Privacy Policy

Preamble

With the following Privacy Policy, we would like to inform you about what types of your personal data (hereinafter also referred to as “data”) we process, for what purposes, and to what extent. This Privacy Policy applies to all processing of personal data carried out by us, both in connection with the provision of our services and, in particular, on our websites, in mobile applications, and within external online presences, such as our social media profiles (hereinafter collectively referred to as the “Online Offer”).

The terms used are gender-neutral.

As of August 17, 2026

Seal of the Data Protection Generator by Dr. Schwenke.

Table of Contents

  • Preamble
  • Person in Charge
  • Overview of Processing Methods
  • Relevant Legal Bases
  • Safety Measures
  • Transfer of Personal Data
  • International Data Transfers
  • General Information on Data Storage and Deletion
  • Rights of Data Subjects
  • Business Services
  • Business Processes and Procedures
  • Use of Online Platforms for Marketing and Sales Purposes
  • Vendors and Services Used in the Course of Business Operations
  • Payment Methods
  • Provision of the Online Service and Web Hosting
  • Use of Cookies
  • Contact and Inquiry Management
  • Artificial Intelligence (AI)
  • Marketing communications via email, mail, fax, or telephone
  • Web Analytics, Monitoring, and Optimization
  • Online Marketing
  • Social Media Presence
  • Plug-ins, embedded features, and content
  • Processing of Data in the Context of Employment Relationships
  • Application Process
  • Changes and Updates
  • Definitions of Terms

Person in Charge

Hotel Garni Zerza
Tröpolach 93a
9631 Tröpolach

Email address:

Phone: +43 4285 556

Legal Notice: https://www.hotel-garni-nassfeld.at/impressum/

Overview of Processing Methods

The following overview summarizes the types of data processed and the purposes of such processing, and identifies the data subjects.

Types of Data Processed

  • Inventory data.
  • Employee data.
  • Payment information.
  • Location data.
  • Contact Information.
  • Table of Contents.
  • Contract information.
  • Usage data.
  • Meta data, communication data, and procedural data.
  • Social data.
  • Applicant information.
  • Photographs and/or video recordings.
  • Log data.
  • Performance and behavioral data.
  • Work hours data.
  • Salary data.

Special Categories of Data

  • Health data.
  • Religious or ideological beliefs.
  • Union membership.

Categories of Data Subjects

  • Service Recipients and Clients.
  • Employees.
  • Prospective buyers.
  • Communication partners.
  • Users.
  • Applicants.
  • Business and contractual partners.
  • Third parties.

Purposes of Processing

  • Provision of contractual services and fulfillment of contractual obligations.
  • Communication.
  • Safety measures.
  • Direct marketing.
  • Range measurement.
  • Tracking.
  • Office and Organizational Procedures.
  • Remarketing.
  • Conversion tracking.
  • Click tracking.
  • Target Audience Identification.
  • Affiliate Tracking.
  • Organizational and Administrative Procedures.
  • Application Process.
  • Feedback.
  • Marketing.
  • Profiles containing user-specific information.
  • Provision of our online services and user-friendliness.
  • Establishment and Administration of Employment Relationships.
  • Information Technology Infrastructure.
  • Financial and Payment Management.
  • Public Relations.
  • Sales promotion.
  • Business processes and management practices.
  • Artificial Intelligence (AI).

Relevant Legal Bases

Relevant Legal Bases Under the GDPR: The following provides an overview of the legal bases under the GDPR on which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection regulations may apply in your country of residence or our country of residence or registered office. Furthermore, should more specific legal bases apply in individual cases, we will inform you of them in the Privacy Policy.

  • Consent (Art. 6(1), first sentence, subparagraph (a) of the GDPR) — The data subject has given consent to the processing of personal data concerning him or her for a specific purpose or for several specific purposes.
  • Performance of a Contract and Precontractual Inquiries (Art. 6(1), first sentence, subparagraph (b) of the GDPR) — Processing is necessary for the performance of a contract to which the data subject is a party or for the implementation of precontractual measures taken at the data subject’s request.
  • Legal Obligation (Art. 6(1), first sentence, subparagraph (c) of the GDPR) — Processing is necessary for compliance with a legal obligation to which the controller is subject.
  • Legitimate Interests (Art. 6(1), first sentence, subparagraph (f) of the GDPR) — processing is necessary to safeguard the legitimate interests of the controller or a third party, provided that such interests are not overridden by the interests, fundamental rights, and fundamental freedoms of the data subject that require the protection of personal data.
  • Job application process as a pre-contractual or contractual relationship (Art. 6(1), sentence 1, subparagraph (b) of the GDPR) — To the extent that, as part of the job application process, special categories of personal data within the meaning of Art. 9(1) of the GDPR (e.g., health data, such as status as a person with a severe disability or ethnic origin) are requested from applicants so that the controller or the data subject can exercise the rights arising from labor law and the law on social security and social protection and fulfill their respective obligations in this regard, such processing is carried out in accordance with Art. 9(2)(b) GDPR; in the case of the protection of the vital interests of applicants or other individuals pursuant to Article 9(2)(c) GDPR; or for the purposes of preventive healthcare or occupational medicine, for the assessment of an employee’s fitness for work, for medical diagnosis, care, or treatment in the health or social sector, or for the administration of systems and services in the health or social sector pursuant to Article 9(2)(h) of the GDPR. In the case of the provision of special categories of data based on voluntary consent, such data is processed pursuant to Article 9(2)(a) of the GDPR.
  • Processing of Special Categories of Personal Data Related to Health, Employment, and Social Security (Art. 9(2)(h) of the GDPR) - The processing is necessary for the purposes of preventive healthcare or occupational medicine, for the assessment of an employee’s fitness for work, for medical diagnosis, care, or treatment in the health or social care sector, or for the administration of systems and services in the health or social care sector, based on Union law or the law of a Member State or pursuant to a contract with a healthcare professional.

National Data Protection Regulations in Austria: In addition to the data protection regulations of the GDPR, national data protection regulations apply in Austria. These include, in particular, the Federal Act on the Protection of Natural Persons with Regard to the Processing of Personal Data (Data Protection Act—DSG). The Data Protection Act contains, in particular, special provisions regarding the right of access, the right to rectification or erasure, the processing of special categories of personal data, processing for other purposes, data transfers, and automated decision-making in individual cases.

Applicable Legal Basis Under the Swiss Data Protection Act: We process your personal data in accordance with the Federal Act on Data Protection, or “Swiss DPA” for short. Personal data must be processed lawfully, in good faith, and in a proportionate manner (Art. 6, paras. 1 and 2 of the DSG). It may only be collected for a specific purpose that is recognizable to the data subject and may only be processed in a manner consistent with that purpose (Art. 6, para. 3 of the DSG). Unlike the GDPR, the Swiss DSG does not, as a general rule, make the lawfulness of processing by private data controllers contingent on the selection of a specific legal basis from a statutorily defined list. Therefore, there is generally no obligation to specify such a legal basis in the privacy policy for every instance of processing.

Note on the Applicability of the GDPR and the Swiss Data Protection Act (DSG): This privacy notice serves to provide information in accordance with both the Swiss Data Protection Act (DSG) and the General Data Protection Regulation (GDPR). For this reason, please note that the terms used in the GDPR are employed here due to its broader geographical scope and greater clarity. In particular, instead of the terms “processing” of “personal data,” “overriding interest,” and “personal data requiring special protection” used in the Swiss Data Protection Act (DSG), the terms “processing” of “personal data,” “legitimate interest,” and “special categories of data” used in the GDPR are employed. However, the legal meaning of these terms continues to be determined in accordance with the Swiss Data Protection Act (DSG) within the scope of its applicability.

Safety Measures

In accordance with legal requirements, and taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the processing, as well as the varying likelihood and severity of threats to the rights and freedoms of natural persons, we implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.

These measures include, in particular, ensuring the confidentiality, integrity, and availability of data by controlling physical and electronic access to the data, as well as access to, input of, and disclosure of the data, ensuring its availability, and maintaining its separation. Furthermore, we have established procedures that ensure the exercise of data subjects’ rights, the erasure of data, and responses to data breaches. Furthermore, we take the protection of personal data into account from the very beginning of the development or selection of hardware, software, and procedures, in accordance with the principle of data protection through technical design and privacy-friendly default settings.

IP Address Truncation: If IP addresses are processed by us or by the service providers and technologies we use, and processing a full IP address is not necessary, the IP address is truncated (also known as “IP masking”). In this process, the last two digits—or the last part of the IP address following a period—are removed or replaced with placeholders. The purpose of truncating the IP address is to prevent or significantly hinder the identification of a person based on their IP address.

Securing Online Connections Using TLS/SSL Encryption Technology (HTTPS): To protect user data transmitted via our online services from unauthorized access, we rely on TLS/SSL encryption technology. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are the cornerstones of secure data transmission on the Internet. These technologies encrypt the information transmitted between the website or app and the user’s browser (or between two servers), thereby protecting the data from unauthorized access. TLS, as the more advanced and secure version of SSL, ensures that all data transmissions meet the highest security standards. When a website is secured by an SSL/TLS certificate, this is indicated by the display of “HTTPS” in the URL. This serves as an indicator to users that their data is being transmitted securely and in an encrypted form.

Transfer of Personal Data

As part of our processing of personal data, it may occur that such data is transferred to or disclosed to other agencies, companies, legally independent organizational units, or individuals. Recipients of this data may include, for example, service providers contracted to perform IT tasks or providers of services and content integrated into a website. In such cases, we comply with legal requirements and, in particular, enter into appropriate contracts or agreements with the recipients of your data to ensure the protection of your data.

Data Transfer Within the Corporate Group: Data Transfer Within the Corporate Group: We may transfer personal data to other companies within our corporate group or grant them access to such data. This data transfer is based on our legitimate business and operational interests. By this we mean, for example, improving business processes, ensuring efficient and effective internal communication, making optimal use of our human and technological resources, and enabling us to make well-informed business decisions. In certain cases, the data transfer may also be necessary to fulfill our contractual obligations, or it may be based on the consent of the data subjects or a legal authorization.

International Data Transfers

Data Processing in Third Countries: If we transfer data to a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)) or if this occurs in connection with the use of third-party services or the disclosure or transfer of data to other individuals, entities, or companies (which can be identified by the provider’s mailing address or if the privacy policy explicitly refers to data transfers to third countries), this is always done in accordance with legal requirements.

For data transfers to the U.S., we primarily rely on the Data Privacy Framework (DPF), which was recognized as a secure legal framework by an adequacy decision of the European Commission dated July 10, 2023. In addition, we have entered into standard contractual clauses with the respective providers that comply with the European Commission’s requirements and establish contractual obligations to protect your data.

This two-tier safeguard ensures comprehensive protection of your data: The DPF serves as the primary layer of protection, while the Standard Contractual Clauses provide an additional layer of security. Should any changes arise within the framework of the DPF, the Standard Contractual Clauses serve as a reliable fallback option. In this way, we ensure that your data remains adequately protected at all times, even in the event of political or legal changes.

For each service provider, we will inform you whether they are DPF-certified and whether standard contract clauses are in place. For more information on the DPF and a list of certified companies, please visit the U.S. Department of Commerce website at https://www.dataprivacyframework.gov/ (in English).

Data transfers to other third countries are subject to appropriate security measures, in particular standard contractual clauses, explicit consent, or transfers required by law. Information on transfers to third countries and applicable adequacy decisions can be found on the European Commission’s website: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en?prefLang=de.

Disclosure of Personal Data Abroad: In accordance with the Swiss Data Protection Act (DSG), we disclose personal data abroad only if adequate protection for the data subjects is guaranteed (Art. 16 of the Swiss DSG). If the Federal Council has not determined that adequate protection exists (list: https://www.bj.admin.ch/de/schweizerische-anerkennung-von-staaten-die-einen-angemessenen-datenschutz-gewaehrleisten), we implement alternative security measures.

