Data protection

General information

We are providing this information to explain to you in a transparent manner how your personal data (which, according to supreme court rulings, also includes your IP address) is handled when you visit our website. According to Art. 4 No. 1 GDPR, personal data is any information relating to an identified or identifiable natural person.

Privacy policy and information

We take the protection of your data and your privacy very seriously and fulfil our obligations under data protection law. We collect and process your personal data in accordance with European and national legal provisions. How and in what form we process your data is explained to you explicitly in this privacy policy.

When you visit our website, we are obliged to collect various personal data - on the one hand, this serves to ensure the functionality of our website and, on the other hand, to increase the attractiveness of our website through the use of various tools.

Nevertheless, we would like to point out that it is not possible to transmit data over the Internet without accepting any security vulnerabilities that may exist. We cannot guarantee complete protection of your data either, but we will do our best to protect your data comprehensively.

Why do we need your data?

Your data is collected so that we can display our website without errors. Other data may be used to analyse your user behaviour.

Furthermore, data is collected on a legal basis:

If you have consented to data processing, we process your personal data on the basis of Art. 6 para. 1 subpara. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR if sensitive data is processed in accordance with Art. 9 para. 1 GDPR. The processing of data in accordance with Art. 9 GDPR is only permitted in certain cases.

If you have consented to the storage of cookies or access to information on your end device, for example through device fingerprinting, the data processing is carried out on the basis of Section 25 (1) TDDDG.

Consent can be revoked at any time with effect for the future. You can revoke your consent by sending us an informal e-mail. You can also contact our data protection officer, who will inform us of your request. However, the legality of the data processing carried out up to the revocation remains unaffected by the revocation exercised by you.

If we collect your data for the fulfilment of a contract or for the implementation of pre-contractual measures, your data will be processed on the basis of Art. 6 para. 1 subpara. 1 lit. b GDPR. If your data is required to fulfil a legal obligation, we process your data on the basis of Art. 6 para. 1 subpara. 1 lit. c GDPR.

Data processing may also be collected on the basis that we are pursuing our legitimate interest in data processing. In this case, data processing is possible provided that your interests or the interests of third parties do not conflict with the data processing. Data processing is then carried out in accordance with Art. 6 para. 1 subpara. 1 lit. f GDPR.

We will specify the relevant legal basis in each individual case in the respective section.

Who is responsible?

As the website operator, we are responsible for data processing on our website under data protection law in accordance with Art. 4 No. 7 GDPR. You can reach us using the following contact details

Hotel Birkenhof

Andrea Braunsch-Voss

Am Anger 30, 87534 Oberstaufen

Tel: +49 (0)83 86 / 98 08 - 0

Fax: +49 (0)83 86 / 98 08 - 20

E-mail: info@birkenhof-oberstaufen.de

How to reach our data protection officer

#KOMM#IT, Funke Solution GmbH & Co KG, Salmas 52, 87534 Oberstaufen

Tel: +49 8325 927050, dsb@komm-it.info

How long do we store your data?

We adhere to the respective statutory retention period for the maximum duration of storage of your personal data. Your data will only be stored by us until we no longer need it for our data processing. With regard to the storage of your data, we are bound by the purpose for which we collected your data. Unless a specific storage period is specified in this information, your personal data will remain with us until the purpose for which it was collected no longer applies.

If you assert a justified request for deletion or revoke your consent to data processing, we must delete your data in the event that there are no other legally permissible reasons for the further storage of your data, such as retention periods under commercial and tax law. We can only fulfil your request for deletion when these reasons no longer apply.

Where do we get your data from?

We collect your data because you provide it to us via a contact form or by other means. There is also data that is collected automatically or only after you have given your consent when you visit our website. This is mainly technical data such as your operating system and the time you accessed the page.

Who do we make your data available to?

We use tools from third-party companies based in and outside the EU and the EEA. Your personal data may be transferred to these third-party companies if you have activated these tools - unless they are necessary for the functionality of the website.

We also use tools from companies based in the USA or other third countries that are not secure under data protection law. Your personal data may also be transferred to these companies if you have activated the corresponding tools. The level of data protection in these countries is not comparable to that in the EU.

Such a data transfer requires an adequacy decision issued by the EU Commission, which guarantees a comparable level of protection for your personal data. In the event that there is no such adequacy decision, other appropriate safeguards in accordance with Art. 44 et seq. GDPR must be taken.

What rights do you have? - Your rights as a data subject

You can assert your rights in accordance with Art. 12 et seq. GDPR.

