your data can be found in Stripe's Privacy Policy:
As part of voucher management, information about the respective voucher is also stored. This includes, in particular, the original voucher value, any remaining balance, redemptions already made and the current voucher status, for example open, paid or redeemed.
The processing of your personal data in connection with the purchase, delivery and redemption of vouchers is carried out on the basis of Art. 6(1)(b) GDPR. It is necessary for the implementation of pre-contractual measures and for the performance and processing of the contract.
Where we are required by law to retain certain data, processing is also carried out on the basis of Art. 6(1)(c) GDPR.
Your personal data is stored for as long as necessary to process the voucher purchase and to manage and redeem the voucher. After the voucher has been fully redeemed or has expired, the data will be deleted unless statutory retention obligations or other legitimate reasons require further storage.
We retain data required for accounting and tax records in accordance with the statutory retention periods.
vioma BAROMETER - Feedback surveys and quality seal
Our website uses the vioma BAROMETER quality seal and survey software, provided by vioma GmbH, Industriestraße 27, 77656 Offenburg, to display guest satisfaction and collect guest feedback. We have concluded a data processing agreement with vioma.
We use the vioma BAROMETER quality seal on our website to give website visitors an impression of the quality of our services. Free-text comments from guests may be displayed. By clicking on the quality seal, you will be redirected to an external website where these comments are displayed. According to vioma, vioma BAROMETER does not process any personal data when you visit our website, click on the quality seal or visit the external website.
We also use vioma BAROMETER to invite guests to take part in a voluntary feedback survey after their stay. For this purpose, we transmit your e-mail address, name and the information about your stay required for the survey to vioma. This transfer takes place for the purpose of conducting and evaluating the guest survey.
The use of your e-mail address for this guest survey is based on our legitimate interest in improving our services in accordance with Art. 6(1)(f) GDPR, while observing the requirements of Section 7(3) UWG. You may object to the use of your e-mail address for this purpose at any time, for example by e-mail to info(at)hanauer-hof.de. We inform you of this right to object when collecting your e-mail address and in every invitation e-mail. You will not incur any costs other than the transmission costs at the basic rates.
Free-text comments that identify individuals or allow conclusions to be drawn about individual guests will only be published with the prior consent of the guests concerned in accordance with Art. 6(1)(a) GDPR. This consent may be withdrawn at any time with effect for the future.
Data from feedback surveys, in particular contact details, information about stays and survey responses, is stored only for as long as necessary to conduct and evaluate the surveys and for quality assurance purposes. Once the respective purpose no longer applies, the data will be deleted unless statutory retention obligations prevent this. If consent to publication is withdrawn, we will remove the relevant comment insofar as this is possible and reasonable for us.
Conclusion of a data processing agreement
We have concluded a data processing agreement with vioma GmbH in accordance with Art. 28 GDPR.
Reservision table reservations
For table reservations at our Klara restaurant, we use the Reservision reservation system provided by Reservision GmbH, Seestraße 29, 64354 Reinheim, Germany. The system is integrated into our website. When you access the table reservation page, a connection to Reservision's servers is established. In particular, your IP address is transmitted in this process.
Purpose of processing and types of data processed
We use Reservision to receive, manage and confirm your table reservations. We process the data you enter in the reservation form, in particular your name, e-mail address, telephone number, desired date and time, number of people and, where applicable, your comments, requests or notes, for example regarding allergies. Technical data generated when accessing the reservation system may also be processed. This includes, for example, your IP address, the date and time of access and information about your browser and device.
Data processing
Reservision processes the data on our behalf and in accordance with our instructions. To ensure data processing in compliance with data protection requirements, we have concluded a data processing agreement with Reservision GmbH in accordance with Art. 28 GDPR.
Legal basis
Your reservation data is processed for the implementation of pre-contractual measures and for the performance of the contract with you in accordance with Art. 6(1)(b) GDPR. The technical provision and secure operation of the reservation system are based on our legitimate interest in the reliable and efficient management of table reservations in accordance with Art. 6(1)(f) GDPR. Where technically necessary cookies or similar technologies are used, their storage is based on Section 25(2)(2) TDDDG.
Storage period
We store your reservation data only for as long as necessary to process and manage your reservation. After your restaurant visit or a cancellation, the data will be deleted as soon as it is no longer required for the purposes stated above and there are no statutory retention obligations or other legitimate reasons for further storage.