For data transfers to the United States, we primarily rely on the Data Privacy Framework (DPF), which was recognized as a secure legal framework by a Swiss adequacy decision dated September 15, 2024. In addition, we have entered into standard data protection clauses with the respective providers, which have been approved by the Federal Data Protection and Information Commissioner (FDPIC) and establish contractual obligations to protect your data.

This two-tiered safeguard ensures comprehensive protection for your data: The DPF serves as the primary layer of protection, while the Standard Data Protection Clauses provide an additional layer of security. Should any changes arise within the framework of the DPF, the Standard Data Protection Clauses serve as a reliable fallback option. In this way, we ensure that your data remains adequately protected at all times, even in the event of any political or legal changes.

For each service provider, we will inform you whether they are certified under the DPF and whether standard data protection clauses are in place. You can find the list of certified companies and additional information about the DPF on the U.S. Department of Commerce website at https://www.dataprivacyframework.gov/ (in English).

Appropriate security measures apply to data transfers to other third countries, including international treaties, specific safeguards, standard data protection clauses approved by the EDÖB, or internal corporate data protection policies pre-approved by the EDÖB or a competent data protection authority in another country.

General Information on Data Storage and Deletion

We delete the personal data we process in accordance with legal requirements as soon as the underlying consents are revoked or there is no longer a legal basis for processing. This applies to cases in which the original purpose of processing no longer applies or the data is no longer needed. Exceptions to this rule apply when legal obligations or specific interests require the data to be retained or archived for a longer period.

In particular, data that must be retained for commercial or tax purposes, or whose storage is necessary for legal proceedings or to protect the rights of other natural or legal persons, must be archived accordingly.

Our privacy notices contain additional information regarding the retention and deletion of data that applies specifically to certain processing operations.

If there are multiple specifications regarding the retention period or deletion deadlines for a particular piece of data, the longest period shall always apply. We process data that is no longer retained for its originally intended purpose—but rather due to legal requirements or other reasons—exclusively for the purposes that justify its retention.

Data Retention and Deletion: The following general time limits apply under Austrian law to the retention and archiving of personal data, to the extent that such retention is necessary to fulfill legal obligations or to protect legitimate interests:

  • 7 Years: Personal data processed in connection with tax-relevant business records is retained for a period of seven years in accordance with § 132 of the Federal Tax Code (BAO) and §§ 190–212 of the Austrian Commercial Code (UGB). This includes, in particular, books and records, annual financial statements, inventories, management reports, opening balance sheets, accounting vouchers, invoices, as well as commercial or business correspondence received and sent, and other documents relevant to tax collection. The period begins at the end of the calendar year for which the last entry was made and may be extended, if necessary, as long as the documents are relevant to pending tax proceedings.
  • Data collected over a 3-year period that is necessary for asserting, exercising, or defending against warranty claims, claims for damages, or other contractual claims will be stored for the duration of the applicable statutory limitation period. This period is generally three years in accordance with § 1489 of the Austrian Civil Code (ABGB), unless longer statutory retention requirements apply.

Rights of Data Subjects

Rights of Data Subjects Under the GDPR: As a data subject, you have various rights under the GDPR, which arise in particular from Articles 15 through 21 of the GDPR:

  • Right to Object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is carried out pursuant to Article 6(1)(e) or (f) of the GDPR; this also applies to profiling based on these provisions. If your personal data is processed for the purpose of direct marketing, you have the right to object at any time to the processing of your personal data for such marketing purposes; this also applies to profiling to the extent that it is related to such direct marketing.
  • Right to Withdraw Consent: You have the right to withdraw your consent at any time.
  • Right of Access: You have the right to request confirmation as to whether your personal data is being processed, as well as access to that data, additional information, and a copy of the data in accordance with legal requirements.
  • Right to Rectification: In accordance with legal requirements, you have the right to request that data concerning you be completed or that inaccurate data concerning you be corrected.
  • Right to Erasure and Restriction of Processing: In accordance with legal requirements, you have the right to request that data concerning you be erased without delay or, alternatively, to request a restriction on the processing of such data in accordance with legal requirements.
  • Right to Data Portability: You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used, and machine-readable format, in accordance with legal requirements, or to request that it be transferred to another data controller.
  • Complaint to a supervisory authority: In accordance with legal requirements and without prejudice to any other administrative or judicial remedy, you also have the right to file a complaint with a data protection supervisory authority—in particular, a supervisory authority in the Member State where you habitually reside— the supervisory authority of your place of work or the location of the alleged violation, if you believe that the processing of personal data concerning you violates the GDPR.

Rights of data subjects under the Swiss Data Protection Act (DSG):

As a data subject, you have the following rights under the provisions of the Swiss Data Protection Act (DSG):

  • Right of Access: You have the right to request confirmation as to whether personal data concerning you is being processed, and to receive the information necessary to enable you to exercise your rights under this law and to ensure transparent data processing.
  • Right to Data Disclosure or Transfer: You have the right to request that we provide you with the personal data you have provided to us in a commonly used electronic format.
  • Right to Rectification: You have the right to request the correction of any inaccurate personal data concerning you.
  • Right to Object, Deletion, and Destruction: You have the right to object to the processing of your data and to request that your personal data be deleted or destroyed.

Business Services

We process the personal data of our contractual and business partners—such as customers, clients, prospective customers, suppliers, and other business partners (collectively, “Contractual Partners”)—for the purpose of establishing, executing, and fulfilling contractual relationships and similar legal relationships. This also includes pre-contractual measures taken upon request, as well as communication related to the respective contractual relationship.

The processing is carried out, in particular, to fulfill our primary and secondary contractual obligations. This includes the provision of the agreed-upon services, any obligations to provide updates and information, the handling of warranty claims and other service disruptions, the processing of revocations, terminations of continuing contractual relationships, rescissions, refunds, and the handling of other contract-related statements and inquiries. This applies to both one-time contracts and ongoing contractual relationships.

In particular, we process master data such as name, address, and, if applicable, company name; contact information such as email address and phone number; contract and service data such as the subject matter of the contract, contract term, order or transaction number; usage and service data; payment and billing data; as well as communication content and history. To the extent necessary, we also process data that is disclosed or transmitted to us in connection with the execution of an order.

In addition, we process the data to protect our rights and to comply with legal obligations. This includes, in particular, retention requirements under commercial and tax law, documentation requirements, and, where applicable, obligations to provide evidence and account for our actions. In addition, processing is carried out based on our legitimate interests in proper business management, internal administration, risk management, and IT security, as well as in protecting our business operations and our contractual partners from misuse and threats to data, confidential information, and other legal interests. This may also include the involvement of external service providers such as IT and telecommunications providers, transportation and logistics companies, payment service providers, banks, tax and legal advisors, or other agents, to the extent necessary for the performance of the contract or to fulfill legal obligations.

Personal data is disclosed to third parties only to the extent necessary to fulfill a contract, to take steps prior to entering into a contract, to protect legitimate interests, or to comply with legal obligations. We provide separate information regarding any additional processing—particularly for marketing purposes—in this Privacy Policy.

We inform our contractual partners of the specific data required in each individual case as part of the data collection process, for example, by clearly marking online forms or through personal contact.

Data will be deleted as soon as it is no longer necessary for the aforementioned purposes and there are no legal retention requirements that prevent its deletion. Legal retention periods, particularly under commercial and tax law, may require longer storage. We delete data transmitted in connection with a specific order upon completion of the order and the expiration of any retention periods, provided there are no further legal or contractual obligations to retain the data.

The legal basis for the processing is Article 6(1)(b) of the GDPR for the implementation of precontractual measures and the fulfillment of the respective contractual relationship, as well as Article 6(1)(c) of the GDPR for compliance with legal obligations. To the extent that the processing is based on legitimate interests, it is carried out pursuant to Article 6(1)(f) of the GDPR. To the extent that processing is based on Article 6(1)(f) of the GDPR, it is carried out to safeguard our legitimate interests in the proper and efficient organization of our business, the internal administration and documentation of business transactions, the enforcement and defense of legal claims, the assurance of IT and data security, preventing misuse and fraud, and the economic management and further development of our business operations. These interests consist, in particular, of ensuring secure and legally compliant business operations and safeguarding our ability to act as a business entity.

  • Types of Data Processed: Master data (e.g., full name, home address, contact information, customer number, etc.); payment data (e.g., bank account information, invoices, payment history); contact data (e.g., mailing and email addresses or phone numbers); contract data (e.g., subject matter of the contract, term, customer category); usage data (e.g., page views and time spent on the site, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and features); meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, individuals involved).
  • Special categories of personal data: Health data.
  • Affected individuals: Service recipients and clients; prospective clients; business and contractual partners.
  • Purposes of processing and legitimate interests: Provision of contractual services and fulfillment of contractual obligations; security measures; communication; office and organizational procedures; organizational and administrative procedures; business processes and business management procedures.
  • Retention and Deletion: Deletion in accordance with the information provided in the section “General Information on Data Retention and Deletion.”
  • Legal basis: Performance of a contract and pre-contractual inquiries (Art. 6(1), first sentence, subparagraph (b) of the GDPR); legal obligation (Art. 6(1), first sentence, subparagraph (c) of the GDPR); legitimate interests (Art. 6(1), first sentence, subparagraph (f) of the GDPR).

Additional information on processing procedures, methods, and services:

  • Online Store, Order Forms, E-Commerce, and Fulfillment: We process our customers’ data to enable them to select, purchase, or order the products, goods, and related services of their choice, as well as to facilitate payment, provision, delivery, or fulfillment of those items. To the extent necessary for fulfilling an order, we engage service providers—in particular postal, freight, and shipping companies—to carry out the delivery or fulfillment for our customers. We use the services of banks and payment service providers to process payment transactions. The required information is identified as such during the ordering process or a comparable purchase process and includes the details necessary for delivery, provision, and billing, as well as contact information to facilitate any necessary communication; legal basis: performance of a contract and pre-contractual inquiries (Art. 6(1), sentence 1, lit. b) GDPR).
  • Hospitality, Hotel, and Accommodation Services: We process the personal data of our guests, visitors, and prospective customers (collectively referred to as “guests”) in order to provide our lodging and related services of a tourist or gastronomic nature, as well as to bill for the services rendered.

    As part of our business operations, it may be necessary for us to process special categories of data as defined in Article 9(1) of the GDPR, in particular information regarding a person’s health or information relating to their religious beliefs. This processing is carried out to protect the health interests of visitors (e.g., in the case of information regarding allergies) or otherwise to meet their physical or mental needs upon request and with their consent.

    To the extent necessary for the performance of a contract or required by law, or where consent has been given by guests, or where processing is based on our legitimate interests, we may disclose or transfer guests’ data, for example, to service providers involved in the delivery of our services, to government agencies, billing offices, and providers of IT, office, or similar services; Legal basis: Performance of a contract and pre-contractual inquiries (Art. 6(1), first sentence, lit. b) of the GDPR).
  • Event Management: We process the data of participants in the events, functions, and similar activities that we offer or organize (hereinafter collectively referred to as “Participants” and “Events”) to enable them to participate in the events and take advantage of the services or promotions associated with their participation. 

    If, in this context, we process health-related data, religious, political, or other special categories of data, this is done within the scope of public knowledge (e.g., for thematically focused events, for the purpose of health care, safety, or with the consent of the data subjects).

    The required information is identified as such in the context of concluding a contract, order, or similar agreement and includes the details necessary for service provision and billing, as well as contact information to facilitate any necessary consultations. To the extent that we obtain access to information regarding end customers, employees, or other individuals, we process such information in accordance with legal and contractual requirements; legal bases: performance of a contract and pre-contractual inquiries (Art. 6(1), sentence 1, lit. b) GDPR).

Business Processes and Procedures

Personal data of service recipients and clients—including customers, clients, or, in specific cases, legal clients, patients, or business partners, as well as other third parties—is processed within the framework of contractual and comparable legal relationships and precontractual measures, such as the initiation of business relationships. This data processing supports and facilitates business processes in areas such as customer management, sales, payment transactions, accounting, and project management.