Withdrawal of consent to data processing

In some cases, we process your data with your express consent. You can revoke any consent you have already given at any time with effect for the future. You can revoke your consent by sending us an informal e-mail. You can also contact our data protection officer, who will inform us of your request. However, the legality of the data processing carried out until the revocation remains unaffected by the revocation exercised by you.

Objection in special cases / against direct advertising, Art. 21 GDPR

If the data processing is carried out on the basis of Art. 6 para. 1 subpara. 1 lit. f GDPR, you can object to the processing of your personal data for reasons arising from your particular situation. This also applies to any profiling - the legal basis on which such profiling is carried out can be found in this information. If you exercise your right to object, your personal data will no longer be processed unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or the processing serves the establishment, exercise or defence of legal claims pursuant to Art. 21 (1) GDPR.

If we process your personal data for direct marketing purposes, you have the right to object to the processing of your personal data for the purpose of such marketing. This also applies to profiling insofar as it is associated with direct advertising. If you object, your personal data will subsequently no longer be sent for the purpose of direct marketing in accordance with Art. 21 para. 2 GDPR.

Right to data portability

You have the right to have data that we process automatically handed over to you or to a third party in a commonly used, machine-readable format. If you request the transfer of the data to another controller, this will only take place if it is technically feasible.

Right to information, erasure and rectification

In accordance with Art. 15 para. 1 GDPR, you have the right to request information free of charge about your stored personal data, its origin, recipients and the purpose of data processing. You may also have the right to have this data rectified or erased. If you have any questions about your rights, you can contact us or our data protection officer at any time.

Right to restriction of processing

You can also request that the processing of your personal data be restricted. If you have any questions about this right, you can contact us or our data protection officer at any time. A right to restriction exists in the cases specified by law. If you dispute the accuracy of your data, we need time to verify this. You have the right to request the restriction of your data for this period. In the event that the processing of your data is unlawful, you can request the restriction of processing instead of the erasure of the data. If we no longer need your personal data, but you wish to exercise, defend or assert legal claims, you have the right to at least request the restriction of data processing. If you have lodged an objection in accordance with Art. 21 para. 1 GDPR, we must weigh up your interests against ours, during which time you have the right to request the restriction of data processing.

If you have restricted the processing of your personal data, this data - apart from its storage - may only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or of a Member State.

Right to lodge a complaint with a competent supervisory authority

As a data subject, you also have the right to lodge a complaint with a supervisory authority in the event of violations of the GDPR. This must be the competent data protection supervisory authority in your federal state. You always have the right to lodge a complaint, regardless of what other measures you take.

Further information

We expressly object to the sending of unsolicited advertising and information material to our contact details. We expressly reserve the right to take legal action against the unsolicited sending of advertising, such as spam e-mails.

For security reasons and to protect the transmission of confidential content, we use an SSL or TLS connection. You can recognise an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line.

Server log files

The website provider collects and stores information in server log files that your browser automatically transmits to us. This includes the following data Browser type and browser version, operating system used, referrer URL, host name of the accessing computer, time of the server enquiry and also your IP address.

Your data will not be merged with data from other data sources. The legal basis for data processing is Art. 6 para. 1 subpara. 1 lit. f GDPR, as we as the website operator have a legitimate interest in the technically error-free presentation and optimisation of our website. Server log files must be recorded for this purpose.

Hosting of our website

We host our website with an external provider.

Mittwald CM Service GmbH & Co KG, Königsberger Straße 4-6, 32339 Espelkamp, Germany

All personal data collected on the website - such as your IP address, meta and communication data, contract data, contact data, names, accesses and other data generated via a website - is stored on the hoster's servers.

The legal basis for the processing of your personal data is Art. 6 para. 1 subpara. 1 lit. f GDPR. Our legitimate interest lies in the most reliable presentation of our website.

In the event that we have requested your consent, your data will be processed on the basis of Art. 6 para. 1 subpara. 1 lit. a GDPR and Section 25 para. 1 TDDDG if the use of data is subject to consent to the storage of cookies or access to information in the user's terminal device, such as device fingerprinting, within the meaning of the TDDDG. Consent can be revoked at any time with effect for the future. You can revoke your consent by sending us an informal email. You can also contact our data protection officer, who will inform us of your request. However, the legality of the data processing carried out up to the revocation remains unaffected by the revocation exercised by you.

