Privacy and Data Protection Policy

Nature and Purpose of Data Processing

Categories of Processed Information

• Identification and contact details (given and family names, postal addresses, telephone numbers, email addresses)
• Textual input (messages, communications), photographic uploads
• Usage patterns, visited pages, access timestamps
• Internet protocol addresses and associated metadata (device specifications)

Affected Individuals

• All visitors and users of our digital platform

Processing Objectives

• Provision of online presence with content and functional capabilities
• Management of bookings, orders, contact inquiries, and communications
• Implementation of security measures
• Statistical analysis and evaluation

Responsible Party for Processing

The responsible entity under data protection regulations is:

Key Terminology and Definitions

• "Personal data" encompasses all information relating to identified or identifiable natural persons that are known to us or can be identified through data stored within our systems.
• "Processing" refers to any operation performed manually or automatically involving personal data, including loading, assigning, storing, or modifying such information.
• "Responsible party" designates individuals, authorities, or institutions determining the purposes and methods of processing personal information.

Your Privacy Rights

• You possess the right to confirmation regarding whether your data is being processed by us, to receive information about this processing, and to obtain a copy of your data (Article 15 GDPR)
• You maintain the right to correction or completion of data concerning you (Article 16 GDPR)
• You hold the right to demand immediate deletion of your data (Article 17 GDPR) or to request restriction of its processing (Article 18 GDPR)
• You have the right to receive your personal data in a structured format or to request transmission to other responsible parties (Article 20 GDPR)
• You retain the right to object at any time to future processing of your data (Article 21 GDPR)
• You possess the right to revoke previously granted consent pursuant to Article 7, Paragraph 3 GDPR with future effect
• You furthermore hold the right pursuant to Article 77 GDPR to lodge a complaint with the competent supervisory authority

Legal Basis for Processing

Article 6 of the GDPR serves as the legal foundation for all processing operations within our organization. We process your data only when:

• You have provided consent for the processing of your personal data for one or more specific purposes
• Processing is necessary for the performance of a contract or for taking pre-contractual measures at your request
• Processing is required to fulfill a legal obligation to which you are subject
• Processing is necessary to protect your vital interests or those of another individual
• Processing is required for performing a task carried out in the public interest or in the exercise of official authority vested in us
• Processing is necessary for purposes of our legitimate interests or those of a third party, except where such interests are overridden by your interests or fundamental rights and freedoms requiring protection of personal data, particularly when you are a child

Duration of Data Storage

We adhere to the respective statutory retention periods regarding the maximum duration for storing your personal data. Upon expiration of these periods, the corresponding information is routinely deleted, provided it is no longer required for contract fulfillment or contract initiation.

Data Deletion Procedures

All personal data processed by us is deleted or restricted for further processing in accordance with Articles 17 and 18 GDPR. Specifically, personal data is deleted when it is no longer necessary for achieving the intended purposes or when statutory retention obligations have expired. This applies particularly to invoices, booking documents, and business records.

Collaboration with Data Processors

When transmission of data to third parties is necessary for contract fulfillment, this occurs only:

• Based on legal permission pursuant to Article 6, Paragraph 1, Letter b GDPR
• Based on your consent
• When a legal obligation mandates such transmission
• Based on our legitimate interests (such as when engaging contractors, web hosts, etc.)

When we commission third parties with processing based on a so-called "data processing agreement," this occurs on the foundation of Article 28 GDPR.

Software and Services from Tramino

We employ products from our technical service provider Tramino (headquarters: Weststrasse 30, D-87561 Oberstdorf, privacy policy) for operating this website and associated software, based on our legitimate interests pursuant to Article 6, Paragraph 1, Letter f GDPR and a data processing agreement pursuant to Article 28, Paragraph 3, Sentence 1 GDPR. The service provider does not use the personal data processed thereby for its own purposes nor transmit it to third parties.

Together with Tramino, we implement technical and organizational security measures pursuant to Section 9 of the German Federal Data Protection Act to protect data managed by us against accidental or intentional manipulation, loss, destruction, or access by unauthorized persons. Our security measures are continuously improved in accordance with technological developments. We store privacy-relevant information exclusively on secured computer systems in Germany. Access is restricted to a limited number of authorized individuals specifically committed to data protection, who are engaged in technical, administrative, or editorial data management.