The data collected is used to fulfill contractual obligations and streamline business processes. This includes processing business transactions, managing customer relationships, optimizing sales strategies, and ensuring the proper functioning of internal accounting and financial processes. In addition, the data helps safeguard the rights of the data controller and supports administrative tasks and the organization of the company.

Personal data may be disclosed to third parties to the extent necessary to fulfill the stated purposes or legal obligations. Once statutory retention periods have expired or the purpose of the processing no longer applies, the data will be deleted. This also includes data that must be retained for a longer period due to tax and legal documentation requirements.

  • Types of Data Processed: Master data (e.g., full name, residential address, contact information, customer number, etc.); payment data (e.g., bank account information, invoices, payment history); contact data (e.g., mailing and email addresses or phone numbers); Content data (e.g., text or image-based messages and posts, as well as related information, such as details regarding authorship or the time of creation); Contract data (e.g., subject matter of the contract, term, customer category); Log data (e.g., log files regarding logins, data retrieval, or access times); Usage data (e.g., page views and time spent on pages, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and features); Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, individuals involved).
  • Data subjects: Service recipients and clients; prospective customers; communication partners; business and contractual partners; third parties. Users (e.g., website visitors, users of online services).
  • Purposes of processing and legitimate interests: Provision of contractual services and fulfillment of contractual obligations; office and organizational procedures; business processes and management procedures; communication; marketing; sales promotion; public relations; financial and payment management; security measures. Information technology infrastructure (operation and provision of information systems and technical equipment (computers, servers, etc.)).
  • Retention and Deletion: Deletion in accordance with the information provided in the section “General Information on Data Retention and Deletion.”
  • Legal Basis: Performance of a contract and pre-contractual inquiries (Art. 6(1), first sentence, subparagraph (b) of the GDPR); Legitimate interests (Art. 6(1), first sentence, subparagraph (f) of the GDPR); Legal obligation (Art. 6(1), first sentence, subparagraph (c) of the GDPR).

Additional information on processing procedures, methods, and services:

  • Contact Management and Maintenance: Procedures required for the organization, maintenance, and protection of contact information (e.g., setting up and maintaining a central contact database, regularly updating contact information, monitoring data integrity, implementing data protection measures, ensuring access controls, performing backups and restores of contact data, training employees in the effective use of contact management software, regularly reviewing communication history, and adapting contact strategies); Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1), first sentence, lit. b) GDPR), legitimate interests (Art. 6(1), first sentence, lit. f) GDPR).
  • General Payment Transactions: Procedures necessary for executing payment transactions, monitoring bank accounts, and controlling cash flows (e.g., creating and verifying wire transfers, processing direct debits, reviewing account statements, monitoring incoming and outgoing payments, managing returned direct debits, account reconciliation, cash management); Legal Basis: Performance of a contract and pre-contractual inquiries (Art. 6(1), first sentence, lit. b) of the GDPR), legitimate interests (Art. 6(1), first sentence, lit. f) of the GDPR).
  • Accounting, Accounts Payable, Accounts Receivable: Procedures required for the recording, processing, and verification of business transactions in the areas of accounts payable and accounts receivable (e.g., preparing and verifying incoming and outgoing invoices, monitoring and managing open items, processing payments, handling collection procedures, reconciling accounts related to receivables and payables, accounts payable, and accounts receivable); Legal Basis: Contract performance and pre-contractual inquiries (Art. 6(1), sentence 1, lit. b) GDPR), legal obligation (Art. 6(1), sentence 1, lit. c) GDPR), legitimate interests (Art. 6(1), sentence 1, lit. f) GDPR).
  • Financial Accounting and Taxes: Procedures required for the recording, management, and control of financially relevant business transactions, as well as for the calculation, reporting, and payment of taxes (e.g., account assignment and posting of business transactions, preparation of quarterly and annual financial statements, processing of payments, handling of collection procedures, account reconciliation, tax consulting, preparation and filing of tax returns, handling of tax matters); Legal basis: Performance of a contract and pre-contractual inquiries (Art. 6(1), sentence 1, letter b) of the GDPR), legal obligation (Art. 6(1), sentence 1, letter c) of the GDPR), legitimate interests (Art. 6(1), sentence 1, letter f) of the GDPR).
  • Marketing, Advertising, and Sales Promotion: Processes required in the context of marketing, advertising, and sales promotion (e.g., market analysis and target audience identification, development of marketing strategies, planning and execution of advertising campaigns, design and production of advertising materials, online marketing including SEO and social media campaigns, event marketing and trade show participation, customer loyalty programs, sales promotion measures, performance measurement and optimization of marketing activities, budget management, and cost control); Legal basis: Legitimate interests (Art. 6(1), sentence 1, letter f) of the GDPR).
  • Public Affairs: Processes required in the context of public relations (e.g., developing and implementing communication strategies, planning and executing PR campaigns, drafting and distributing press releases, maintaining media contacts, monitoring and analyzing media coverage, organizing press conferences and public events, crisis communication, creating content for social media and corporate websites, managing corporate branding); Legal Basis: Legitimate interests (Art. 6(1), sentence 1, subparagraph (f) of the GDPR).
  • Guest Wi-Fi: Procedures required for the setup, operation, maintenance, and monitoring of a wireless network for guests (e.g., installation and configuration of Wi-Fi access points, creation and management of guest accounts, monitoring of the network connection, ensuring network security, troubleshooting connection issues, updating network software, compliance with data protection regulations); Legal Bases: Performance of a contract and pre-contractual inquiries (Art. 6(1), first sentence, lit. b) GDPR), legal obligation (Art. 6(1), first sentence, lit. c) GDPR), legitimate interests (Art. 6(1), first sentence, lit. f) GDPR).

Use of Online Platforms for Marketing and Sales Purposes

We offer our services on online platforms operated by other service providers. In this context, the privacy policies of the respective platforms apply in addition to our privacy policy. This applies in particular to the processing of payments and the methods used on the platforms for measuring reach and for interest-based marketing.

  • Types of Data Processed: Master data (e.g., full name, home address, contact information, customer number, etc.); payment data (e.g., bank account information, invoices, payment history); contact data (e.g., mailing and email addresses or phone numbers); contract data (e.g., subject matter of the contract, term, customer category); usage data (e.g., page views and time spent on the site, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and features); meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, individuals involved).
  • Affected parties: Service recipients and clients. Business and contractual partners.
  • Purposes of processing and legitimate interests: Provision of contractual services and fulfillment of contractual obligations; marketing; business processes and business management procedures; affiliate tracking.
  • Retention and Deletion: Deletion in accordance with the information provided in the section “General Information on Data Retention and Deletion.”
  • Legal basis: Performance of a contract and pre-contractual inquiries (Art. 6(1), first sentence, subparagraph (b) of the GDPR). Legitimate interests (Art. 6(1), first sentence, subparagraph (f) of the GDPR).

Additional information on processing procedures, methods, and services:

Vendors and Services Used in the Course of Business Operations

As part of our business operations, we use additional third-party services, platforms, interfaces, or plug-ins (collectively, “Services”) in compliance with legal requirements. Our use of these Services is based on our interest in the proper, lawful, and efficient management of our business operations and internal organization.

  • Types of data processed: Master data (e.g., full name, home address, contact information, customer number, etc.); payment data (e.g., bank account information, invoices, payment history); contact information (e.g., mailing and email addresses or phone numbers); content data (e.g., text or image-based messages and posts, as well as related information such as authorship details or the date of creation); contract data (e.g., subject matter of the contract, term, customer category).
  • Affected individuals: Service recipients and clients; prospective clients; business and contractual partners.
  • Purposes of processing and legitimate interests: Provision of contractual services and fulfillment of contractual obligations; office and organizational procedures; business processes and business management procedures.
  • Retention and Deletion: Deletion in accordance with the information provided in the section “General Information on Data Retention and Deletion.”
  • Legal Basis: Legitimate Interests (Art. 6(1), first sentence, (f) of the GDPR).

Additional information on processing procedures, methods, and services:

Payment Methods

Within the framework of contractual and other legal relationships, in accordance with legal obligations, or otherwise based on our legitimate interests, we offer data subjects efficient and secure payment options and, for this purpose, engage not only banks and credit institutions but also other service providers (collectively, “payment service providers”). In accordance with the state of the art, payment transactions are conducted exclusively via encrypted connections, ensuring that the data entered is protected from unauthorized access during transmission.

The data processed by payment service providers includes personal information, such as name and address; banking information, such as account numbers or credit card numbers; passwords, TANs, and checksums; as well as details related to the contract, transaction amounts, and recipients. This information is required to process the transactions. However, the data entered is processed and stored solely by the payment service providers. This means that we do not receive any account- or credit card-related information, but only information confirming the payment or indicating that the payment was declined. Under certain circumstances, the payment service providers may transmit the data to credit bureaus. The purpose of this transmission is to verify identity and creditworthiness. For more information, please refer to the terms and conditions and privacy policies of the payment service providers.

Payment transactions are subject to the terms and conditions and privacy policies of the respective payment service providers, which are available on their respective websites or within their transaction applications. We also refer you to these documents for further information and to exercise your rights of withdrawal, access, and other data subject rights.

  • Types of Data Processed: Master data (e.g., full name, home address, contact information, customer number, etc.); payment data (e.g., bank account information, invoices, payment history); contract data (e.g., subject matter of the contract, term, customer category); Usage data (e.g., page views and time spent on the site, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and features); metadata, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, individuals involved).
  • Affected individuals: Service recipients and clients; business and contractual partners; prospective clients.
  • Purposes of processing and legitimate interests: Provision of contractual services and fulfillment of contractual obligations. Business processes and management procedures.
  • Retention and Deletion: Deletion in accordance with the information provided in the section “General Information on Data Retention and Deletion.”
  • Legal basis: Performance of a contract and pre-contractual inquiries (Art. 6(1), first sentence, subparagraph (b) of the GDPR). Legitimate interests (Art. 6(1), first sentence, subparagraph (f) of the GDPR).

Additional information on processing procedures, methods, and services:

Provision of the Online Service and Web Hosting

We process users' data in order to provide them with our online services. For this purpose, we process the user's IP address, which is necessary to deliver the content and features of our online services to the user's browser or device.

  • Types of Data Processed: Usage data (e.g., page views and time spent on the site, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and features); meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, individuals involved); Log data (e.g., log files regarding logins, data retrieval, or access times); content data (e.g., text or image-based messages and posts, as well as related information such as details regarding authorship or the time of creation).
  • Data subjects: Users (e.g., website visitors, users of online services).
  • Purposes of processing and legitimate interests: Providing our online services and ensuring user-friendliness; information technology infrastructure (operation and provision of information systems and technical equipment (computers, servers, etc.)). Security measures.
  • Retention and Deletion: Deletion in accordance with the information provided in the section “General Information on Data Retention and Deletion.”
  • Legal Basis: Legitimate Interests (Art. 6(1), first sentence, (f) of the GDPR).

Additional information on processing procedures, methods, and services:

  • Provision of Online Services on Leased Server Space: To provide our online services, we use server space, computing capacity, and software that we lease or otherwise obtain from a server provider (also known as a “web host”); Legal basis: Legitimate interests (Art. 6(1), sentence 1, subparagraph f) of the GDPR).
  • Collection of Access Data and Log Files: Access to our online service is logged in the form of so-called “server log files.” Server log files may include the address and name of the web pages and files accessed, the date and time of access, the amount of data transferred, a notification of successful access, the browser type and version, the user’s operating system, the referrer URL (the previously visited page), and, as a rule, IP addresses and the requesting provider. The server log files may be used, on the one hand, for security purposes—for example, to prevent server overload (particularly in the event of malicious attacks, known as DDoS attacks)—and, on the other hand, to ensure server capacity and stability; Legal basis: Legitimate interests (Art. 6(1), sentence 1, lit. f) of the GDPR). Data deletion: Log file information is stored for a maximum of 30 days and is then deleted or anonymized. Data that must be retained for evidentiary purposes is exempt from deletion until the respective incident has been fully resolved.
  • Email Sending and Hosting: The web hosting services we use also include the sending, receiving, and storage of emails. For these purposes, we process the addresses of the recipients and senders, as well as other information related to email transmission (e.g., the involved providers) and the content of the respective emails. The aforementioned data may also be processed for the purpose of detecting spam. Please note that emails are generally not sent in encrypted form over the Internet. Although emails are typically encrypted during transmission, they are not encrypted on the servers from which they are sent and received (unless a so-called end-to-end encryption method is used). We therefore cannot assume any responsibility for the transmission of emails between the sender and our server; Legal basis: Legitimate interests (Art. 6(1), sentence 1, lit. f) GDPR).
  • Typo3: Content management , website creation and administration, support for multilingual content, user and permissions management, integration of extensions and plugins, search engine optimization, responsive design support, workflow management, content versioning; Service provider: Operated on servers and/or computers under the provider’s own responsibility with respect to data protection; Legal basis: Legitimate interests (Art. 6(1), sentence 1, letter f) of the GDPR). Website:https://typo3.com/.