We have concluded an agreement on order processing to provide evidence of data protection-compliant processing and to outline our respective obligations. This is a contract prescribed by data protection law in accordance with Art. 28 para. 3 GDPR, which guarantees that our processor will only process the personal data of our website visitors in accordance with our instructions and in compliance with the GDPR. Our hosting provider is:

Setting of cookies

We use cookies on our website. These are small text files and data packets that are placed on the end devices, but do not cause any damage there. The cookies are either stored temporarily for a session as session cookies or permanently as permanent cookies on your end device. Session cookies are automatically deleted at the end of the session, whereas permanent cookies are stored on the end device until you delete them yourself or they are automatically deleted by your web browser.

In some cases, cookies from third-party companies may also be stored on your end device; these are third-party cookies. They enable the use of services from this company, such as cookies for processing payment services.

Cookies fulfil different functions. Some of them are technically necessary for certain applications on the website to function at all, such as the shopping basket function. Other cookies are used to evaluate user behaviour on our website or to display advertising. Cookies that are technically absolutely necessary and are therefore to be regarded as necessary cookies are stored on the basis of Section 25 (2) TDDDG, unless another legal basis is explicitly stated. The storage of cookies is absolutely necessary in order to create the technical prerequisites for an error-free and optimised website. For cookies that are not technically necessary, consent is requested in accordance with Section 25 (1) TDDDG. Cookies are then only stored on the basis of this consent. Consent can be revoked at any time with effect for the future. You can revoke your consent by sending us an informal e-mail. You can also contact our data protection officer, who will inform us of your request. However, the legality of the data processing carried out until the revocation remains unaffected by the revocation exercised by you.

You can set your browser so that you are informed about the setting of cookies and only allow them in individual cases. You can also generally exclude the storage of cookies and activate the automatic deletion of cookies when closing the browser. We would recommend this procedure. If you generally deactivate cookies, the functionality of our website and its display may be restricted. If we use cookies from third-party companies and for analysis purposes, we will inform you again separately. In this case, we will also ask for your consent.

Cookie banner on the homepage:

Our cookie banner on the homepage (request for consent) comes from a third-party provider.

We use the cookie banner to obtain your consent for certain cookies that are not required for the technical display of the website to be stored on your end device. We require this consent in order to be able to provide a legal basis for the storage.

When you visit our website, personal data is transmitted to our cookie banner provider. This is the following data: Your response to our request for consent in the context of the cookie banner, your IP address, information about your browser and your end device as well as the time of your visit to our website.

When you enter our website, a connection is established to the provider's servers so that your consent or other declarations regarding the setting of cookies can be obtained. Once you have given your consent, our provider stores a cookie in your Internet browser so that it can assign whether you have consented to the setting of cookies or rejected them. It is also used to allocate any subsequent cancellation. This data is stored until you ask us to delete the data, delete the cookie yourself or the purpose for the data processing no longer applies. If the deletion conflicts with statutory retention periods, these remain unaffected.

The legal basis for obtaining consent is Section 25 (1) TDDDG. You can revoke your consent at any time with effect for the future. If you wish to change your settings, please contact us or follow the instructions on our website. You can revoke your consent by sending us an informal e-mail. You can also contact our data protection officer, who will inform us of your request. However, the legality of the data processing carried out up to the time of cancellation remains unaffected by your cancellation.

Usercentrics GmbH

Sendlinger Straße 7, 80331 Munich, Germany

Special offers on our website

We offer services on our website that are specifically tailored to our industry. These are the following services:

Voucher purchase and administration

We offer the purchase of vouchers and the online administration of vouchers on our website.

If you would like to purchase an online voucher via our website, we require your data for processing. We process the following data in order to be able to process your enquiry: Your e-mail address and the title and first and last name of the voucher recipient. We will also ask you for your preferred method of dispatch so that we can issue the voucher in accordance with your wishes. If you choose to send the voucher by e-mail, we will process the e-mail address of the recipient of the e-mail. If you choose dispatch by post, we also need the recipient's postal address in order to be able to send you the voucher. In the voucher management system, we store the remaining value of the voucher, the redemptions already made and the current status of the voucher (open, paid, redeemed, etc.).

The legal basis for data processing when purchasing and managing vouchers is Art. 6 para. 1 subpara. 1 lit. b GDPR for the fulfilment of a contract or the implementation of pre-contractual measures. The data transmitted to us will remain with us until the purpose for storing the data no longer applies. However, mandatory statutory retention periods prevent your data from being deleted.

