g. Use of Facebook Connect 

We use Facebook Connect on our websites, a service of Meta Platforms Inc., 1601 Willow Road, Menlo Park, CA 94025, USA or Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. ("Facebook").   

Facebook Connect makes it easy to register for services on the internet. Instead of using a registration mask on our websites, you can enter your login data for Facebook and then use our services. By using Facebook Connect, your web browser automatically establishes a direct connection with the Facebook server. To log in, you will be redirected to the Facebook page. There you can log in with your user data. This links your user account with Facebook to our service.   

We have no influence on the further use of data collected by Facebook through the use of Facebook Connect. As far as we are aware, Facebook receives the information that you have accessed the relevant part of one of our websites or clicked on one of our ads. If you have a user account with Facebook and are registered, Facebook can assign the visit to your user account. Even if you are not registered with Facebook or have not logged in, it is possible that Facebook will find out and store your IP address and possibly other identifying features.  

We use Facebook Connect to facilitate and shorten the registration and login process for you.   

You can prevent Facebook from processing the above information by using our registration form and not using Facebook Connect.   

However, we would like to point out that you may not be able to use all the functions of our websites to their full extent if you take appropriate preventive measures.   

The processing of your personal data is based on your consent pursuant to Art. 6 para. 1 lit. a GDPR, which you grant us through your selection decision in the consent banner. By making a corresponding selection via our consent banner, you also consent to the transfer of the data collected about you to Facebook in the manner and for the purpose described above (Art. 49 para. 1 lit. a GDPR). We would like to inform you in particular that by giving your consent, data will be transferred to the USA and may therefore be subject to access by the authorities there and in particular secret services. Further information on data protection and the complete Facebook data protection guidelines can be found at:   

https://www.facebook.com/about/privacy  

https://de-de.facebook.com/full_data-use_policy  

Your consent can be revoked at any time. To do so, send us an email to anfrage@hamburgerding.de. 

h. Use of Facebook Pixel 

We use Facebook Pixel from "Facebook" on our websites.   

This function is used to present you with interest-based advertisements ("Facebook ads") when you visit Facebook. In this way, we want to ensure that our Facebook Ads correspond to your potential user interest and do not have a harassing effect. Furthermore, with the help of the Facebook pixel, we can track the effectiveness of the Facebook ads for statistical and market research purposes by evaluating the number of users who click on a Facebook ad.   

The Facebook pixel is directly integrated by Facebook when you visit our website and can save a cookie on your device. If you subsequently log in to Facebook or visit Facebook while logged in, Facebook assigns this information to your Facebook user account. The data collected about you does not allow us to draw any conclusions about your identity as a user.   

The collection and processing of data by Facebook takes place within the framework of Facebook's privacy policy. You can find more information about this under:  

https://www.facebook.com/about/privacy  

You can object to the collection by Facebook Pixel and the use of your data for the display of Facebook ads. To do this, you can visit the website set up by Facebook (see the settings for usage-based advertising there) if you are logged in to Facebook:   

https://www.facebook.com/settings  

The settings are platform-independent, i.e. they are applied to all devices, such as desktop computers or mobile devices.  

However, we would like to point out that you may not be able to use all the functions of our websites to their full extent if you take appropriate preventive measures.   

The processing of your personal data is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR, which you grant us through your selection decision in the consent banner. By making a corresponding selection via our consent banner, you also consent to the transfer of the data collected about you to Google in the manner and for the purpose described above (Art. 49 para. 1 lit. a GDPR). We would like to inform you in particular that by granting your consent, data will be transferred to the USA and may therefore be exposed to access by the authorities there and in particular secret services.  

Your consent can be revoked at any time. To do so, send us an email to anfrage@hamburgerding.de. 

4. external links 

We maintain online presences on social networks, career platforms and streaming services in order to exchange information with the users registered there, to get in touch easily and to make our company better known. On our websites you will therefore find link buttons to our company profiles on Facebook, Instagram and LinkedIn as well as to our YouTube and TikTok channel.   

We do not use social plugins from these networks, but refer to our accounts on our websites exclusively by means of a link. You will therefore only be redirected to our accounts on the websites of the individual networks and channels. Accordingly, no data is transmitted from you to the servers of these networks when you visit our websites. Your data will only be forwarded to the servers of the networks when you are linked to their websites.  

Please log out of your respective accounts beforehand if you do not want your visit to our websites to be assigned to your personal account on the respective third-party site of its operators.  

When you click on the link buttons, the login screen of the respective third-party site opens. If you are already logged in there at this point, you will be taken directly to our profile or channel.  

