German
Logo

Marktredwitz

MODERN AND CHARMING

Privacy Policy

The City of Marktredwitz is committed to protecting your personal data. In this Privacy Policy, we provide information about the processing of personal data when you use our website and—where applicable—about other typical processing situations (e.g., events, job applications).

To the extent that we store information on your device or access information already stored there (e.g., through cookies or similar technologies), this is also done in accordance with Section 25 of the TDDDG.

For specific administrative procedures or special processing operations, we will provide you with additional information as needed.

1. Person in Charge

Stadt Marktredwitz
Egerstraße 2
95615 Marktredwitz
Phone: +49 (0) 9231 501 0
Fax: +49 (0) 9231 501 174
Email: E-Mail

The city of Marktredwitz is a public-law entity and is represented by Mayor Oliver Weigel.

2. Data Protection Officer

You can contact our data protection officer at:

fly-tech IT GmbH & Co. KG
Winterbruckenweg 58
86316 Friedberg
Phone: 0821 207 111 17
Email: E-Mail

If you have any questions regarding data protection, you can contact our data protection officer at any time.

3. Purposes and Legal Bases

We process personal data to the extent necessary to fulfill our legal obligations. The legal basis is generally Article 6(1), first sentence, letter e of the GDPR in conjunction with Article 4(1) of the Bavarian Data Protection Act (BayDSG) (performance of a task carried out in the public interest or in the exercise of official authority).

To the extent that we obtain your consent for certain processing activities, the processing is based on Article 6(1), first sentence, letter a of the GDPR. You may revoke any consent you have given at any time with future effect.

4. Recipients/Categories of Recipients

In connection with our website and digital administrative services, depending on the features you use, the following recipients or service providers, in particular, may receive personal data or process it on our behalf (listed below with their addresses and brief descriptions):

  • Institute for Municipal Data Processing in Bavaria (AKDB)  (Citizen Service Portal)
    The technical operation of municipal IT systems and the citizen service portal is handled by:
    Anstalt für Kommunale Datenverarbeitung in Bayern (AKDB)
    Hansastraße 12–16, 80686 München
    Postfach 150 140, 80042 München
    Phone: 089 5903-0
    Fax: 089 5903-1845
    Email: E-Mail
    Privacy Notice: Depending on the online service, AKDB processes data on our behalf as a data processor (e.g., operation/hosting of online services). Details can be found in the respective online service within the Citizen Service Portal.
    Privacy Policy: https://www.akdb.de/datenschutz/
     
  • komuna GmbH IT Consulting (komuna.RIS – Council Information System), Wallerstraße 2, 84032 Altdorf.
    Privacy Notice: The technical operation of the Council Information System may be carried out by komuna (typically as a data processor). The types of data processed in the Council Information System (e.g., access/usage data) are specified in the notices within the RIS.
    Privacy Policy: https://www.komuna-web.de/datenschutz.php
     
  • Bavarian State Ministry for Digital Affairs (BayernPortal), Oskar-von-Miller-Ring 35, 80333 München.
    Privacy Notice: When accessing or using central portal services, the BayernPortal privacy policy applies.
    Privacy Policy: https://www.bayernportal.de/datenschutz
     
  • BayernID (User account of the Free State of Bavaria) – A central service under the jurisdiction of the Free State of Bavaria (provided through the BayernPortal).
    Privacy Notice: If you authenticate yourself via BayernID to securely use online forms, the operator of the user account will process the data required for this purpose under its own responsibility in accordance with its privacy policy.
    Privacy Policy: https://id.bayernportal.de/de/datasecurity
     
  • Bentjen Software GmbH (Online Appointment Scheduling), Hebelweg 8, 76275 Ettlingen.
    Privacy Notice: When you book an appointment, the information you provide (e.g., contact information, appointment details, and the reason for your visit) will be processed for the purpose of scheduling the appointment; please refer to the privacy notice within the appointment booking system for more details.
    Privacy Policy: https://termin-online-buchen.de/doc/Termin-online-buchen-Datenschutz.pdf
     