Right to object
Where processing is based on Art. 6(1)(f) GDPR, you may object to the processing on grounds relating to your particular situation in accordance with Art. 21 GDPR. Further information can be found in the section “Right to object to data collection in specific cases and to direct marketing (Art. 21 GDPR)”.
Further information about data protection at Reservision can be found at: https://www.reservision.de/datenschutz/
AI telephone assistant and chat widget (AURA)
We use the AI assistant “AURA” from Aura Intelligence Ltd., 6 Fern Road, Sandyford, Dublin 18, Ireland, on our website and for our telephone service. Customer support for the DACH region is provided by Aura Intelligence Group, Talacker 21, 8001 Zurich, Switzerland.
The AI assistant handles calls and chat messages, answers frequently asked questions and records requests such as reservation or booking enquiries. For this purpose, AURA can access availability in our vioma booking system and create bookings or booking enquiries there.
You are communicating with an AI system and not with a human being. We inform you of this at the beginning of the telephone call or in the chat window. You can also contact us directly at any time by e-mail or via our contact form.
Purpose of processing and types of data processed
We use AURA to handle enquiries promptly, including outside our business hours and during periods of high call volume.
During a telephone call, your voice data is technically processed and converted into text (transcription). According to our current configuration, the audio recording is not stored permanently. The resulting text transcript may be processed and stored in order to handle your request.
In particular, the following data may be processed:
- Your voice data during the conversation and the resulting text transcript,
- Your telephone number and connection data (e.g. date, time and duration of the call),
- Your chat entries and the responses generated by the system,
- Information you provide, such as your name, contact details, travel dates, number of people and the nature of your request,
- Technical data such as your IP address, device and browser information.
Please do not provide sensitive data, in particular health data, during the conversation or in the chat unless it is necessary for your request.
Loading the chat widget
The chat widget is only loaded after you have given your consent via our cookie banner or actively opened the chat. According to our technical configuration, no connection to AURA is established and your IP address is not transmitted to AURA before the widget is loaded.
Data processing and other service providers
AURA processes the data on our behalf and in accordance with our instructions. To ensure data processing in compliance with data protection requirements, we have concluded a data processing agreement with Aura Intelligence Ltd. in accordance with Art. 28 GDPR.
According to its own information, AURA uses additional service providers to operate the AI assistant. These include, in particular, providers of speech recognition and speech synthesis, telephony, database hosting, workflow automation and PMS integrations, cloud infrastructure and AI language models.
According to AURA, processing takes place primarily within the EU. Individual service providers used may be based outside the EU or the European Economic Area, in particular in the USA. Where personal data is transferred to such third countries, this is done in compliance with Art. 44 et seq. GDPR, in particular on the basis of an adequacy decision pursuant to Art. 45 GDPR or appropriate safeguards pursuant to Art. 46 GDPR, such as EU Standard Contractual Clauses.
Where data is transferred to Aura Intelligence Group in Switzerland as part of customer support, this is done in compliance with the data protection requirements for transfers to third countries. The European Commission has issued an adequacy decision for Switzerland pursuant to Art. 45 GDPR.
You may request an overview of the specific sub-processors used from us.
Legal basis
Where your enquiry relates to a contract or pre-contractual measures, for example a booking or reservation, processing is carried out on the basis of Art. 6(1)(b) GDPR. In all other cases, processing is based on our legitimate interest in ensuring reliable accessibility and efficiently handling enquiries in accordance with Art. 6(1)(f) GDPR. Where the chat widget stores or accesses information on your device that is not strictly necessary to provide the chat service, this only takes place with your consent in accordance with Section 25(1) TDDDG. Where the subsequent processing of personal data is based on this consent, the legal basis is Art. 6(1)(a) GDPR. You may withdraw any consent you have given at any time with effect for the future, for example via the cookie settings on our website.
Storage period
We store personal data only for as long as necessary to handle your request. It will then be deleted unless statutory retention obligations or other legal reasons prevent deletion. The agreed deletion and retention rules apply to the storage and deletion of data processed by AURA and its service providers.
No solely automated decision-making
No solely automated decision is made that produces legal effects concerning you or similarly significantly affects you within the meaning of Art. 22 GDPR.