In principle, their operators are responsible for the processing of your personal data on these external websites. However, we would like to point out the following:   

a. Instagram & Facebook 

By clicking on the Instagram link button, you can access our company profile on Instagram. Instagram is a social media platform of the company Instagram LLC, 1601 Willow Rd, Menlo Park, CA 94025, USA ("Instagram"), which has been a subsidiary of "Facebook" since 2012. By clicking on the Facebook link button, you can access our company profile on Facebook. Facebook is also a social media platform and is operated by "Facebook".   

We would like to point out that you use this Instagram page as well as this Facebook page and its functions on your own responsibility. This applies in particular to the use of the interactive functions (e.g. commenting, sharing, rating). Alternatively, you can also access parts of the information offered via these pages on our websites.  

When you visit our company profiles on Instagram and Facebook, Facebook collects your IP address and other information in the form of cookies on your PC. This information is used to provide us, as the operator of the Instagram or Facebook profile, with statistical information about the use of the company profile. Facebook provides more detailed information on this under the following links:   

http://de-de.facebook.com/help/pages/insights  

https://help.instagram.com/1896641480634370?ref=ig  

The data collected about you in this context is processed by Facebook and may be transferred to countries outside the European Union. Facebook describes in general terms what information it receives and how it is used in its data usage guidelines. There you will also find information on how to contact Facebook and on the settings for advertisements. The data usage guidelines are available at the following link:   

http://de-de.facebook.com/about/privacy  

You can find the full privacy policies of Instagram and Facebook here:   

https://de-de.facebook.com/full_data-use_policy  

https://help.instagram.com/519522125107875  

 
In what way Facebook uses the data from visits to Instagram and Facebook pages for its own purposes, to what extent activities on Instagram and Facebook pages are assigned to individual users, how long Facebook stores this data and whether data from a visit to Instagram and Facebook pages is passed on to third parties is not clearly stated by Facebook and is not known to us.  

When you access the Instagram and Facebook pages, the IP address assigned to your end device is transmitted to Facebook. According to Facebook, this IP address is anonymised (for "German" IP addresses). Facebook also stores information about the end devices of its users (e.g. as part of the "Login notification" function); this may enable Facebook to assign IP addresses to individual users.  

If you are currently logged in to Instagram or Facebook as a user, a cookie with your Instagram or Facebook ID is stored on your end device. This enables Facebook to track that you have visited these pages. This also applies to all other Instagram and Facebook pages. Through Instagram and Facebook buttons embedded in websites, it is possible for Facebook to record your visits to these websites and assign them to your Instagram or Facebook profile. This data can be used to offer content or advertising tailored to you.  

If you want to avoid this, you should log out of Instagram or Facebook or deactivate the "stay logged in" function, delete the cookies on your device and close and restart your browser. This will delete information that can directly identify you. This allows you to use our Instagram or Facebook page without revealing your Instagram or Facebook identifier. When you access interactive functions of the site (like, comment, share, message, etc.), an Instagram or Facebook login screen appears. After logging in, you will once again be recognisable to Facebook as a specific user.   

For information on how to manage or delete information about you, please visit the following Facebook support page:   

https://de-de.facebook.com/about/privacy#  

You can find the current version of this data protection declaration under "Data protection" on our Instagram or Facebook page.  

b. LinkedIn 

If you click the LinkedIn button on our websites, you will be redirected to our account on LinkedIn. LinkedIn is operated by LinkedIn Corporation, 1000 West Maude Avenue Sunnyvale, CA 94085, USA ("LinkedIn"). The responsible party in terms of data protection law for users from Germany is LinkedIn Ireland Unlimited Company, 70 Sir John Rogerson's Quay, Dublin 2, Dublin, D02r296, Ireland ("LinkedIn").  

LinkedIn is an internet-based social network for connecting users with existing business contacts and generating new business contacts. On LinkedIn, companies can create profiles or post job offers.   

We would like to point out that you use this LinkedIn page and its functions on your own responsibility. This applies in particular to the use of the interactive functions (e.g. commenting, sharing, rating). Alternatively, you can also access parts of the information offered via this page on our websites.  

When you visit our LinkedIn page, LinkedIn collects, among other things, your IP address and other information that is present on your PC in the form of cookies. This information is used to provide us, as the operator of the LinkedIn site, with statistical information about the use of the LinkedIn site. LinkedIn provides more detailed information on this under the following link:   

https://www.linkedin.com/legal/privacy-policy?trk=hb_ft_priv  

The data collected about you in this context is processed by LinkedIn and may be transferred to countries outside the European Union. LinkedIn describes in general terms what information it receives and how it is used in its data usage guidelines. There you will also find information on how to contact LinkedIn and on the settings for advertisements. The data usage guidelines are available at the following link:   

https://www.linkedin.com/legal/privacy-policy  

In what way LinkedIn uses the data from visits to LinkedIn pages for its own purposes, to what extent activities on the LinkedIn page are assigned to individual users, how long LinkedIn stores this data and whether data from a visit to the LinkedIn page is passed on to third parties, is not conclusively and clearly stated by LinkedIn and is not known to us.  