Use of Cookies

The term “cookies” refers to functions that store and retrieve information on users’ devices. Cookies may also be used for various purposes, such as ensuring the functionality, security, and convenience of online services, as well as analyzing visitor traffic. We use cookies in accordance with legal requirements. To this end, we obtain users’ consent in advance when necessary. If consent is not required, we rely on our legitimate interests. This applies when the storage and retrieval of information is essential to provide explicitly requested content and features. This includes, for example, saving settings and ensuring the functionality and security of our online service. Consent may be revoked at any time. We provide clear information about the scope of our use of cookies and which cookies are used.

Information on the Legal Basis for Data Protection: Whether we process personal data using cookies depends on consent. If consent has been given, it serves as the legal basis. Without consent, we rely on our legitimate interests, which are explained earlier in this section and in the context of the respective services and procedures.

Storage Duration: Withregard to storage duration, the following types of cookies are distinguished:

  • Temporary cookies (also known as session cookies): Temporary cookies are deleted at the latest after a user leaves a website and closes their device (e.g., browser or mobile app).
  • Persistent cookies: Persistent cookies remain stored even after the device is turned off. This allows, for example, the user’s login status to be saved and preferred content to be displayed immediately when the user visits a website again. Likewise, user data collected via cookies may be used for audience measurement. Unless we provide users with explicit information regarding the type and retention period of cookies (e.g., when obtaining consent), they should assume that these cookies are persistent and may be stored for up to two years.

General Information on Withdrawal of Consent and Objection (Opt-out): Usersmay withdraw the consent they have provided at any time and may also object to the processing of their data in accordance with legal requirements, including through their browser’s privacy settings.

  • Types of data processed: metadata, communication data, and transaction data (e.g., IP addresses, timestamps, identification numbers, individuals involved).
  • Data subjects: Users (e.g., website visitors, users of online services).
  • Legal Basis: Legitimate interests (Art. 6(1), first sentence, subparagraph (f) of the GDPR). Consent (Art. 6(1), first sentence, subparagraph (a) of the GDPR).

Additional information on processing procedures, methods, and services:

  • Processing of Cookie Data Based on Consent: We use a consent management solution to obtain users’ consent to the use of cookies or to the procedures and providers specified within the consent management solution. This process is used to obtain, log, manage, and revoke consents, particularly with regard to the use of cookies and similar technologies that are used to store, read, and process information on users’ devices. As part of this process, users’ consent is obtained for the use of cookies and the associated processing of information, including the specific processing activities and providers mentioned in the consent management process. Users also have the option to manage and revoke their consents. The consent declarations are stored to avoid repeated requests and to maintain proof of consent in accordance with legal requirements. Storage takes place on the server and/or in a cookie (a so-called “opt-in cookie”) or via comparable technologies to enable the consent to be assigned to a specific user or their device. Unless specific information regarding the providers of consent management services is available, the following general guidelines apply: Consent is stored for up to two years. A pseudonymous user identifier is created and stored along with the time of consent, details regarding the scope of consent (e.g., relevant categories of cookies and/or service providers), and information about the browser, the system, and the end device used; legal basis: consent (Art. 6(1), first sentence, lit. a) of the GDPR).

Contact and Inquiry Management

When you contact us (e.g., by mail, contact form, email, phone, or social media), as well as in the context of existing user and business relationships, we process the information provided by the individuals making the inquiry to the extent necessary to respond to their inquiries and take any requested actions.

  • Types of data processed: Contact information (e.g., mailing and email addresses or phone numbers); content data (e.g., text or image-based messages and posts, as well as related information, such as details regarding authorship or the time of creation). Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, and individuals involved).
  • Affected individuals: Communication partners.
  • Purposes of processing and legitimate interests: Communication; organizational and administrative procedures; feedback (e.g., collecting feedback via an online form). Providing our online services and ensuring user-friendliness.
  • Retention and Deletion: Deletion in accordance with the information provided in the section “General Information on Data Retention and Deletion.”
  • Legal Basis: Legitimate interests (Art. 6(1), first sentence, subparagraph (f) of the GDPR). Performance of a contract and pre-contractual inquiries (Art. 6(1), first sentence, subparagraph (b) of the GDPR).

Additional information on processing procedures, methods, and services:

  • Contact Form: When you contact us via our contact form, by email, or through other communication channels, we process the personal data you provide to respond to and handle your inquiry. This typically includes information such as your name, contact information, and, if applicable, any additional information you provide that is necessary for us to handle your inquiry appropriately. We use this data exclusively for the stated purpose of establishing contact and communicating; legal bases: performance of a contract and pre-contractual inquiries (Art. 6(1), first sentence, lit. b) GDPR), legitimate interests (Art. 6(1), first sentence, lit. f) GDPR).

Artificial Intelligence (AI)

We use artificial intelligence (AI), which involves the processing of personal data. The specific purposes and our interest in using AI are outlined below. We define AI, in accordance with the term “AI system” as defined in Article 3(1) of the AI Regulation, as a machine-based system designed for operation with varying degrees of autonomy, capable of adapting after its deployment, and producing results—such as predictions, content, recommendations, or decisions—from the inputs it receives, which may affect physical or virtual environments.

Our AI systems are used in strict compliance with legal requirements. These include both specific regulations governing artificial intelligence and data protection requirements. In particular, we adhere to the principles of lawfulness, transparency, fairness, human oversight, purpose limitation, data minimization, integrity, and confidentiality. We ensure that the processing of personal data always has a legal basis. This can be either the consent of the data subjects or a legal authorization.

When using external AI systems, we carefully select their providers (hereinafter “AI providers”). In accordance with our legal obligations, we ensure that the AI providers comply with applicable regulations. We also adhere to our obligations when using or operating the AI services we obtain. The processing of personal data by us and the AI providers is carried out exclusively on the basis of consent or a legal basis. In doing so, we place particular emphasis on transparency, fairness, and maintaining human oversight of AI-supported decision-making processes.

To protect the data we process, we implement appropriate and robust technical and organizational measures. These measures ensure the integrity and confidentiality of the processed data and minimize potential risks. By regularly reviewing AI providers and their services, we ensure ongoing compliance with current legal and ethical standards.

  • Types of Data Processed: Content data (e.g., text-based or image-based messages and posts, as well as related information, such as details regarding authorship or the time of creation). Usage data (e.g., page views and time spent on the site, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and features).
  • Data subjects: Users (e.g., website visitors, users of online services). Third parties.
  • Purposes of processing and legitimate interests: Artificial Intelligence (AI).
  • Retention and Deletion: Deletion in accordance with the information provided in the section “General Information on Data Retention and Deletion.”
  • Legal Basis: Legitimate Interests (Art. 6(1), first sentence, (f) of the GDPR).

Additional information on processing procedures, methods, and services:

Marketing communications via email, mail, fax, or telephone

We process personal data for the purpose of sending promotional communications, which may be sent via various channels—such as email, telephone, mail, or fax—in accordance with legal requirements.

Recipients have the right to revoke their consent at any time or to opt out of promotional communications at any time, free of charge, by using the contact information provided above.

Following revocation or objection, we store the data necessary to prove prior authorization for contacting you or sending you communications for up to three years after the end of the year in which the revocation or objection occurred, based on our legitimate interests. The processing of this data is limited to the purpose of potentially defending against claims. Based on our legitimate interest in permanently honoring users’ revocations or objections, we also store the data necessary to prevent further contact (e.g., depending on the communication channel, the email address, phone number, or name).

  • Types of data processed: Master data (e.g., full name, home address, contact information, customer number, etc.); contact information (e.g., mailing and email addresses or phone numbers); content data (e.g., text or image-based messages and posts, as well as related information such as details regarding authorship or the time of creation).
  • Affected individuals: Communication partners.
  • Purposes of processing and legitimate interests: Direct marketing (e.g., via email or mail); marketing; sales promotion.
  • Retention and Deletion: Deletion in accordance with the information provided in the section “General Information on Data Retention and Deletion.”
  • Legal basis: Consent (Art. 6(1), first sentence, subparagraph (a) of the GDPR). Legitimate interests (Art. 6(1), first sentence, subparagraph (f) of the GDPR).

Web Analytics, Monitoring, and Optimization

Web analytics (also known as “audience measurement”) is used to analyze visitor traffic to our online platform and may include pseudonymized data on visitor behavior, interests, or demographic information—such as age or gender. With the help of audience analysis, we can, for example, determine at what times our online platform, its features, or its content are used most frequently, or encourage repeat visits. It also enables us to identify which areas require optimization.

In addition to web analytics, we can also use testing methods to, for example, test and optimize different versions of our online offering or its components.

Unless otherwise specified below, profiles—that is, data aggregated for a specific usage session—may be created for these purposes, and information may be stored in a browser or on a device and subsequently retrieved. The data collected includes, in particular, websites visited and the features used there, as well as technical information such as the browser used, the computer system used, and details regarding usage times. If users have consented to the collection of their location data by us or by the providers of the services we use, the processing of location data is also possible.

In addition, users’ IP addresses are stored. However, we use an IP masking process (i.e., pseudonymization by truncating the IP address) to protect users. In general, no personally identifiable user data (such as email addresses or names) is stored in the context of web analytics, A/B testing, and optimization; instead, pseudonyms are used. This means that neither we nor the providers of the software we use know the actual identity of the users, but only the information stored in their profiles for the purposes of the respective processes.

Notes on Legal Bases: If we ask users for their consent to the use of third-party providers, the legal basis for data processing is consent. Otherwise, user data is processed based on our legitimate interests (i.e., our interest in providing efficient, cost-effective, and user-friendly services). In this context, we would also like to draw your attention to the information regarding the use of cookies in this Privacy Policy.

  • Types of Data Processed: Usage data (e.g., page views and time spent on the site, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and features). Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, individuals involved).
  • Data subjects: Users (e.g., website visitors, users of online services).
  • Purposes of processing and legitimate interests: Audience measurement (e.g., traffic statistics, identification of returning visitors); profiles containing user-related information (creation of user profiles). Provision of our online services and user-friendliness.
  • Retention and Deletion: Deletion in accordance with the information provided in the section “General Information on Data Storage and Deletion.” Cookies may be stored for up to 2 years (Unless otherwise specified, cookies and similar storage methods may be stored on users’ devices for a period of two years.).
  • Security measures: IP masking (pseudonymization of the IP address).
  • Legal basis: Consent (Art. 6(1), first sentence, subparagraph (a) of the GDPR). Legitimate interests (Art. 6(1), first sentence, subparagraph (f) of the GDPR).