  • RUBICON IT GmbH (Nova Find / Digital Lost and Found Office), Gonzagagasse 16, 1010 Wien, Austria (“FundInfo” Service).
    Privacy Notice: When using the digital Lost and Found Office, data is processed for the purpose of handling reports of lost or found items. The relevant privacy notices are provided on the Lost and Found Office portal.
    Privacy Policy: https://fundinfo.de/datenschutz/
  • Healy Hudson GmbH (German e-Procurement), Murnaustraße 10, 65189 Wiesbaden (Platform for Public Bids).
    Privacy Notice: When using the e-procurement platform, registration, communication, and procedural data are processed. The privacy policy of the procurement platform applies.
    Privacy Policy: https://www.deutsche-evergabe.de/home/DataSecurity
     
  • Lachnit & Rademacher GmbH (FreiNet-Online), Jahnstraße 31, 64732 Bad König (“MAKmit” Citizen Information Center).
    Privacy Notice: When using FreiNet-Online, personal data may be processed depending on the function (e.g., contacting us/submitting information); the privacy notices are provided on the respective online service.
    Privacy Policy: https://freinet-online.com/?show=datenschutz
     
  • komoot GmbH (Tour Collection/Bindings), Kienberger Allee 4, 12529 Schönefeld.
    Privacy Notice: When viewing komoot content (e.g., tours), data may be transmitted to komoot (e.g., IP address, device/browser information). It cannot be ruled out that komoot may process data in third countries; komoot’s privacy policy applies.
    Privacy Policy: https://www.komoot.com/de-de/privacy
     
  • Fichtelgebirge Tourism Association (Fichtelgebirge Tour Portal), Rathaus, 95686 Fichtelberg.
    Privacy Notice: When using the tour portal, the privacy policy posted there applies; due to technical reasons, usage and log data may be processed when you access the site.
    Privacy Policy: https://www.fichtelgebirge.bayern/datenschutzerklaerung
     
  • digi·access GmbH (Accessibility Tool: digi smartPlugin / digi easyLanguageAI), Quarzstr. 4, 51371 Leverkusen.
    Privacy Notice: To support accessibility, features such as contrast and display adjustments, as well as a live translator into plain language, may be provided. Depending on the specific implementation, technical usage data (e.g., IP address, browser and device information) may be processed; when using the translation feature, the content requested in each instance is also processed. The provider’s privacy policy applies.
    Privacy Policy: https://www.digiaccess.org/datenschutzerklaerung/

Whether a service is classified as data processing or involves independent responsibility depends on the specific service and usage scenario. To the extent that we engage providers as data processors, this is done on the basis of a data processing agreement. To the extent that providers render services under their own responsibility (e.g., central portal services) or joint responsibility applies, the privacy notices of the respective provider/portal (typically available within the respective online service) apply in addition.

Where applicable, we may transfer data to the relevant supervisory and auditing authorities to the extent necessary to exercise control rights.

To mitigate information technology security risks, log data may be transferred to the State Office for Information Technology Security in accordance with the applicable state regulations (see the “Logging” section).

5. Retention period

We process and store personal data only for as long as is necessary for the respective purpose or as required by statutory retention periods. Afterward, the data is deleted or—where applicable—anonymized.

6. Rights of the Data Subject

When we process your personal data, you have the following rights—subject to the applicable legal requirements:

  • Right of access (Art. 15 GDPR) and—where applicable—restrictions on access under the Bavarian Data Protection Act (BayDSG)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR) or restriction of processing (Art. 18 GDPR)
  • Objection to processing on grounds relating to your particular situation (Art. 21 GDPR)
  • Withdrawal of consent with future effect (Art. 7(3) GDPR)

Note: The rights listed above may be restricted in specific cases by the GDPR and national regulations.

For more information, please contact our Data Protection Officer (see Section 2).

7. Right to File a Complaint with the Regulatory Authority

You also have the right to file a complaint with the Bavarian State Commissioner for Data Protection. You can contact the Commissioner using the following contact information:

Mailing Address: Postfach 22 12 19, 80502 München
Address: Wagmüllerstraße 18, 80538 München
Phone: 089 212672-0
Fax: 089 212672-50

Online report: https://www.datenschutz-bayern.de/service/complaint.html

8. Hosting, Logging, and Encryption

8.1 Web Host

Our web server is operated by ProComp Professional Computer GmbH. A data processing agreement (DPA) is in place for this purpose.

