Content Structure

§ 1 Information on the collection of personal data
§ 2 Legal basis of processing
§ 3 Disclosure of data
§ 4 Rights of data subjects
§ 5 Collection of personal data when visiting our website
§ 6 Contact forms
§ 7 Links to other websites / References to third-party websites
§ 8 Hosting
§ 9 Cookies
      9.1 Fonts (local hosting) 9.2 Google Tag Manager
      9.3 Google Maps form
      9.4 Mapbox 9.5 Matterport
      9.6 ipify
§ 10 Newsletter (dailypoint)
§ 11 AI ChatBot & WhatsApp Chat
      11.1 Alveni AI ChatBot (+ jQuery)
      11.2 Seminargo
§ 12 Data transmission upon conclusion of contracts for services and digital content
§ 13 Marketing
      13.1 Google Analytics
      13.2 Hotjar
      13.3 Meta Pixel (formerly Facebook Pixel)
§ 14 Processing under contract
§ 15 SSL encryption
§ 16 Security notice
§ 17 Changes to this privacy policy
§ 18 Duration of storage of personal data

Privacy Policy

§ 1 Information on the collection of personal data

Below, we inform you about the collection of personal data when you use our website. Personal data are all data that relate to you personally, e.g., name, address, email addresses, user behavior.

The controller pursuant to Art. 4(7) of the EU General Data Protection Regulation (GDPR) is:

PLAZA Hotelgroup GmbH
Lise-Meitner-Straße 4, 74074 Heilbronn
Phone: +49 (0) 7131 26417 0 Email: info@plazahotels.de

(see our imprint: https://plazahotels.de/en/imprint/)

You can reach our Data Protection Officer at DSKC Datenschutz-Arbeitssicherheit-Kompetenz-Center GmbH, Sielower Landstraße 68, 03044 Cottbus, Germany, email: info@dskc.de, phone: +49 355 48679410.

§ 2 Legal basis of processing

Our company relies on Art. 6(1)(a) GDPR as the legal basis for processing data when we obtain your consent for a specific processing purpose.

For processing operations required to carry out pre-contractual measures, for example in cases of inquiries about our products or services, the processing is based on Art. 6(1)(b) GDPR.

If we are subject to a legal obligation that requires the processing of personal data, e.g., to fulfill obligations under the TDDDG (Telecommunications-Digital Services Data Protection Act) or DDG (Digital Services Act—Germany), the processing is based on Art. 6(1)(c) GDPR.

Processing operations may also be based on Art. 6(1)(f) GDPR. This legal basis applies to processing operations when none of the above legal bases apply and the processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party, provided that the interests or fundamental rights and freedoms of the data subject do not override those interests.

§ 3 Disclosure of data

Your personal data will not be transferred to third parties for purposes other than those listed below. We only disclose your personal data to third parties if:

• you have given your explicit consent pursuant to Art. 6(1) sentence 1 lit. a GDPR,
• the disclosure is necessary for the establishment, exercise, or defense of legal claims pursuant to Art. 6(1) sentence 1 lit. f GDPR and there is no reason to assume that you have an overriding legitimate interest in not having your data disclosed,
• there is a legal obligation for the transfer pursuant to Art. 6(1) sentence 1 lit. c GDPR, and it is legally permissible and necessary for the performance of contractual relationships with you pursuant to Art. 6(1) sentence 1 lit. b GDPR.

§ 4 Rights of data subjects

In accordance with the statutory provisions of the GDPR, you have the following rights regarding your personal data:

• Right of access under Art. 15 GDPR
• Right to rectification under Art. 16 GDPR
• Right to erasure under Art. 17 GDPR
• Right to restriction of processing under Art. 18 GDPR
• Right to data portability under Art. 20 GDPR
• Right to object to processing under Art. 21 GDPR and, where based on consent, under Art. 7(3) GDPR

You also have the right under Art. 77 GDPR to lodge a complaint with a supervisory authority about unlawful processing of your personal data by us.

§ 5 Collection of personal data when visiting our website

When you use the website purely for informational purposes, i.e., if you do not register or otherwise transmit information to us, we only collect the personal data that your browser transmits to our server. If you wish to view our website, we collect the following data, which are technically necessary for us to display our website to you and to ensure stability and security (the legal basis is Art. 6(1) sentence 1 lit. f GDPR):

• IP address
• Domain name of the website you came from
• Names of the files retrieved
• Date and time of a request
• Name of your Internet Service Provider
  and, where applicable, the operating system and browser version of your device

We reserve the right to carry out statistical evaluations of anonymized data sets.