When you access a LinkedIn page, the IP address assigned to your end device is transmitted to LinkedIn. According to LinkedIn, this IP address is anonymised (for "German" IP addresses) and deleted after 90 days. LinkedIn also stores information about the end devices of its users (e.g. as part of the "registration notification" function); LinkedIn may thus be able to assign IP addresses to individual users.  

If you are currently logged in to LinkedIn, a cookie with your LinkedIn ID will be placed on your end device. This enables LinkedIn to track that you have visited this website and how you have used it. This also applies to all other LinkedIn pages. LinkedIn buttons integrated into websites enable LinkedIn to record your visits to these websites and to assign them to your LinkedIn profile. This data can be used to offer content or advertising tailored to you.  

If you want to avoid this, you should log out of LinkedIn or deactivate the "stay logged in" function, delete the cookies on your device and close and restart your browser. This will delete LinkedIn information that can directly identify you. This allows you to use our LinkedIn page without revealing your LinkedIn identifier. If you access interactive functions of the page (like, comment, share, news, etc.), a LinkedIn login screen will appear. After a possible login, you will again be recognisable to "LinkedIn" as a specific user.  

For information on how to manage or delete information about you, please visit the following LinkedIn support page:   

https://www.linkedin.com/legal/privacy-policy  

You can find the current version of this data protection declaration under "Data protection" on our LinkedIn page.  

c. YouTube 

If you click the YouTube button on our websites, you will be redirected to our YouTube channel. YouTube is a streaming platform and is operated by Google.  

We would like to point out that you use this YouTube channel and its functions on your own responsibility. This applies in particular to the use of the "Discussion" function. Furthermore, we would like to point out that we have no influence or control over the type and scope of the data processed by Google, the type of data processing and the use and disclosure of this data to third parties. When using YouTube, your personal data may be collected, transferred, stored, disclosed, used by Google and transferred to and stored in the United States and/or other third countries in which Google does business, regardless of your country of residence. In addition, it can be assumed that data will be transferred to companies affiliated with Google as well as other companies and/or persons who process data on behalf of Google.  

Google processes your voluntarily entered data such as name and username, email address and telephone number. Google also collects the content that you create, upload or receive from third parties when using the services (e.g. photos, videos, documents, spreadsheets, comments) and processes the personal data contained therein. The content you share will be analysed by Google to determine what topics interest you. Google can also determine your location based on your IP address and send you advertising or other content tailored to you.   

Google may use analysis tools such as Google Analytics for evaluation purposes. We have no influence on the use of such tools by Google and were not informed about their potential use. We have neither commissioned the use of such tools nor do we support Google in any way. We are also not provided with any data obtained in the course of the analysis and we have no possibility to stop the use of such tools on our YouTube channel. We can only view certain profiles of subscribers to our YouTube channel.  

Even if you are not registered with YouTube, Google retrieves certain information when you use our YouTube channel, such as IP address, browser type, operating system, previously visited websites, search terms used, stored cookies and - if you access via a mobile phone - mobile provider and the terminal device used (including device ID and application ID).   

You can restrict data processing in the general settings of your Google account. In addition, Google also offers specific privacy settings for YouTube. You can find more information on this at:  

https://policies.google.com/technologies/product-privacy?hl=de&gl=de  

Information about which data is processed by Google and for what purposes it is used can be found in Google's data protection information at:  

https://policies.google.com/privacy?hl=de&gl=de#infocollect  

Finally, you have the option of requesting information from Google via the data protection form:  

https://support.google.com/policies/answer/9581826?visit_id=637054532384299914-2421490167&hl=de&rd=3 

d. Use of TikTok 

If you click the TikTok button on our websites, you will be redirected to our TikTok channel. TikTok is a video portal and is operated by TikTok Inc., 10100 Venice Blvd, Culver City, CA 90232, USA. The representative of TikTok Inc. in the EU is News Republic SAS, Rue Robert Caumont, 33049 Bordeaux Cedex, France ("TikTok").  