Right to object
Where processing is based on Art. 6(1)(f) GDPR, you may object to the processing on grounds relating to your particular situation in accordance with Art. 21 GDPR. Further information can be found in the section “Right to object to data collection in specific cases and to direct marketing (Art. 21 GDPR)”.
Further information can be found in AURA's privacy notice: https://auravoice.ai/datenschutz
Registration on this website
You can register on our website to use additional features. We use the data entered for this purpose only to provide the offer or service for which you have registered. The mandatory information requested during registration must be provided in full; otherwise, we will not be able to complete your registration.
We use the e-mail address provided during registration to inform you about important changes, such as changes to the scope of the service or technically necessary changes.
The data entered during registration is processed for the performance of the user relationship (Art. 6(1)(b) GDPR) [or on the basis of your consent, Art. 6(1)(a) GDPR]. If you have given consent, you may withdraw it at any time with effect for the future, e.g. by e-mail to info(at)hanauer-hof.de. The lawfulness of processing carried out before withdrawal remains unaffected.
We store the data collected during registration for as long as you remain registered on our website. It will then be deleted unless statutory retention periods prevent this.
Cookie consent
Our website uses the cookie consent technology provided by vioma GmbH, Industriestraße 27, 77656 Offenburg, to obtain your consent to the storage of certain cookies and access to information on your device and to document this in compliance with data protection requirements. We have concluded a data processing agreement with vioma in accordance with Art. 28 GDPR.
When you access our website, a technically necessary cookie from vioma is stored in your browser. Your consent decisions or a withdrawal are documented in this cookie so that your selection can be taken into account when you access further pages. The storage of this cookie is necessary to manage your consent and is carried out in accordance with Section 25(2)(2) TDDDG without separate consent.
The data processed as part of consent management is used to manage and document your consent decisions.
Withdrawal of your consent
You may withdraw consent given in the cookie consent dialogue at any time with effect for the future. If you wish to change your selection, please click here. The cookie consent dialogue will then be displayed again, allowing you to adjust your selection.
Alternatively, you can delete the relevant cookies via your browser settings. Please note that this may also remove your saved consent settings. The next time you visit our website, the cookie consent dialogue will be displayed again.
The logging of your consent and any withdrawal is carried out to fulfil our statutory obligation to provide evidence in accordance with Art. 7(1) GDPR in conjunction with Art. 6(1)(c) GDPR. Withdrawal is logged to fulfil our obligation to provide evidence on the basis of Art. 6(1)(c) in conjunction with Art. 7(1) GDPR. Mandatory statutory retention periods remain unaffected.
SOCIAL MEDIA
Facebook plugins (Like & Share button)
Plugins from the social network Facebook may be integrated into our website. The provider for users within the EU is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland (“Meta”). You can recognise Facebook plugins, for example, by the Facebook logo or the “Like” button.
An overview of Facebook plugins can be found here: https://developers.facebook.com/docs/plugins/
The Facebook plugins are only loaded after you have consented to their use. After you have given your consent, a direct connection is established between your browser and Meta's servers when you access a page containing such a plugin. In particular, Meta may receive your IP address and information about your visit to our website.
If you click the “Like” button while logged into your Facebook account, you can link content from our website to your Facebook profile. Meta may then associate your visit to our website with your user account. We have no influence over the scope of the data collected by Meta or its further use.
Further information about data processing by Meta can be found in Facebook's Privacy Policy: https://www.facebook.com/privacy/explanation
The integration of Facebook plugins and the associated processing of personal data are based on your consent in accordance with Art. 6(1)(a) GDPR and Section 25(1) TDDDG, insofar as information is stored on or accessed from your device. You may withdraw your consent at any time with effect for the future via the cookie settings on our website.
Where we and Meta jointly determine the purposes and means of collecting and transmitting personal data through the plugins, joint controllership exists in accordance with Art. 26 GDPR. Meta is independently responsible for subsequent processing.
If you do not want Meta to be able to associate your visit to our website with your Facebook account, you can log out of your Facebook account before visiting our website. However, this does not replace the consent required for the plugins to be loaded.
ANALYTICS TOOLS AND ADVERTISING
Google Analytics
This website uses the e-commerce tracking function of Google Analytics 4. This enables us to analyse the booking and purchasing behaviour of visitors to our website and evaluate the effectiveness of our online marketing activities. Information about bookings and voucher purchases is collected. This may include, in particular, transaction IDs, purchase values and information about the booking and purchasing process. This data is evaluated statistically in order to improve our services and marketing activities.