§ 6 Contact forms

When you submit inquiries to us via a contact form, by email, or by telephone, the information you provide, including all resulting contact data, is processed and, if applicable, stored by us solely for the purpose of processing your inquiry and in case of follow-up questions. These data are used exclusively for the purpose of responding to and handling your request. The legal basis for this data processing is Art. 6(1) sentence 1 lit. b GDPR; these are pre-contractual measures. You may object to this processing at any time with effect for the future.

§ 7 Links to other websites / References to third-party websites

Our website may also contain links to third-party websites. If you choose to follow a link to an external website, please note that the website has its own privacy policy. We assume no liability for this privacy policy or its content. We recommend that you obtain information from the external provider about the processing of your data.

From time to time, we refer to content from other providers on our website. For this we use links or linked objects; these are marked accordingly. Only when you click on a link will your data (IP address, time of clicking, the page on which you clicked the link, information about your Internet browser) be transmitted to the provider. This is technically necessary to display the content to you. The legal basis for this processing is Art. 6(1) sentence 1 lit. f GDPR; our legitimate interest lies in offering you a complete, easy-to-use information service.

If you do not click these links, your data will not be transmitted to third parties.

§ 8 Hosting

Our website is hosted by an external provider. Our host processes your data only to fulfill its service obligations and will follow our instructions regarding these data.

Your personal data are collected on the servers of our host when you visit our website. This includes, for example, IP addresses, your contact data, your meta and communication data, and other data generated when accessing the website. The purpose of external hosting is based on our performance of a contract with the customer (legal basis Art. 6(1) lit. b GDPR) as well as the secure, fast, and efficient provision of an online offering (legal basis Art. 6(1) lit. f GDPR).

If processing is based on consent, the legal basis is Art. 6(1) lit. a GDPR and, among other things, § 25(1) TDDDG, insofar as consent is given for cookie storage or access to information on the user’s device takes place within the meaning of the TDDDG (e.g., device fingerprinting). Consent may be withdrawn at any time.

Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen

A data processing agreement (DPA) has been concluded with the host.

§ 9 Cookies

Our website uses cookies. Cookies are small text files stored on users’ end devices via the Internet browser. When our website is called up again or when navigating between subpages, cookies can recognize the browser and transmit certain information.

We use cookies to make our online offering user-friendly, effective, and secure. Some functions of our website require technically necessary cookies that enable the operation of the site in the first place (e.g., login functions or language settings). Storage of or access to information on your end device takes place in accordance with § 25 TDDDG.

• No consent is required for technically necessary cookies (§ 25(2) TDDDG).
• All other cookies (e.g., statistics, marketing, or third-party cookies) are processed only with your consent pursuant to Art. 6(1) lit. a GDPR.

Where data processing is based on Art. 6(1) lit. f GDPR, our legitimate interest lies in ensuring a technically error-free and optimized provision of our website. You have the right to object to the processing of personal data at any time. This is done via the icon element in the lower left area of your website view.

By selecting appropriate technical settings in your Internet browser, you can prevent the storage of cookies and the transmission of the data contained therein. Cookies already stored can be deleted at any time. However, please note that you may then not be able to use all functions of this website to their full extent.
You can block cookies in the local settings of your Internet browser (e.g., Chrome, Safari, Mozilla, Opera, Firefox, Microsoft…).

9.1 Fonts (local hosting)
This site uses fonts (web fonts), some of which are provided by Google, for display purposes. All fonts are installed locally. No connection to external servers (e.g., Google) takes place.

9.2 Google Tag Manager
This website uses Google Tag Manager, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Tag Manager is used to manage website tags via a unified interface. The tool itself processes personal data for technically necessary purposes, for example to trigger, control, and monitor errors of embedded tags. The Tag Manager does not access the data collected by other Google components.

9.3 Google Maps form
We provide an input form that allows you to display the position on the map for an address, e.g., for route planning. The underlying map software is provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Only when you submit the form will your entry, together with your IP address and the address of the page on which the form is located, be transmitted to Google. By using the form, you agree to the collection, processing, and use of the data by Google and its representatives. Terms of Use for Google Maps. Google Privacy Policy.