We point out that you use this TikTok channel and its functions on your own responsibility. We have no influence or control over the type and scope of the data processed by TikTok, the type of data processing and the use and disclosure of this data to third parties. The data collected about you when using the service is processed by TikTok and may be transferred to countries outside the European Union. This includes, but is not limited to, your IP address (excluding GPS data), device information or other unique device identifiers, browsing history, mobile carrier, time zone and local settings, mobile phone or device model, operating system and information about your use of our websites. If you have a TikTok account or profile, this information will be associated with your TikTok account or profile information.   

For more information about what data is processed by TikTok and for what purposes it is used, please see TikTok's privacy policy at:  

https://www.tiktok.com/legal/privacy-policy  

Here you will also find information about the cookies stored by TikTok and how you can manage or delete information TikTok has about you.  

5. e-mails and contact form 

If you contact us by e-mail, the personal data you send us with your e-mail will be stored. We also have a contact form on our website www.hamburgerding.de and various landing pages that you can use to contact us. The following data entered by you in the input mask will be transmitted to us and stored: title, first name, last name, email address, telephone number, subject, message, category, additional interests. In addition, we record your IP address and the time of sending.  

The contact form is provided by "HubSpot". The entry of your data may result in a transmission to HubSpot. You can find more information about HubSpot in section F., 1., e. of this privacy policy. Please note in particular that American authorities, such as intelligence agencies, may be able to access your personal data due to American laws such as the Cloud Act. 

We need your e-mail address to send you our reply. The other data enables us to address you personally (title, first name, surname), to provide you with the right contact person to answer your enquiry (category) and to find out which of our offers might still be of interest to you. 

The processing of your personal data is based on your consent in accordance with Art. 6 Para. 1 lit. a GDPR, which you grant by ticking the checkbox provided for this purpose. By doing so, you also consent to the transfer of the data collected about you to HubSpot in the manner and for the purpose described above (Art. 49 Para. 1 lit. a GDPR). We would like to inform you in particular that by granting your consent, data will be transferred to the USA and may therefore be exposed to access by the authorities there and in particular secret services.   

Subject to legal retention periods, your personal data will be deleted as soon as we have finally processed your enquiry. If you do not receive a response from us for the aforementioned reasons within a period of ten days, your personal data will also be deleted.  

Your consent can be revoked at any time. To do so, send us an email to anfrage@hamburgerding.de. However, we would like to point out that your request cannot be processed further in the event of a revocation.  

6. newsletter 

We provide you with a newsletter to which you can subscribe on our websites. Details of the newsletter, in particular its possible contents, are specified in the declaration of consent. If you subscribe to our newsletter, the email address you entered in the input mask when registering for the newsletter will be transmitted to us.  

We use the so-called double opt-in procedure to register for our newsletter. After your registration, we will send you an email to the email address you provided, in which we ask you to confirm that you would like us to send you the newsletter in the future. If you do not confirm your registration within a period of 48 hours, the data you have provided will be blocked and deleted after five weeks. In addition, we store your IP address and the time of registration for the newsletter as well as the time of confirmation.   

We use a carefully selected external service provider to send the newsletter and the associated processing of your personal data. This is currently the company "HubSpot". You can find more information about HubSpot in section F., 1., e. of this privacy policy. Please note in particular that American authorities, such as intelligence agencies, could possibly gain access to your personal data due to American laws such as the Cloud Act. 

The newsletter is sent by the company More Than Brands GmbH, Nobistor 16, 22767 Hamburg ("More than Brands"). If you register for the newsletter, your data may also be processed by this company. 

To subscribe to the newsletter, you must enter your e-mail address in the corresponding input field. After your confirmation, we will store your email address in order to send you the newsletter. The storage of your email address and its transfer to HubSpot is based on Art. 6 para. 1 lit. a GDPR and Art. 49 para. 1 lit. a GDPR. The processing of your email address by More than Brands is based on Art. 6 para. 1 lit. a GDPR. You give us your consent by ticking the checkbox provided. 

We store the respective IP address and the times of registration and confirmation in order to prove your registration and, if necessary, to be able to clarify a possible misuse of your personal data. This is also our legitimate interest within the meaning of Art. 6 (1) f GDPR, which serves as the legal basis for the processing of this personal data. Insofar as the processing of your personal data is carried out on the basis of Art. 6 Para. 1 lit. f GDPR, there is no possibility of objection.  

Your personal data will be deleted as soon as they are no longer required to achieve the aforementioned purposes. We therefore store your above-mentioned data as long as you have subscribed to the newsletter.  

You can revoke your consent to receive the newsletter at any time by unsubscribing by clicking on the link contained in each of the newsletter emails sent to you. Alternatively, you can send us a corresponding e-mail to anfrage@hamburgerding.de.  

