Legal Basis for the Processing of Personal Data

To the extent that we obtain the data subject’s consent for the processing of personal data, Article 6(1), first sentence, subparagraph (a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis.When processing personal data necessary for the performance of a contract to which the data subject is a party, Article 6(1)(b) of the GDPR serves as the legal basis. This also applies to processing operations necessary for the implementation of precontractual measures.

To the extent that the processing of personal data is necessary to comply with a legal obligation to which we are subject, Article 6(1), first sentence, subparagraph (c) of the GDPR serves as the legal basis.

If processing is necessary to safeguard a legitimate interest of our company or a third party, and the interests, fundamental rights, and fundamental freedoms of the data subject do not override the aforementioned interest, then Article 6(1), first sentence, subparagraph (f) of the GDPR serves as the legal basis for the processing.

Data Deletion and Retention Period

The data subject’s personal data will be deleted or blocked as soon as the purpose for which it was stored no longer applies. Data may also be retained if this is provided for by European or national legislation in EU regulations, laws, or other provisions to which we are subject. Data will also be blocked or deleted when a retention period prescribed by the aforementioned standards expires, unless further retention of the data is necessary for the conclusion or performance of a contract.

§ 1 THE DATA CONTROLLER AND THE DATA PROTECTION OFFICER

(1) Name and address of the controller
The controllerwithin the meaning of the General Data Protection Regulation and other national data protection laws of the Member States, as well as other data protection regulations, is:

Gebr. Traubel GmbH
Dorf 5, 87538 Balderschwang, Germany
Tel.: 08328-9200
info@hotel-hubertus.de; www.hotel-hubertus.de

(2) Name and address of the data protection officer
The data protection officer for the controller is:

Dieter Grohmann
akwiso Data Protection & Audit
Beethovenstrasse 23, 87435 Kempten, Germany
Tel.: 0831-5124-7030
info@akwiso.de, www.akwiso.de

§ 2 DEFINITIONS
This Privacy Policy is based on the terminology used by the European legislator when enacting the EU General Data Protection Regulation (hereinafter referred to as the “GDPR”). This Privacy Policy is intended to be easy to read and understand. To ensure this, the most important terms are explained below:

a) Personal data refers to any information relating to an identified or identifiable natural person (hereinafter referred to as the “data subject”). A natural person is considered identifiable if they can be identified, directly or indirectly, in particular by association with an identifier such as a name, an identification number, location data, an online identifier, or one or more specific characteristics that reflect the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

b) A data subject is any identified or identifiable natural person whose personal data is processed by the controller.

c) Processing means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, distribution, or any other form of disclosure, the matching or linking, the restriction, erasure, or destruction.

d) Profiling means any form of automated processing of personal data that consists of using such personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person’s work performance, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.

e) Pseudonymization is the processing of personal data in such a way that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures that ensure the personal data is not attributed to an identified or identifiable natural person.

(f) The controller is the natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by Union law or the law of the Member States, the controller or the specific criteria for its designation may be provided for by Union law or the law of the Member States.

(g) A processor is a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller.

(h) A recipient is a natural or legal person, public authority, agency, or other body to whom personal data is disclosed, regardless of whether or not that entity is a third party. However, public authorities that may receive personal data in the course of a specific investigative mandate under Union law or the law of the Member States are not considered recipients.

(i) “Third party” means a natural or legal person, public authority, agency, or other body other than the data subject, the controller, the processor, and the persons authorized to process the personal data under the direct responsibility of the controller or the processor.

(j) Consent means any freely given, specific, informed, and unambiguous indication of the data subject’s wishes, expressed in the form of a statement or other unambiguous affirmative action, by which the data subject indicates that he or she consents to the processing of personal data relating to him or her.

§ 3 PROVISION OF THE WEBSITE AND CREATION OF LOG FILES

(1) When you use the website for informational purposes only—that is, if you do not register or otherwise provide us with information—we automatically collect the following data and information from the computer system of the device used to access the website each time you visit:

a) The user's IP address

b) Information about the browser type and version used

c) The user's operating system

d) The user's Internet service provider

e) Date and time of access

f) Websites from which the user's system accesses the website

g) Websites accessed by the user's system via our website

h) Content of the calls (specific pages)

i) Amount of data transferred in each instance

j) Language and version of the browser software

k) Search engines used

l) Names of downloaded files

The data is also stored in our system's log files. This data is not stored together with any other personal data belonging to the user.

(2) The legal basis for the temporary storage of log files is Article 6(1)(f) of the GDPR.

(3) The system's temporary storage of the IP address is necessary in order to

a) To enable the website to be delivered to the user’s computer. To do this, the user’s IP address must be stored for the duration of the session.
b) To optimize the content of our website and the advertising displayed on it
c) To ensure the functionality of our information technology systems and the technology underlying our website
d) To provide law enforcement agencies with the information necessary for criminal prosecution in the event of a cyberattack

Data is stored in log files to ensure the proper functioning of the website. In addition, we use this data to optimize the website and to ensure the security of our IT systems. The data is not analyzed for marketing purposes in this context. These purposes also constitute our legitimate interest in data processing pursuant to Article 6(1), first sentence, letter f) of the GDPR.

(4) The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected—in this case, at the end of the usage session

When data is stored in log files, this occurs no later than seven days after collection. Storage beyond this period is possible. In such cases, the IP addresses are deleted or anonymized so that the accessing client can no longer be identified.
(5) The collection of data for the purpose of providing the website and the storage of data in log files is absolutely necessary for the operation of the website; therefore, there is no option to object.

§ 4 USE OF COOKIES

(1) This website uses so-called cookies. Cookies are small text files that, as soon as you visit a website, are sent from a web server to your browser, stored locally on your device (PC, laptop, tablet, smartphone, etc.), and provide the user (i.e., us) with certain information. Cookies serve to make the website more user-friendly and secure, in particular to collect usage-related information, such as the frequency of use, the number of users visiting the pages, and user behavior on the site. Cookies do not cause any damage to your computer and do not contain viruses.

This cookie contains a unique string (known as a cookie ID) that allows the browser to be uniquely identified when the website is visited again.

(2) We use cookies to make our website more user-friendly. Some elements of our website require that the browser accessing the site can be identified even after a page change.

(3) The purpose of using technically necessary cookies is to make it easier for you to use websites. Some features of our website cannot be provided without the use of cookies. For these features, it is necessary for the browser to be recognized even after changing pages.

(4) Cookies remain stored even after the browser session ends and can be accessed again when you visit the site a second time. However, cookies are stored on your computer and transmitted from there to our site. Therefore, you have full control over the use of cookies. If you do not wish to have data collected via cookies, you can configure your browser through the “Settings” menu to notify you when cookies are set, to block cookies entirely, or to delete individual cookies. Please note, however, that disabling cookies may limit the functionality of this website. Session cookies are automatically deleted when you leave the website anyway.

§ 5 NEWSLETTER

(1) With your consent, you can subscribe to our free newsletter, through which we will keep you informed about our latest special offers. The advertised goods and services are listed in the consent form.
We use the so-called double opt-in procedure for newsletter sign-ups. This means that after you sign up, we will send an email to the address you provided, asking you to confirm that you wish to receive the newsletter. If you do not confirm your subscription within [24 hours], your information will be blocked and automatically deleted after one month. In addition, we store the IP addresses you used as well as the times of your subscription and confirmation. The purpose of this procedure is to verify your subscription and, if necessary, to investigate any potential misuse of your personal data.

The only required information for subscribing to the newsletter is your email address. Providing any additional information is optional and will be used to address you personally.

The data will be used exclusively for sending the newsletter.

(2) The legal basis for processing data after a user subscribes to the newsletter is Article 6(1), first sentence, subparagraph (a) of the GDPR, provided that consent has been given.

(3) The user's email address is collected for the purpose of delivering the newsletter.

The collection of other personal data as part of the registration process is intended to prevent misuse of the services or the email address provided.

(4) The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. Your email address will therefore be stored for as long as your newsletter subscription remains active.

(5) You may unsubscribe from our newsletters at any time and thereby revoke your consent by clicking the “Unsubscribe from Newsletter” link in our newsletter footer, or by sending us an email to info@hotel-hubertus.de or a message using the contact information provided in the legal notice.

§ 6 NEWSLETTER TRACKING

The newsletters from Gebr. Traubel GmbH contain so-called web beacons. A web beacon is a miniature graphic embedded in emails sent in HTML format to enable log file recording and analysis. This allows for a statistical evaluation of the success or failure of online marketing campaigns. Using the embedded web beacon, Gebr. Traubel GmbH can determine whether and when an email was opened by a data subject and which links contained in the email were clicked by the data subject.

Such personal data collected via the tracking pixels contained in the newsletters is stored and analyzed by the data controller in order to optimize the distribution of the newsletter and to tailor the content of future newsletters even better to the interests of the data subject. This personal data is not disclosed to third parties. Data subjects are entitled at any time to revoke the separate declaration of consent provided via the double opt-in procedure. Following revocation, this personal data will be deleted by the data controller. Gebr. Traubel GmbH automatically interprets unsubscribing from the newsletter as a revocation of consent.

§ 7 REGISTRATION FOR THE REGULAR CUSTOMER CLUB AND RESERVATION MANAGEMENT

(1) We offer you the option to register on our website by providing personal data. The data is entered into a form, transmitted to us, and stored. We do not disclose this data to third parties under any circumstances, unless there is a legal obligation to do so or the disclosure is necessary for criminal or civil prosecution.

The following data is collected as part of the registration process:

- Email address

- Password of your choice (There is no requirement to use your real name; pseudonymous use is permitted)

- Username of your choice

- IP address

- Date and time of registration

You can manage and change all of your information in the secure customer area.
As part of the registration process, the user’s consent to the processing of this data is obtained.

(2) We use the so-called double opt-in procedure for registration. This means that after you sign up, we will send an email to the email address you provided, asking you to confirm that you wish to register. If you do not confirm your registration within 24 hours, your information will be blocked and automatically deleted after one month. In addition, we store the IP addresses you use as well as the times of your registration and confirmation. The purpose of this procedure is to verify your registration and, if necessary, to investigate any potential misuse of your personal data.

(3) If the user has given consent, the legal basis for processing the data is Article 6(1), first sentence, subparagraph (a) of the GDPR.

(4) Registration is required to provide certain content and services on our website, as well as to prevent misuse and, if necessary, to investigate criminal offenses.

(5) The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected.

Otherwise, you are free to have the personal data you provided during registration completely deleted from the data controller’s database. Upon request, the data controller will provide you at any time with information regarding which personal data about the data subject is stored. Furthermore, the data controller will correct or delete personal data at the request or upon notification by the data subject, provided that no statutory retention obligations prevent this. You may contact the data controller or the data protection officer at any time in accordance with Section 1 via email or mail to request the deletion or modification of your data.