Please note that, due to the U.S. CLOUD Act, U.S. intelligence services may potentially gain access to personal data that are necessarily exchanged with Google when this tool is embedded as a result of the Internet protocol.

9.4 Mapbox
Our website uses Mapbox (Mapbox Inc., 740 15th Street NW, 5th Floor, District of Columbia 20005, USA) as an interactive map provider to display our locations. The map view is provided via a static image that can be displayed larger or smaller.
When a request is made to the Mapbox API, technical information (IP address, browser information, operating system details, partial location and usage data, date, time, etc.) is automatically collected by Mapbox. The processing of data serves the provider to continuously improve the product. Randomly generated IP addresses are used to analyze user behavior.
If you wish to check or prevent your usage behavior from being processed, you can withdraw your consent in the cookie settings or disable cookies in your browser settings. In this case, the map display will no longer be possible.
Further information about the purpose and scope of data collection by Mapbox can be found in the privacy notice (https://www.mapbox.com/privacy/).

9.5 Matterport
We use the 3D data platform Matterport on our website, operated by Matterport Inc., 352 E. Java Drive, Sunnyvale, CA 94089, USA. The service enables the display of virtual 3D tours, for example to present hotel rooms or event spaces.
When using Matterport, connections are made to the provider’s servers. In doing so, personal data such as your IP address and technical information about your device may be transmitted to Matterport and processed on servers in the USA.
Please note that, according to the Court of Justice of the European Union, there is currently no adequate level of data protection in the USA within the meaning of the GDPR. This may entail risks for the enforcement of your data subject rights and the protection of your data.
To safeguard data transfers, Matterport relies on the EU Commission’s Standard Contractual Clauses pursuant to Art. 46(2) and (3) GDPR. These are intended to ensure that your personal data are subject to the European level of data protection even when processed in third countries. Matterport thus undertakes to comply with EU data protection requirements, even if data are stored or processed in the USA.
Further information on data protection and the Standard Contractual Clauses used by Matterport can be found at: https://matterport.com/standard-contractual-clauses

9.6 ipify
Our website or application uses the ipify service (operated by Randall Degges, USA) to determine the public IP address of the calling device. The service is used solely to technically determine the IP address and, where applicable, to display or verify the network connection.
When accessing the API at https://api.ipify.org, the user’s IP address is transmitted to ipify’s servers. According to the provider, no personal data are permanently stored or evaluated; the IP address is processed only temporarily to answer the request.
The legal basis for this processing is Art. 6(1) lit. f GDPR. Our legitimate interest lies in the secure and reliable provision of our online services.
Since ipify is a service based in the USA, it cannot be ruled out that data will be transferred to a third country for which there is no adequacy decision by the EU Commission. The transfer is based on the Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.

§ 10 Newsletter

(1) We use your email address and personal information independently of contract processing exclusively for our own advertising purposes for sending newsletters, provided that you have expressly consented to this. Processing is carried out on the basis of Art. 6(1)(a) GDPR with your consent. You can withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. You can unsubscribe from the newsletter at any time by using the corresponding link in the newsletter. Your email address will then be removed from the distribution list.

(2) For sending and managing our newsletter, we use the service dailypoint®, a product of Toedt, Dr. Selk & Coll. GmbH, Augustenstraße 79, 80333 Munich, Germany. The data you provide (e.g., name and email address) are processed via dailypoint® to send you regular information on current offers, news, or events.

(3) We use the so-called double-opt-in procedure for newsletter registration. This means that after you register, we send an email to the specified email address asking you to confirm that you wish to receive the newsletter. If you do not confirm your registration within 14 days, your information will be deleted automatically.

(4) To prevent automated registrations, a numeric code is requested in the newsletter form. This security check serves to distinguish between a human entry and automated spam requests.

(5) After submitting the form, you will receive a confirmation email from dailypoint®/Mailingwork with a link to finally activate your subscription (double-opt-in procedure). Only after this confirmation will your email address be added to our distribution list. This procedure serves to authenticate your address and to document your consent.