7. registration via UnidyID 

In order to offer you the greatest possible convenience, you can permanently store your personal data in a password-protected customer account. Registration takes place via our website www.hamburgerding.unidy.de. After registering, you have access to our offers as well as to the offers of the other companies of the Think United Group that are affiliated with us (not in the legal sense) and can use both our services and theirs. This has the advantage for you that you only have to register once and can easily log in to all companies of the group with your UnidyID account. In your UnidyID account, you can also manage your subscriptions and set your preferences.  

The operator of the UnidyID platform is Unidy GmbH, Ballindamm 4-5, 20095 Hamburg ("Unidy GmbH").  

Registration is voluntary at all times. Our offers can also be ordered without an existing customer account. The creation of a customer account is only intended to make the ordering process easier for you, as you only have to enter the data required for your order once.  

You have various options for creating a customer account. You can enter your e-mail address and set a password of your choice or register with your Facebook, Google or LinkedIn account. If you decide to register with your email address, you will receive an email to the email address you provided with a confirmation link. If you click on this link, you will be redirected back to us and you will be successfully registered as a customer (so-called double opt-in). Please treat your personal access data confidentially and in particular do not make them accessible to unauthorised third parties.  

After setting up your customer account, you can enter your personal data (gender, first and last name, telephone number, birthday, company name, address) in your profile. This information is also voluntary, but makes it easier for you to order our services, as you will no longer be asked to enter the data required for invoicing during the individual order processes. In addition, providing us with your telephone number makes it easier for us to contact you, and if you give us your date of birth, special benefits await you on your birthday. The data you have entered in your profile can be viewed and changed at any time.  

The legal basis for the processing of your personal data is Art. 6 para. 1 lit. a GDPR. By entering your personal data in your profile, you give us to understand that we may process this data.  

You have the option to delete your customer account at any time. To do so, send us an email with the subject "Deletion of customer account" to anfrage@hamburgerding.de. Please note, however, that once you have placed an order with us, the data visible in the customer account will not be deleted at the same time. In this case, the deletion of your data will take place after the expiry of the retention obligations applicable to us under commercial and tax law. The legal basis for this further data processing is Art. 6 (1) lit. c GDPR. 

8. order 

On our websites you have the possibility to order some of our offers online. For your order to be recorded in our system, you enter personal data in our input form, whereby a distinction is made between mandatory and voluntary information. The mandatory data marked with an asterisk includes your e-mail address, your first and last name and your address. We need this personal data to send you the invoice by e-mail. The other details (company name, telephone number and VAT ID), on the other hand, are voluntary and not mandatory for the order.  

As far as mandatory data is concerned, the processing of your personal data is based on Art. 6 para. 1 lit. b GDPR. This personal data is necessary for the performance of the contract. In addition, we are obliged to issue invoices properly. According to § 14 para. 4 in conjunction with 14a para. 5 UStG, invoices must contain, among other things, the full name and address of the recipient of the service. The further legal basis for the processing of your personal data is therefore Art. 6 para. 1 lit. c GDPR.  

As far as it is not mandatory, the processing of your personal data is based on your consent according to Art. 6 para. 1 lit. a GDPR.   

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. This is regularly the case when the contract has been fully processed, provided there is no reasonable probability of claims arising from the contractual relationship. However, we have a legal obligation to retain data for 10 years, beginning with the first of January of the year following the year in which the invoice was issued.   

The collection of data is mandatory for booking/ordering. Consequently, there is no possibility of objection.   

If the processing of your personal data is based on your consent, you can revoke your consent at any time. To do so, send us an email to anfrage@hamburgerding.de. 

9. Payment and payment processing 

Insofar as we offer chargeable services on our websites, payment and payment processing shall be carried out either via external service providers (e.g. Klarna, PayPal, etc.) or via bank transfer by you after receipt of the invoice.  

Your personal data (name, address, bank details, such as account numbers, as well as the contract, total and recipient-related details) are stored and, depending on which payment service provider you select in the ordering process, are forwarded to the credit institution commissioned with the payment and, if applicable, to the commissioned payment service provider in order to process the payments. In some cases, the selected payment service providers collect this and possibly other data (such as credit card numbers, passwords, TANs, checksums) themselves if you have created or are creating an account there. In this case, you must log in to the payment service provider with your access data during the ordering process.   

The processing and transfer of your personal data is necessary in order to be able to process payment transactions for services offered by us for which a fee is charged. Furthermore, the processing and transfer of your personal data is necessary to offer you an effective and secure payment option. In the context of the fulfilment of contracts, Art. 6 para. 1 lit. b GDPR serves as the legal basis for the processing and transfer of your personal data. Furthermore, we use external payment service providers on the basis of our legitimate interests pursuant to Art. 6 (1) (f) of the German Data Protection Act (GDPR), which consists of the simplest possible processing of orders and payments and the prevention of fraud. 