§ 8 E-COMMERCE / PURCHASE OF GIFT CERTIFICATES

(1) If you wish to place an order in our online store, you must provide your personal information—which we need to process your order—in order to conclude the contract. Required information necessary for processing the contract is marked separately; additional information is optional. The data is entered into a form, transmitted to us, and stored. The following data is collected through the online store:

- Name

- Address (different shipping address, if applicable)

- Email address

- IP address

- Date and time of the order

- Payment information
Data will only be disclosed to third parties if such disclosure is necessary for the purpose of contract fulfillment, billing, or collection of fees, or if you have expressly consented to it. In this regard, we disclose only the data that is strictly necessary. The recipients of the data are

- The applicable delivery/shipping company (disclosure of name and address)

- Collection agencies, if payment needs to be collected (disclosure of name, address, and order details)

- Credit bureaus for credit checks (disclosure of name, address, date of birth, etc.). In this case, such information is disclosed only to the extent that we provide goods or services in advance (e.g., purchase on account).

- The bank responsible for collecting the payment, if payment is made via direct debit: You may voluntarily create a customer account, which allows us to store your information for future purchases. When you create an account under “My Account,” the information you provide will be stored on a revocable basis. You can delete or modify all other information, including your user account, at any time in the customer area.

(2) The legal basis is Article 6 ( 1), first sentence, subparagraph (b) of the GDPR. With regard to voluntarily provided data, the legal basis for processing the data is Article 6(1), first sentence, subparagraph (a) of the GDPR.

(3) The mandatory information collected is necessary to fulfill the contract with the user (for the purpose of shipping the goods and confirming the terms of the contract). We therefore use this data to respond to your inquiries, process your order, verify your creditworthiness or collect a debt if necessary, and for the technical administration of the websites. Voluntary information is provided to prevent misuse and, if necessary, to investigate criminal offenses. We may also process the data you provide to inform you about other interesting products in our portfolio or to send you emails containing technical information.

(4) The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. We are required by commercial and tax law to retain your address, payment, and order information for a period of ten years following the fulfillment of the contract. However, after two years, we restrict the processing of your data, meaning it will be used solely to comply with legal obligations. If a continuing contractual relationship exists between us and the user, we will store the data for the entire duration of the contract and for a period of ten years thereafter (see above). With regard to data provided voluntarily, we will delete the data two years after the contract has been fulfilled, provided that no further contract is concluded with the user during this period; in this case, the data will be deleted two years after the fulfillment of the last contract.

(5) Otherwise, you are free to request that the personal data you provided during registration be completely deleted from the data controller’s database. Upon request, the data controller will provide you with information at any time regarding which personal data about you is stored. Furthermore, the data controller will correct or delete personal data at the request or upon notification by the data subject, provided that no statutory retention obligations prevent this. You may contact the data controller or the data protection officer at any time in accordance with § 1 via email or mail to request the deletion or modification of your data.

§ 9 DISCLOSURE OF PERSONAL DATA TO THIRD PARTIES

1. Embedding YouTube Videos

(1) We have embedded YouTube videos in our online content that are stored on http://www.YouTube.com and can be played directly from our website. [These are all embedded in “enhanced privacy mode,” which means that no data about you as a user is transmitted to YouTube unless you play the videos. Only when you play the videos is the data described in paragraph 2 transmitted. We have no control over this data transmission. When you visit the website, YouTube receives the information that you have accessed the corresponding page of our website.]

The following data is transmitted in this process

- Device-specific information, such as the hardware used; the operating system version; a unique device identifier; and information about the mobile network, including your phone number.

- Log data in the form of server logs. This includes, among other things, details about how the services were used, such as search queries; IP address; hardware settings; browser type; browser language; the date and time of your request; referring page; and cookies that can be used to uniquely identify your browser or your Google Account

- Location-based information. Google may collect information about your actual location. This includes, for example, your IP address, Wi-Fi access points, or cell towers

- For more information about the data collected by Google, Inc., please visit the following link: https://policies.google.com/privacy?hl=de&gl=de

This occurs regardless of whether YouTube provides a user account through which you are logged in or whether you do not have a user account. If you are logged in to Google, your data will be directly associated with your account.

(2) The legal basis for the processing of users’ personal data is Article 6(1), first sentence, subparagraph (f) of the GDPR. Google also processes your personal data in the United States and has complied with the EU-U.S. Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.

(3) The embedding of videos serves to make the website more engaging for users and to improve the website’s search engine ranking on Google. YouTube stores your data as usage profiles and uses them for advertising, market research, and/or to tailor its website to user needs. Such analysis is carried out in particular (even for users who are not logged in) to deliver targeted advertising and to inform other users of the social network about your activities on our website.

(4) If you do not want this information to be linked to your YouTube profile, you must log out before clicking the button.

(5) You have the right to object to the creation of these user profiles; to exercise this right, you must contact YouTube.

(6)For more information on the purpose and scope of data collection and its processing by YouTube, please refer to the privacy policy. There you will also find further information about your rights and settings options for protecting your privacy: https://www.google.de/intl/de/policies/privacy.

2. Links to External Websites
This website contains links to external sites. We are solely responsible for our own content. We have no influence over the content of external links and are therefore not responsible for it; in particular, we do not endorse their content. If you are redirected to an external site, the privacy policy provided there applies. If you notice any illegal activities or content on this site, please feel free to bring it to our attention. In this case, we will review the content and respond accordingly (notice-and-takedown procedure).

§ 10 BROCHURE ORDER, CONTACT FORM, AND EMAIL CONTACT (UNENCRYPTED)

(1) Our website features a contact form that can be used to contact us electronically. If you use this option, the data you enter in the form will be transmitted to us and stored. This data includes:

- Name

- Address (different shipping address, if applicable)

- Email address

At the time the message is sent, the following data is also stored:

- User's IP address

- Date and time of registration

Your consent to the processing of your data will be obtained as part of the submission process, and you will be directed to this Privacy Policy.

Alternatively, you may contact us using the email address provided. In this case, the personal data transmitted in the email will be stored.

To the extent that this involves information regarding communication channels (such as an email address or phone number), you also consent to us contacting you via that communication channel, if necessary, to address your inquiry.

In this context, no data is disclosed to third parties. The data is used exclusively for processing the conversation.

(2) The legal basis for processing the data, provided the user has given consent, is Article 6(1)(a) of the GDPR. The legal basis for processing data transmitted when sending an email is Article 6(1)(f) of the GDPR. If the purpose of the email contact is to conclude a contract, the additional legal basis for processing is Article 6(1)(b) of the GDPR.

(3) We process the personal data entered in the form solely for the purpose of handling your inquiry. We will, of course, use the data from your email inquiries exclusively for the purpose for which you provided it to us when you contacted us. If you contact us via email, the legitimate interest in processing the data is based on the need to respond to your inquiry. The other personal data processed during the submission process is used to prevent misuse of the contact form and to ensure the security of our IT systems.

(4) The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. For personal data entered in the contact form and data sent via email, this is the case once the respective conversation with the user has ended. The conversation is considered concluded when the circumstances indicate that the matter in question has been definitively resolved. Any additional personal data collected during the submission process will be deleted no later than seven days after submission.

(5) You may revoke your consent to the processing of your personal data at any time. If you contact us by email, you may object to the storage of your personal data at any time. In such a case, the conversation cannot be continued. Regarding the withdrawal of consent or objection to storage, please contact the data controller or the data protection officer as specified in § 1 via email or by mail. In this case, all personal data stored in the course of establishing contact will be deleted.

§ 11 WEB ANALYSIS USING GOOGLE ANALYTICS (WITH PSEUDONYMIZATION)

(1) We use a service provided by Google Inc. (Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) on our website to analyze our users’ browsing behavior. The software places a cookie on your computer (see above for information on cookies). When individual pages of our website are accessed, the following data is stored:

a) Two bytes of the IP address of the user’s system from which the request was made
b) The webpage accessed
c) Entry pages, exit pages,
d) The duration of the visit to the website and the bounce rate
e) The frequency of visits to the website
f) Country of origin and region, language, browser, operating system, screen resolution, use of Flash or Java
g) Search engines used and search terms entered

The information generated by the cookie regarding users' use of this website is generally transmitted to a Google server in the United States and stored there.

This website uses Google Analytics with the “_anonymizeIp()” extension. The software is configured so that IP addresses are not stored in full, but only in truncated form. This prevents the truncated IP address from being linked to the visiting computer. Only in exceptional cases is the full IP address transmitted to a Google server in the United States and truncated there. However, the IP address transmitted by your browser as part of Google Analytics is not combined with other data held by Google.

(2) The legal basis for the processing of personal data is Article 6(1), first sentence, subparagraph (f) of the GDPR. For the exceptional cases in which personal data is transferred to the United States, Google has complied with the EU-U.S. Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.

(3) On our behalf, Google will use this information to evaluate your use of the website and to compile reports on website activity. By analyzing the data collected, we are able to compile information about the use of the individual components of our website. This helps us to continuously improve our website and its user-friendliness. These purposes also constitute our legitimate interest in processing the data pursuant to Article 6(1)(f) of the GDPR. By anonymizing the IP address, we adequately safeguard users’ interests in the protection of their personal data.

(4) The data will be deleted as soon as it is no longer needed for our record-keeping purposes.

(5) The cookies used are stored on your computer and transmitted from there to our website. If you do not consent to the collection and analysis of usage data, you can prevent this by adjusting your browser settings accordingly—specifically, by disabling or restricting the use of cookies. Cookies that have already been stored can be deleted at any time. However, in this case, you may not be able to use all features of this website to their full extent.

You can also prevent Google from collecting the data generated by the cookie and related to your use of the website (including your IP address), as well as from processing this data, by downloading and installing the browser plugin available at the following link. The current link is: "http://tools.google.com/dlpage/gaoptout?hl=de."

You can also disable Google Analytics by clicking this link: Disable Google Analytics Tracking

(6) The third-party provider is Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001. For more information, please see the Terms of Service at http://www.google.com/analytics/terms/de.html, the Privacy Overview at http://www.google.com/intl/de/analytics/learn/privacy.html, and the Privacy Policy at http://www.google.de/intl/de/policies/privacy.

(7) We use your data to provide you with tailored offers and a personalized customer experience. To this end, we also share your information with third-party providers such as Google in order to optimize our services and provide you with relevant content.

§ 12 GOOGLE DYNAMIC REMARKETING

We use "Google Dynamic Remarketing" on our website, a service provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter referred to as "Google"). Google Dynamic Remarketing allows us to display our ads to you as you continue browsing the internet after visiting our website. This is done using cookies stored in your browser, which Google uses to track and analyze your browsing behavior as you visit various websites. This allows Google to identify your previous visit to our website. According to Google, the data collected as part of remarketing is not combined with your personal data that may be stored by Google. In particular, Google states that pseudonymization is used for remarketing.