We point out that, with your consent and where you have agreed to this tracking via the consent manager, we evaluate your user behavior when sending the newsletter. For this evaluation, the emails sent contain so-called web beacons and/or cookies that are stored on our website. For the evaluations, we link parts of the data mentioned in § 5 and the web beacons with your email address and an individual ID.
As part of the sending process, dailypoint® collects technical information, such as when an email was opened or a link was clicked. These data are used solely for statistical evaluation and to optimize content. No further use, in particular for advertising purposes outside the newsletter, takes place.

You can object to this tracking at any time by clicking the separate link provided in each email or by informing us via another contact channel. The information is stored for as long as you subscribe to the newsletter. After unsubscribing from the newsletter, we automatically delete your required data within 24 hours, provided there are no statutory retention obligations.

No data will be transferred to third countries.

§ 11 AI ChatBot & WhatsApp Chat

11.1 Alveni AI ChatBot

Our website uses, to a limited extent, the chat application of Alveni AG, Balbweg 7, 8832 Wollerau, Switzerland (www.alveni.ai), to enable you to contact our team directly and easily. The chat is used exclusively to answer questions about our hotel, our services, and reservations.

When using the chat, only the data you voluntarily provide - such as your name, email address, or message - are processed. This information is used exclusively to handle your request, for example to clarify questions or to assist with bookings. It is not used for advertising or analytics purposes.

For technical operation, your IP address and a technically necessary cookie with a session ID are processed. This cookie enables the maintenance of the chat history and is deleted no later than three months. You can disable the storage of cookies in your browser; however, this may limit the functionality of the chat.

Processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in fast, secure, and service-oriented communication with our guests. Providing personal data is voluntary and can also be done anonymously. You can object to the processing of your data at any time with effect for the future (privacy@alveni.ai). Further information on data protection can be found at www.alveni.ai/datenschutz.

We also offer the option to communicate directly via WhatsApp with our AI-powered chatbot from Alveni using a button. In the WhatsApp chat environment, the same AI chatbot is integrated as on our website. As soon as you click the WhatsApp button, you leave our website and contact us via the WhatsApp service (Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland). In doing so, your phone number, your WhatsApp name, and the messages you send are transmitted to WhatsApp. The WhatsApp privacy policy applies: https://www.whatsapp.com/legal/privacy-policy-eea?lang=en.

In this communication, your messages via WhatsApp are forwarded to Alveni’s AI chatbot so that your request can be answered automatically or by our team. Alveni processes the transmitted data (name, phone number, chat content, time of the message, and, where applicable, IP address) solely for the purpose of responding to your inquiry.

Processing is based on Art. 6(1)(b) GDPR (contract initiation or performance) and, insofar as technically necessary, Art. 6(1)(f) GDPR (legitimate interest in a secure and efficient communication service). No further use or profiling takes place.

jQuery JavaScript library

This site uses the jQuery library for JavaScript functions, which is retrieved from a Google server. Your IP address, along with the page (Internet address) you visited, is transmitted to a Google server. Further information can be found in Google’s Privacy Policy at https://policies.google.com/privacy?hl=en.
Please note that, due to the U.S. CLOUD Act, U.S. intelligence services may potentially gain access to personal data that are necessarily exchanged with Google when this tool is embedded as a result of the Internet protocol.

11.2 Seminargo (conference and event inquiries)
We use the Seminargo service on our website, to a limited extent, to handle conference and event inquiries, operated by seminargo GmbH, Simmeringer Hauptstraße 24, 1110 Vienna, Austria (www.seminargo.com). With this tool, you can conveniently submit inquiries for seminars, conferences, or events.
When using Seminargo, the personal data you provide - such as name, contact details, company affiliation, event details, and other messages - are processed and transmitted to Seminargo. The processing of these data is carried out solely for the purpose of handling your inquiry and/or for performing pre-contractual measures pursuant to Art. 6(1)(b) GDPR.
Seminargo processes the data on our behalf and only to the extent necessary to provide the service.
There is no further use of the data, such as for advertising or analytics purposes. Data are not transferred to third countries outside the EU.
Further information on data processing by Seminargo can be found in the privacy policy of seminargo GmbH at: https://www.seminargo.com/nutzungsbedingungen

§ 12 Data transmission upon conclusion of contracts for services and digital content

Online reservation
To use our online reservation, certain personal data must be provided. These data are processed pursuant to Art. 6(1)(b) GDPR for the purpose of carrying out pre-contractual measures and fulfilling a contract. In particular, the following information is collected:

1. Master data
   – First and last name, additional names
2. Contact details
   – Email address (for booking confirmation and communication)
   – Postal address (for sending travel documents and invoices)
   – Telephone (for queries)
3. Payment data
   – Payment modalities
   – Credit card information (to secure or process the booking and/or payment)
4. Communication data
   – Contents of your messages (e.g., special requests or notes regarding the reservation)
   – Booking and reservation details (e.g., stay period, room category, number of persons)
5. Contract data
   – Consent to GTC

To process your reservation, we cooperate with Hotelpartner Management GmbH, International Group Headquarters, Chaltenbodenstrasse 16, 8834 Schindellegi, Switzerland. Your data are transmitted to this service provider solely in the context of contract performance.

Your payment data are transmitted to the bank commissioned or the payment service provider you choose to process the payment, insofar as this is necessary for the execution of the payment. The processing and transfer of these data are carried out on the basis of Art. 6(1)(b) GDPR for the performance of the underlying contract.

Encrypted payment transactions
To process payments, personal data are transmitted exclusively via secure SSL encryption to the payment provider you selected during the order process. The transfer is made for the purpose of payment processing and is based on Art. 6(1)(a) GDPR (consent) as well as Art. 6(1)(b) GDPR (processing for the performance of a contract). You can withdraw your consent at any time with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out up to that point.

Payment by Visa, Mastercard, American Express
For credit card payments, processing is carried out via Concardis GmbH, Helfmann-Park 7, 65760 Eschborn, Germany. The data required for this (credit card number, expiry date, security code) are transmitted in encrypted form to Concardis and are not visible to us as the website operator. Electronic credit card payment processing is PCI-DSS certified and thus ensures the highest security standards to protect your data.

PayPal
We also offer payment via PayPal on our website. The provider is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. If you select this payment method, you will be redirected to PayPal to execute the payment. In doing so, we pass your data to PayPal in accordance with § 5 (IP address; website from which the request originates) to enable a simple payment process.
Processing is carried out on the basis of Art. 6(1)(a) GDPR (consent) and Art. 6(1)(b) GDPR (contract performance). You can withdraw your consent at any time with effect for the future. A withdrawal does not affect the lawfulness of processing already carried out.

§ 13 Marketing

13.1 Google Analytics

(1) This website uses Google Analytics, a web analytics service of Google Inc. (“Google”). Google Analytics uses so-called “cookies,” text files that are stored on your computer and enable an analysis of your use of the website. The information generated by the cookie about your use of this website is generally transmitted to a Google server in the USA and stored there. If IP anonymization is activated on this website, your IP address will, however, be shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area beforehand. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activities, and to provide other services related to website and Internet usage to the website operator.

(2) The IP address transmitted by your browser within the scope of Google Analytics will not be merged with other data by Google.

(3) You can prevent the storage of cookies by selecting the appropriate settings in your browser software; however, please note that, in this case, you may not be able to use all functions of this website to their full extent. You can also prevent the collection of the data generated by the cookie and related to your use of the website (including your IP address) by Google and the processing of these data by Google by downloading and installing the browser plug-in available at the following link: https://tools.google.com/dlpage/gaoptout?hl=en.

(4) We use Google Analytics to analyze and regularly improve the use of our website. The statistics obtained allow us to improve our offering and make it more interesting for you as a user. For exceptional cases in which personal data are transferred to the USA, Google also processes your personal data in the USA within the framework of the Standard Contractual Clauses (SCCs) and additional technical and organizational measures. Information on this can be found at: https://privacy.google.com/businesses/compliance/#!#gdpr. The legal basis for the use of Google Analytics is Art. 6(1) sentence 1 lit. f GDPR.

(5) Information about the third-party provider: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001. Terms of use: http://www.google.com/analytics/terms/de.html, Privacy Policy: https://policies.google.com/privacy?hl=en&gl=de.

(6) This website also uses Google Analytics for a cross-device analysis of visitor flows, which is carried out via a user ID. You can deactivate the cross-device analysis of your usage in your Google account under “My data,” “personal data.”