Hosting, Access Data, and Log Files

For purposes of operating this digital platform, we utilize hosting services from Tramino for the following provisions:

• Provision of our online platform infrastructure
• Provision of software, computing capacity, storage space, and database resources
• Security services and technical maintenance

In this context, we and our hosting provider process content data, personal data, contract data, usage data, meta-information, and communications data from customers, prospects, and visitors to this online offering, based on our legitimate interests in efficient and secure provision pursuant to Article 6, Paragraph 1, Letter f GDPR in conjunction with Article 28 GDPR. Every access to the server hosting this service is recorded in a log file.

Specifically, the following information is stored:

• Name of the retrieved webpage or file
• Date and time of access
• Volume of data transmitted, notification of successful retrieval
• Browser type and version, as well as operating system used
• Address of the previously visited website
• Internet protocol address of the visitor at the utilized provider

Log file information is stored for security purposes (such as investigating abuse or fraud) for a maximum duration of thirty days and then deleted. Data whose continued retention is required for evidentiary purposes is exempt from deletion until final clarification of the respective incident.

Cookie Usage

Our internet presence utilizes cookies. Cookies are small text files placed and stored on your computer system via your internet browser. A specific internet browser can be recognized and identified through its unique cookie identification. The purpose of this recognition is to facilitate your use of our website. In detail, we employ cookies as follows:

• We associate the contents of your shopping cart with your browser so you may continue bookings or orders initiated at a later time
• When you make settings on our site (such as travel period in the booking interface), we associate these with your browser so you need not re-enter them upon your next visit
• When you access our site via a link from another site, we associate the previous address with your cookie and read this information in case of a booking, order, or inquiry to statistically determine how our customers became aware of us
• When using a login function, you need not re-enter your access credentials with each visit to our website

You may prevent the placement of cookies by our website at any time through appropriate settings in your internet browser, thereby permanently objecting to cookie placement. Furthermore, cookies already placed may be deleted at any time via your internet browser. Should you permanently deactivate cookie placement, certain functions of our website may not be fully usable.

SSL Encryption

To protect the security of your data during transmission, we employ encryption procedures corresponding to current technological standards (such as SSL) via HTTPS.

Contact Forms

Processing of our contact forms occurs through software from Tramino (headquarters: Weststrasse 30, D-87561 Oberstdorf, privacy policy). When you contact us (via contact form, email, telephone, or social media), user information is processed for handling the contact inquiry and its settlement pursuant to Article 6, Paragraph 1, Letter b GDPR. User information is stored in a Customer Relationship Management System. We delete inquiries when they are no longer required for fulfilling your concerns. We review necessity biennially; furthermore, statutory archiving obligations apply.

Booking and Order Systems

Processing of our bookings or orders occurs through software from Tramino (headquarters: Weststrasse 30, D-87561 Oberstdorf, privacy policy). This service provider is engaged based on our legitimate interests pursuant to Article 6, Paragraph 1, Letter f GDPR and a data processing agreement pursuant to Article 28, Paragraph 3, Sentence 1 GDPR, and does not use the resulting personal data for its own purposes nor transmit it to third parties.

Data collected during booking or ordering (address data including postal address, communication data such as telephone number and email address) as well as information about accompanying persons (names, birth dates) are stored in a Customer Relationship Management System. If you provide special personal data relevant to fulfilling our services, such as allergy-related intolerances, these are also stored. We delete this data when it is no longer required for fulfilling your concerns. We review necessity biennially; furthermore, statutory archiving obligations apply.

Newsletter Services

Distribution of our newsletter occurs through software from Tramino (headquarters: Weststrasse 30, D-87561 Oberstdorf, privacy policy). The distribution service provider is engaged based on our legitimate interests pursuant to Article 6, Paragraph 1, Letter f GDPR and a data processing agreement pursuant to Article 28, Paragraph 3, Sentence 1 GDPR. The distribution service provider may use recipient data in anonymized form for optimizing or improving its own software, for technical optimization of distribution, newsletter presentation, or for statistical purposes. However, the distribution service provider does not use data from our newsletter recipients to contact them directly or to transmit data to third parties.