Additional information on processing procedures, methods, and services:

  • Google Analytics: We use Google Analytics to measure and analyze the use of our online service based on a pseudonymous user identification number. This identification number does not contain any unique data, such as names or email addresses. It is used to associate analytical information with a device in order to determine which content users have accessed during one or more sessions, which search terms they have used, whether they have revisited that content, or how they have interacted with our online service. The time and duration of use are also stored, as well as the sources from which users were referred to our online service and technical details about their devices and browsers.
    In doing so, pseudonymous user profiles are created using information from the use of various devices, and cookies may be used for this purpose. Google Analytics does not log or store individual IP addresses for EU users. However, Analytics provides approximate geographic location data by deriving the following metadata from IP addresses: city (and the derived latitude and longitude of the city), continent, country, region, subcontinent (and ID-based equivalents). For EU data traffic, IP address data is used exclusively for this derivation of geolocation data before being immediately deleted. It is not logged, is not accessible, and is not used for any other purposes. When Google Analytics collects measurement data, all IP queries are performed on EU-based servers before the traffic is forwarded to Analytics servers for processing; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; legal basis: consent (Art. 6(1)(a) GDPR); Website:https://marketingplatform.google.com/intl/de/about/analytics/; Security measures: IP masking (pseudonymization of the IP address); Privacy policy:https://business.safety.google/privacy/; Data processing agreement:https://business.safety.google/adsprocessorterms/; Legal basis for transfers to third countries: EU/EEA – Data Privacy Framework (DPF), Standard Contractual Clauses (https://business.safety.google/adsprocessorterms), Switzerland – Data Privacy Framework (DPF), Standard Contractual Clauses ( https://business.safety.google/adsprocessorterms); Right to object (opt-out): Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de, settings for displaying ads: https://myadcenter.google.com/personalizationoff. Further information:https://business.safety.google/adsservices/ (types of processing and data processed).
  • Google Tag Manager: We use Google Tag Manager, a software tool from Google that allows us to centrally manage so-called website tags via a user interface. Tags are small pieces of code on our website that are used to track and analyze visitor activity. This technology helps us improve our website and the content offered on it. Google Tag Manager itself does not create user profiles, does not store cookies containing user profiles, and does not perform any independent analyses. Its function is limited to simplifying and streamlining the integration and management of the tools and services we use on our website. Nevertheless, when Google Tag Manager is used, users’ IP addresses are transmitted to Google, which is necessary for technical reasons to implement the services we use. Cookies may also be set in the process. However, this data processing occurs only when services are integrated via Tag Manager. For more detailed information about these services and their data processing, please refer to the relevant sections of this Privacy Policy; Service Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal Basis: Consent (Art. 6(1)(a) GDPR); Website:https://marketingplatform.google.com; Privacy Policy:https://business.safety.google/privacy/; Data Processing Agreement:
    https://business.safety.google/adsprocessorterms. Basis for transfers to third countries: EU/EEA – Data Privacy Framework (DPF), Standard Contractual Clauses (https://business.safety.google/adsprocessorterms); Switzerland – Data Privacy Framework (DPF), Standard Contractual Clauses ( https://business.safety.google/adsprocessorterms).
  • Matomo (without cookies): Matomo is a privacy-friendly web analytics software that operates without cookies and identifies returning users using a so-called “digital fingerprint,” which is stored anonymously and updated every 24 hours; With the “digital fingerprint,” user activity within our online platform is tracked using pseudonymized IP addresses in combination with the user’s browser settings in such a way that it is not possible to identify individual users. The user data collected through the use of Matomo is processed only by us and is not shared with third parties; Legal basis: Legitimate interests (Art. 6(1), sentence 1, lit. f) GDPR); Website:https://matomo.org/; Security measures: IP masking (pseudonymization of the IP address).

Online Marketing

We process personal data for the purpose of online marketing, which may include, in particular, the marketing of advertising space or the display of promotional and other content (collectively referred to as “content”) based on users’ potential interests, as well as the measurement of its effectiveness.

For these purposes, so-called user profiles are created and stored in a file (known as a “cookie”), or similar methods are used to store user information relevant to the display of the aforementioned content. This may include, for example, content viewed, websites visited, online networks used, as well as communication partners and technical details such as the browser and computer system used, along with information on usage times and features used. If users have consented to the collection of their location data, this data may also be processed.

In addition, users’ IP addresses are stored. However, we use available IP masking methods (i.e., pseudonymization by truncating the IP address) to protect users. In general, as part of the online marketing process, no plaintext user data (such as email addresses or names) is stored; instead, pseudonyms are used. This means that neither we nor the providers of the online marketing services know the users’ actual identities, but only the information stored in their profiles.

The information contained in the profiles is typically stored in cookies or using similar methods. These cookies can generally be read later on other websites that use the same online marketing method; they can be analyzed for the purpose of displaying content, supplemented with additional data, and stored on the server of the online marketing provider.

In exceptional cases, it is possible to associate personal data with user profiles, particularly when users are, for example, members of a social network whose online marketing methods we use and the network links user profiles to the aforementioned information. Please note that users may enter into additional agreements with these providers, such as by providing consent during registration.

As a general rule, we only have access to aggregated information about the performance of our advertisements. However, through what is known as conversion tracking, we can determine which of our online marketing methods have led to a so-called conversion—for example, the signing of a contract with us. Conversion tracking is used solely to analyze the effectiveness of our marketing efforts.

Unless otherwise specified, please assume that cookies used on this site will be stored for a period of two years.

Notes on Legal Bases: When we ask users for their consent to the use of third-party providers, the legal basis for data processing is that consent. Otherwise, user data is processed based on our legitimate interests (i.e., our interest in providing efficient, cost-effective, and user-friendly services). In this context, we would also like to draw your attention to the information regarding the use of cookies in this Privacy Policy.

Information on Revocation and Objection:

Please refer to the privacy policies of the respective providers and the opt-out options specified for those providers. If no explicit opt-out option is provided, you have the option of disabling cookies in your browser settings. However, doing so may limit the functionality of our website. We therefore also recommend the following opt-out options, which are summarized and organized by category:

a) Europe: https://youronlinechoices.eu/.

b) Canada: https://youradchoices.ca/.

c) United States: https://optout.aboutads.info/.

d) Cross-regional: https://optout.aboutads.info.

  • Types of Data Processed: Usage data (e.g., page views and time spent on the site, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and features). Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, individuals involved).
  • Data subjects: Users (e.g., website visitors, users of online services).
  • Purposes of processing and legitimate interests: Audience measurement (e.g., traffic statistics, identification of returning visitors); tracking (e.g., interest-based/behavioral profiling, use of cookies); target audience segmentation; marketing; profiles containing user-related information (creation of user profiles); Conversion tracking (measuring the effectiveness of marketing measures); remarketing; provision of our online services and user-friendliness; click tracking.
  • Retention and Deletion: Deletion in accordance with the information provided in the section “General Information on Data Storage and Deletion.” Cookies may be stored for up to 2 years (Unless otherwise specified, cookies and similar storage methods may be stored on users’ devices for a period of two years.).
  • Security measures: IP masking (pseudonymization of the IP address).
  • Legal basis: Consent (Art. 6(1), first sentence, subparagraph (a) of the GDPR). Legitimate interests (Art. 6(1), first sentence, subparagraph (f) of the GDPR).

Additional information on processing procedures, methods, and services:

  • Google Ads and Conversion Tracking: Online marketing methods used to place content and ads within the service provider’s advertising network (e.g., in search results, in videos, on websites, etc.) so that they are displayed to users who are likely to be interested in the ads. In addition, we measure the conversion of the ads, i.e., whether users have been prompted to interact with the ads and take advantage of the advertised offers (so-called conversions). However, we only receive anonymous information and no personal information about individual users; Service Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Art. 6(1)(a) GDPR), Legitimate Interests (Art. 6(1)(f) GDPR); Website:https://marketingplatform.google.com; Privacy Policy:https://business.safety.google/privacy/; Basis for transfers to third countries: EU/EEA – Data Privacy Framework (DPF), Switzerland – Data Privacy Framework (DPF); Further information: Types of processing and data processed: https://business.safety.google/adsservices/. Data processing terms between controllers and standard contractual clauses for data transfers to third countries: https://business.safety.google/adscontrollerterms.
  • Google Ads Remarketing: Google Remarketing, also known as retargeting, is a technology that adds users who use an online service to a pseudonymous remarketing list, so that ads can be displayed to users on other online platforms based on their visit to the online service; Service Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal Basis: Consent (Art. 6(1)(a) GDPR); Website:https://marketingplatform.google.com; Privacy Policy:https://business.safety.google/privacy/; Basis for Transfers to Third Countries: EU/EEA – Data Privacy Framework (DPF), Switzerland – Data Privacy Framework (DPF); Further information: Types of processing and data processed: https://business.safety.google/adsservices/. Data processing terms between controllers and standard contractual clauses for data transfers to third countries: https://business.safety.google/adscontrollerterms.
  • Enhanced Conversions for Google Ads: When users click on our Google ads and subsequently use the advertised service (known as a “conversion”), the data entered by the user—such as their email address, name, home address, or phone number—may be transmitted to Google. The hash values are then matched with users’ existing Google accounts to better evaluate and improve users’ interactions with the ads (e.g., clicks or views) and, consequently, their performance; Legal basis: Consent (Art. 6(1)(a) GDPR). Website:https://support.google.com/google-ads/answer/9888656.
  • UTM Parameters: Analysis of sources and user actions based on an extension of web addresses that link to us with an additional parameter, the "UTM" parameter. For example, a UTM parameter such as "utm_source=platformX&utm_medium=video" tells us that a person clicked on the link on Platform X within a video. The UTM parameters provide information about the source of the link, the medium used (e.g., social media, website, newsletter), the type of campaign, or the content of the campaign (e.g., post, link, image, and video). Using this information, we can, for example, assess our online visibility or the effectiveness of our campaigns; Legal basis: Legitimate interests (Art. 6(1), first sentence, lit. f) of the GDPR).

Social Media Presence

We maintain online presences on social media platforms and, in this context, process user data in order to communicate with users active on those platforms or to provide information about us.

Please note that user data may be processed outside the European Union in this context. This may pose risks to users, as it could, for example, make it more difficult to enforce their rights.

Furthermore, user data within social networks is generally processed for market research and advertising purposes. For example, user profiles can be created based on users’ behavior and the resulting interests. These profiles may in turn be used, for instance, to display advertisements both within and outside the networks that are presumed to correspond to the users’ interests. For this reason, cookies are typically stored on users’ computers to record their usage behavior and interests. In addition, data may also be stored in these user profiles regardless of the devices used by the users (particularly if they are members of the respective platforms and are logged in there).

For a detailed description of the specific ways in which your data is processed and your options for opting out, please refer to the privacy policies and information provided by the operators of the respective networks.

We would also like to point out that requests for information and the exercise of data subject rights are most effectively handled by the service providers themselves. Only they have access to the user data and can take appropriate action and provide information directly. If you still need assistance, however, you can contact us.

  • Types of data processed: Contact information (e.g., mailing and email addresses or phone numbers); Content data (e.g., text or image-based messages and posts, as well as related information such as details regarding authorship or the time of creation); Usage data (e.g., page views and time spent on the site, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and features).
  • Data subjects: Users (e.g., website visitors, users of online services).
  • Purposes of processing and legitimate interests: Communication; feedback (e.g., collecting feedback via an online form). Public relations.
  • Retention and Deletion: Deletion in accordance with the information provided in the section “General Information on Data Retention and Deletion.”
  • Legal Basis: Legitimate Interests (Art. 6(1), first sentence, (f) of the GDPR).