ProComp Professional Computer GmbH
Industrieallee 1
95615 Marktredwitz

The legal basis is Article 6(1), first sentence, letter e of the GDPR. To the extent that consent is required for this (e.g., for non-essential cookies/technologies), processing is based on Article 6(1), first sentence, letter a of the GDPR in conjunction with Section 25(1) of the TDDDG; consent may be revoked at any time.

The service provider processes data only in accordance with our instructions and in compliance with the GDPR.
 

8.2 Logging

When you visit this or other websites, you transmit data to our web server via your web browser. The following data is recorded during an active connection for communication between your web browser and our web server:

  • Date and time of the request
  • Name of the requested file
  • Page from which the file was requested
  • Access status (e.g., file transferred, file not found)
  • Web browser and operating system used
  • Full IP address of the requesting computer
  • Amount of data transferred

We store this data for technical security reasons, in particular to defend against attempted attacks on our web server. After no later than seven days, the data is anonymized by truncating the IP address to the domain level, so that it is no longer possible to establish a connection to individual users.

To prevent threats to information technology security, this data may be transmitted to the State Office for Information Technology Security (e.g., pursuant to Art. 12 of the Bavarian E-Government Act (BayEGovG) or relevant subsequent regulations).


8.3 Secure Data Transmission

This site uses SSL or TLS encryption for security reasons and to protect the transmission of confidential information, such as inquiries you send to us as the site operator. You can recognize an encrypted connection by the fact that the browser’s address bar changes from “http://” to “https://” and by the lock icon in your browser’s address bar. When SSL or TLS encryption is enabled, the data you transmit to us cannot be read by third parties.

9. Cookies

9.1 General Information

We use technically necessary cookies to enable the website to function (e.g., for session management and functionality). The legal basis is Section 25(2)(2) of the TDDDG and Article 6(1), first sentence, letter e of the GDPR. For all other (non-essential) cookies and technologies, we obtain your consent—where required—pursuant to Section 25(1) of the TDDDG; the associated processing is then carried out on the basis of Article 6(1), first sentence, letter a of the GDPR.
 

9.2 Cookie Consent Manager - Usercentrics

This website uses Usercentrics’ consent technology to manage and document consents. Provider: Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich.

When you visit our website, the following personal data is transmitted to Usercentrics:

  • Your consent(s) or the revocation of your consent(s)
  • Your IP address
  • Information about your browser
  • Information about your device
  • The time of your visit to the website

In addition, Usercentrics stores a cookie in your browser to associate the consents you have granted—or their revocation—with you. The data collected in this manner is stored until you request that we delete it, delete the Usercentrics cookie yourself, or the purpose for storing the data no longer applies. Mandatory statutory retention requirements remain unaffected.

Usercentrics is used to obtain the legally required consents for the use of certain technologies. The legal basis for this is Article 6(1)(c) of the GDPR.

A data processing agreement (DPA) is in place with Usercentrics.

10. Contacting Us Through the Website

10.1 General Information

If you submit data to us via the website (e.g., through forms), we will process it to handle your request and, if necessary, for further communication. The specific form will indicate which data is required.
 

10.2 Electronic Mail (E-Mail)

Unencrypted emails can be intercepted during transmission. It is not possible to verify identity in a legally compliant manner via a simple email. Emails containing malicious content (e.g., viruses) are automatically blocked; in some cases, spam filters may also mistakenly block legitimate messages.

If you would like to send us a message, we recommend using our secure contact form at: https://www.marktredwitz.de/kontakt
 

10.3 Contact Forms

If you send us inquiries via the contact form, we will process your information (including contact details) to handle the inquiry and for any follow-up questions.

The legal basis is generally Article 6(1), first sentence, letter e of the GDPR in conjunction with Article 4(1) of the Bavarian Data Protection Act (BayDSG) (processing of requests within the scope of our duties). To the extent that the processing relates to a contract or precontractual measures, Article 6(1), first sentence, letter b of the GDPR may apply. Your information will be deleted as soon as the processing is complete and there are no retention obligations that prevent this.
 

10.4 PDF Forms

PDF forms made available for download may contain their own privacy notices (e.g., within the form itself or in the associated procedure). Please review the respective notices.

11. Embedded Third-Party Content and Services

11.1 OpenStreetMap (Maps)

We use the OpenStreetMap (OSM) mapping service.