We have concluded an order processing agreement to provide evidence of data protection-compliant processing and to outline our respective obligations. This is a contract prescribed by data protection law in accordance with Art. 28 para. 3 GDPR, which guarantees that our processor will only process the personal data of our website visitors in accordance with our instructions and in compliance with the GDPR.

Contact options on our website

We offer various ways to contact us on our website.

Registration with Facebook Connect

You have the option of registering on Facebook Connect instead of on our website. The provider of this service is Meta Platforms Ireland Limited (hereinafter: "Meta"), 4 Grad Canal Square, Dublin 2, Ireland.

To register, you can click on the Facebook Connect button ("Login with Facebook"). With a further click ("two-click solution") you will be redirected to the Meta platform, where you can log in with your login data. When you log in, our website is linked to your Meta profile and we gain access to your data stored on Meta, such as user name, profile information and profile picture, email address, Meta ID, friend lists on Meta, likes on Meta ("Like" information), date of birth, gender, country and language. We process your data to set up, provide and personalise your log-in.

The legal basis for our data processing is your consent in accordance with Art. 6 para. 1 subpara. 1 lit. a GDPR. You can withdraw your consent at any time with effect for the future. You can revoke your consent by sending us an informal email. You can also contact our data protection officer, who will inform us of your request. However, the legality of the data processing carried out until the revocation remains unaffected by the revocation exercised by you.

By logging in via Facebook Connect, there is no joint responsibility for any data processing of personal data in accordance with Art. 26 GDPR. By using the "two-click solution" we have implemented, you voluntarily decide to place yourself under Meta's data sovereignty. Contrary to the ECJ judgement of 5 June 2018, C-210/16, there is therefore no responsibility based on a joint decision on the purposes and means of data processing, as Meta only processes personal data at the point in time when you have already voluntarily transferred to Meta's data sovereignty. The processing of personal data that takes place after the transfer to Meta is not attributable to us. In addition, in the event of joint responsibility, the required agreement pursuant to Art. 26 para. 3 GDPR can be found in the addendum provided by Meta: www.facebook.com/legal/controller_addendum. According to this agreement, we are obliged to provide the data protection information in accordance with Art. 13 f. GDPR and to integrate the Meta tool on our website in compliance with data protection regulations. You can assert your data subject rights directly with Meta. In the event that you assert your data subject rights with us in relation to the use of Facebook Connect, we are obliged to forward your request to Meta.

The data processed by Meta is also transferred to the USA and other third countries. The data transfer to the USA is again based on an adequacy decision by the EU Commission. Meta is a certified partner for the EU-US Privacy Framework. Details can be found at: facebook.com/legal/EU_data_transfer_addendum, de-de.facebook.com/help/566994660333381 and facebook.com/policy.php. Further information can be found in the Terms of Use and the Privacy Policy. These can be found at: de-de.facebook.com/about/privacy/ and de-de.facebook.com/legal/terms/.

Registration for our newsletter

You can voluntarily subscribe to our newsletter. We will process the data you provide in the registration form as well as your email address in order to process your registration and in case we have any follow-up questions for you. However, we will not pass on your data to third parties without your consent.

The legal basis for the processing of your data is your consent in accordance with Art. 6 para. 1 subpara. 1 lit. a GDPR and §25 para. 1 TDDDG. You can revoke your consent at any time with effect for the future. All you need to do is send us an informal email. However, this will not affect the lawfulness of our data processing up to the time of revocation.

The data you provide will remain with us until you ask us to delete it or revoke your consent to its storage. Mandatory legal provisions such as statutory retention periods remain unaffected.

Enquiries via contact form

You can use our contact form to send us enquiries at any time. We will process the data you provide in the contact form as well as your email address in order to process your enquiry and in case we have any follow-up questions for you. However, we will not pass on your data to third parties without your consent.

The legal basis for the processing of your data is Art. 6 para. 1 subpara. 1 lit. b GDPR, provided that your enquiry is related to the fulfilment of a contract or is necessary for the implementation of pre-contractual measures.

In other cases, the processing is based on our legitimate interest in the effective processing of your enquiry in accordance with Art. 6 para. 1 subpara. 1 lit. f GDPR

or on your consent in accordance with Art. 6 para. 1 subpara. 1 lit. a GDPR, if this was requested by us. You can withdraw your consent at any time with effect for the future. All you need to do is send us an informal email. However, this will not affect the lawfulness of our data processing until you withdraw your consent.

The data you provide will remain with us until you ask us to delete it or revoke your consent to its storage. Mandatory statutory provisions such as statutory retention periods remain unaffected.