Processing takes place exclusively on the basis of your prior consent in accordance with Art. 6(1)(a) GDPR. Where information is stored on or accessed from your device for this purpose, this is additionally based on Section 25(1) TDDDG. You may withdraw your consent at any time with effect for the future via the cookie settings on our website.
Storage period for Google Analytics 4
The user-level and event-level data stored by Google that is associated with cookies, user identifiers (e.g. a User-ID) or advertising IDs is deleted or anonymised after 14 months in accordance with the data retention settings configured in our Google Analytics account.
This retention period does not automatically apply to all aggregated reports and statistics. Further information about data retention in Google Analytics can be found here:
https://support.google.com/analytics/answer/7667196?hl=de
Data processing and transfer of data to the USA
We have concluded a data processing agreement with Google Ireland Limited in accordance with Art. 28 GDPR.
Where personal data is transferred to the USA as part of the use of Google Analytics, this is carried out on the basis of the European Commission's adequacy decision concerning the EU-US Data Privacy Framework (DPF), provided that the respective recipient is certified accordingly. Google LLC is certified under the EU-US Data Privacy Framework. In addition, the European Commission's Standard Contractual Clauses may be used as appropriate safeguards pursuant to Art. 46 GDPR.
Further information can be found in the section “Data transfers to third countries” of this Privacy Policy.
IP anonymisation
According to Google, IP addresses are not logged or stored in Google Analytics 4. The IP address is used only briefly to determine the user's approximate location and is then discarded. A separate setting for IP anonymisation is therefore not required in Google Analytics 4. According to Google, for users from the EU, IP addresses are processed to determine location on servers within the EU before the other data is forwarded for processing.
On behalf of the operator of this website, Google uses the information collected to evaluate your use of the website, compile reports on website activity and provide the website operator with other services relating to website and internet use.
The information collected by Google about your use of our website may be transferred to and stored on Google's servers. This may also involve the transfer of personal data to the USA. Further information can be found in the section “Data transfers to third countries”.
The use of Google Analytics and the setting of the cookies required for this purpose are carried out exclusively on the basis of your prior consent in accordance with Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You may withdraw your consent at any time with effect for the future by changing your selection in the cookie settings on our website.
Browser add-on to disable tracking
You may withdraw your consent to the use of Google Analytics at any time with effect for the future by changing your selection in the cookie settings on our website.
Further information about the handling of user data by Google Analytics can be found in Google's Privacy Policy:
https://support.google.com/analytics/answer/6004245?hl=de
Information about the browser add-on for disabling Google Analytics can be found here:
https://tools.google.com/dlpage/gaoptout?hl=de
Google Signals and demographic characteristics
This website uses the “Google Signals” feature of Google Analytics 4 to provide enhanced analysis of website usage. This enables reports to be created containing aggregated information about the demographic characteristics and interests of website visitors, for example age, gender and interests.
The data comes, among other things, from the use of Google services and Google's interest-based advertising. The prerequisite for collecting such information is that visitors are logged into their Google account and have enabled personalised advertising.
We receive this information only in aggregated form and cannot directly associate it with individual website visitors.
Processing is based on your consent in accordance with Art. 6(1)(a) GDPR and Section 25(1) TDDDG, insofar as information is stored on or accessed from your device. You may withdraw your consent at any time with effect for the future via the cookie settings on our website.
You can also disable personalised advertising in your Google account via Google's ad settings: https://myadcenter.google.com/
Further information about data processing by Google can be found at: https://policies.google.com/privacy?hl=de
Google Analytics E-Commerce Tracking
This website uses Google Tag Manager, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Tag Manager is used to manage and integrate various services and tracking technologies on our website. For example, analytics and marketing services can be integrated and managed via a central user interface.
Google Tag Manager itself does not create independent user profiles and does not carry out its own web analytics. However, it can load and trigger other services and their tags, through which personal data may be processed. When Google Tag Manager is accessed, your IP address in particular may be transmitted to Google. This may also involve transmission to servers operated by Google LLC in the USA.