We integrate OpenStreetMap map data from the OpenStreetMap Foundation’s server, located at St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom. The United Kingdom is considered a safe third country under data protection law. This means that the United Kingdom maintains a level of data protection equivalent to that of the European Union. When you use OpenStreetMap maps, a connection is established to the OpenStreetMap Foundation’s servers. In the process, your IP address and other information about your activity on this website may be transmitted to the OSMF. To this end, OpenStreetMap may store cookies in your browser or use comparable recognition technologies.

The use of OpenStreetMap constitutes a task carried out in the public interest pursuant to Article 6(1)(e) of the GDPR, to enable an appealing presentation of our online offerings and to make it easy to locate the places we specify on the website. If consent has been requested, processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g., device fingerprinting) within the meaning of the TDDDG. Consent may be revoked at any time.

11.2 Venus Ai (Social Knowledge Graph: Event Planner & Map View in collaboration with the Fichtelgebirge Tourism Association)

For the event planner and map displays (e.g., for hiking tours), we use the “Social Knowledge Graph” platform from Venus Ai GmbH & Co. KG in cooperation with the Fichtelgebirge Tourism Association (Tourismuszentrale Fichtelgebirge e. V.). The content is embedded in our website via an iFrame.

The iFrame is loaded only after you give your consent. When the iFrame loads, a connection is established to servers on the Venus platform (e.g., domain: media.venus.bayern). Additionally, after you give your consent, technical libraries are loaded via content delivery networks (CDNs) (e.g., cdnjs.cloudflare.com, maxcdn.bootstrapcdn.com, code.jquery.com). In particular, your IP address, the date and time of the request, the referrer URL, and information about your browser and device may be transmitted to the respective providers; cookies or similar technologies may also be used.

Legal Basis and Revocation
The legal basis for loading the iFrame and the associated setting/reading of cookies or access to information on your device is—to the extent necessary—your consent pursuant to Section 25(1) of the TDDDG. The subsequent processing of personal data is based on your consent pursuant to Article 6(1), first sentence, letter a of the GDPR. You may revoke your consent at any time with future effect via the consent/cookie settings.

Transfers to Third Countries and Additional Information
Particularly in the case of CDNs (Cloudflare/jQuery/CDN), processing in third countries (e.g., the U.S.) cannot be ruled out. Such transfers—where applicable—are made only in compliance with the provisions of Articles 44 et seq. of the GDPR. We do not store any separate profile data in connection with this integration.

11.3 AI Chatbot “MAKSI KI”

We offer an AI-powered chatbot (“MAKSI KI”) on our website to answer frequently asked questions and make it easier to contact us. The technical infrastructure is provided by Cosmema GmbH (Carl-Benz-Ring 4–6, 85080 Gaimersheim). Hosting is provided by BYTS Tech, Stadtbadstraße 5, 85368 Moosburg a. d. Isar. Data is processed and stored exclusively in Germany; it is not transferred to third countries. Use of the chatbot is voluntary. Alternatively, you can contact us at any time using the contact methods listed in Section 1.

What data do we process?
We process the content you enter into the chat window (messages), as well as technical usage data required for operation (e.g., IP address, time, device/browser information). Please do not enter any special categories of personal data (e.g., health data) or any confidential information.

Purposes and Legal Bases
Data processing is carried out to inform the public, to support the use of our online services, and to handle inquiries. The legal basis is Article 6(1), first sentence, letter e of the GDPR in conjunction with Article 4(1) of the Bavarian Data Protection Act (BayDSG). If the chatbot is loaded only after you have actively selected it or given your consent, the processing is additionally based on Article 6(1), first sentence, letter a of the GDPR in conjunction with Section 25(1) of the TDDDG; consent may be revoked at any time.

Recipient / Hosting (Data Processing on Behalf of a Client)
We engage the aforementioned service providers as data processors in accordance with Article 28 of the GDPR for the operation, maintenance, and hosting of the chatbot. A data processing agreement is in place between the two parties. Data processing takes place exclusively in Germany.

Retention Period, Logging, and No Automated Decision-Making
Chat content and log data are stored only for as long as necessary for operations, error analysis, and the processing of your inquiry; they are subsequently deleted or anonymized, provided there are no legal retention requirements to the contrary. The chatbot does not engage in fully automated decision-making within the meaning of Article 22 of the GDPR.