Enquiries by e-mail, telephone and fax

You can contact us at any time by e-mail, telephone and fax. We process the data that you have provided to us in order to be able to process your enquiry. However, we will not pass on your data to third parties without your consent.

The legal basis for the processing of your data is Art. 6 para. 1 subpara. 1 lit. b GDPR, insofar as your enquiry is related to the fulfilment of a contract or is necessary for the implementation of pre-contractual measures or on your consent in accordance with Art. 6 para. 1 subpara. 1 lit. a GDPR, if this was requested by us. You can withdraw your consent at any time with effect for the future. All you need to do is send us an informal email. However, this will not affect the lawfulness of our data processing until you withdraw your consent.

The data you provide will remain with us until you ask us to delete it or revoke your consent to its storage. Mandatory statutory provisions such as statutory retention periods remain unaffected.

In other cases, the processing is based on our legitimate interest in the effective processing of your enquiry in accordance with Art. 6 para. 1 subpara. 1 lit. f GDPR

Dispatch of postal advertising

We use your address to send you postal advertising.

The legal basis for the processing of your data is our legitimate interest in direct advertising in accordance with Art. 6 para. 1 subpara. 1 lit. f GDPR in conjunction with EW 47 of the GDPR.

In the event that we have requested consent, the data processing is carried out solely on the basis of Art. 6 para. 1 subpara. 1 lit. a GDPR. You can withdraw your consent at any time with effect for the future. All you need to do is send us an informal email. However, this will not affect the lawfulness of our data processing until you withdraw your consent.

The data you provide will remain with us until you ask us to delete it or revoke your consent to its storage. Mandatory statutory provisions such as statutory retention periods remain unaffected.

Data processing by social networks

We use a publicly accessible profile in various social networks.

The social networks may already analyse your behaviour when you visit our website, as we have integrated social network plug-ins or other links. Personal data is also collected even if you are not logged in as a user or do not have an account with the respective provider. Your data is collected via cookies that are stored on your end device or by recording your IP address.

The social networks create user profiles. They store your interests and preferences in these profiles so that interest-based advertising is displayed to you. If you have a profile with the respective provider, the adverts will be displayed on all devices on which you are or were logged in.

The data you provide will remain with us until you ask us to delete it or revoke your consent to its storage. Mandatory legal provisions such as statutory retention periods remain unaffected. Stored cookies, unless they are session cookies, remain on your device until you delete them.

We have concluded an order processing agreement with the respective provider to provide evidence of data protection-compliant processing and to outline our respective obligations. This is a contract prescribed by data protection law in accordance with Art. 28 para. 3 GDPR, which ensures that our processor only processes the personal data of our website visitors in accordance with our instructions and in compliance with the GDPR.

Meta plug-in and Meta profile

We maintain a profile on Meta (formerly Facebook). The provider is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (hereinafter: "Meta"). We have also integrated a Meta plug-in on our website. You can recognise these by the Meta profile button or the "Like" button. You can find an overview of the Facebook/Meta plug-ins at: developers.facebook.com/docs/plugins/.

The integration of the plug-in alone does not lead to any direct data transfer to Meta. Personal data is only processed when information is accessed that goes beyond the home page of a Meta profile; this processing is no longer attributable to us as the operator, as you have voluntarily transferred your data to Meta's data sovereignty by giving your consent through the "two-click solution".

The legal basis for our data processing is our legitimate interest in the widest possible visibility in social media in accordance with Art. 6 para. 1 subpara. 1 lit. f GDPR.

If a corresponding consent has been requested, Meta's data processing is based on your consent in accordance with Art. 6 para. 1 subpara. 1 lit. a GDPR. You can withdraw your consent at any time with effect for the future. You can revoke your consent by sending us an informal email. You can also contact our data protection officer, who will inform us of your request. However, the legality of the data processing carried out until the revocation remains unaffected by the revocation exercised by you.

The use of a meta profile does not result in joint responsibility for any data processing of personal data in accordance with Art. 26 GDPR. By using the "two-click solution" provided by us, you voluntarily decide to place yourself under Meta's data sovereignty. Contrary to the ECJ judgement of 5 June 2018, C-210/16, there is therefore no responsibility based on a joint decision on the purposes and means of data processing, as Meta only processes personal data at the point in time when you have already voluntarily transferred to Meta's data sovereignty. The processing of personal data that takes place after the transfer to Meta is not attributable to us. In addition, in the event of joint controllership, the agreement required pursuant to Art. 26 (3) GDPR can be found in the addendum provided by Meta: www.facebook.com/legal/controller_addendum. According to this agreement, we are obliged to provide the data protection information in accordance with Art. 13 f. GDPR and to integrate the Meta tool on our website in compliance with data protection regulations. You can assert your data subject rights directly with Meta. In the event that you assert your data subject rights with us in relation to the use of Meta, we are obliged to forward your request to Meta.