To verify that registration is actually performed by the owner of an email address, we employ the "double opt-in" procedure. We log the newsletter order, transmission of a confirmation email, and receipt of the response requested thereby.

Our newsletters contain a pixel-sized image loaded from our distribution service provider's server when the newsletter is opened. During this process, information about the browser and operating system used, internet protocol address, and retrieval time is collected. This data is used for technical improvement of the service and statistical determination of reading behavior and access times. Furthermore, it is recorded which links within the newsletter were clicked. While this data can technically be associated with individual recipients, it is not used to observe individual users but only to statistically recognize reading habits and adapt our content accordingly or to send different content according to interests.

Every newsletter we send contains a direct unsubscribe link. You may also unsubscribe here by providing your email address.

Our Social Media Presence

We maintain active engagement in social networks and platforms to communicate with customers and interested parties active there and to provide information about our services. When using respective networks or platforms, the terms of service and privacy policies of their respective operators apply. We process user data only when they communicate with us in social networks or platforms, create posts, or send us messages.

YouTube Integration

Videos from the platform YouTube, operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, may be embedded on our website. Google is certified under the Privacy Shield Agreement, thereby providing a guarantee to observe European data protection law. Please also note Google's privacy policy.

When you visit a page with the YouTube plugin, a connection to YouTube servers is established. YouTube is thereby informed which pages you visit. If you are logged into your YouTube account, YouTube can associate your surfing behavior with you personally. You prevent this by logging out of your YouTube account beforehand. When a YouTube video is started, the provider employs cookies that collect information about user behavior. Anyone who has deactivated cookie storage for the Google Ad program need not expect such cookies when viewing YouTube videos. However, YouTube also stores non-personal usage information in other cookies. Should you wish to prevent this, you must block cookie storage in your browser.

Google Analytics Usage

This website utilizes Google Analytics, a web analysis service from Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google is certified under the Privacy Shield Agreement, thereby providing a guarantee to observe European data protection law. Please also note Google's privacy policy.

Google Analytics employs so-called "cookies," text files stored on your computer enabling analysis of your website usage. Information generated by the cookie regarding your use of this website (including your internet protocol address) is transmitted to and stored on a Google server in the United States. Google will use this information to evaluate your website usage, compile reports on website activities for website operators, and provide additional services related to website and internet usage. Google may also transfer this information to third parties where required by law or where such third parties process data on behalf of Google. Under no circumstances will Google associate your internet protocol address with other Google data. You may prevent cookie installation through appropriate browser software settings; however, we note that in this case you may not be able to use all functions of this website to their full extent. By using this website, you consent to processing of data concerning you by Google in the manner and for the purposes described above.

Google tracking codes on this website employ the "_anonymizeIp()" function, whereby internet protocol addresses are only processed in shortened form to preclude direct personal identification. Data collection and storage may be objected to at any time with future effect. By clicking the "Deactivate" button, tracking is completely prevented. For objection to remain permanent, your browser must accept cookies. Alternatively, you may object to data collection through deployment of a Google browser plugin.

Google Maps Implementation

We integrate maps from the "Google Maps" service operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google is certified under the Privacy Shield Agreement, thereby providing a guarantee to observe European data protection law. Please also note Google's privacy policy.

We utilize the Google Maps API to visually present geographical information. When using Google Maps, Google also collects, processes, and uses data regarding visitor use of map functions. More detailed information about data processing by Google can be found in Google's privacy notices. There you may also modify your personal privacy settings in the Privacy Center.

Google Fonts

We integrate fonts from the "Google Fonts" service. Provider: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google is certified under the Privacy Shield Agreement, thereby providing a guarantee to observe European data protection law. Please also note Google's privacy policy.

Google ReCaptcha

We integrate the bot detection function for inputs in online forms ("ReCaptcha") from provider Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google is certified under the Privacy Shield Agreement, thereby providing a guarantee to observe European data protection law. Please also note Google's privacy policy.

Validity of This Statement

By using our website, you consent to the data usage described above. Due to continued development of our website or implementation of new technologies, it may become necessary to modify this privacy statement. We reserve the right to amend this privacy policy at any time with future effect. We therefore recommend that you regularly review this privacy statement.