13.2 Hotjar

This website uses the web analytics service Hotjar, operated by Hotjar Ltd., Level 2, St Julians Business Centre, 3 Elia Zammit Street, St Julians STJ 1000, Malta (www.hotjar.com). Hotjar is used to analyze user behavior on our website in order to improve the user-friendliness and performance of our online offerings.

With Hotjar, interactions by website visitors—such as mouse movements, clicks, scrolling behavior, or time spent on specific areas—can be recorded and visually represented in so-called heatmaps. This allows us to identify which areas of our website are used particularly frequently. In addition, so-called conversion funnels can be analyzed to determine where users, for example, abort form entries. Hotjar also provides the ability to obtain direct feedback from website visitors.

Hotjar uses cookies to analyze visitor behavior and ensure the functionality of the service. These cookies store information about whether our website has been visited with a particular device or whether Hotjar has been deactivated in a browser. Cookies remain on your end device until you delete them.

The use of Hotjar is based on Art. 6(1)(f) GDPR. We have a legitimate interest in analyzing user behavior to design our web offering to be user-friendly and needs-based. Where consent has been obtained via a cookie banner, processing is additionally based on Art. 6(1)(a) GDPR. Consent can be withdrawn at any time with effect for the future.
If you wish to deactivate data collection by Hotjar, you can do so at the following link: https://www.hotjar.com/opt-out. Please note that deactivation must be carried out separately for each browser and device.
Further information on data processing by Hotjar can be found in Hotjar’s Privacy Policy at: https://www.hotjar.com/privacy.

13.3 Meta Pixel (Facebook Pixel)

Our website uses the so-called Meta Pixel (formerly “Facebook Pixel”) of Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (formerly Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA) to measure conversions.

The Meta Pixel allows us to track the behavior of visitors to our website after they have been redirected to our website by clicking on a Meta advertisement (e.g., on Facebook or Instagram). This enables us to analyze the effectiveness of our advertisements for statistical and market research purposes and to optimize future advertising measures.

The data collected via the pixel are anonymous to us; we cannot draw any conclusions about individual persons. However, Meta can link these data with existing Facebook or Instagram user accounts and use them in accordance with Meta’s Data Policy for its own advertising and analytics purposes, in particular to display personalized advertising within Meta services and on other websites. We have no influence on this processing by Meta.

The use of the Meta Pixel is based on Art. 6(1)(f) GDPR, as we have a legitimate interest in targeted analysis and optimization of our marketing measures via social networks. If you have given consent via our cookie consent tool, processing is additionally based on Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future.

Further information on data protection at Meta can be found at: https://www.facebook.com/about/privacy/.
You can deactivate the “Custom Audiences” remarketing function in your Facebook ad settings: https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen. If you do not have a Facebook account, you can deactivate usage-based advertising by Meta on the website of the European Interactive Digital Advertising Alliance: http://www.youronlinechoices.com/de/praferenzmanagement/.

§ 14 Processing under contract

A data processing agreement is necessary if personal data of the website operator are transferred to a third party.

We have concluded a data processing agreement pursuant to Art. 28 GDPR with our service providers, which ensures that your data are processed exclusively in accordance with our instructions and in compliance with European data protection requirements.

§ 15 SSL encryption

The transmission of data from your browser to our server, as well as data provided by servers, is carried out via SSL encryption (Secure Socket Layer). The encrypted data transmitted cannot be altered. In addition, the sender of the data is identifiable.
Depending on the browser used, you can recognize SSL encryption in the address field by the prefixed “https://,” the lock symbol, or similar indicators.

§ 16 Security notice

By appropriate technical and organizational measures, we protect your data and our data against loss, destruction, unauthorized access, unauthorized alteration, or unauthorized distribution. Despite all due care, comprehensive protection against all risks is not possible in every case. For example, when communicating by email, we cannot fully guarantee data security. As an alternative for transmitting confidential information, postal mail would be advisable.

§ 17 Changes to this privacy policy

If the legal situation, this online offering, or the manner of data collection changes, we will amend this privacy policy. These changes relate only to information about processing on our homepage. If consent has been given, changes to the privacy policy will only be made with the user’s approval.

§ 18 Duration of storage of personal data

The duration of the storage of personal data is based on the respective statutory retention period (e.g., commercial and tax retention periods). After the period expires, the corresponding data are routinely deleted, provided they are no longer required for contract performance or contract initiation and/or we have no legitimate interest in continuing storage.