Instagram plug-in and Instagram profile

We maintain a profile on Instagram. The provider is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (hereinafter: "Meta"). We have also integrated an Instagram plug-in on our website. You can recognise this by the Instagram profile button.

The integration of the plug-in alone does not lead to any direct data transfer to Meta. Personal data is only processed when information is accessed that goes beyond the start page of an Instagram profile; this processing is no longer attributable to us as the operator, as you have voluntarily transferred your data to Meta's data sovereignty by giving your consent through the "two-click solution".

The legal basis for our data processing is our legitimate interest in the widest possible visibility in social media in accordance with Art. 6 para. 1 subpara. 1 lit. f GDPR.

The use of an Instagram profile does not result in joint responsibility for any data processing of personal data in accordance with Art. 26 GDPR. By using the "two-click solution" we have implemented, you voluntarily decide to place yourself under Meta's data sovereignty. Contrary to the ECJ judgement of 5 June 2018, C-210/16, there is therefore no responsibility based on a joint decision on the purposes and means of data processing, as Meta only processes personal data at the point in time when you have already voluntarily transferred to Meta's data sovereignty. The processing of personal data that takes place after the transfer to Meta is not attributable to us. In addition, in the event of joint responsibility, the required agreement pursuant to Art. 26 para. 3 GDPR can be found in the addendum provided by Meta: www.facebook.com/legal/controller_addendum. According to this agreement, we are obliged to provide the data protection information in accordance with Art. 13 f. GDPR and to integrate the Meta tool on our website in compliance with data protection regulations. You can assert your data subject rights directly with Meta. In the event that you assert your data subject rights with us in relation to the use of Instagram, we are obliged to forward your request to Meta.

Integration of analysis tools and plug-ins

We use various analysis and advertising tools.

We have concluded an order processing agreement with the respective provider to provide evidence of data protection-compliant processing and to outline our respective obligations. This is a contract required by data protection law in accordance with Art. 28 para. 3 GDPR, which ensures that our processor only processes the personal data of our website visitors in accordance with our instructions and in compliance with the GDPR.

Integration of Google Tag Manager

We use Google Tag Manager to integrate tracking or statistical tools on our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: "Google Tag Manager").

The technology does not create a user profile, does not store cookies and does not carry out any analyses itself; it only stores your IP address. The Google Tag Manager manages the integrated tools.

The data processed by Google is also transmitted to the USA and other third countries. The data transfer to the USA is again based on an adequacy decision by the EU Commission. Google is a certified partner for the EU-US Privacy Framework. You can find details at: privacy.google.com/businesses/controllerterms/mccs/

Integration of Google Analytics

We use the web analysis services of Google Analytics to carry out user analyses. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: "Google").

Google collects personal data for the analysis of user behaviour, which is stored on our server, whereby the IP address is only stored in anonymised form. Google helps us to collect data on when our website was accessed from which region and whether and which purchases were made via the website. To carry out this analysis, Google stores log files such as the IP address, referrer, browser and operating system used. In addition, Google may also record your mouse and scroll movements and your clicks.

The legal basis for data processing is our legitimate interest in anonymised analysis to improve our services in accordance with Art. 6 para. 1 subpara. 1 lit. f GDPR.

If a corresponding consent has been requested, Google's data processing is based on your consent in accordance with Art. 6 para. 1 subpara. 1 lit. a GDPR. You can withdraw your consent at any time with effect for the future. You can revoke your consent by sending us an informal email. You can also contact our data protection officer, who will inform us of your request. However, the legality of the data processing carried out until the revocation remains unaffected by the revocation exercised by you.

The data processed by Google is also transferred to the USA and other third countries. The data transfer to the USA is again based on an adequacy decision by the EU Commission. Google is a certified partner for the EU-US Privacy Framework. You can find details at: privacy.google.com/businesses/controllerterms/mccs/

Google stores the data for two months, after which it is anonymised. Details can be found at the following link: support.google.com/analytics/answer/7667196

Use of Google Signals: When using Google Signals, Google Analytics also records your location, search history and, if applicable, your YouTube history as well as demographic data such as visitor data. Google Signals uses this data to provide you with personalised advertising. If you have a Google account and are logged into it, Google Signals will also extract your data from your Google account. Google also uses the data to create anonymised user profiles and to display user behaviour in statistics.