Google Tag Manager is only loaded on our website after you have given your consent. The processing of personal data is therefore based on Art. 6(1)(a) GDPR. Where information is stored on or accessed from your device, Section 25(1) TDDDG also applies.
You may withdraw your consent at any time with effect for the future via the “Cookie Settings” link at the bottom of our website.
We have concluded a data processing agreement with Google in accordance with Art. 28 GDPR.
Where personal data is transferred to the USA as part of the use of Google Tag Manager, this is carried out on the basis of the European Commission's adequacy decision concerning the EU-US Data Privacy Framework (DPF), provided that the respective recipient is certified accordingly. In addition, the European Commission's Standard Contractual Clauses may be used as appropriate safeguards pursuant to Art. 46 GDPR.
Further information can be found in the section “Data transfers to third countries” and in Google's privacy notices: https://policies.google.com/privacy?hl=de
Google Tag Manager
This website uses “Google Tag Manager”, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Tag Manager provides a technical basis for bundling various web applications, including tracking and analytics services, controlling them via a uniform user interface and linking them to specific conditions. Google Tag Manager itself does not store any information on your device or read any information from it. It also does not carry out any independent data analyses. However, when a page is accessed, Google Tag Manager transmits your IP address to Google, where it may be stored. Transmission to servers operated by Google LLC in the USA is also possible.
Google Tag Manager is only loaded if you have given us your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). It is not used during your visit to our website without your consent. You may withdraw your consent at any time with effect for the future by disabling this service in the [Cookie Settings].
We have concluded a data processing agreement with Google.
Where data is transferred to the USA, the transfer is based on the European Commission's adequacy decision concerning the EU-US Data Privacy Framework (DPF). To our knowledge, Google LLC is certified under the DPF. Further information can be found in the section “Data transfers to third countries”.
Google Ads
We use Google Ads, an online advertising programme provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Ads enables us to place advertisements in Google Search and on websites and platforms operated by third parties. The advertisements may be targeted, for example, on the basis of specific search terms (keyword targeting) or audience characteristics such as interests and location information.
We can evaluate the effectiveness of our advertising measures using aggregated statistics. For example, we can see which search terms led to our advertisements being displayed and how often our advertisements were clicked. Where cookies or similar technologies are used on our website in connection with Google Ads, they are stored or accessed only after you have given your prior consent in accordance with Section 25(1) TDDDG. The subsequent processing of personal data is based on your consent in accordance with Art. 6(1)(a) GDPR.
You may withdraw your consent at any time with effect for the future via the “Cookie Settings” link at the bottom of our website.
Advertising within Google services and on third-party websites is delivered by Google. We have influence over the data processing carried out there only to the extent that we participate in determining its purposes and means. Where personal data is transferred to the USA as part of the use of Google Ads, this is carried out on the basis of the European Commission's adequacy decision concerning the EU-US Data Privacy Framework (DPF), provided that the respective recipient is certified accordingly. In addition, the European Commission's Standard Contractual Clauses may be used as appropriate safeguards pursuant to Art. 46 GDPR.
Further information about data processing by Google can be found at: https://privacy.google.com/businesses/controllerterms/mccs/
Further information can also be found in the section “Data transfers to third countries” of this Privacy Policy.
Google Ads conversion tracking
This website uses Google Ads conversion tracking, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Ads conversion tracking enables us to determine whether visitors perform certain actions on our website after clicking one of our Google advertisements. These actions include, for example, visiting specific pages, clicking buttons, making bookings or purchasing vouchers. This allows us to measure the effectiveness of our advertisements and improve our online marketing activities.
In particular, information about ad clicks, pages visited, actions performed and the times of the respective interactions is processed. Cookies and similar technologies may be used to recognise visitors. These may include, for example, the cookies “_gcl_aw” and “_gcl_au”. You can find the specific storage periods of the cookies used in our cookie settings.
We receive evaluations and statistics from Google about the conversions generated by our advertisements. As a rule, this information does not allow us to directly identify individual website visitors. Google may further process the data collected as part of its own services and in accordance with the applicable data protection provisions.
The use of Google Ads conversion tracking and the setting or retrieval of the cookies required for this purpose are carried out exclusively on the basis of your prior consent. The legal basis for accessing information on your device is Section 25(1) TDDDG. The subsequent processing of personal data is based on Art. 6(1)(a) GDPR.