We use Google Dynamic Remarketing for marketing and optimization purposes, specifically to display ads that are relevant and interesting to you, to improve campaign performance reports, and to ensure a fair calculation of advertising costs. This also constitutes our legitimate interest in having the third-party provider process the aforementioned data. The legal basis is Article 6(1), first sentence, letter f) of the GDPR.

You can prevent cookies from being installed by deleting existing cookies and disabling cookie storage in your web browser settings. Please note that in this case, you may not be able to fully use all features of our website. You can also prevent cookies from being stored by configuring your web browser to block cookies from the domain “www.googleadservices.com” (https://www.google.de/settings/ads). Please note that this setting will be deleted if you clear your cookies. You can also disable interest-based ads via the link http://www.aboutads.info/choices. Please note that this setting will also be deleted if you clear your cookies.

In addition, Google has complied with and obtained certification under the Privacy Shield Agreement between the European Union and the United States. As a result, Google is committed to adhering to the standards and regulations of European data protection law. For more information, please see the link below: https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active

Third-party provider information: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001. For more information about Google’s use of data, options for settings and opting out, and privacy policies, please visit the following Google websites:

- Privacy Policy: http://www.google.de/intl/de/policies/privacy

- Google Website Statistics: https://services.google.com/sitestats/de.html

§ 13 GOOGLE ADWORDS

We use "Google AdWords" on our website, a service provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter referred to as "Google"). Google AdWords enables us to draw attention to our attractive offers on external websites using advertising materials (so-called Google AdWords). This allows us to determine how successful individual advertising campaigns are. These advertising materials are delivered by Google via so-called “ad servers.” We use so-called ad server cookies for this purpose, which allow us to measure certain performance metrics, such as ad impressions or user clicks. If you access our website via a Google ad, Google AdWords will store a cookie on your computer. These cookies typically expire after 30 days. They are not intended to identify you personally. The following information is typically stored with this cookie as analytics data: unique cookie ID, number of ad impressions per placement (frequency), last impression (relevant for post-view conversions), and opt-out information (indicating that the user no longer wishes to be targeted). These cookies enable Google to recognize your web browser. If a user visits specific pages on an AdWords customer’s website and the cookie stored on their computer has not yet expired, Google and the customer can recognize that the user clicked on the ad and was redirected to that page. Each AdWords customer is assigned a different cookie. Cookies cannot therefore be tracked across the websites of AdWords customers. We ourselves do not collect or process any personal data in connection with the advertising measures mentioned. We merely receive statistical reports from Google. Based on these reports, we can determine which of the advertising measures used are particularly effective. We do not receive any further data resulting from the use of these advertising tools; in particular, we cannot identify users based on this information. Due to the marketing tools used, your browser automatically establishes a direct connection to Google’s server. We have no influence over the scope or further use of the data collected by Google through the use of Google AdWords. To the best of our knowledge, Google receives the information that you have accessed the relevant section of our website or clicked on one of our ads. If you have a Google user account and are logged in, Google can associate your visit with your user account. Even if you are not registered with Google or are not logged in, it is possible that Google may obtain and store your IP address.

We use Google AdWords for marketing and optimization purposes, specifically to display ads that are relevant and interesting to you, to improve campaign performance reports, and to ensure a fair calculation of advertising costs. This also constitutes our legitimate interest in having the third-party provider process the aforementioned data. The legal basis is Article 6(1), first sentence, letter f) of the GDPR.

You can prevent cookies from being installed by deleting existing cookies and disabling cookie storage in your web browser settings. Please note that in this case, you may not be able to fully use all features of our website. You can also prevent cookies from being stored by configuring your web browser to block cookies from the domain “www.googleadservices.com” (https://www.google.de/settings/ads). Please note that this setting will be deleted if you clear your cookies. You can also disable interest-based ads via the link http://www.aboutads.info/choices. Please note that this setting will also be deleted if you clear your cookies.

In addition, Google has complied with and obtained certification under the Privacy Shield Agreement between the European Union and the United States. As a result, Google is committed to adhering to the standards and regulations of European data protection law. For more information, please see the link below: https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active

Third-party provider information: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001. For more information about Google’s use of data, options for settings and opting out, and privacy policies, please visit the following Google websites:

· Privacy Policy: http://www.google.de/intl/de/policies/privacy

· Google Website Statistics: https://services.google.com/sitestats/de.html

§ 14 GOOGLE WEB FONTS

We use "Google Web Fonts" on our website, a service provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter referred to as "Google"). Google Web Fonts allows us to use external fonts, known as Google Fonts. To do this, when you visit our website, the required Google Font is loaded from your web browser into the browser cache. This is necessary so that your browser can display our text with improved visual quality. If your browser does not support this feature, a standard font from your computer will be used for display. These web fonts are integrated via a server request, typically to a Google server in the United States. As a result, information about which of our web pages you have visited is transmitted to the server. Google also stores the IP address of your device’s browser. We have no influence over the scope or further use of the data collected and processed by Google through the use of Google Web Fonts.

We use Google Web Fonts for optimization purposes, specifically to improve your experience on our website and to make its design more user-friendly. This also constitutes our legitimate interest in the processing of the aforementioned data by the third-party provider. The legal basis is Article 6(1), first sentence, subparagraph (f) of the GDPR.

Google has complied with and obtained certification under the Privacy Shield Agreement between the European Union and the United States. As a result, Google is committed to adhering to the standards and regulations of European data protection law. For more information, please see the link below:https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active

Third-party provider information: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001. For more information on data protection, please refer to Google's Privacy Policy: http://www.google.de/intl/de/policies/privacy

For more information about Google Web Fonts, visit fonts.google.com, https://developers.google.com/fonts/faq?hl=de-DE&csw=1, and https://www.google.com/fonts#AboutPlace:about

§ 15 GOOGLE RECAPTCHA

To ensure adequate data security when submitting forms, we use the reCAPTCHA service provided by Google Inc. in certain cases. This is primarily used to distinguish whether the input is being made by a human or is the result of abusive, machine-based, or automated processing. The service involves sending the IP address and, if applicable, other data required by Google for the reCAPTCHA service to Google. Google Inc.’s separate privacy policy applies in this regard. For more information on Google Inc.’s privacy policy, please visit http://www.google.de/intl/de/privacy or https://www.google.com/intl/de/policies/privacy/

§ 16 GOOGLE MAPS

We use "Google Maps" on our website, an online map service provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter referred to as "Google"). This allows us to display interactive maps directly on our website and enables you to conveniently use the map feature. When you visit our website, Google receives the information that you have accessed the corresponding page of our website. Your IP address is transmitted in the process. This occurs regardless of whether you are logged in to a Google user account or do not have a user account. If you are logged in to Google, your data will be directly associated with your account. If you do not wish for your data to be associated with your Google profile, you must log out beforehand. Google stores your data as usage profiles and uses them for advertising, market research, and/or to tailor the website to your needs. Such analysis is conducted in particular (even for users who are not logged in) to deliver targeted advertising and to inform other users about your activities on our website.

We use Google Maps to display interactive maps from Google Maps and thereby provide you with a better user experience on our website. This also constitutes our legitimate interest in the processing of the aforementioned data by the third-party provider. The legal basis is Article 6(1), first sentence, subparagraph (f) of the GDPR.

You have the right to object to the creation of these user profiles; to do so, you must contact Google.

Google has complied with and obtained certification under the Privacy Shield Agreement between the European Union and the United States. As a result, Google is committed to complying with the standards and regulations of European data protection law. For more information, please see the link below: https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active

For more information on the purpose and scope of data collection and its processing by the plug-in provider, please refer to the provider’s privacy policy. There you will also find further information about your rights in this regard and settings options to protect your privacy: http://www.google.de/intl/de/policies/privacy.

§ 17 Social Media

1. Privacy Policy for Social Networks

(As of June 2, 2021)

We maintain an online presence on various social networks and platforms. Below, we would like to inform you about the data collected by these platforms and by us, the purposes for which it is collected, the legal basis, the recipients, and your rights.

1. PRELIMINARY NOTE

Please note that you use our content and the interactive features provided (e.g., commenting, sharing, rating) at your own risk. Alternatively, you can also find the information, products, etc., offered through our social media channels on our website at www.hotel-hubertus.de. For more information, please feel free to contact us at any time via email at info@hotel-hubertus.de.

2. DATA CONTROLLER AND DATA PROTECTION OFFICER

Joint controllers within the meaning of Article 26 of the General Data Protection Regulation and other national data protection laws of the member states, as well as other data protection provisions applicable to our social media platforms, are

Traubel Brothers, LLC

HUBERTUS Mountain Refugio Allgäu

Village 5

87538 Balderschwang

Phone: 08328/9200

Email: info@hotel-hubertus.de

Website: www.hotel-hubertus.de

The Data Protection Officer is Dieter Grohmann, Beethovenstr. 23, 87435 Kempten, info@akwiso.de.

as well as the company listed below for the respective network

Facebook: Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The supervisory authority is the Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland, https://www.dataprotection.ie/;. For more information on data protection, contact Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, or visit https://www.facebook.com/about/privacy. Since the use of Meta (Facebook) is currently highly controversial from a data protection perspective, Meta (Facebook) has posted additional terms of use for business tools. These can be found at https://www.facebook.com/legal/technology_terms.

Instagram: Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbor, Dublin 2, Ireland. The supervisory authority is the Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland, https://www.dataprotection.ie/; For more information on data protection, visit https://privacycenter.instagram.com/policy/ and https://privacycenter.instagram.com/policies/cookies/. Some of Facebook’s (Meta) business tools can also be connected to Instagram. We therefore also refer you to the Terms of Use for business tools at https://www.facebook.com/legal/technology_terms.

YouTube: YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. YouTube LLC is a subsidiary of Google Inc. The entity responsible in the EU is Google Ireland Ltd., Gordon House, 4 Barrow St., Dublin, D04 E5W5, Ireland. For more information on data protection, visit https://policies.google.com/privacy?hl=de, as well as https://policies.google.com/?hl=de and https://policies.google.com/technologies/product-privacy?hl=de.

Pinterest: Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, IRELAND; the supervisory authority is the Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland, https://www.dataprotection.ie/. The Data Protection Officer can be contacted at https://help.pinterest.com/de/data-protection-officer-contact-form. For more information on data protection, visit https://policy.pinterest.com/de/privacy-policy and https://policy.pinterest.com/de/cookies.