Additional information on processing procedures, methods, and services:

  • Instagram: Social network that allows users to share photos and videos, comment on and like posts, send messages, and follow profiles and pages; Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal basis: Legitimate interests (Art. 6(1), first sentence, lit. f) GDPR); Website:https://www.instagram.com; Privacy Policy:https://privacycenter.instagram.com/policy/. Basis for transfers to third countries: EU/EEA – Data Privacy Framework (DPF), Switzerland – Data Privacy Framework (DPF).
  • Facebook Pages: Profiles within the Facebook social network—We are jointly responsible with Meta Platforms Ireland Limited for the collection and transmission of data from visitors to our Facebook page (“Fan Page”). This includes, in particular, information about user behavior (e.g., content viewed or interacted with, actions taken) as well as device information (e.g., IP address, operating system, browser type, language settings, cookie data). Further details can be found in Facebook’s Data Policy: https://www.facebook.com/privacy/policy/. Facebook also uses this data to provide us with statistical analyses via the “Page Insights” service, which provide information on how people interact with our page and its content. This is based on an agreement with Facebook (“Information about Page Insights”: https://www.facebook.com/legal/terms/page_controller_addendum), which governs, among other things, security measures and the exercise of data subjects’ rights. Further information can be found here: https://www.facebook.com/legal/terms/information_about_page_insights_data. Users may therefore direct requests for access or deletion directly to Facebook. Users’ rights (in particular the right to access, erasure, objection, and filing a complaint with a supervisory authority) remain unaffected by this. Joint responsibility is limited exclusively to the collection of data by Meta Platforms Ireland Limited (EU). Meta Platforms Ireland Limited is solely responsible for further processing, including any potential transfer to Meta Platforms Inc. in the U.S.; Service Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal Basis: Legitimate Interests (Art. 6(1)(f) GDPR); Website:https://www.facebook.com; Privacy Policy:https://www.facebook.com/privacy/policy/. Basis for transfers to third countries: EU/EEA – Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.facebook.com/legal/EU_data_transfer_addendum); Switzerland – Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.facebook.com/legal/EU_data_transfer_addendum).
  • Facebook Events: Event profiles within the Facebook social network—We use the “Events” feature on the Facebook platform to publicize events and dates, to connect with users (participants and interested parties), and to exchange information. In doing so, we process the personal data of users of our event pages to the extent necessary for the purpose of the event page and its moderation. This data includes first and last names, as well as content that has been published or shared privately, information regarding participation status, and the timestamps associated with the aforementioned data. Furthermore, we draw your attention to the processing of user data by Facebook itself. This data includes information about the types of content users view or interact with, or the actions they take (see “Things You and Others Do and Share” in the Facebook Data Policy: https://www.facebook.com/privacy/policy/), as well as information about the devices users use (e.g., IP addresses, operating system, browser type, language settings, cookie data; see “Device Information” in the Facebook Data Policy: https://www.facebook.com/privacy/policy/). As explained in the Facebook Data Policy under “How do we use this information?”, Facebook also collects and uses information to provide analytics services, known as “Insights,” to event organizers so that they can gain insights into how people interact with their event pages and the content associated with them; Service Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal Basis: Legitimate Interests (Art. 6(1)(f) GDPR); Website:https://www.facebook.com; Privacy Policy:https://www.facebook.com/privacy/policy/. Basis for transfers to third countries: EU/EEA – Data Privacy Framework (DPF), Switzerland – Data Privacy Framework (DPF).

Plug-ins, embedded features, and content

We incorporate functional and content elements into our online offering that are sourced from the servers of their respective providers (hereinafter referred to as “third-party providers”). These may include, for example, graphics, videos, or city maps (hereinafter collectively referred to as “content”).

This integration always requires that the third-party providers of this content process users’ IP addresses, since they would not be able to send the content to users’ browsers without an IP address. The IP address is therefore necessary for displaying this content or these functions. We make every effort to use only content whose respective providers use the IP address solely for the purpose of delivering the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. These “pixel tags” allow information—such as visitor traffic on the pages of this website—to be analyzed. This pseudonymous information may also be stored in cookies on the user’s device and may include, among other things, technical details about the browser and operating system, referring websites, the time of the visit, and other information regarding the use of our online service; it may also be linked to such information from other sources.

Notes on Legal Bases: If we ask users for their consent to the use of third-party providers, the legal basis for data processing is that consent. Otherwise, user data is processed based on our legitimate interests (i.e., our interest in providing efficient, cost-effective, and user-friendly services). In this context, we would also like to draw your attention to the information regarding the use of cookies in this Privacy Policy.

  • Types of data processed: Usage data (e.g., page views and time spent on the site, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and features); Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, individuals involved). Location data (information regarding the geographic location of a device or a person).
  • Data subjects: Users (e.g., website visitors, users of online services).
  • Purposes of processing and legitimate interests: Providing our online services and ensuring user-friendliness. Providing contractual services and fulfilling contractual obligations.
  • Retention and Deletion: Deletion in accordance with the information provided in the section “General Information on Data Storage and Deletion.” Cookies may be stored for up to 2 years (Unless otherwise specified, cookies and similar storage methods may be stored on users’ devices for a period of two years.).
  • Legal basis: Consent (Art. 6(1), first sentence, subparagraph (a) of the GDPR). Legitimate interests (Art. 6(1), first sentence, subparagraph (f) of the GDPR).

Additional information on processing procedures, methods, and services:

  • Integration of third-party software, scripts, or frameworks (e.g., jQuery): We integrate software into our online service that we retrieve from servers operated by other providers (e.g., function libraries that we use to enhance the presentation or user-friendliness of our online service). In doing so, the respective providers collect users’ IP addresses and may process them for the purpose of transmitting the software to users’ browsers, for security purposes, and for the evaluation and optimization of their services. - We integrate software into our online service that we retrieve from servers operated by third-party providers (e.g., function libraries that we use to enhance the presentation or user-friendliness of our online service). In doing so, the respective providers collect users’ IP addresses and may process them for the purpose of transmitting the software to the user’s browser, for security purposes, and for the evaluation and optimization of their services; legal basis: legitimate interests (Art. 6(1), sentence 1, lit. f) of the GDPR).
  • Google Fonts (hosted on our own server): Provision of font files to ensure a user-friendly display of our online content; Service provider: Google Fonts are hosted on our server; no data is transmitted to Google; Legal basis: Legitimate interests (Art. 6(1)(1)(f) of the GDPR).
  • Google Maps: We integrate maps from the “Google Maps” service provided by Google. The data processed may include, in particular, users’ IP addresses and location data; Service provider: Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland; Legal basis: Consent (Art. 6(1)(a) GDPR); Website:https://mapsplatform.google.com/; Privacy Policy:https://business.safety.google/privacy/. Basis for transfers to third countries: EU/EEA – Data Privacy Framework (DPF), Switzerland – Data Privacy Framework (DPF).
  • reCAPTCHA: We integrate the "reCAPTCHA" feature to determine whether entries (e.g., in online forms) are made by humans and not by automated machines (so-called "bots"). The data processed may include IP addresses, information about operating systems, devices, or browsers used, language settings, location, mouse movements, keystrokes, time spent on web pages, previously visited web pages, interactions with reCAPTCHA on other websites, cookies in some cases, and results of manual verification processes (e.g., answering questions or selecting objects in images). Data processing is based on our legitimate interest in protecting our online service from abusive automated crawling and spam; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Art. 6(1)(1)(f) GDPR); Website:https://cloud.google.com/security/products/recaptcha; Privacy Policy:https://business.safety.google/privacy/; Data Processing Agreement:https://cloud.google.com/terms/data-processing-addendum. Basis for transfers to third countries: EU/EEA – Data Privacy Framework (DPF), Standard Contractual Clauses (https://cloud.google.com/terms/sccs/eu-c2p); Switzerland – Data Privacy Framework (DPF), Standard Contractual Clauses (https://cloud.google.com/terms/sccs/eu-c2p).
  • Weglot: Automated AI translation of website content; Service provider: 7 Cité Paradis,
    , 75010 Paris, France; Website:https://www.weglot.com/. Privacy Policy:https://www.weglot.com/privacy.

Processing of Data in the Context of Employment Relationships

In the context of employment relationships, personal data is processed for the purpose of effectively establishing, administering, and terminating such relationships. This data processing supports various operational and administrative functions necessary for managing employee relationships.

Data processing encompasses various aspects, ranging from the initiation of a contract to its termination. This includes the organization and administration of daily work schedules, the management of access rights and permissions, as well as the handling of employee development initiatives and performance reviews. The processing also serves to calculate and administer wage and salary payments, which are critical aspects of contract execution.

In addition, data processing takes into account the legitimate interests of the employer, such as ensuring workplace safety or collecting performance data to evaluate and optimize operational processes. Furthermore, data processing includes the disclosure of employee data as part of external communication and publication processes, where required for operational or legal purposes.

This data is always processed in accordance with the applicable legal framework, with the goal of creating and maintaining a fair and efficient work environment. This also includes safeguarding the privacy of the employees concerned, as well as anonymizing or deleting data once the purpose of processing has been fulfilled or in accordance with statutory retention periods.

  • Types of Data Processed: Employee data (information about employees and other individuals in an employment relationship); Payment data (e.g., bank account information, invoices, payment history); Contract data (e.g., subject matter of the contract, term, customer category); Master data (e.g., full name, residential address, contact information, customer number, etc.); Contact data (e.g., mailing and email addresses or phone numbers); Content data (e.g., text or image-based messages and posts, as well as related information, such as details regarding authorship or the time of creation); Social data (data subject to social confidentiality and processed, for example, by social insurance agencies, social assistance agencies, or pension authorities); Log data (e.g., log files regarding logins, data retrieval, or access times); Performance and behavioral data (e.g., performance and behavioral aspects such as performance evaluations, feedback from supervisors, training participation, compliance with company policies, self-assessments, and behavioral evaluations); Work time data (e.g., start of work, end of work, actual work time, scheduled work time, break times, overtime, vacation days, special leave days, sick days, absences, work-from-home days, business trips); Salary data (e.g., base salary, bonus payments, incentives, tax bracket information, night shift/overtime premiums, tax deductions, social security contributions, net pay); Usage data (e.g., page views and time spent on pages, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and features); Image and/or video recordings (e.g., photographs or video recordings of a person). Meta, communication, and transaction data (e.g., IP addresses, timestamps, identification numbers, individuals involved).
  • Special categories of personal data: Health data; religious or philosophical beliefs; union membership.
  • Data subjects: Employees (e.g., staff members, job applicants, temporary workers, and other personnel). Business and contractual partners.
  • Purposes of processing and legitimate interests: Establishment and administration of employment relationships (processing of employee data in connection with the establishment and administration of employment relationships); business processes and operational procedures; provision of contractual services and fulfillment of contractual obligations; office and organizational procedures; public relations; security measures.
  • Legal basis: Performance of a contract and pre-contractual inquiries (Art. 6(1), sentence 1, subparagraph (b) of the GDPR); Legal obligation (Art. 6(1), sentence 1, subparagraph (c) of the GDPR); Legitimate interests (Art. 6(1), sentence 1, subparagraph (f) of the GDPR). Processing of special categories of personal data relating to health, employment, and social security (Art. 9(2)(h) of the GDPR).