You may withdraw your consent at any time with effect for the future via the “Cookie Settings” link at the bottom of our website. The lawfulness of processing carried out before withdrawal remains unaffected.
As part of the use of Google Ads, personal data may be transferred to Google LLC in the USA. Where the transfer is covered by Google LLC's certification under the EU-US Data Privacy Framework, it is carried out on the basis of the European Commission's adequacy decision pursuant to Art. 45 GDPR. In addition, the European Commission's Standard Contractual Clauses pursuant to Art. 46 GDPR may be applied as appropriate safeguards.
Further information about data protection at Google can be found at: https://policies.google.com/privacy?hl=de
vioma TAO - Web analytics
This website uses the vioma TAO web analytics service provided by vioma GmbH, Industriestraße 27, 77656 Offenburg, Germany.
vioma TAO uses cookies and similar technologies to collect and evaluate information about the use of our website. The information collected is transmitted to vioma servers and stored there. You can view which cookies are used in detail and how long they are stored at any time in our cookie settings.
Purpose of processing and types of data processed
We use vioma TAO to analyse visitor traffic and user behaviour on our website. The information obtained helps us evaluate the use of our online services, create visitor statistics and reports, and improve our website and services.
In particular, the following personal data may be processed:
- Your IP address,
- Date and time of your access,
- Information about the source of your visit,
- Pages visited and content clicked,
- Frequency and duration of your visits,
- Information about your browser and device.
The IP address may be used to determine the approximate location and for statistical evaluation of visitor access.
Data processing and disclosure to third parties
vioma processes personal data on our behalf and in accordance with our instructions. We have concluded a data processing agreement with vioma GmbH in accordance with Art. 28 GDPR.
Personal data collected via vioma TAO is only passed on to third parties or transferred to countries outside the EU or the European Economic Area where this is necessary for the services used and permitted under data protection law.
Legal basis
The use of vioma TAO and the storage or retrieval of the cookies and similar technologies required for this purpose take place only after you have given your prior consent. The legal basis for accessing information on your device is Section 25(1) TDDDG. The subsequent processing of personal data is based on Art. 6(1)(a) GDPR.
You may withdraw your consent at any time with effect for the future via our cookie settings.
Storage period
The personal data collected via vioma TAO is stored only for as long as necessary to analyse and evaluate website usage or for as long as consent has been given. Once the purpose of processing no longer applies or you withdraw your consent, the data will be deleted unless statutory retention obligations or other legal reasons prevent deletion.
The storage periods of the individual cookies can be found in our cookie settings.
Your data protection rights
Subject to the statutory requirements, you have the right to access the personal data stored about you (Art. 15 GDPR), to have inaccurate data rectified (Art. 16 GDPR), to have data erased (Art. 17 GDPR) and to restrict processing (Art. 18 GDPR). Further information about your rights and how to exercise them can be found in the relevant sections of this Privacy Policy.
Withdrawal of your consent
You may withdraw or change your consent to the use of vioma TAO at any time with effect for the future via the “Cookie Settings” link at the bottom of our website. The lawfulness of processing carried out before withdrawal remains unaffected. You can also delete cookies or restrict their storage via your internet browser settings. Please note that this may also cause other saved website settings to be lost.
Further information about data protection at vioma can be found at: https://www.vioma.de/
YouTube with enhanced privacy mode
We embed videos from the YouTube platform on our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).
We use YouTube in enhanced privacy mode. According to YouTube's technical description, this means that fewer visitor details are initially collected when a page containing an embedded video is merely accessed. However, data may be transmitted to YouTube, in particular if you consent to the embedding of the video or play the video.
The YouTube video is only loaded after you have given your consent. As soon as you start a video, a connection to YouTube's servers is established. In particular, your IP address and information about the page accessed are transmitted to Google.
If you are logged into your Google or YouTube account while using the video, Google may associate your usage with your user account. You can prevent this by logging out of your account before playing the video.
After a video has been started, YouTube may use cookies or similar technologies to collect information about how the video is used. This information may be used, for example, to compile video statistics, improve user-friendliness and prevent misuse. You can find details of the cookies and similar technologies used and how long they are stored in our cookie settings.
We have no influence over further data processing operations carried out by Google or any associated service providers.