3. GENERAL DATA COLLECTED

When you visit our page on the respective social network, your IP address and other information are stored. The other information consists of the data mentioned in Section 4 that we process, as well as the data processed by the respective network (for more information on this, see Section 6). Some of this data is stored on your device via cookies. Cookies are small text files that, as soon as you visit a website, are sent from a web server to your browser, stored locally on your device (PC, laptop, tablet, smartphone, etc.), and provide the user (i.e., us) with certain information. Cookies do not cause any damage to your computer and do not contain viruses. Each cookie contains a unique string of characters (known as a “cookie ID”) that allows the browser to be uniquely identified when you revisit the website.

If you wish to avoid data usage by the social network, you should log out of it or disable the “stay logged in” feature, delete the cookies stored on your device, and close and restart your browser. You can then visit our fan page without revealing your own identifier. Please note, however, that you will not be able to use interactive features, as you would need to log in again to do so.

You can also disable or restrict the use of cookies by adjusting the settings in your browser. However, if you do so, you may not be able to access our page on the social network.

4. DATA WE COLLECT ON SOCIAL MEDIA

4.1 Facebook (Meta)

We have entered into various agreements with Facebook regarding the protection of personal data,

· Addendum for Data Controllers (Agreement on Joint Control pursuant to Art. 26(1), sentence 3 of the GDPR); see https://www.facebook.com/legal/controller_addendum.

· Information on Page Insights (agreement on joint responsibility pursuant to Art. 26(1), sentence 3 of the GDPR regarding Insights data); see https://www.facebook.com/legal/terms/page_controller_addendum

· Data Processing Terms (Data Processing Agreement pursuant to Art. 28 of the GDPR), available at https://www.facebook.com/legal/terms/dataprocessing.

· Facebook EU Data Transfer Addendum (EU Standard Contractual Clauses for Controller-to-Processor Transfers, i.e., transfer of data from data controllers to Facebook as a data processor), available at https://www.facebook.com/legal/EU_data_transfer_addendum

4.1.1 Page Insights

We use the statistical reports (Page Insights) provided to us by the social network. We are currently unable to disable or modify this feature. As a result, we collect the following data:

· Statistical data on user actions: page views (broken down by category, age, gender, country, city, and device), viewing posts, subscribing to pages, bookmarks, recommendations, comments, shares, types of reactions, post performance, clicks, negative feedback such as reporting as spam or “Hide,” conversations, views of our store and interactions there, our events (ticket sales, clicks, registrations, guest contributions) and interactions there (link usage, tickets sold, people reached), and the use of the website, phone number, “Plan Route,” or other buttons on our site.

· Statistical data regarding the actions themselves and the individuals who performed them, as well as the browsers/apps they used: access times (days, times), location (estimated based on the IP address or, for logged-in users, from the user profile), language code (from the browser’s HTTP header and/or language settings); Age/gender data (from the user profile; only for logged-in users); previously visited website (from the browser’s HTTP header); use of a computer or mobile device (from the browser user agent or app attributes); Facebook user ID (only for logged-in users).

· Whenever we post events, live videos, Stories, or other content, we also analyze the performance data—that is, the number of views or the duration of views, the number of interactions, and the demographic target audience.

We receive the analyses of the data mentioned in this paragraph in anonymized form, whereas Facebook receives the data without anonymization.

Cookies are used to determine whether a user is logged in to Facebook (see the Cookie Policy at https://www.facebook.com/policies/cookies). Without logging in, most actions are not possible. The only actions possible are visiting a page or clicking on a photo or video to view it.

The legal basis for our collection of the aforementioned data for statistical purposes is Article 89 of the GDPR and, insofar as sensitive data is involved, Section 27 of the BDSG in conjunction with Article 9(1) in conjunction with Article 22(2), second sentence, of the GDPR. We collect the data solely in anonymized form. Facebook Ireland Ltd. implements appropriate technical and organizational measures to ensure the security of the processing. An additional legal basis for this is Article 6(1)(f) of the GDPR; this applies in particular to the marketing purposes also pursued through Page Insights. We also have a legitimate interest in this. The anonymization of the data largely safeguards your rights.

Purpose: We use this data to learn which posts visitors interact with (or do not interact with). Based on these results, we can build and expand our target audience, provide them with events, information, and other content tailored to their interests, and optimize our content. Reach and post statistics help us identify which posts have received the most attention; engagement and post statistics help us understand how to encourage people to interact more; and page view statistics enable us to tailor our content to specific target audiences.

Deletion: Statistical data (such as actions on the site and page views) is deleted after 7 days or after 2 months, respectively. As previously noted, statistical data is collected without currently offering an opt-out option. If you do not wish this to occur, you can configure your settings at https://www.facebook.com/settings. Otherwise, please contact the social network directly using the addresses listed in Section 2.

4.1.2 Interactions/Messages

We collect content, communications, and other information that you provide when you visit our fan page and interact with us through it (see above). As a result, we collect and process the content you share (hashtags, messages, etc.) and the nature of your interactions. In each case, we process the content of the message as well as the time it was sent.

Please note that—if you have a Facebook profile—based on your interactions, we are also able to track your networks (groups, connected pages) and connections, as well as view the information you post there (photos, posts, information, etc.). In doing so, you may also disclose sensitive data in accordance with Article 9 of the GDPR. If we collect this data, we will do so only in an anonymized form and analyze it in a way that does not allow for identification of any individual. This helps us learn more about our target audience and better tailor our advertising and products to our customers. We use the data to understand which posts and information you interact with (or do not interact with). With the help of these results, we can build and expand our target audience, provide them with events, information, etc., that are relevant to their interests, and optimize our content. Furthermore, we identify which posts have received the most attention. In addition, we would like to know which visitors view our profile and how they arrived there. This also helps us learn more about our target audience and better tailor our advertising and products to you.

Please note that the data is accessible not only to us and Facebook, but also to their affiliated partners and companies, as well as to all subscribers, fans, people who share posts, commenters, and other individuals who click on our page or browse the pages of our subscribers, fans, people who share posts, and commenters.

The legal basis for collecting the aforementioned data is Article 6(1)(a) of the GDPR. Subscribers, fans, users who share posts, and commenters provide their consent to the collection of this data by voluntarily interacting with our fan page and accepting Facebook’s Terms of Use.

The data is generally deleted when our page is deleted or temporarily removed when the feature is deactivated. In addition, you can delete your connections to us by deactivating the “Like” buttons again. If we receive a revocation and are able to delete your data (e.g., comments on our wall, application documents, etc.), we will take the necessary steps to do so. Withdrawal of consent does not affect the lawfulness of the processing of your data that took place on the basis of your consent up until the time of withdrawal. The data is stored in our Facebook statistics for a period of 26 months and is then automatically deleted. This also applies hereinafter, unless we indicate otherwise. Alternatively, we ask that you contact the social network directly at the addresses listed in Section 2, as we are unable to determine which data originates from you due to the extensive anonymization of the data. You can prevent the collection of your data by selecting the appropriate privacy settings on Facebook; see https://www.facebook.com/settings.

You may also send us messages via social media. In this case, the personal data transmitted with the message (name/username; profile picture) will be stored. By doing so, you consent to us contacting you via this communication channel, if necessary, to respond to your inquiry. No data will be disclosed to third parties in this context. The data will be used exclusively for the purpose of handling the conversation. The legal basis for processing the data transmitted when you send a message is Article 6(1)(f) of the GDPR. The legitimate interest lies in handling your inquiry. If the message or contact is intended to lead to the conclusion of a contract, the additional legal basis for processing is Article 6(1)(b) of the GDPR. The data from the message will be deleted once the respective conversation has ended. However, if the conversation is aimed at concluding a contract, the data will be deleted in accordance with the statutory retention periods; these are generally 10 years. You have the right to withdraw your consent, provided that the message does not serve the purpose of preparing for or executing a contract. Please note that in this case, your request may not be processed.

4.1.3 Live Videos

We also use the “Live Videos” feature on Facebook. If you watch these videos, your data will be collected—including whether you watched the video for more than 3 seconds.

You can also contact us directly through Messenger during the live video.

If you are a subscriber, you can post comments on our videos. We may configure this comment feature so that you can only post if your profile has been active for more than 2 weeks and/or you have been subscribed to our fan page for at least 15 minutes. This is to prevent misuse of the live comment feature. Please note that comments will appear on the live video feed and can be viewed by everyone watching the video; they will also be associated with your profile.

As part of our live videos, we collect statistics on the number of viewers, the number and content of comments, questions, and shared content, as well as the number and type of reactions (Likes, etc.).

If we embed a link in our videos, you can click on it. If you do, you will be redirected to another website. The privacy policy posted on that website applies.

We process the aforementioned data to learn more about our viewers and prospective customers and to better tailor our videos to you.

To the extent that you interact with us in connection with the live videos (in particular, by commenting, participating in polls, using the link, sharing, recommending, posting, etc.), the legal basis is Article 6(1)(a) of the GDPR, whereby you provide your consent implicitly through the respective interaction. This consent applies in conjunction with your acceptance of Facebook’s Terms of Use. The legal basis for processing the data transmitted when sending a message is Article 6(1)(f) of the GDPR. The legitimate interest lies in processing your inquiry. The data from the message will be deleted once the respective conversation has ended. Please note that if you object to this processing, your inquiry may not be processed in such cases.

If the legal basis is your consent, you may revoke it at any time. If we receive a revocation and are able to delete your data (e.g., comments on our wall, job application documents, etc.), we will take the necessary steps to do so. Withdrawal does not affect the lawfulness of the processing of your data that took place based on your consent up until the time of withdrawal. You can also partially prevent the collection of your data by selecting the appropriate privacy settings on LinkedIn; see https://www.facebook.com/settings/.

4.1.4 Facebook Jobs

We post job openings on our fan page. You can apply via email.

When you apply for a position with us, we process the information we receive from you as part of the application process, i.e., information from the

· Correspondence (in particular, from a cover letter, if any, attachments—especially transcripts—and the resume)

· Photo

If you apply via email, we will also process

· Email address

· Additional information, if applicable, that is sent via email

We do not conduct online searches about you (so-called background checks).

During the application process, we will not use any information that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, nor will we use genetic data, biometric data for the unique identification of a natural person, health data, or data regarding sex life, sexual orientation, pregnancy, family planning, age, or gender. We ask that you refrain from providing us with any such information from the outset. Exceptions to this include, where applicable, information regarding gender and any severe disability. We require this information in order to implement and comply with legal requirements for protective measures, etc. However, you are not obligated to provide us with such information on your own initiative during the application process. If you send us a photo of yourself, information regarding your racial or ethnic origin may be inferred from it. Please note that while we do not explicitly analyze the photos for such information, biometric data, or health-related information, certain indications may sometimes arise simply from viewing the image.