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. This is regularly the case when the contract has been fully processed, provided there is no reasonable probability of claims arising from the contractual relationship. However, we have a legal obligation to retain data for 10 years, beginning with the first of January of the year following the year in which the invoice was issued.   

The collection of data is mandatory for the processing of payments. Consequently, there is no possibility to object. 

a. Use of PayPal 

We offer the PayPal service on our websites. PayPal is an online payment service provider of PayPal (Europe) S.à.r.l. & Cie. S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg, Luxembourg ("PayPal").  

Payments are processed via so-called PayPal accounts, which represent virtual private or business accounts. In addition, PayPal offers the possibility of processing virtual payments via credit cards if no PayPal account is maintained. A PayPal account is managed via an e-mail address, which is why there is no classic account number. PayPal makes it possible to initiate online payments to third parties or to receive payments. PayPal also assumes trustee functions and offers buyer protection services.  

If you decide to use this payment method, your personal data will be stored by PayPal. Your personal data is usually your first and last name, your address, your email address and IP address, as well as other data that is necessary for processing the payment. Personal data that is related to the respective order is also necessary for processing. The purpose of processing the data is payment processing and fraud prevention.  

PayPal may share your personal data with affiliated companies and service providers or subcontractors to the extent necessary to fulfil contractual obligations or to process the data on behalf of PayPal. Your personal data transmitted to PayPal may also be transmitted by PayPal to credit agencies. The purpose of this transmission is to check your identity and creditworthiness. PayPal uses the result of the credit check, taking into account the statistical probability of non-payment, for the purpose of deciding whether to provide the respective payment method. The creditworthiness information may contain probability values (so-called score values). Insofar as score values are included in the result of the credit report, they have their basis in a scientifically recognised mathematical-statistical procedure. You can find out which credit agencies are involved here:  

https://www.paypal.com/de/webapps/mpp/ua/privacy-full#rAnnex  

If you select PayPal as a payment option during the ordering process on our website, your data will be automatically transmitted to PayPal. By selecting this payment option, you consent to the transmission of your personal data required for payment processing.  

You have the option to revoke your consent to the processing of your personal data at any time. However, the revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent up to the revocation, insofar as the personal data must be processed, used or transmitted for payment processing in accordance with the contract.  

You can find PayPal's applicable privacy policy at:  

https://www.paypal.com/de/webapps/mpp/ua/privacy-full 

​

b. Use of Klarna 

We offer the Sofortüberweisung service of Sofort GmbH, Theresienhöhe 12, 80339 Munich, Germany ("Sofort GmbH"), for cashless payment on our websites. Sofort GmbH has been part of the Swedish company Klarna Bank AB, Sveavägen 46, 11134 Stockholm, Sweden ("Klarna") since 2014.  

Sofortüberweisung is an online payment system that allows you to place an order via online banking. The payment is processed by Sofort GmbH or Klarna and we receive information about your payment. You can usually use this payment method if you have an active online bank account.  

If you decide to use this payment method, your personal data, such as your first and last name, your account details, your payment amount and the purpose of use specified by you will be stored on the servers of Sofort GmbH or Klarna. We also receive this data via the payment confirmation. As part of the account coverage check, Sofort GmbH or Klarna checks whether your account balance and, if applicable, your overdraft limit covers the payment amount. In individual cases, it is also checkes whether Sofort transfers have been successfully carried out within the last 30 days. Your user identification (e.g. authorisation and contract number) in shortened ("hashed") form and your IP address as well as - in the case of SEPA transfers - your IBAN and BIC are also stored as part of the account coverage check. According to information provided by Sofort GmbH and Klarna, no further data (such as account balances, turnover data, account lists, mobile phone numbers, authentication certificates, security codes or PIN/TAN) are stored or passed on to third parties.  

When you place an order, you will be redirected to the website of Sofort GmbH or Klarna and after successful payment you will be redirected back to the previously visited website. Cookies are set in order to make the service of Sofort GmbH or Klarna more user-friendly.   

If you select Sofortüberweisung as the payment option during the order process, your data will be automatically transmitted to Sofort GmbH or Klarna. By selecting this payment option, you consent to the transmission of your personal data required for payment processing, including the storage of cookies.  

You have the option to revoke your consent to the processing of your personal data at any time vis-à-vis Sofort GmbH or Klarna. However, the revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent up to the revocation, insofar as the personal data must be processed, used or transmitted for payment processing in accordance with the contract.  