11.4 “Meldoo” Defect Reporting System

On our website, we offer the option to report damage or defects in public spaces through the external service Meldoo, provided by leanact GmbH.

Description and Purpose of the Processing

Meldoo is a digital defect reporting system that allows citizens to submit reports of damage (e.g., to roads, sidewalks, streetlights, or public facilities) to the appropriate authority.

Data is processed for the purpose of receiving, processing, and tracking defect reports, as well as to improve public infrastructure and administrative efficiency.

Type of Data Processed

When using Meldoo, the following data in particular may be processed:

  • Contact information (e.g., name, email address—optional depending on usage)
  • Location data (e.g., address or GPS data of the reported defect)
  • Content data (description of the defect, photos/attachments)
  • Usage and metadata (e.g., date and time of the report, IP address)

Legal Basis

Data processing is based on:

  • Art. 6(1)(e) of the GDPR in conjunction with the performance of the respective municipal duties (performance of public tasks)
  • and, where applicable, additionally Art. 6(1)(a) of the GDPR, provided that personal data is provided voluntarily (e.g., for feedback)

Integration and Data Transfer

Meldoo is made available via an interface or integration on our website.
This may result in the transfer of personal data to the provider of Meldoo.

The provider is: leanact GmbH, Hagenmarkt 8, 38100 Braunschweig
Where necessary, a data processing agreement has been entered into with the provider in accordance with Article 28 of the GDPR.

Data Processing by the Provider
For more information about data processing by Meldoo, please see the provider's privacy policy at: Privacy Policy - leanact GmbH

Retention period
The data will be stored only for as long as is necessary to address the reported defect and for documentation purposes. Beyond that, data will be stored only if required by statutory retention obligations.

Voluntary Nature of the Information Provided
In general, you can use the defect reporting system without providing any personal contact information. If you would like to receive a response, you must provide the appropriate contact information.

Map Feature
OpenStreetMap mapping services are used to display the location. The privacy policies of the respective map provider also apply.

Privacy Policy - OpenStreetMap Deutschland

12. Events

The City of Marktredwitz organizes or co-organizes events. For this purpose, we process the personal data (name, contact information, etc.) of participants in accordance with Art. 4(1) of the Bavarian Data Protection Act (BayDSG) in conjunction with Art. 6(1), first subparagraph, letter e of the General Data Protection Regulation (GDPR). We collect the data from publicly available sources (e.g., newspapers or online publications), directly from event participants (e.g., by providing a form, via email, or by phone), or receive it from other public or private entities.

The data is processed for the purpose of preparing and conducting the respective events (e.g., creating guest lists and facilitating access control).

Depending on the type of event, the City of Marktredwitz acts as a co-organizer alongside another partner. In such cases, the collected data is transferred to this partner or, if applicable, to an external service provider, who may also use the data solely for the proper execution of the event.

The data is deleted when it is no longer necessary for fulfilling the tasks, but no later than after 30 years.

 

12.1 Photography and Videography

Photos and, in some cases, videos are taken at our events and used for the City of Marktredwitz’s public relations efforts. Media representatives may also be present at some events.

You are entitled to the rights listed in Section 6. In some cases, participation in an event may not be possible without certain processing activities (e.g., access control). Regardless of this, you may object to the publication of photos or videos in which you are recognizable; to do so, please contact the organizing body.
 

12.2 Planning and Conducting Awards and Honors Ceremonies

The City of Marktredwitz organizes or co-organizes events at which individuals are awarded or presented with honors or distinctions for special achievements. In addition, we are involved in reviewing nominations for honors and distinctions submitted by other government agencies.

For this purpose, we process personal data of the honorees (name, contact information, reason for the award, etc.) in accordance with Article 27 of the Bavarian Data Protection Act (BayDSG).

We receive this data from other public or private entities or individuals, or we collect it from publicly available sources (e.g., newspapers or online publications). We also collect some data directly from the honorees (e.g., by providing a form, via email, or by phone).

The data is processed to review award nominations and to prepare for and carry out the respective events. Depending on the award or honor, the data may also be transmitted to members of the state government, members of the state legislature, local elected officials, cooperation partners, and external service providers.

As part of public relations efforts, information about the honorees and the respective award or honor may be published on the City of Marktredwitz’s website and shared with the media for publication. The data will be deleted once it is no longer necessary to fulfill these purposes.