Your data will initially be processed solely for the purpose of conducting the application process. If your application is successful, the data will become part of your personnel file and may be used for the duration and termination of the employment relationship. If we are unable to offer you employment at this time, we will process your data to defend ourselves against any potential legal claims, in particular those alleging discrimination in the application process. To the extent that you receive reimbursement of expenses, the corresponding accounting documents will be processed to comply with commercial and tax law retention requirements. The legal basis for data processing is therefore Article 6(1)(b) of the GDPR, insofar as the data processing serves the decision regarding the establishment of an employment relationship and insofar as the data is subsequently incorporated into the employment relationship. If the retention of data serves to safeguard claims, the legal basis is Article 6(1)(f) of the GDPR. The legitimate interest here is the preservation of supporting documents for a potential defense. We process information and documents that are not necessary for the aforementioned purposes on the basis of your implied consent pursuant to Article 6(1)(a) of the GDPR, which you have granted us by submitting them. To the extent that you receive reimbursement of costs from us, the legal basis is Article 6(1)(c) of the GDPR.​

We retain the data necessary for a successful application and for the employment relationship until the end of the employment relationship and for up to 3 years thereafter. We continue to process data related to an application that we were required to reject for a period of 6 months after sending the rejection notice to safeguard our legitimate interests. If we are named as a party in a legal proceeding, we will retain the data until the conclusion of such proceedings. This also applies accordingly to data provided voluntarily. To the extent that you receive reimbursement of expenses, the corresponding accounting records will be retained to fulfill commercial and tax law retention requirements until no later than March 31 of the eleventh calendar year following the payment; in the case of commercial and business correspondence and other tax-related documents, they will be retained until the end of the seventh calendar year following their creation.

4.1.5 Posts About Special Offers or Discounts

If we have posted offers or discounts, both Facebook and we may collect information about you if you have saved the offer or discount as interesting or taken action based on it (e.g., by making a purchase, calling, or sending a message). You will then receive a notification from Facebook before the offer expires.

We collect, store, and, if necessary, disclose this data to the extent required to provide the contractual services. In particular, we use the data to identify you as a customer, to process your order, to correspond with you, to issue invoices, and to handle any contractual or non-contractual claims that may arise.

The legal basis for processing the data transmitted in connection with the storage of the inquiry, as well as the call or message, is Article 6(1)(f) of the GDPR. The legitimate interest lies in handling your inquiry. If the message or call is intended to conclude a contract, the additional legal basis for processing is Article 6(1)(b) of the GDPR; the same applies to the additional data we receive based on your Facebook login.

We are entitled to disclose your contractual data to third parties if and to the extent that this is necessary for the implementation of precontractual measures and the performance of this contract pursuant to Article 6(1)(b) of the GDPR, for compliance with a legal obligation within the meaning of Article 6(1)(c) GDPR, or to pursue our legitimate interests pursuant to Article 6(1)(f) of the GDPR. In particular, such data may be transferred to

a) Shipping service providers for the purpose of delivery

b) Collection agencies or attorneys for the purpose of enforcing our claim, provided that you are in default. In this case, we have a legitimate interest in enforcing our valid claim. Given that we have provided services in advance and you are in default, our legitimate interests take precedence.

c) Tax advisor.

The personal data collected will be stored until the expiration of the statutory retention period for merchants (6, 8, or 10 years after the end of the calendar year in which the contractual relationship ended) and will be deleted thereafter. This does not apply, however, if we are required to store the data for a longer period due to tax or commercial law retention obligations (in accordance with the German Commercial Code (HGB), the German Criminal Code (StGB), or the German Fiscal Code (AO)), or if you have consented to storage beyond this period.

4.1.6 Call-to-Action Buttons

You can use the button to book an appointment or a service immediately. The latter is only possible if we offer this option. Depending on your settings, you will receive a confirmation of your appointment booking as well as an appointment reminder. In all other respects, the provisions of Section 4.1.6 apply; the same rules apply to appointment bookings and reservations as to purchase inquiries.

4.2 Instagram

Instagram is a service provided by Facebook. However, to avoid confusion, we will continue to use the term “Instagram” throughout this text, even when referring to the operator.

4.2.1 Page Insights

We use the statistical reports (Page Insights) provided to us by the social network. We are currently unable to disable or modify this feature. As a result, we collect the following data:

· Statistical data on user actions: visits to our profile, our website, or our posts; clicks on our buttons or the route planner; interactions with our posts; and the type of interaction or response.

· Depending on the type of post, interactions include tagging, commenting, sharing, or saving our content; negative feedback such as reporting as spam or hiding; "Like" clicks; leaving or clicking on the next story; and clicking on links.

· Other statistical metrics: New subscribers acquired through our posts, reach, and the average percentage of a video viewed.

We also collect data on our target audience: top locations, average age, gender, peak activity times, interests, and more.

According to Instagram, no Insights are generated in the EU in connection with posts.

Whenever we post live videos, Stories, or other content, the performance data is also analyzed in accordance with the criteria mentioned above.

We receive the analyses of the data mentioned in this paragraph in anonymized form, whereas Instagram receives the data without anonymization. Cookies are used to determine whether a user is logged in to Instagram (see the Cookie Policy at https://www.facebook.com/policies/cookies). Most actions are not possible without logging in. The only actions possible are visiting a page or clicking on a photo or video to view it.

The legal basis for our collection of the aforementioned data for statistical purposes is Article 89 of the GDPR and, insofar as sensitive data is concerned, Section 27 of the BDSG in conjunction with Article 9(1) in conjunction with Article 22(2), second sentence, of the GDPR. We collect the data exclusively in anonymized form. An additional legal basis for the collection of the aforementioned data is Article 6(1)(a) of the GDPR. You grant your consent to the collection by accepting the terms of use of the respective social network and the related posts on that platform.

Purpose: We use this data to learn which posts you interact with (or do not interact with). Based on these results, we can build and expand our target audience, provide them with events, information, and other content tailored to their interests, and optimize our content. Reach and post statistics help us identify which posts have received the most attention; engagement and post statistics help us determine how to encourage people to interact more; and view statistics enable us to tailor our content to specific target audiences.

Deletion: This data is made available for up to 2 years in each case. As previously noted, statistical data is collected without us currently offering an opt-out option. If you do not wish this to occur, you can configure your settings at https://www.instagram.com/accounts/privacy_and_security/. Otherwise, please contact the social network directly using the addresses listed in Section 2.

4.2.2 Interactions/Messages (“Instagram Direct”)

We collect content, communications, and other information that you provide when you visit our fan page and interact with us through it, as described above. As a result, we collect and process the content you share (hashtags, messages, etc.) and the nature of your interactions. We process both the content of the message and the time it was sent. Please note that—if you have an Instagram profile—based on your interactions, we are also able to track your networks (followers) and connections, as well as view the information you post there (posts, etc.). In doing so, you may also disclose sensitive data in accordance with Article 9 of the GDPR.

When we do this, it helps us learn more about our target audience and better tailor our advertising and products to you. We may mention your name, your posts, and your interactions in a post (story, etc.) and display them—for example, because your post or interaction serves as a review for us.

Please note that the data is accessible not only to us and Instagram, but also to their affiliated partners and companies, as well as to all followers, people who share our posts, commenters, and other individuals who click on our page or browse the pages of our followers, people who share our posts, and commenters.

The legal basis for collecting the aforementioned data is Article 6(1)(a) of the GDPR. Subscribers, post sharers, and commenters provide their consent to the collection of this data by voluntarily interacting with our fan page and accepting Instagram’s Terms of Use.

The data is generally deleted when our page is deleted or temporarily removed when the buttons are deactivated. In addition, you can delete your connections to us by deactivating the “Like” buttons again. If we receive a request to revoke consent and are able to delete your data, we will take the necessary steps to do so. Revocation does not affect the lawfulness of the processing of your data that took place based on your consent up until the time of revocation. The data is stored in our Instagram statistics for a period of 24 months and is then automatically deleted. This also applies in the following cases, unless we specify otherwise. You can prevent the collection of your data by selecting the appropriate privacy settings on Instagram; see https://www.instagram.com/accounts/privacy_and_security/.

You can also send us messages via social media. In this case, the personal data transmitted with the message (name/username; profile picture) will be stored; if you send us videos, voice messages, or images, the information transmitted through these channels will also be processed by Instagram and, where applicable, by us (image, voice, etc.). In this case, you consent to us contacting you via this communication channel, if necessary, to respond to your inquiry. No data will be disclosed to third parties in this context. The data will be used exclusively for the purpose of handling the conversation. The legal basis for processing the data transmitted when sending a message is Article 6(1)(f) of the GDPR. The legitimate interest lies in processing your inquiry. If the message or contact is intended to lead to the conclusion of a contract, the additional legal basis for processing is Article 6(1)(b) of the GDPR. The data from the message will be deleted once the respective conversation has ended. However, if the conversation is aimed at concluding a contract, the data will be deleted in accordance with the statutory retention periods; these are generally 10 years. You have the option to withdraw your consent, provided that the message does not serve the purpose of preparing or executing a contract. Please note that in this case, your inquiry may not be processed.

4.2.3 Live Videos

We also use the “Live Videos” feature on Instagram. If you watch these videos, your data is collected—including whether you watched the video for more than 3 seconds. We can see the number of viewers and whether anyone has liked the video.

If you are watching our live video, you can post comments on our videos. Please note that the comments will appear on the live video screen and will be visible to everyone watching the video, and will be associated with you.

We can invite people watching the video to join the live stream. This, above all, increases the number of potential viewers.

As part of our live videos, we collect statistics on the number of viewers, the content of comments, and the number and type of reactions (likes).

We process the aforementioned data to learn more about our viewers and prospective customers and to better tailor our videos to you.

The legal basis for processing data in connection with live videos is Article 6(1)(f) of the GDPR. Our legitimate interest in this regard is that we use the data for marketing purposes. We collect the number of viewers in an anonymized form. If you “like” a video, the legal basis is Article 6(1)(a) of the GDPR. If you post a comment during a live video or if we invite a viewer and they join, the legal basis is Article 6(1)(a) of the GDPR, whereby you imply your consent through the respective interaction. This consent applies in conjunction with your acceptance of Instagram’s Terms of Use.

Please note that the data is not only accessible to us and Instagram, but also to their affiliated partners and companies, as well as, where applicable, to all subscribers, people who share posts, commenters, and other individuals who click on our page (e.g., when clicking “Like”).

You can prevent your data from being collected by, for example, not posting any comments. The data is generally deleted when you delete your account or temporarily removed when you deactivate it. In addition, you can delete your connections to us by deactivating the interaction buttons again. If we receive a request to withdraw consent and are able to delete your data (e.g., comments), we will take the necessary steps to do so. Withdrawal of consent does not affect the lawfulness of the processing of your data that took place based on your consent up until the time of withdrawal. Alternatively, we ask that you contact the social network directly at the addresses listed in Section 2. You can also partially prevent the collection of your data by selecting the appropriate privacy settings; see https://www.instagram.com/accounts/privacy_and_security/.