You can find the applicable data protection provisions of Sofort GmbH and Klarna at:  

https://www.sofort.de/datenschutz.html  

10. pinestack 

To make it easier for you to order our offers, we use the service of Pinestack. The provider of Pinestack is Pinestack GmbH, An der Spinnerei 2/6, 96047 Bamberg ("Pinestack GmbH").  

Pinestack is a room booking software that creates a digital twin of our rooms. Pinestack offers mobile booking solutions that allow us to optimally utilise our rooms and minimise administrative work. Our room resources can thus be used effectively. In addition, usage analyses of our rooms can be carried out via Pinestack to optimise staffing and cleaning efforts, allowing us to plan and effectively deploy our staff resources. Staff and clients also benefit from the so-called POI Finder, a mobile indoor navigation system that enables them to find their way around in unfamiliar buildings immediately, as well as from the associated app, which enables simplified access to our rooms via smartphone. 

When using Pinestack, your personal data (in particular booking data) is processed and, if necessary, transferred to Pinestack GmbH. The servers of Pinestack GmbH are hosted in a German data centre.  

The legal basis for the data transfer is Art. 6 para. 1 lit. f GDPR. We have a legitimate interest in optimising and improving our online services and in effectively planning and designing our capacities. 

G. Data recipient 

Your personal data may be passed on to third parties. We will only pass on your personal data to third parties if we are authorised to do so under data protection law.  

The transfer of data to third parties is based either on the fulfilment of legal obligations, on legitimate interests, on the necessity of fulfilling a contract or on the basis of any consent given. If the external service provider acts as a processor, the data transfer is carried out within the framework of a processing contract. If data transfer to processors in countries outside the European Economic Area (EEA) is necessary, this is done on the basis of the EU standard contractual clauses or to countries in respect of which an EU adequacy decision exists.  

H. Your rights as a data subject 

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis us as the controller:  

1. right to information 

You can request confirmation from us as to whether your personal data is being processed by us. If such processing is taking place, you can request information about the following pursuant to Article 15 of the GDPR:  

1. the purposes for which the personal data are processed  

1. the categories of personal data which are processed  

1. the recipients or categories of recipients to whom the personal data concerning you have been or will be disclosed  

1. the planned duration of the storage of the personal data concerning you or, if concrete information on this is not possible, criteria for the determination of the storage duration  

1. the existence of a right to rectify or erase personal data concerning you, a right to restrict processing by us or a right to object to such processing  

1. the existence of a right of appeal to a supervisory authority  

1. any available information on the origin of the data if the personal data are not collected from the data subject  

1. the existence of automated decision-making, including profiling, pursuant to Article 22(1) and (4) of the GDPR and - at least in these cases - meaningful information about the logic involved and the scope and intended effects of such processing on you  

Furthermore, you have the right to request information on whether the personal data concerning you is transferred to a third country or to an international organisation. In this context, you may request to be informed about the appropriate safeguards pursuant to Art. 46 GDPR in connection with the transfer.  

2. right of rectification 

Pursuant to Art. 16 GDPR, you have a right of rectification and/or completion vis-à-vis us if the processed data concerning you is incorrect and/or incomplete. We must carry out the correction without delay.  

3. right to restriction of processing 

Under the following conditions, you can request the restriction of the processing of personal data concerning you in accordance with Art. 18 GDPR:  

1. if you dispute the accuracy of the personal data relating to you for a period that allows us to verify the accuracy of the personal data.  

1. the processing is unlawful and you oppose the deletion of the personal data and request the restriction of the use of the personal data instead  

1. we no longer need the personal data for the purposes of processing, but you require them for the assertion, exercise or defence of legal claims, or  

1. if you have objected to the processing in accordance with Art. 21 (1) GDPR and it is not yet clear whether our legitimate reasons outweigh your reasons.  

Where the processing of personal data concerning you has been restricted, such data may be processed, with the exception of storage, only with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of substantial public interest of the Union or a Member State. You will be informed by us before the restriction is lifted. 

4. right to deletion  

 a. Obligation to delete 

Pursuant to Art. 17 GDPR, you can demand that we delete the personal data concerning you without delay. We are obliged to delete this data immediately if one of the following reasons applies: 

1. the personal data concerning you are no longer necessary for the purposes for which they were collected or otherwise processed  

1. Your consent on which the processing is based pursuant to Art. 6 (1) lit. a GDPR or Art. 9 (2) lit. a GDPR is revoked by you and there is no other legal basis for the processing. 