The integration and use of YouTube are based on your consent in accordance with Art. 6(1)(a) GDPR. Where cookies or similar technologies are stored on or accessed from your device, this is also based on your consent in accordance with Section 25(1) TDDDG. You may withdraw your consent at any time with effect for the future via the “Cookie Settings” link at the bottom of our website. The lawfulness of processing carried out before withdrawal remains unaffected.
As part of the use of YouTube, personal data may be transferred to Google LLC in the USA. Where Google LLC is certified under the EU-US Data Privacy Framework and the transfer is covered by this certification, the transfer is based on the European Commission's adequacy decision pursuant to Art. 45 GDPR. In addition, appropriate safeguards, in particular the European Commission's Standard Contractual Clauses pursuant to Art. 46 GDPR, may be applied.
Further information about data protection at YouTube can be found in Google's Privacy Policy: https://policies.google.com/privacy?hl=de.
YOUR RIGHTS
Access, rectification and erasure
Within the framework of the applicable legal provisions, you have the right at any time to obtain information free of charge about the personal data concerning you that we have stored. This includes, in particular, information about the origin and recipients of your data, the purposes of processing and the storage period (Art. 15 GDPR).
In addition, you have the right to request the rectification of inaccurate personal data (Art. 16 GDPR) and, subject to the statutory requirements, to request the erasure of your personal data (Art. 17 GDPR).
You may contact us at any time to exercise these rights or if you have any further questions about personal data. Our contact details can be found in the section “Controller” of this Privacy Policy.
Right to restriction of processing
You have the right to request the restriction of the processing of your personal data, subject to the statutory requirements (Art. 18 GDPR). This right applies in particular in the following cases:
- Verification of data accuracy: If you dispute the accuracy of the personal data we have stored about you, you may request restriction of processing for the period required to verify its accuracy.
- Unlawful processing: If the processing of your personal data is unlawful, you may request restriction of processing instead of erasure.
- Data required for legal claims: If we no longer need your personal data for the original processing purposes, but you need it to establish, exercise or defend legal claims, you may request restriction of processing.
- Objection to processing: If you have objected to processing pursuant to Art. 21(1) GDPR, you may request restriction of processing for the period required to verify whether our legitimate grounds override your interests.
If the processing of your personal data has been restricted, such data may – apart from being stored – only be processed with your consent, for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or a Member State.
Withdrawal of your consent to data processing
Some personal data processing operations are only possible with your consent. You have the right to withdraw consent once given at any time with effect for the future (Art. 7(3) GDPR). Withdrawal may be made informally, for example by e-mail to the contact address specified in this Privacy Policy.
You may withdraw or change consent to the use of cookies and similar technologies at any time via the “Cookie Settings” link at the bottom of our website. Withdrawal is just as easy as giving consent. The lawfulness of processing carried out before withdrawal remains unaffected by the withdrawal.
Right to object to data collection in specific cases and to direct marketing (Art. 21 GDPR)
Objection on specific grounds (Art. 21(1) GDPR)
If we process your personal data on the basis of Art. 6(1)(e) or (f) GDPR, you have the right to object to this processing at any time on grounds relating to your particular situation. This also applies to profiling based on these provisions.
You can find the respective legal basis for the individual processing operations in this Privacy Policy.
If you object, we will no longer process the personal data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
Objection to direct marketing (Art. 21(2) and (3) GDPR)
If your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for this purpose. This also applies to profiling insofar as it is related to direct marketing.
If you object to processing for direct marketing purposes, your personal data will subsequently no longer be processed for these purposes.
Right to lodge a complaint with the competent supervisory authority
In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work or the place of the alleged infringement (Art. 77 GDPR). The right to lodge a complaint exists without prejudice to any other administrative or judicial remedies.
The following supervisory authority is responsible for our company:
The State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (LfDI Baden-Württemberg)
Heilbronner Straße 35
70191 Stuttgart
Website: https://www.baden-wuerttemberg.datenschutz.de/
Right to data portability
You have the right to receive personal data that you have provided to us and that we process automatically on the basis of your consent or for the performance of a contract in a structured, commonly used and machine-readable format. You may also request that we transmit this data directly to another controller, provided this is technically feasible. The right to data portability applies only insofar as the statutory requirements under Art. 20 GDPR are met and the rights and freedoms of other persons are not adversely affected. To exercise your right, please contact us using the contact details provided under “Controller” in this Privacy Policy.