4.2.4 Promotions/Ads

We use promotional opportunities (Instagram Ads) with the goal of increasing profile views, website visitors, or the number of messages we receive. The ads are targeted at specific audiences based on location, interests, age, and gender. Instagram automatically selects the target audience based on people similar to our followers; we can also set the target audience ourselves. The legal basis for collecting the aforementioned data is Article 6(1)(a) of the GDPR. You grant consent to the collection by accepting the terms of use of the respective social network and the related posts on that platform. Please note that the data is accessible not only to us and Instagram but also to their affiliated partners/companies. You can prevent the collection of your data by, for example, not visiting our website via Instagram and not following any links. The data is generally deleted when our account is deleted or temporarily removed upon deactivation. If we receive a revocation and have the ability to delete your data (e.g., comments, etc.), we will take the necessary steps to do so. The revocation does not affect the lawfulness of the processing of your data that took place based on your consent up until the time of revocation. Alternatively, we ask that you contact the social network directly using the addresses listed in Section 2. You can also partially prevent the collection of your data by selecting the appropriate privacy settings; see https://www.instagram.com/accounts/privacy_and_security/.

4.3 YouTube

We post videos on our YouTube channel. To analyze these videos, we use the relevant statistical data that YouTube provides to us. We are currently unable to disable or modify this feature. As a result, we collect the following data:

· Number of views and subscribers

· Sources of access

· Interactions (playback duration, top videos)

· Audience information (total number of viewers, repeat viewers, subscribers; times of activity, watch time, age, gender, other videos/channels viewed, countries, languages)

We receive these reports in anonymized form.

We also collect data regarding our fans (“Likes”/subscribers), our non-fans (“Dislikes”), and those who have commented on or shared something. Through this, we obtain the name (or just the account’s username), the profile picture (if available), the time of the comment, and the rating—and, in turn, the information these individuals have made publicly available, particularly regarding their own YouTube activities. Through the comments, we also learn about their opinions and the individuals themselves.

If you subscribe to our channel, you'll receive a notification from YouTube about new videos we've uploaded, and you'll also see them in your Subscriptions section.

Purpose: Only by analyzing the data can we determine which actions are worthwhile for us and whether our videos resonate with our audience. This allows us to optimize our content.

The legal basis for collecting the aforementioned data is Article 6(1)(a) of the GDPR. Subscribers, fans, content sharers, and commenters provide their consent to the collection of this data by accepting the terms of use of the respective social network and the related posts on that platform.

We collect and process the statistical data and comments. In addition, this data is processed by the social network and its affiliated partners/companies, etc. Public comments and ratings on a video, as well as subscriptions to our channel or videos, are visible not only to us, the social network, and its affiliated partners/companies, but also to all subscribers, fans, people who share the post, commenters, and others who click on our video.

The legal basis for this is Article 6(1)(f) of the GDPR, which allows us to tailor our videos to specific target audiences where appropriate.

The statistical, anonymized data is available for 5 years in accordance with YouTube's fixed settings. The remaining interaction data will be irrevocably deleted when our site is taken down.

As previously stated, the statistical data is collected without us currently offering an opt-out option. For this reason, we are unable to honor your right to object for technical reasons. We therefore ask that you contact the social network directly using the addresses listed in Section 2. Furthermore, you have the option to object to comments as follows: We can delete comments upon request, as well as if we determine that their content is unlawful. With regard to other interactions (sharing, likes, dislikes), we ask that you contact YouTube directly, as we have no control over these either. If you do not wish for your data to be collected, you can adjust your privacy settings accordingly at https://myaccount.google.com/privacycheckup?utm_source=pp&utm_medium=Promo-in-product&utm_campaign=pp_intro&hl=de.

4.4. Pinterest

4.4.1 Statistics

We use the statistical reports provided to us by the social network. We are currently unable to disable or modify this. As a result, we collect the following data: number of impressions, interactions, number of tags, clicks on PINS, and, for videos, video views and total playback time. Regarding our target audience, we collect information on location, gender, interests, categories, age, and devices.

We receive the analysis results in anonymized form each time.

Insofar as this involves purely statistical and data-related matters, the legal basis is Article 89 of the GDPR. Another legal basis for this is Article 6(1)(f) of the GDPR, so that we know which pins are worthwhile for us. This applies in particular to the marketing purposes pursued in this context. We also have a legitimate interest in this. This allows us to optimize our content. Since we conduct these analyses anonymously and the social network is the only party that can use the data in a personally identifiable manner (within the scope of its terms of use), we believe that the interests of our users are protected.

We collect and process the statistical data. In addition, this data is processed by the social network and its affiliated partners, companies, etc.

The statistical data is deleted after 30 days. As previously noted, the statistical data is collected without us currently offering an option to opt out. If you do not wish this to occur, you can configure this in your settings at https://www.pinterest.de/settings/privacy. Otherwise, please contact the social network directly using the addresses listed in Section 2.

4.4.2 Interactions, Messages

We also collect data from people who have commented on, shared, rated, posted (PINs, photos), tagged, or followed our profile. In doing so, we learn the person’s name (or username) and can access their profile along with all associated data. Through the comments, we also learn about their opinions or the person themselves. Please note that—if you have a Pinterest profile yourself—based on your interactions, we are also able to track your networks (groups, etc.) and connections, as well as view the information you have posted there (photos, posts, personal information, etc.). In doing so, you may also disclose sensitive data in accordance with Article 9 of the GDPR. If we collect this data, we will only collect and analyze it in an anonymized form, without any possibility of identifying an individual.

Purpose: We use this data to learn which posts and information our visitors interact with (or do not interact with). Based on these results, we can build and expand our target audience, provide them with events, information, and other content tailored to their interests, and optimize our content. Furthermore, we identify which posts have received the most attention. In addition, we want to know which visitors view our profile and how they arrived there. This also helps us learn more about our target audience and better tailor our advertising and products to our customers.

The legal basis for our collection of the aforementioned data for statistical purposes is Article 89 of the GDPR. Another legal basis for the collection of the aforementioned data is Article 6(1)(a) of the GDPR. You grant consent to the collection of this data by accepting the terms of use of the respective social network and the posts published on it based on those terms.

The data is accessible not only to us, the social network, and their affiliated partners/companies, but also to all followers, people who share posts, commenters, and anyone else who clicks on our page or browses the pages of our followers, people who share posts, and commenters.

The remaining data is generally deleted when our page is deleted or temporarily removed upon deactivation. Additionally, you can delete your connections to us by deactivating the interaction buttons or PINS again. If we receive a revocation and are able to delete your data (e.g., comments on our wall, application documents, etc.), we will take the necessary steps to do so. The revocation does not affect the lawfulness of the processing of your data that took place based on your consent up until the time of revocation.

You can also send us messages via social media. In this case, the personal data transmitted with the message (name/username) will be stored. By doing so, you consent to us contacting you via this communication channel, if necessary, to respond to your inquiry. No data will be disclosed to third parties in this context. The data will be used exclusively for the purpose of handling the conversation. The legal basis for processing the data transmitted when you send a message is Article 6(1)(f) of the GDPR. The legitimate interest lies in handling your inquiry. If the message or contact is intended to lead to the conclusion of a contract, the additional legal basis for processing is Article 6(1)(b) of the GDPR. The data from the message will be deleted once the respective conversation has ended. However, if the conversation is aimed at concluding a contract, the data will be deleted in accordance with the statutory retention periods; these are generally 10 years. You have the right to withdraw consent, provided that the message does not serve the purpose of preparing for or executing a contract. Please note that in this case, your request may not be processed.

5. RIGHTS OF DATA SUBJECTS WITH RESPECT TO US

Below, we would like to inform you of your rights. Please note that, unfortunately, we can only provide limited information because the data collected by the social network is received by us in anonymized form; in other words, we only collect anonymized data in this context. For this reason, we are unable to associate a request with any specific individual. However, we can identify you and guarantee your rights to the extent that we collect your data directly—for example, in response to an inquiry, a “like,” etc.

5.1 Rights with Respect to Us

You have the right to request information from us at any time regarding the personal data we have stored about you (Art. 15 of the GDPR). This also applies to the recipients or categories of recipients to whom this data is disclosed and the purpose of its storage.

In addition, you have the right to request the rectification of inaccurate or incomplete data under the conditions set forth in Article 16 of the GDPR and/or the erasure of stored data under the conditions set forth in Article 17 of the GDPR. Erasure is only possible to the extent that the processing is not necessary for the exercise of the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise, or defense of legal claims.

You have the right to request the restriction of processing under the conditions set forth in Article 18 of the GDPR if you dispute the accuracy of your data, if the processing is unlawful and we refuse to erase the data, if you need the data to assert legal claims, or if you have objected to the processing.

Furthermore, you may request the transfer of your data at any time in accordance with the provisions of Article 20 of the GDPR.

To the extent that data collection is based on consent, you may withdraw your consent at any time. As a result, we may no longer process this data in the future.

In the event that personal data is processed for the performance of tasks carried out in the public interest (Art. 6(1), first sentence, lit. e of the GDPR) or for the purposes of legitimate interests (Art. 6(1), first sentence, lit. f of the GDPR), you may object to the processing of your personal data at any time with future effect. If you object, we must cease any further processing of your data for the aforementioned purposes, unless

· there are compelling legitimate grounds for processing that override your interests, rights, and freedoms, or

· The processing is necessary for the assertion, exercise, or defense of legal claims.

For more information, please refer to the full text of the GDPR.

Please direct all requests for information, inquiries, revocations, or objections regarding data processing by email to our Data Protection Officer as specified in Section 2 or to the data controller named in Section 2. You also have the option to file a complaint regarding data protection matters with the competent supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision, Promenade 27, 91522 Ansbach.

In addition, please see below for details on the specific features of each social network:

5.2 Facebook

In accordance with the agreement between Facebook Ireland and us regarding the processing of Insights data, Facebook Ireland is responsible for providing information about the processing of the aforementioned Page Insights in response to inquiries. We will therefore forward your inquiry, including your name and email address, to Facebook Ireland Ltd., which will assist us in responding to or acting on your inquiry.

Facebook Ireland Ltd. has also assumed primary responsibility for the processing of Insights data in accordance with Section 2(1) and has assured us that it will fulfill all obligations regarding the processing of the data, in particular the rights of data subjects. Accordingly, any further rights of data subjects—including the rights to rectification, data portability, erasure, and objection—must also be exercised with Facebook Ireland Ltd. (see Section 2). The Irish Data Protection Commission (see https://www.dataprotection.ie/ ) has been designated as the competent authority for complaints against Facebook and us regarding the processing of data for Page Insights. To the extent that the legal basis for data processing is Article 6(1)(c) or (e) of the GDPR, the supervisory authority named in Section 5.1 is responsible for handling complaints.