1. You object to the processing in accordance with Art. 21 (1) GDPR and there are no overriding legitimate grounds for the processing.  

1. You object to the processing pursuant to Art. 21 (2) GDPR  

1. the personal data concerning you have been processed unlawfully  

1. the deletion of the personal data concerning you is necessary for compliance with a legal obligation under Union or Member State law to which we are subject  

1. the personal data concerning you has been collected in relation to information society services offered pursuant to Art. 8(1) GDPR  

b. Information to third parties 

If we have made the personal data concerning you public and we are obliged to erase it pursuant to Article 17(1) of the GDPR, we shall take reasonable steps, including technical measures, having regard to the available technology and the cost of implementation, to inform data controllers which process the personal data that you, as the data subject, have requested that they erase all links to, or copies or replications of, that personal data.  

​

c. Exceptions to the right to deletion 

The right to deletion does not exist insofar as the processing is necessary:  

1. on the exercise of the right to freedom of expression and information  

1. for compliance with a legal obligation which requires processing under Union or Member State law to which we are subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in us  

1. for reasons of public interest in the area of public health pursuant to Art. 9 (2) (h) and (i) and Art. 9 (3) GDPR  

1. for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes pursuant to Article 89(1) of the GDPR, where the right referred to in Section 1 is likely to render impossible or seriously prejudice the achievement of the purposes of such processing  

1. for the assertion, exercise or defence of legal claims  

d. Right to information 

If you have asserted the right to rectification, deletion or restriction of processing against us, we are obliged pursuant to Article 19 of the GDPR to notify all recipients to whom the personal data concerning you has been disclosed of this rectification or deletion of the data or restriction of processing, unless this proves impossible or involves a disproportionate effort. You have the right to be informed about these recipients.  

e. Right to data portability 

Pursuant to Article 20 of the GDPR, you have the right to receive the personal data relating to you that you have provided to us in a structured, commonly used and machine-readable format. You also have the right to transfer this data to another controller to whom the personal data has been provided without hindrance from us, provided that  

1. the processing is based on consent pursuant to Art. 6 (1) lit. a GDPR or Art. 9 (2) lit. a GDPR or on a contract pursuant to Art. 6 (1) lit. b GDPR and  

1. the processing is carried out with the aid of automated procedures  

In exercising this right, you also have the right to have the personal data concerning you transferred directly from one controller to another controller, insofar as this is technically feasible. The freedoms and rights of other persons must not be affected by this.  

The right to data portability does not apply to processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.  

f. Right of objection 

Pursuant to Art. 21 GDPR, you have the right to object at any time to the processing of personal data relating to you on the basis of Art. 6 para. 1 lit. e or f GDPR for reasons arising from your particular situation; this also applies to profiling based on these provisions. The objection must be justified.  

Upon receipt of an objection, we will no longer process the personal data concerning you unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the purpose of asserting, exercising or defending legal claims.  

If the personal data concerning you is processed for the purpose of direct marketing, you have the right to object at any time to the processing of the personal data concerning you for the purpose of such marketing; this also applies to profiling, insofar as it is related to such direct marketing.  

If you object to processing for the purposes of direct marketing, the personal data concerning you will no longer be processed for these purposes.  

You have the possibility, in connection with the use of information society services, notwithstanding Directive 2002/58/EC, to exercise your right to object by means of automated procedures using technical specifications.  

g. Right to revoke the declaration of consent under data protection law 

In accordance with Art. 7 (3) GDPR, you have the right to revoke your declaration of consent under data protection law at any time - even before the GDPR came into force (25.05.2018). The revocation does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation. The revocation of consent can be declared via e-mail, letter or telephone to our contact details above.  

h. Automated decision in individual cases including profiling 

Pursuant to Article 22 of the GDPR, you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision  

1. is necessary for the conclusion or performance of a contract between you and us, or  

1. is permitted under Union or Member State law to which we are subject and that law contains appropriate measures to safeguard your rights and freedoms and your legitimate interests; or  

1. is done with your express consent  

However, these decisions must not be based on special categories of personal data pursuant to Article 9(1) of the GDPR, unless Article 9(2)(a) or (g) of the GDPR applies and appropriate measures have been taken to protect the rights and freedoms and your legitimate interests.  

With regard to the cases referred to in points 1 and 3, we shall take reasonable measures to safeguard your rights and freedoms and your legitimate interests, including at least the right to obtain the intervention of a person on our side, to express your point of view and to contest the decision.  

i. Right to complain to a supervisory authority 

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, place of work or the place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.  

The supervisory authority to which the complaint has been lodged shall inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy under Article 78 GDPR.  

Status: December 2021