"E-commerce measurement": With the help of this measurement, we analyse the purchasing behaviour of our website visitors in order to improve our offer on our website. Google stores information such as orders placed, average order values, shipping costs and the time from viewing to purchasing a product. Google then summarises this information and assigns it to the respective user.

Integration of Google Ads

We use the Google Ads online advertising programme to display advertisements in Google or on third-party websites when certain terms are entered into Google (keyword targeting). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: "Google").

Google also uses target group targeting, which displays advertising tailored to the target group using user data stored by Google, such as location data or interests. As the website operator, we can evaluate and analyse this data in order to improve our offering. We are particularly interested in which search terms have been entered and how many adverts have led to corresponding clicks.

The legal basis for data processing is our legitimate interest in the effective marketing of our products and services in accordance with Art. 6 para. 1 subpara. 1 lit. f GDPR.

Integration of Google Conversion Tracking

We use Google Conversion Tracking to recognise whether you have performed certain functions or actions. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: "Google").

With this anonymous tracking, we can find out which buttons you have clicked on our website and which products or pages are frequently viewed. This information can be used to create conversion statistics in order to filter the total number of users who found certain products interesting.

The legal basis for data processing is the consent given to us in accordance with Art. 6 para. 1 subpara. 1 lit. a GDPR and Section 25 para. 1 TDDDG. You can revoke your consent at any time with effect for the future. You can revoke your consent by sending us an informal email. You can also contact our data protection officer, who will inform us of your request. However, the legality of the data processing carried out until the revocation remains unaffected by the revocation exercised by you.

Integration of Google DoubleClick

We use Google DoubleClick to provide you with interest-based advertising throughout the Google network. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: "Google").

We use DoubleClick to adapt our adverts to your interests so that we can improve our advertising system. Adverts displayed to you in search results or in banner ads are targeted to you. So that a profile can be created to tailor the advertisements precisely to your interests, Google stores a cookie on your end device that tracks the pages you visit, clicks and other information about your user behaviour.

The legal basis for data processing is the consent given to us in accordance with Art. 6 para. 1 subpara. 1 lit. a GDPR and § 25 para. 1 TDDDG. You can revoke your consent at any time with effect for the future. You can revoke your consent by sending us an informal email. You can also contact our data protection officer, who will inform us of your request. However, the legality of the data processing carried out until the revocation remains unaffected by the revocation exercised by you.

The data processed by Google is also transferred to the USA and other third countries. The data transfer to the USA is currently based on standard contractual clauses of the EU Commission. An adequacy decision by the EU Commission is currently being reviewed and is expected before the end of the year. Details can be found at: privacy.google.com/businesses/controllerterms/mccs/. Further information can be found at the following link: policies.google.com/technologies/ads and adsettings.google.com/authenticated

Integration of Facebook Pixel

We use Facebook Pixel to measure conversions. The provider is Meta Platforms Ireland Limited, 4 Grad Canal Square, Dublin 2, Ireland (hereinafter: "Meta").

Your behaviour can be tracked by clicking on the Meta ad and being redirected to the Meta website. Meta then evaluates your user behaviour for statistical purposes in order to improve its own advertising system. As the website operator, we keep the statistical data in anonymous form and are therefore unable to draw any conclusions about the identity of users. The use of your data by Meta cannot be influenced by us.

The integration of Facebook Pixel does not result in joint responsibility for any data processing of personal data in accordance with Art. 26 GDPR. Through the "two-click solution" we have implemented, you voluntarily decide to place yourself under Meta's data sovereignty. Contrary to the ECJ judgement of 5 June 2018, C-210/16, there is therefore no responsibility based on a joint decision on the purposes and means of data processing, as Meta only processes personal data at the point in time when you have already voluntarily transferred to Meta's data sovereignty. The processing of personal data that takes place after the transfer to Meta is not attributable to us. In addition, in the event of joint controllership, the agreement required pursuant to Art. 26 (3) GDPR can be found in the addendum provided by Meta: www.facebook.com/legal/controller_addendum. According to this agreement, we are obliged to provide the data protection information in accordance with Art. 13 f. GDPR and to integrate the Meta tool on our website in compliance with data protection regulations. You can assert your data subject rights directly with Meta. In the event that you assert your data subject rights with us in relation to the use of Meta, we are obliged to forward your request to Meta.