5.3 Other Networks

Incidentally, the social media platforms have not yet taken any action to implement these measures, so at this time we can only advise you to exercise the following rights with the social media platform. With regard to data that you provide to us, we will also implement these measures to the extent that it is technically possible for us to do so.

6. Processing of Data by the Social Network and Disclosure of Data

The social network collects various types of information from you. Unfortunately, we cannot tell you for what purposes, to what extent, for how long, in what manner, or by whom the data is processed by the respective social network. We therefore refer you to the privacy policy of the respective network regarding the data, the purposes for which it is collected, and the recipients of this data.

Data is therefore also transferred to partners and companies in countries outside the European Union, particularly the United States, which, according to a ruling by the European Court of Justice, currently do not provide an adequate level of data protection.

You also have the rights granted by the GDPR with respect to the social network:

· You have the right to request information at any time regarding the personal data we have stored about you (Art. 15 of the GDPR). This also applies to the recipients or categories of recipients to whom this data is disclosed and the purpose of its storage.

· In addition, you have the right to request rectification under the conditions set forth in Article 16 of the GDPR, erasure under the conditions set forth in Article 17 of the GDPR, and restriction of processing under the conditions set forth in Article 18 of the GDPR.

· Furthermore, you may request data portability at any time in accordance with the provisions of Article 20 of the GDPR.

· For more information, please refer to the full text of the GDPR.

· In the event that personal data is processed for the performance of tasks carried out in the public interest (Art. 6(1), first sentence, lit. e of the GDPR) or for the purposes of legitimate interests (Art. 6(1), first sentence, lit. f of the GDPR), you may object to the processing of your personal data at any time with future effect. In the event of an objection, any further processing of your data for the aforementioned purposes must be discontinued, unless there are compelling legitimate grounds for processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.

Please direct all requests for information, inquiries, revocations, or objections regarding data processing by email to the social network’s address listed in Section 2. You also have the option to file a complaint regarding data protection matters with the competent supervisory authority specified there. These are also listed in Section 2, to the extent known.

In addition, you can revoke your consent to the processing of certain data or object to such processing on social media platforms by adjusting the relevant settings. However, we refer you to the respective providers for this:

6.1 Facebook

For more information on data protection, please visit http://de-de.facebook.com/about/privacy and https://www.facebook.com/policies/cookies. However, since Facebook also stores information about users’ devices, it is able to associate IP addresses with individual users. In addition, Facebook is able to track that you have visited our page and how you used it.

The user’s data is stored until the account is deleted or for as long as it is needed to provide the social network’s services—whichever occurs first. However, only the content you have posted or created yourself will be deleted; content posted by others about you will not be deleted. If data is the subject of an inquiry, a legal obligation, an official investigation, etc., it may be stored for a longer period, but no longer than until the matter is resolved. To prevent misuse, the social network also stores information about accounts that have been deactivated due to violations of the Terms of Use for at least one year.

Facebook is headquartered in the United States. Consequently, data is also transferred to the United States. Such transfers are currently a matter of concern due to the ruling of the European Court of Justice. We have entered into the available agreements with Facebook (see Section 4.1). We have taken all possible measures to comply with the requirements of Article 44 of the GDPR and to ensure appropriate safeguards.

You can adjust your settings and opt out of having your data used for advertising purposes in your profile settings at https://www.facebook.com/settings?tap=ads.

6.2 Instagram

For more information on data protection, please visit https://privacycenter.instagram.com/policies/cookies/ and https://privacycenter.instagram.com/policies/cookies/. In addition, please note the following:

According to the information available to us, Instagram stores IP addresses in an anonymized form. However, since Instagram also stores information about users’ devices, it may be able to associate IP addresses with individual users. In addition, Instagram is able to track that you have visited our site and how you used it.

Your data will be stored until your account is deleted or for as long as it is needed to provide the social network’s services—whichever occurs first. However, only the content you have posted or created yourself will be deleted; content provided by others will not be deleted. If data is the subject of an inquiry, a legal obligation, an official investigation, etc., it may be stored for a longer period, but no longer than until the matter is resolved. To prevent misuse, the social network also stores information about accounts that have been deactivated due to violations of the Terms of Use for at least one year.

Instagram, as part of Facebook, is headquartered in the United States. This means that data is also transferred to the United States. Such transfers are currently a matter of concern due to the ruling of the European Court of Justice. We will do our utmost to implement all necessary measures to comply with the requirements of Article 44 of the GDPR and ensure appropriate safeguards.

You can adjust your settings and opt out of having your data used for advertising purposes in your profile settings at https://www.instagram.com/accounts/privacy_and_security/.

6.3 YouTube

For more information on data protection, please visit https://policies.google.com/privacy?hl=de DSE, as well as https://policies.google.com/?hl=de and https://policies.google.com/technologies/product-privacy?hl=de.

Within YouTube, Google stores your data for varying lengths of time, depending on the type of data. In this regard, please refer to Google’s data retention policy at https://policies.google.com/privacy?hl=de&gl=de#infodelete.

Google is headquartered in the United States. As a result, data is also transferred to the United States. Data transfers to the United States are currently a sensitive issue due to the ruling by the European Court of Justice. We will do our utmost to implement all necessary measures to comply with the requirements of Article 44 of the GDPR and ensure appropriate safeguards.

You can adjust your settings and opt out of having your data used for advertising purposes in your profile settings at https://myaccount.google.com/privacycheckup?utm_source=pp&utm_medium=Promo-in-product&utm_campaign=pp_intro&hl=de.

6.4 Pinterest

For more information on data protection, please visit https://policy.pinterest.com/de/privacy-policy and https://policy.pinterest.com/de/cookies.

Pinterest is headquartered in the United States. As a result, data is also transferred to the United States. Such transfers are currently a matter of concern due to the ruling of the European Court of Justice. We will do our utmost to implement all necessary measures to comply with the requirements of Article 44 of the GDPR and to ensure appropriate safeguards.

You can adjust your settings and opt out of having your data used for advertising purposes in your profile settings at https://www.pinterest.de/settings/privacy.

7. CHANGES TO THE PRIVACY POLICY

We reserve the right to modify our privacy practices and these provisions in order to adapt them, as necessary, to changes in relevant laws, regulations, case law, or guidelines issued by data protection authorities, or to better meet your needs. Any changes to our privacy practices will be announced here. Please note the current version date of the Privacy Policy.

5. Information on the Use of Cookies

You can find a detailed description of the cookies on our site in our cookie policy.

§ 18 RIGHTS OF THE DATA SUBJECT

If your personal data is processed, you are a data subject within the meaning of the GDPR, and you have the following rights with respect to the controller:

1. Right of access,

2. Right to Rectification

3. Right to restriction of processing,

4. Right to Erasure

5. Right to Information

6. Right to Data Portability.

7. Right to Object to Processing

8. Right to Withdraw Consent Under Data Protection Law

9. Right to Opt Out of Automated Decision-Making

10. Right to File a Complaint with a Supervisory Authority

1. Right to Information

(1) You may request confirmation from the controller as to whether we are processing personal data concerning you. If such processing is taking place, you may at any time request, free of charge, information from the controller regarding the personal data stored about you, as well as the following information:

(a) the purposes for which the personal data is processed;

b) the categories of personal data that are processed;

c) the recipients or categories of recipients to whom your personal data has been or will be disclosed;

d) the planned duration of the storage of your personal data or, if it is not possible to provide specific information in this regard, the criteria used to determine the storage period;

e) the existence of a right to have personal data concerning you rectified or erased, a right to restrict processing by the controller, or a right to object to such processing;

(f) the existence of a right to file a complaint with a supervisory authority;

(g) all available information regarding the origin of the data, if the personal data is not collected from the data subject;

(h) the existence of automated decision-making, including profiling, pursuant to Article 22(1) and (4) of the GDPR; and—at least in such cases—meaningful information regarding the logic involved, as well as the scope and intended effects of such processing on the data subject.

(2) You have the right to request information regarding whether your personal data will be transferred to a third country or to an international organization. In this context, you may request to be informed of the appropriate safeguards pursuant to Article 46 of the GDPR in connection with the transfer.

2. Right to Rectification

You have the right to request that the controller promptly correct and/or complete your personal data if the personal data being processed concerning you is inaccurate or incomplete.

3. Right to Restriction of Processing

(1) Under the following conditions, you may request that the controller immediately restrict the processing of your personal data:

a) if you contest the accuracy of the personal data concerning you for a period that allows the controller to verify the accuracy of the personal data;

b) the processing is unlawful, and you object to the erasure of the personal data and instead request that the use of the personal data be restricted;

c) the controller no longer needs the personal data for the purposes of the processing, but you need it to assert, exercise, or defend legal claims, or

d) if you have objected to the processing pursuant to Article 21(1) of the GDPR and it has not yet been determined whether the controller’s legitimate grounds override your grounds.

(2) If the processing of your personal data has been restricted, such data—with the exception of its storage—may be processed only with your consent, or for the purpose of asserting, exercising, or defending legal claims, or to protect the rights of another natural or legal person, or for reasons of an important public interest of the Union or a Member State. If the restriction on processing has been imposed in accordance with the above conditions, the controller will notify you before the restriction is lifted.

4. Right to Erasure

(1) You may request that the controller erase your personal data without delay if any of the following grounds apply:

a) The personal data concerning you is no longer necessary for the purposes for which it was collected or otherwise processed.

b) You withdraw your consent on which the processing was based pursuant to Article 6(1)(a) or Article 9(2)(a) of the GDPR, and there is no other legal basis for the processing.

c) You object to the processing pursuant to Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2) of the GDPR.

d) The personal data concerning you has been processed unlawfully.

(e) The erasure of your personal data is necessary to comply with a legal obligation under Union law or the law of the Member States to which the controller is subject.

f) The personal data concerning you was collected in connection with information society services offered in accordance with Article 8(1) of the GDPR.

(2) If the controller has made the personal data concerning you public and is required to erase it pursuant to Article 17(1) of the GDPR, the controller shall take appropriate measures, including technical measures, taking into account available technology and the cost of implementation, to inform controllers who process the personal data that you, as the data subject, have requested that they erase all links to such personal data or any copies or replicas of such personal data.

(3) The right to erasure does not apply to the extent that the processing is necessary

(a) to exercise the right to freedom of expression and information;

(b) to comply with a legal obligation that requires processing under Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

(c) for reasons of public interest in the area of public health pursuant to Article 9(2)(h) and (i) and Article 9(3) of the GDPR;

(d) for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes pursuant to Article 89(1) of the GDPR, to the extent that the right referred to in subsection (a) is likely to render impossible or seriously impair the achievement of the objectives of such processing, or

e) to assert, exercise, or defend legal claims.