13. Applications

13.1 Handling of Applicant Data

We offer you the opportunity to apply for a position with us (e.g., by email, mail, or via our online application form). Below, we provide information about the scope, purpose, and use of your personal data collected as part of the application process. We assure you that the collection, processing, and use of your data are carried out in accordance with applicable data protection laws and all other legal requirements, and that your data will be treated with the strictest confidentiality.

Applicant Tracking System (BITE)
We use an applicant tracking system provided by BITE GmbH, Magirus-Deutz-Straße 12, 89077 Ulm (Germany), to conduct and manage recruitment processes. BITE GmbH acts as a data processor in accordance with Article 28 of the GDPR; a data processing agreement is in place.
Privacy Policy: https://www.b-ite.de/legal-notice.html

External link to the job board (CareerNetwork)
Our website may contain links to an external job board operated by CareerNetwork JOBBÖRSE.de GmbH & Co. KG, Thorwaldsenanlage 19, 65195 Wiesbaden. If you click on such a link, you will leave our website; the respective operator is responsible for the processing of personal data on the linked site. Please review the privacy policy posted there. 

Scope and Purpose of Data Collection
If you submit an application to us, we will process your associated personal data (e.g., contact and communication information, application documents, notes taken during job interviews, etc.) to the extent necessary to make a decision regarding the establishment of an employment relationship. The legal basis for this is Article 88 of the GDPR (data processing in the context of employment), Article 6(1), first sentence, letter b of the GDPR (initiation of an employment relationship), and—if you have given your consent—Article 6(1), first sentence, letter a of the GDPR (e.g., applicant pool). You may withdraw your consent at any time. Within our company, your personal data will be disclosed exclusively to individuals involved in processing your application. If you apply via the online application form, your information will also be transmitted to our applicant tracking system provider (BITE GmbH) for technical processing purposes. If your application is successful, the data you submitted will be stored in our data processing systems for the purpose of carrying out the employment relationship.

Retention Period
If we are unable to offer you a position, if you decline a job offer, or if you withdraw your application, we reserve the right to retain the data you have provided for up to 6 months from the conclusion of the application process (rejection or withdrawal of the application) based on Article 6(1)(e) of the GDPR (processing in the public interest). After that, the data will be deleted and the physical application documents will be destroyed. Retention serves, in particular, as evidence in the event of a legal dispute. If it becomes apparent that the data will be required after the 6-month period has expired (e.g., due to an impending or pending legal dispute), deletion will not take place until the purpose for continued retention no longer applies.

Data may also be retained for a longer period if you have provided your consent (Art. 6(1)(a) GDPR) or if statutory retention obligations prevent deletion.

14. Social Media

14.1 Our Online Presence and Links Only

We maintain publicly accessible accounts on YouTube, Facebook, Instagram, and WhatsApp. On our website, we can only provide links to these services. If you follow such a link, you will leave our website, and the privacy policy of the respective provider will apply.

Please note that the platform providers process personal data under their own responsibility (e.g., to provide the service, for security, advertising, and market research purposes, and to compile usage statistics). We have no complete control over this. Data may also be transferred to third countries (e.g., the U.S.); the information provided by the respective providers is authoritative.
 

14.2 Instagram-Plugin (Integration on our website)

Our website includes an Instagram plugin/content that directly displays content from our Instagram channel. When you visit a page with embedded Instagram content, a connection may be established to servers operated by Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland).

In particular, your IP address, device and browser information, and, if applicable, other data (e.g., page visited, time) may be transmitted to Meta; in addition, cookies or similar technologies may be used.

To the extent that loading the Instagram plugin requires access to information on your device or the setting/reading of cookies, this is done based on your consent pursuant to Section 25(1) of the TDDDG. Any subsequent processing of personal data is carried out—to the extent necessary—based on your consent pursuant to Article 6(1), first sentence, letter a of the GDPR. You may revoke your consent at any time with future effect (e.g., via the cookie/consent settings).
 

14.3 Contact via WhatsApp

If we offer WhatsApp as a communication channel, communication takes place via the WhatsApp service (provider: WhatsApp Ireland Limited, Ireland; a company of the Meta Group). Depending on how you use the service, the content of your messages as well as metadata (e.g., time, recipient/sender) may be processed. Please do not send any sensitive data via WhatsApp unless it is necessary. Alternatively, you can contact us at any time using the contact methods listed in Section 1.
 