You can also deactivate the "Custom Audiences" function in the settings for adverts at www.facebook.com/ads/preferences/.

Integration of YouTube

We use YouTube videos for visual presentation. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: "Google").

YouTube transmits data to its partners and establishes a connection to Google due to the integration on our website, regardless of whether a video is viewed or not. However, if you watch a video, YouTube connects to the YouTube servers, which are informed which page you are visiting. If you are logged into your account, YouTube will carry out profiling. To prevent this, you must log out of your account.

After starting a video, various cookies are stored on your end device in order to obtain information about our website visitors. We have no influence on data processing by YouTube.

The legal basis for data processing is our legitimate interest in an appealing and uniform presentation of our online offer in accordance with Art. 6 para. 1 subpara. 1 lit. f GDPR.

If a corresponding consent has been requested, the data processing is based on your consent in accordance with Art. 6 para. 1 subpara. 1 lit. a GDPR. You can withdraw your consent at any time with effect for the future. You can revoke your consent by sending us an informal email. You can also contact our data protection officer, who will inform us of your request. However, the legality of the data processing carried out until the revocation remains unaffected by the revocation exercised by you.

The data processed by YouTube is also transferred to the USA and other third countries. The data transfer to the USA is again based on an adequacy decision by the EU Commission. Google is a certified partner for the EU-US Privacy Framework. Details can be found at:https://privacy.google.com/businesses/controllerterms/mccs/. Further information can be found at the following link: policies.google.com/privacy.

Integration of Google Fonts

We use web fonts provided by Google for the standardised display of fonts. The fonts are installed locally, which is why no connection to Google's servers is established.

Integration of Outdoor Active

We use the Outdoor Active map service. The provider is Outdooractive AG, Missener Str. 18, 87509 Immenstadt, Germany (hereinafter: "OA").

You can use OA's tools to search for tours, plan routes or create your own tours. The service offers these goods and services from co-operation partners via an integration on this page. The data is collected for the purpose of integrating the service on the website and for personalisation. Please note that when consent is given, the loading of external services and the transfer of personal data to this service is also permitted.

Specifically, the following data is collected IP address, date and time of the request, time zone difference to GMT, content of the request, access status/ HTTPS status code, amount of data transferred, website from which the request comes, browser, operating system and interface, language and version of the browser software.

The legal basis for data processing is your consent in accordance with Art. 6 para. 1 subpara. 1 lit. a GDPR. You can withdraw your consent at any time with effect for the future. You can revoke your consent by sending us an informal email. You can also contact our data protection officer, who will inform us of your request. However, the legality of the data processing carried out up to the time of revocation remains unaffected by the revocation exercised by you.

Our own services - dealing with applicants

You have the opportunity to send us an unsolicited application or apply for an advertised position at any time. We accept applications by e-mail, post and via our online application form. In the following, we would like to inform you about data processing as part of the application process.

We process your personal data such as contact and communication data, application documents and notes in the context of job interviews, insofar as they are necessary for the establishment of an employment relationship.

In the event that we introduce you to an employment relationship, your data will be processed further for the purpose of implementing your employment relationship.

If we are unable to offer you a position, you reject our offer or withdraw your application, we reserve the right to retain your documents for up to six months after the end of the application process. After this period has expired, your data will be deleted and destroyed. Mandatory statutory retention periods remain unaffected by this. If you have given us your consent to store your data for a longer period, your data may be stored for a longer period.

The legal basis for our data processing is Art. 6 para. 1 subpara. 1 lit. b GDPR i.V.m. § SECTION 26 BDSG. If you have given your consent in accordance with Art. 6 para. 1 subpara. 1 lit. a GDPR, the data processing is based on your consent. You can revoke your consent at any time with effect for the future. You can revoke your consent by sending us an informal email. You can also contact our data protection officer, who will inform us of your request. However, the legality of the data processing carried out up to the time of revocation remains unaffected by the revocation exercised by you.

You have the option of being included in our applicant pool. This includes all documents and information from your application so that we can contact you if there are suitable vacancies. The legal basis for this data processing is your express consent in accordance with Art. 6 para. 1 subpara. 1 lit. a GDPR. You can revoke your consent at any time with effect for the future. You can revoke your consent by sending us an informal email. You can also contact our data protection officer, who will inform us of your request. However, the legality of the data processing carried out until the revocation remains unaffected by the revocation exercised by you.

newsletter

News from Birkenhof