5. Right to Information

If you have exercised your right to rectification, erasure, or restriction of processing with the controller, the controller is obligated to notify all recipients to whom your personal data has been disclosed of such rectification, erasure, or restriction of processing, unless this proves impossible or involves disproportionate effort. You have the right to request information from the data controller regarding these recipients.

6. Right to Data Portability

(1) You have the right to receive the personal data concerning you that you have provided to the controller in a structured, commonly used, and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller to whom the personal data was provided, provided that

(a) the processing is based on consent pursuant to Article 6(1)(a) of the GDPR or Article 9(2)(a) of the GDPR, or on a contract pursuant to Article 6(1)(b) of the GDPR, and

(b) the processing is carried out using automated means.

(2) In exercising this right, you also have the right to have your personal data transferred directly from one data controller to another, provided that this is technically feasible. This must not infringe upon the freedoms and rights of others.

(3) The right to data portability does not apply to the processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

(4) To exercise the right to data portability, the data subject may contact the data controller at any time.

7. Right to Object

(1) You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data carried out pursuant to Article 6(1)(e) or (f) of the GDPR; this also applies to profiling based on these provisions.

(2) The controller shall no longer process the personal data concerning you unless it can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.

(3) If your personal data is processed for the purpose of direct marketing, you have the right to object at any time to the processing of your personal data for such marketing purposes; this also applies to profiling to the extent that it is related to such direct marketing. If you object to the processing for direct marketing purposes, your personal data will no longer be processed for those purposes.

(4) Notwithstanding Directive 2002/58/EC, you have the option of exercising your right to object in connection with the use of information society services through automated procedures that utilize technical specifications.

(5) To exercise the right to object, the data subject may contact the data controller directly.

8. Right to Withdraw Consent Under Data Protection Law

You have the right to withdraw your consent under data protection law at any time. Withdrawing your consent does not affect the lawfulness of the processing carried out on the basis of your consent prior to its withdrawal. You may contact the data controller for this purpose.

9. Automated decision-making in individual cases, including profiling

(1) You have the right not to be subject to a decision based solely on automated processing—including profiling—that produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision

a) is necessary for the conclusion or performance of a contract between you and the data controller,

(b) is permitted under Union or Member State law to which the controller is subject, and such law provides for appropriate measures to safeguard your rights and freedoms as well as your legitimate interests; or

c) is done with your express consent.

(2) However, these decisions may not be based on special categories of personal data as defined in Article 9(1) of the GDPR, unless Article 9(2)(a) or (g) of the GDPR applies and appropriate measures have been taken to protect your rights and freedoms as well as your legitimate interests.

(3) With regard to the cases referred to in (1) and (3), the controller shall take appropriate measures to safeguard your rights and freedoms as well as your legitimate interests, including, at a minimum, the right to request that the controller designate a person to act on your behalf, to present your point of view, and to challenge the decision.

(4) If the data subject wishes to exercise rights related to automated decision-making, he or she may contact the data controller at any time.

10. Right to File a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority—in particular, in the Member State of your residence, your workplace, or the place where the alleged infringement occurred—if you believe that the processing of your personal data violates the GDPR. The supervisory authority to which the complaint was submitted shall inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy under Article 78 of the GDPR.

§ 19 Changes to the Privacy Policy

We reserve the right to modify our privacy practices and this policy to comply with changes in relevant laws or regulations, as necessary, or to better meet your needs. Any changes to our privacy practices will be announced here accordingly. Please note the current version date of the Privacy Policy.

§ 20 Payment by Credit Card

You can pay by credit card on our website. In doing so, payment data will be transmitted to Hobex AG, Josef-Brandstätter-Straße 2b, 5020 Salzburg, Austria, in order to process the payment. The legal basis for the processing of your data is Article 6(1)(f) of the GDPR.

Hobex AG, Josef-Brandstätter-Straße 2b, 5020 Salzburg, Austria collects information about the transaction, as well as other information related to the transaction, such as information about goods/services, financial information, information about the interaction between you and Hobex AG, Josef-Brandstätter-Straße 2b, 5020 Salzburg, Austria, merchant information—including details about payment instruments—device-related information, and location data.

Hobex AG, Josef-Brandstätter-Straße 2b, 5020 Salzburg, Austria uses the data for purposes including payment processing, credit checks, and monitoring and improving its services.

For details on data processing and the purposes of processing, please refer to the Privacy Policy of Hobex AG, Josef-Brandstätter-Straße 2b, 5020 Salzburg, Austria:

https://www.hobex.at/de/service/datenschutz/

For more information about Hobex AG, Josef-Brandstätter-Straße 2b, 5020 Salzburg, Austria:

https://www.hobex.at/de/kontakt/impressum/

§ 21 Payment via Klarna (Instant Bank Transfer)

On our website, you can pay via the payment service provider Klarna. In doing so, payment data is transmitted to Klarna in order to process the payment. The legal basis for the processing of your data is Article 6(1)(f) of the GDPR.

Klarna collects information about the transaction, as well as other information related to the transaction, such as information about goods and services, financial information, information about your interactions with Klarna, merchant information (including details about payment methods), device-related information, and location data.

Klarna uses the data for purposes including payment processing, credit checks, and monitoring and improving its services.

For details on data processing and the purposes of processing, please see Klarna's Privacy Policy:

https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_de/privacy

Klarna shares your data with a number of third parties, including other companies in the Klarna Group, credit bureaus, and service providers. Sample Privacy Policy under the GDPR

The protection of personal data is a top priority for us. Therefore, we process personal data in accordance with applicable European and national laws.

You may, of course, revoke your consent at any time with future effect. To do so, please contact the data controller as specified in Section 1.
The following statement provides an overview of the types of data we collect, how this data is used and shared, the security measures we take to protect your data, and how you can obtain information about the data you have provided to us.

Legal Basis for the Processing of Personal Data

To the extent that we obtain the data subject’s consent for the processing of personal data, Article 6(1), first sentence, subparagraph (a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis.

When processing personal data that is necessary for the performance of a contract to which the data subject is a party, Article 6(1)(b) of the GDPR serves as the legal basis. This also applies to processing operations necessary for the implementation of precontractual measures.

To the extent that the processing of personal data is necessary to comply with a legal obligation to which we are subject, Article 6(1), first sentence, subparagraph (c) of the GDPR serves as the legal basis.

If processing is necessary to safeguard a legitimate interest of our company or a third party, and the interests, fundamental rights, and fundamental freedoms of the data subject do not override the aforementioned interest, then Article 6(1), first sentence, subparagraph (f) of the GDPR serves as the legal basis for the processing.

Data Deletion and Retention Period

The data subject’s personal data will be deleted or blocked as soon as the purpose for which it was stored no longer applies. Data may also be retained if this is provided for by European or national legislation in EU regulations, laws, or other provisions to which we are subject. Data will also be blocked or deleted when a retention period prescribed by the aforementioned standards expires, unless further retention of the data is necessary for the conclusion or performance of a contract.

§ 22 Pingdom

On our website, we use the Pingdom service provided by SolarWinds Worldwide, LLC (U.S.), which helps us measure various metrics on our website. These include active sessions, current load time, page views per minute, bounce rates, and the Apdes Score (an index for assessing user satisfaction based on Core Web Vitals, such as page load time). To measure these parameters, Pingdom uses various cookies that are stored on the user’s device. However, no personal data, such as the IP address, is transmitted. The cookies generated by Pingdom are stored on your device only if you have previously given your consent via our Consent Management system. The legal basis for this processing of personal data is therefore Article 6(1)(a) of the GDPR in conjunction with Section 25 of the TDDDG.

§ 23 DialogShift Chat Application on Our Website

Our website uses the chat application provided by DialogShift GmbH, Rheinsberger Str. 76/77, 10115 Berlin. This application processes and stores data for the purposes of web analytics, operating the chat application, and responding to inquiries.

To enable the chat feature, chat messages are stored and a cookie with a unique ID is set—this is used to recognize you as a customer.

A cookie is a small text file that is stored locally in the cache on your device. This cookie allows our application to recognize your device and retrieve past chat histories. This cookie is stored for 90 days after its last use. You can disable cookies in your browser settings. However, the chat feature will not work without cookies.

The provision of information such as your name, email address, or phone number is voluntary and implies your consent to the temporary use and storage of this data for the purpose of establishing contact until the end of that contact. This personal data will be deleted after 90 days.

The legal basis for data processing is Article 6(1)(f) of the GDPR, based on our legitimate interest in providing effective customer service, conducting statistical analysis of usage patterns, and optimizing our offerings.

DialogShift offers the following at
: https://www.dialogshift.com/datenschutz

Further information regarding the collection and use of data, as well as your rights and options for protecting your privacy.

§ 24 Use of the five-digital Travel Planner

Our website uses a travel assistant (hereinafter referred to as “Klickberater”) to provide interactive guidance to our visitors. The ClickAdvisor software is operated by five digital GmbH. The company is headquartered in Germany (https://www.five-digital.de/impressum). The data collected through the use of ClickAdvisor is transmitted via SSL encryption and stored in a database to enable us to contact you or send you the requested information. HUBERTUS Mountain Refugio Allgäu is the data controller for this data within the meaning of Article 24 of the GDPR. five digital GmbH is solely the developer and operator of the software and, in this context, acts as a data processor pursuant to Article 28 of the GDPR. The basis for the processing by five digital GmbH is a data processing agreement between HUBERTUS Mountain Refugio Allgäu and five digital GmbH. In addition, five digital GmbH processes further data—some of which may also be personal data—in order to provide its services, in particular for the operation of the click advisors. Further information can be found at https://www.five-digital.de/datenschutz/.

6. BOOKING A DAY SPA THROUGH E-TERMIN

Personal data collected and processed as part of this online appointment booking service by eTermin Ltd on behalf of the client is limited to what is strictly necessary.

Only the information marked with an asterisk is required; this information is essential for using the service (Art. 6(1), first sentence, lit. b of the GDPR). Providing additional information may be helpful, but is not mandatory (voluntary information, Art. 6(1), first sentence, lit. a of the GDPR).

We process and store your personal data for as long as necessary to fulfill our contractual and legal obligations. Once the storage of personal data is no longer necessary to fulfill these obligations, it will be deleted, unless there are legal retention requirements.

§1 Withdrawal of Consent
If you have provided us with consent, you may withdraw it at any time with future effect. You can send your withdrawal to us using the contact information listed under “Data Controller.”

§2 Your Rights
You have the following rights with respect to your personal data:
• Right of access
• Right to rectification or erasure
• Right to restriction of processing
• Right to object to processing
• Right to data portability

You also have the right to lodge a complaint with a data protection supervisory authority regarding our processing of your personal data.

§3 Data Controller
You can find the contact information for the data controller, as well as the contact information for any appointed data protection officer, in the legal notice.