Additional information on processing procedures, methods, and services:

  • Time Tracking: Methods for tracking employees’ working hours include both manual and automated approaches, such as the use of time clocks, time-tracking software, or mobile apps. This involves activities such as entering arrival and departure times, break times, overtime, and absences. Verification and validation of recorded working hours include cross-checking with work schedules or shift schedules, reviewing absences, and approval of overtime by supervisors. Reports and analyses are generated based on the recorded working hours to provide timesheets, overtime reports, and absence statistics for management and the human resources department; Legal basis: Performance of a contract and pre-contractual inquiries (Art. 6(1), sentence 1, lit. b) GDPR), legitimate interests (Art. 6(1), sentence 1, lit. f) GDPR).
  • Access Management: Procedures required for defining, managing, and controlling access rights and user roles within a system or organization (e.g., creation of access profiles, role- and access-based control, review and approval of access requests, periodic review of access rights, tracking and auditing of user activities, creation of security policies and procedures); Legal Bases: Performance of a contract and pre-contractual inquiries (Art. 6(1), first sentence, letter b) of the GDPR), legal obligation (Art. 6(1), first sentence, letter c) of the GDPR), legitimate interests (Art. 6(1), first sentence, letter f) of the GDPR).
  • Special Categories of Personal Data: Special categories of personal data are processed in connection with the employment relationship or to fulfill legal obligations. The special categories of personal data processed include data concerning employees’ health, union membership, or religious affiliation. This data may, for example, be disclosed to health insurance providers or processed to assess employees’ fitness for work, for occupational health management, or for reporting to the tax authorities; Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1), first sentence, lit. b) GDPR), legal obligation (Art. 6(1), first sentence, lit. c) GDPR), legitimate interests (Art. 6(1), first sentence, lit. f) GDPR).
  • Sources of the processed data: Personal data obtained in connection with employees’ job applications and/or employment relationships is processed. In addition, where required by law, personal data is collected from other sources. These may include tax authorities for tax-related information, the respective health insurance provider for information regarding incapacity to work, third parties such as employment agencies, or publicly accessible sources such as professional social networks in the context of application processes; Legal bases: Legal obligation (Art. 6(1), first sentence, lit. c) of the GDPR), legitimate interests (Art. 6(1), first sentence, lit. f) of the GDPR).
  • Purposes of Data Processing: Employees’ personal data is primarily processed for the establishment, execution, and termination of the employment relationship. In addition, the processing of this data is necessary to comply with legal obligations under tax and social security law. In addition to these primary purposes, employees’ data is also used to comply with regulatory and supervisory requirements, to optimize electronic data processing procedures, and to compile internal or cross-company data, which may include statistical data. Furthermore, employees’ data may be processed to assert legal claims and to defend against legal disputes; Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1), first sentence, lit. b) GDPR), Legal obligation (Art. 6(1), first sentence, lit. c) GDPR), Legitimate interests (Art. 6(1), first sentence, lit. f) GDPR).
  • Transfer of Employee Data: Employee data is processed internally only by those departments that require it to fulfill operational, contractual, and legal obligations.
    Data is disclosed to external recipients only if required by law or if the affected employees have given their consent. Possible scenarios for this include requests for information from government authorities or in the case of asset-building benefits. Furthermore, the data controller may transfer personal data to other recipients to the extent necessary to fulfill its contractual and legal obligations as an employer. These recipients may include: a) Banks b) Health insurance providers, pension insurance providers, retirement plan providers, and other social insurance providers c) Government agencies, courts (e.g., tax authorities, labor courts, and other regulatory authorities in connection with the fulfillment of reporting and disclosure obligations) d) tax and legal advisors e) third-party debtors in the event of wage and salary garnishments f) other entities to which legally required disclosures must be made.
    In addition, data may be disclosed to third parties if this is necessary for communication with business partners, suppliers, or other service providers. Examples include information in the “From” field of emails or letterhead, as well as the creation of profiles on external platforms; Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1), sentence 1, lit. b) GDPR), Legitimate interests (Art. 6(1), sentence 1, lit. f) GDPR).
  • Transfer of Employee Data to Third Countries: Employee data is transferred to third countries—that is, countries outside the European Union (EU) and the European Economic Area (EEA)—only if such transfer is necessary for the fulfillment of the employment relationship, is required by law, or if employees have given their consent. Employees will be informed separately of the details, to the extent required by law; legal basis: legitimate interests (Art. 6(1), sentence 1, lit. f) of the GDPR).
  • Business Travel and Travel Expense Reporting: Procedures required for the planning, execution, and settlement of business trips (e.g., booking travel, arranging accommodations and transportation, managing travel expense advances, submitting and reviewing travel expense reports, verifying and posting incurred expenses, complying with travel policies, and handling travel expense management); Legal Basis: Performance of a contract and pre-contractual inquiries (Art. 6(1), sentence 1, letter b) of the GDPR), legal obligation (Art. 6(1), sentence 1, letter c) of the GDPR), legitimate interests (Art. 6(1), sentence 1, letter f) of the GDPR).
  • Payroll Processing and Payroll Accounting: Processes required for the calculation, payment, and documentation of employees’ wages, salaries, and other compensation (e.g., recording working hours, calculating deductions and premiums, remitting taxes and social security contributions, preparing payroll statements, maintaining payroll accounts, and reporting to tax authorities and social security agencies); Legal Basis: Performance of a contract and pre-contractual inquiries (Art. 6(1), sentence 1, lit. b) GDPR), legal obligation (Art. 6(1), sentence 1, lit. c) GDPR).

  • Deletion of Employee Data: Under German law, employee data is deleted when it is no longer necessary for the purpose for which it was collected, unless it must be retained or archived due to legal obligations or the employer’s interests. In this regard, the following retention and archiving requirements are observed:

    • General Personnel Records - General personnel records (such as employment contracts, employment references, and supplementary agreements) are retained for up to three years after the termination of the employment relationship (Section 195 of the German Civil Code (BGB)).
      Tax-Related Documents - Tax-related documents in the personnel file are retained for six years (Section 147 of the German Fiscal Code (AO), Section 257 of the German Commercial Code (HGB)).
      Information on Wages and Working Hours - Information on wages and working hours for individuals covered by (accident) insurance, along with proof of wages, is retained for five years (Section 165(1)(1), (4)(2) of Book VII of the Social Code (SGB VII)).
    • Payroll records, including lists of special payments—Payroll records, including lists of special payments, provided that an accounting document exists, must be retained for ten years (Section 147 of the German Fiscal Code (AO), Section 257 of the German Commercial Code (HGB)).
    • Payroll records for interim, final, and special payments—Payroll records for interim, final, and special payments must be retained for six years (Section 147 of the German Fiscal Code (AO), Section 257 of the German Commercial Code (HGB)).
    • Documents Related to Employee Insurance - Documents related to employee insurance, provided that supporting accounting records exist, must be retained for ten years (Section 147 of the German Fiscal Code (AO), Section 257 of the German Commercial Code (HGB)).
    • Social Security Contribution Statements - Social Security contribution statements must be retained for ten years (Section 165 of Book VII of the Social Code).
      Payroll Records - Payroll records must be retained for six years (Section 41(1)(9) of the Income Tax Act).
    • Applicant data—Is retained for a maximum of six months from the date the rejection notice is received.
    • Time records (for workdays exceeding 8 hours) — Are retained for two years (Section 16(2) of the Working Hours Act (ArbZG)).
    • Job application materials (in response to an online job posting) — Retained for three to a maximum of six months after receipt of the rejection notice (Section 26
    • Federal Data Protection Act (BDSG), as amended, § 15(IV) of the General Equal Treatment Act (AGG)).
    • Certificates of Incapacity for Work (AU) — Are retained for up to five years (Section 6(1) of the Expense Reimbursement Act (AAG)).
    • Documents related to employer-sponsored retirement plans—are retained for 30 years (Section 18a of the Act on the Improvement of Employer-Sponsored Retirement Plans (BetrAVG)).
    • Employee medical records—Are retained for twelve months after the onset of the illness if absences do not exceed six weeks in a year.
    • Documents related to maternity leave—are retained for two years (Section 27(5) of the Maternity Leave Act).

    Legal Basis: Performance of a contract and pre-contractual inquiries (Art. 6(1), first sentence, lit. b) GDPR), Legal obligation (Art. 6(1), first sentence, lit. c) GDPR), Legitimate interests (Art. 6(1), first sentence, (f) of the GDPR), processing of special categories of personal data relating to health, employment, and social security (Art. 9(2)(h) of the GDPR).

  • Personnel Record Management: Procedures required for the organization, updating, and administration of employee data and documents (e.g., recording employee master data, retaining employment contracts, references, and certificates, updating data in the event of changes, compiling documents for performance reviews, archiving personnel files, complying with data protection regulations); Legal Bases: Performance of a contract and pre-contractual inquiries (Art. 6(1), sentence 1, subparagraph b) of the GDPR), legal obligation (Art. 6(1), sentence 1, subparagraph c) of the GDPR), Legitimate interests (Art. 6(1), first sentence, lit. f) GDPR), processing of special categories of personal data relating to health, employment, and social security (Art. 9(2), lit. h) GDPR).
  • Human Resources Development, Performance Evaluation, and Employee Reviews: Procedures required for the promotion and professional development of employees, as well as for the assessment of their performance and in the context of employee reviews (e.g., needs analysis for continuing education, planning and conducting training programs, preparing performance evaluations, conducting goal-setting and feedback meetings, career planning and talent management, succession planning); Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1), first sentence, lit. b) GDPR), legal obligation (Art. 6(1), first sentence, lit. c) GDPR), Legitimate interests (Art. 6(1), first sentence, lit. f) of the GDPR), processing of special categories of personal data relating to health, employment, and social security (Art. 9(2), lit. h) of the GDPR).
  • Obligation to Provide Data: The data controller informs employees that the provision of their data is required. This is generally the case when the data is necessary for the establishment and performance of the employment relationship or when its collection is required by law. The provision of data may also be required when employees assert claims or are entitled to claims. The implementation of these measures or the fulfillment of obligations depends on the provision of this data (for example, providing data for the purpose of receiving wages); Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1), sentence 1, lit. b) GDPR), legal obligation (Art. 6(1), sentence 1, lit. c) GDPR), legitimate interests (Art. 6(1), sentence 1, lit. f) GDPR).
  • Publication and Disclosure of Employee Data: Employee data will only be published or disclosed to third parties if this is necessary for the performance of work duties in accordance with the employment contract. This applies, for example, when employees are named as points of contact in correspondence, on the website, or in public registries—as agreed upon or as specified in their job descriptions—or when their responsibilities include representative functions. This may also be the case when, as part of performing their duties, employees appear in or communicate with the public, such as in photographs taken as part of public relations activities. Otherwise, employee data is published only with their consent or on the basis of the employer’s legitimate interests, for example, in the case of stage or group photographs taken during a public event; Legal basis: Performance of a contract and pre-contractual inquiries (Art. 6(1), sentence 1, lit. b) GDPR), Legitimate interests (Art. 6(1), sentence 1, lit. f) GDPR).

Application Process

The application process requires applicants to provide us with the information necessary for their evaluation and selection. The information required is specified in the job description or, in the case of online forms, in the instructions provided there.

Generally, the required information includes personal details such as your name, address, and contact information, as well as proof of the qualifications necessary for the position. Upon request, we are also happy to provide additional details on what information is needed.

If available, applicants are welcome to submit their applications via our online form, which is encrypted using state-of-the-art technology. Alternatively, you may also send your application to us by email. However, we would like to point out that emails are generally not encrypted when sent over the Internet. Although emails are usually encrypted during transmission, this encryption does not occur on the servers from which they are sent and received. Therefore, we cannot assume any responsibility for the security of the application during its transmission between the sender and our server.

For the purposes of searching for candidates, submitting applications, and selecting candidates, we may use applicant tracking and recruitment software, as well as third-party platforms and services, in accordance with applicable legal requirements.

Applicants are welcome to contact us regarding how to submit their application or to send their application to us by mail.

Processing of Special Categories of Data: To the extent that, as part of the application process, special categories of personal data (Art. 9(1) GDPR, e.g., health data, such as severe disability status or ethnic origin) are requested from applicants or provided by them as part of the application process, such data is processed to enable the controller or the data subject to exercise the rights and fulfill the obligations arising under labor law and the law on social security and social protection, in the case of the protection of the vital interests of applicants or other individuals, or for purposes of preventive healthcare or occupational medicine, for the assessment of an employee’s fitness for work, for medical diagnosis, for care or treatment in the health or social sector, or for the administration of systems and services in the health or social sector.

Deletion of Data: The data provided by applicants may be further processed by us for the purposes of the employment relationship in the event of a successful application. Otherwise, if the application for a job opening is unsuccessful, the applicants’ data will be deleted. Applicants’ data will also be deleted if an application is withdrawn, which applicants are entitled to do at any time. Subject to a valid revocation by the applicant, the data will be deleted no later than six months after the application is submitted, so that we can answer any follow-up questions regarding the application and fulfill our record-keeping obligations under the regulations on equal treatment of applicants. Invoices for any travel expense reimbursements will be archived in accordance with tax regulations.

Inclusion in a Candidate Pool: Inclusion in a candidate pool, if offered, is based on consent. Candidates are informed that their consent to be included in the talent pool is voluntary, has no impact on the ongoing application process, and that they may withdraw their consent at any time with future effect.