14.4 Legal Basis and Retention Period (Our Area of Responsibility)

We process personal data that you provide to us via our social media channels or via WhatsApp (e.g., messages, comments, direct messages) to handle your inquiry and for public relations purposes. The legal basis is generally Article 6(1), first sentence, letter e of the GDPR in conjunction with Article 4(1) of the Bavarian Data Protection Act (BayDSG); where consent is required (in particular for the embedded Instagram plugin), Article 6(1), first sentence, letter a of the GDPR applies. We delete content that we store within our area of responsibility as soon as it is no longer necessary for the intended purpose and there are no legal retention obligations that prevent us from doing so.

15. Online Services Requiring Registration, a Contract, and Payment

Encrypted Payments on This Website
If, after entering into a paid contract, you are required to provide us with your payment information (e.g., account number for direct debit authorization), this information is necessary for processing the payment.

Payment transactions using standard payment methods (Visa/MasterCard, direct debit) are conducted exclusively via an encrypted SSL or TLS connection. You can recognize an encrypted connection by the fact that the browser’s address bar changes from “http://” to “https://” and by the padlock icon in your browser’s address bar.

With encrypted communication, the payment information you send to us cannot be read by third parties.
 

E-commerce and Payment Providers

Processing of Data (Customer and Contract Data)
We collect, process, and use personal data only to the extent necessary to establish, define the terms of, or modify the legal relationship (master data). This is done pursuant to Article 6(1)(b) of the GDPR, which permits the processing of data for the performance of a contract or pre-contractual measures. We collect, process, and use personal data regarding the use of this website (usage data) only to the extent necessary to enable the user to use the service or to bill the user.

The collected customer data will be deleted upon completion of the order or termination of the business relationship. Statutory retention periods remain unaffected.

Data Transmission Upon Contract Formation for Online Stores, Retailers, and Merchandise Shipping
We transfer personal data to third parties only when necessary for the fulfillment of the contract, such as to companies responsible for delivering the goods or to the financial institution handling the payment. No further transfer of data takes place, or only if you have expressly consented to such transfer. We do not disclose your data to third parties without your express consent, such as for advertising purposes.

The legal basis for data processing is Article 6(1)(b) of the GDPR, which permits the processing of data for the performance of a contract or pre-contractual measures.

Payment Services
We integrate third-party payment services into our website. When you make a purchase from us, your payment information (e.g., name, payment amount, bank account information, credit card number) is processed by the payment service provider for the purpose of processing the payment. The respective terms and conditions and privacy policies of the relevant providers apply to these transactions. The use of payment service providers is based on Article 6(1)(b) of the GDPR (performance of a contract) as well as on the legitimate interest in ensuring a payment process that is as smooth, convenient, and secure as possible (Article 6(1)(f) of the GDPR). To the extent that your consent is requested for certain actions, Article 6(1)(a) of the GDPR serves as the legal basis for data processing; consent may be revoked at any time with future effect.

Use of the online booking tool provided by OBS OnlineBuchungService GmbH and feratel media technologies AG
To enable online bookings, we use a booking process involving two service providers: feratel media technologies AG, which provides the technical booking/online store platform (including “Deskline,” “resc.deskline.net,” and “MAK Shop”), and OBS OnlineBuchungService GmbH, Im Gewerbepark D 80, 93059 Regensburg, as the booking and sales service provider.

Technical Implementation (feratel)
For the technical implementation of the booking and online store functions, we use the “Deskline” booking software and the associated services (including “resc.deskline.net” and “MAK Shop”) provided by feratel media technologies AG. The booking process is integrated into our website via a corresponding module or as an iFrame. The technical privacy notices for these feratel services can be viewed during the booking process.

Booking and Sales Service (OBS)
In addition, we use the services of OBS OnlineBuchungService GmbH as a booking and sales service provider (e.g., for the organizational handling of online bookings and the associated service and sales processes). OBS provides its service and sales privacy notices within the booking tool.

16. Changes to This Privacy Policy

We reserve the right to amend this Privacy Policy to bring it into line with changes in the legal landscape and technical standards. We ask our users to check this page regularly for updates.

This Privacy Policy was last updated on June 9, 2026.