  • Types of data processed: Master data (e.g., full name, home address, contact information, customer number, etc.); contact information (e.g., mailing and email addresses or phone numbers); content data (e.g., text or image-based messages and posts, as well as related information such as details regarding authorship or the time of creation). Applicant data (e.g., personal details, mailing and contact addresses, documents submitted with the application, and the information contained therein, such as cover letters, resumes, certificates, as well as other information regarding a specific position or voluntarily provided by applicants about their personal background or qualifications).
  • Individuals affected: Job applicants.
  • Purposes of processing and legitimate interests: Hiring process (evaluation and any subsequent implementation, as well as possible future termination of the employment relationship).
  • Retention and Deletion: Deletion in accordance with the information provided in the section “General Information on Data Retention and Deletion.”
  • Legal Basis: The application process as a pre-contractual or contractual relationship (Art. 6(1), first sentence, subparagraph (b) of the GDPR).

Changes and Updates

We ask that you review the content of our Privacy Policy on a regular basis. We will update the Privacy Policy as soon as changes to our data processing practices make it necessary to do so. We will notify you as soon as the changes require action on your part (e.g., consent) or any other individual notification.

If we provide addresses and contact information for companies and organizations in this Privacy Policy, please note that these addresses may change over time, and we ask that you verify the information before contacting them.

Definitions of Terms

This section provides an overview of the terms used in this Privacy Policy. To the extent that these terms are defined by law, their legal definitions apply. The explanations below, however, are intended primarily to aid understanding.

  • Affiliate Tracking: As part of affiliate tracking, links used by referring websites to direct users to websites offering products or other services are logged. The operators of the respective referring websites may receive a commission if users follow these so-called affiliate links and subsequently take advantage of the offers (e.g., purchase goods or use services). For this purpose, it is necessary for providers to be able to track whether users who are interested in specific offers subsequently take advantage of them as a result of the affiliate links. Therefore, for affiliate links to function properly, they must be supplemented with certain values that become part of the link or are stored elsewhere, such as in a cookie. These values include, in particular, the referring website (referrer), the time, an online identifier for the operator of the website on which the affiliate link was located, an online identifier for the respective offer, an online identifier for the user, as well as tracking-specific values such as, for example, advertising material ID, partner ID, and categorizations.
  • Employees: The term “employees” refers to individuals who are in an employment relationship, whether as staff members, salaried employees, or in similar positions. An employment relationship is a legal relationship between an employer and an employee that is established by an employment contract or agreement. It involves the employer’s obligation to pay the employee compensation in exchange for the employee’s work. The employment relationship comprises various phases, including the establishment phase, during which the employment contract is signed; the performance phase, during which the employee performs their work; and the termination phase, when the employment relationship ends, whether through termination, a mutual termination agreement, or otherwise. Employee data refers to all information relating to these individuals in the context of their employment. This includes aspects such as personal identification information, identification numbers, salary and bank details, working hours, vacation entitlements, health information, and performance evaluations.
  • Master Data: Master data comprises essential information necessary for the identification and management of contractual partners, user accounts, profiles, and similar assignments. This data may include, among other things, personal and demographic information such as names, contact information (addresses, phone numbers, email addresses), dates of birth, and specific identifiers (user IDs). Master data forms the basis for any formal interaction between individuals and services, institutions, or systems by enabling unique mapping and communication.
  • Content Data: Content data encompasses information generated during the creation, editing, and publication of all types of content. This category of data may include text, images, videos, audio files, and other multimedia content published on various platforms and media. Content data is not limited to the actual content itself but also includes metadata that provides information about the content, such as tags, descriptions, author information, and publication dates.
  • Click Tracking: Click tracking allows us to monitor users’ movements throughout an entire online service. Since the results of these tests are more accurate when user interactions can be tracked over a certain period of time (e.g., so we can determine whether a user is likely to return), cookies are typically stored on users’ computers for these testing purposes.
  • Contact information: Contact information is essential data that enables communication with individuals or organizations. It includes, among other things, phone numbers, mailing addresses, and email addresses, as well as communication channels such as social media handles and instant messaging identifiers.
  • Conversion Tracking: Conversion tracking (also known as “visit-action analysis”) is a method used to determine the effectiveness of marketing campaigns. To do this, a cookie is typically stored on users’ devices while they are on the websites where the marketing campaigns are running, and then retrieved again on the target website. For example, this allows us to track whether the ads we placed on other websites were successful.
  • Artificial Intelligence (AI): The purpose of processing data using artificial intelligence (AI) includes the automated analysis and processing of user data to identify patterns, make predictions, and improve the efficiency and quality of our services. This includes the collection, cleaning, and structuring of data; the training and application of AI models; and the continuous review and optimization of results, and is carried out exclusively with the users’ consent or on the basis of legal authorization.
  • Performance and Behavioral Data: Performance and behavioral data refer to information related to how individuals perform tasks or behave in a specific context, such as an educational, work, or social setting. This data may include metrics such as productivity, efficiency, quality of work, attendance, and compliance with policies or procedures. Behavioral data could include interactions with colleagues, communication styles, decision-making processes, and reactions to various situations. These types of data are often used for performance evaluations, training and development initiatives, and decision-making within organizations.
  • Metadata, Communication Data, and Operational Data: Metadata, communication data, and operational data are categories that contain information about how data is processed, transmitted, and managed. Metadata, also known as “data about data,” includes information that describes the context, origin, and structure of other data. It may include details on file size, creation date, the author of a document, and revision histories. Communication data captures the exchange of information between users across various channels, such as email correspondence, call logs, social media messages, and chat histories, including the individuals involved, timestamps, and transmission methods. Process data describes the processes and procedures within systems or organizations, including workflow documentation, transaction and activity logs, as well as audit logs used to track and verify operations.
  • Usage Data: Usage data refers to information that tracks how users interact with digital products, services, or platforms. This data encompasses a wide range of information that reveals how users use applications, which features they prefer, how long they stay on specific pages, and the paths they take when navigating through an application. Usage data may also include frequency of use, activity timestamps, IP addresses, device information, and location data. It is particularly valuable for analyzing user behavior, optimizing user experiences, personalizing content, and improving products or services. Furthermore, usage data plays a crucial role in identifying trends, preferences, and potential problem areas within digital offerings.
  • Personal Data: “Personal data” means any information relating to an identified or identifiable natural person (hereinafter referred to as the “data subject”); a natural person is considered identifiable if they can be identified, directly or indirectly, in particular by association with an identifier such as a name, an identification number, location data, an online identifier (e.g., a cookie) or to one or more specific characteristics that reflect the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
  • Profiles containing user-related information: The processing of “profiles containing user-related information,” or “profiles” for short, encompasses any type of automated processing of personal data that involves using such personal data to analyze, evaluate, or predict certain personal aspects relating to a natural person (depending on the type of profiling, this may include various information regarding demographics, behavior, and interests, such as interaction with websites and their content, etc.), to analyze, evaluate, or predict them (e.g., interests in specific content or products, click behavior on a website, or location). Cookies and web beacons are frequently used for profiling purposes.
  • Log data: Log data is information about events or activities that have been logged in a system or network. This data typically includes information such as timestamps, IP addresses, user actions, error messages, and other details regarding the use or operation of a system. Log data is often used to analyze system issues, monitor security, or generate performance reports.
  • Audience Measurement: Audience measurement (also known as web analytics) is used to analyze visitor traffic to an online service and may include the behavior or interests of visitors regarding specific information, such as website content. With the help of audience analysis, operators of online services can, for example, determine at what times users visit their websites and what content they are interested in. This enables them, for example, to better tailor the content of their websites to the needs of their visitors. For the purposes of audience analysis, pseudonymous cookies and web beacons are frequently used to identify returning visitors and thus obtain more accurate analyses of how an online service is used.
  • Remarketing: The terms "remarketing" or "retargeting" are used, for example, when a website tracks which products a user has shown interest in—for advertising purposes—in order to remind the user of those products on other websites, such as through advertisements.
  • Location Data: Location data is generated when a mobile device (or another device capable of determining its location) connects to a cellular cell, a Wi-Fi network, or similar technical means and location-determination functions. Location data is used to indicate the specific geographically identifiable location on Earth where the device is located. Location data can be used, for example, to display map features or other location-dependent information.
  • Tracking: The term “tracking” refers to the ability to track users’ behavior across multiple online services. Typically, information about behavior and interests related to the online services used is stored in cookies or on the servers of the providers of tracking technologies (a process known as “profiling”). This information can then be used, for example, to display advertisements to users that are likely to match their interests.
  • Data Controller: The term "data controller" refers to the natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of the processing of personal data.
  • Processing: “Processing” means any operation or set of operations performed on personal data, whether or not by automated means. The term is broad and encompasses virtually any handling of data, whether it involves collection, analysis, storage, transmission, or deletion.
  • Contract Data: Contract data consists of specific information related to the formalization of an agreement between two or more parties. It documents the terms under which services or products are provided, exchanged, or sold. This data category is essential for managing and fulfilling contractual obligations and includes both the identification of the contracting parties and the specific terms and conditions of the agreement. Contract data may include the contract’s start and end dates, the nature of the agreed-upon services or products, pricing agreements, payment terms, termination rights, renewal options, and special terms or clauses. It serves as the legal basis for the relationship between the parties and is crucial for clarifying rights and obligations, enforcing claims, and resolving disputes.
  • Payment Data: Payment data includes all information required to process payment transactions between buyers and sellers. This data is critical for e-commerce, online banking, and any other form of financial transaction. It includes details such as credit card numbers, bank account information, payment amounts, transaction dates, verification numbers, and billing information. Payment data may also include information about payment status, chargebacks, authorizations, and fees.
  • Target Audience Creation: The term "Custom Audiences" refers to the process of defining target audiences for advertising purposes, such as displaying ads. For example, based on a user’s interest in specific products or topics online, it can be inferred that this user would be interested in ads for similar products or the online store where they viewed those products. The term “Lookalike Audiences” (or similar target groups) is used when content deemed suitable is displayed to users whose profiles or interests are presumed to match those of the users whose profiles were used to create the audience. Cookies and web beacons are typically used for the purpose of creating Custom Audiences and Lookalike Audiences.

Necessary cookies

These cookies do not provide any data to third parties

Cookie nameProviderFunctionService life
fe_typo_userhotel-garni-nassfeld.atTypo3 Frontend User Session CookieSession
xeye_cookie_statushotel-garni-nassfeld.atStatus of the cookie consentUnlimited
ga-disable-UA-...hotel-garni-nassfeld.atGoogle Analytics opt-out cookieUnlimited
_pk_idhotel-garni-nassfeld.atIdentification of the user,
Matomo Analytics		13 months
_pk_refhotel-garni-nassfeld.atReferrer,
Matomo Analytics		6 months
_pk_seshotel-garni-nassfeld.atData on current website visits,
Matomo Analytics		Session
_pk_cvarhotel-garni-nassfeld.atData on current website visits,
Matomo Analytics		Session
_pk_hsrhotel-garni-nassfeld.atData on current website visits,
Matomo Analytics		Session

Marketing and tracking cookies

These cookies are only set with your consent.

Cookie nameProviderFunctionService life
_gaGoogleIdentification of the user,
Google Analytics		2 years
_gidGoogleIdentification of the user,
Google Analytics		24 hours
_gatGoogleLimitation of server requests,
Google Analytics		1 minute
_fbpFacebookPersonalized advertising4 months
datrFacebookto prevent fake accounts2 years
frFacebookUser and browser ID3 months
sbFacebookHelps you make new friends2 years
wdFacebookSize of the browser windowSession
CONSENTGoogleGoogle Maps, Youtube20 years
NIDGoogleGoogle Maps, Youtube6 months
SNIDGoogleGoogle Maps, Youtube6 months
DPGoogleGoogle Maps, YoutubeSession
CGICGoogleGoogle Maps, Youtube5 months
1P_JARGoogleGoogle Maps, Youtube1 month
_gcl_auGoogleGoogle AdSense3 months

Further information: Facebook | Google

Home | Privacy Policy
Book Online
Request a Room
Vouchers
Table Reservation