§ 1 INFORMATION ON THE COLLECTION OF PERSONAL DATA
(1) In the following paragraphs, we will inform you about the collection and processing of personal data when using our website and the rights granted to you under the EU General Data Protection Regulation (hereinafter referred to as: "GDPR" for short).
(2) Personal data is all data that can be related to you personally, e.g. name, address, e-mail addresses and user behavior.
(3) The data controller pursuant to Article 4(7) of the EU General Data Protection Regulation (GDPR) is:
Mr. Josef Liebl, Managing Director, Josef-Buchinger-Straße 9, 94481 Grafenau, Germany, email@example.com
(4) Our data protection officer is Ms. Kathrin Friedl. You can reach the data protection officer at firstname.lastname@example.org or our postal address, Josef-Buchinger-Straße 9, 94481 Grafenau, Germany, with the addition of “Data protection officer".
(5) If you contact us by e-mail or via a contact form, the data you provide (your e-mail address, name and telephone number, if applicable) will be stored by us in order to answer your questions. We will delete the data generated in this context after the storage is no longer required or restrict the processing if there are legal retention obligations.
(6) If we use contracted service providers for individual functions of our offer or would like to use your data for advertising purposes, we will inform you in detail about the respective processes below. In doing so, we also state the specified criteria for the storage period.
§ 2 YOUR RIGHTS
(1) You have the following rights against us regarding the personal data concerning you:
- Right of access (Article 15 of the GDPR)
- Right to rectification or deletion (Article 16 and 17 of the GDPR)
- Right to restriction of processing (Article 18 of the GDPR)
- Right to object to processing (Article 21 of the GDPR)
- Right to data portability (Article 20 of the GDPR)
- Right to complain to a supervisory authority
- Right to revoke the declaration of consent under data protection law
(2) Explanation of your rights in detail:
(2.1) Right to information
You may request confirmation from the controller as to whether personal data concerning you is being processed by us. If there is such processing, you can request information from the controller about the following:
a. the purposes for which the personal data is processed;
b. the categories of personal data which are processed;
c. the recipients or categories of recipients to whom the personal data concerning you has been or will be disclosed;
d. the planned duration of the storage of the personal data concerning you or, if concrete information is possible in this regard, criteria for determining the storage duration;
e. the existence of a right to rectification or deletion of personal data concerning you, a right to restriction of processing by the controller or a right to object to such processing;
f. the existence of a right of appeal to a supervisory authority;
g. all available information on the origin of the data, if the personal data is not collected from the data subject;
h. the existence of automated decision-making, including profiling, pursuant to Article 22(1) and (4) of the GDPR and - at least in these cases - meaningful information about the logic involved and the scope and intended effects of such processing for the data subject.
You also have the right to request information about whether the personal data concerning you is transferred to a third country or to an international organization. In this context, you may request to be informed about the appropriate safeguards in connection with the transfer, pursuant to Article 46 of the GDPR.
(2.2) Right to rectification
You have a right to rectification and/or completion vis-à-vis the data controller, insofar as the personal data processed concerning you is inaccurate or incomplete. The data controller shall make the correction without undue delay.
(2.3) Right to deletion
(2.3.1) You may request the controller to delete the personal data concerning you without undue delay, and the controller is obliged to delete such data without undue delay, if one of the following reasons applies:
a. The personal data concerning you is no longer necessary for the purposes for which it was collected or otherwise processed.
b. You revoke your consent on which the processing was based pursuant to Article 6(1) (a) or Article 9(2) (a) of the GDPR and there is no other legal basis for the processing.
c. You object to the processing pursuant to Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2) of the GDPR.
d. The personal data concerning you has been processed unlawfully.
e. The deletion of the personal data concerning you is necessary for compliance with a legal obligation under Union or Member State law to which the controller is subject.
f. The personal data concerning you was collected in relation to information society services offered pursuant to Article 8(1) of the GDPR.
(2.3.2) If the data controller has made the personal data concerning you public and is obliged to delete it pursuant to Article 17(1) of the GDPR, he shall take reasonable measures, including technical measures, having regard to the available technology and the cost of implementation, to inform data controllers who process the personal data that you, as the data subject, have requested that they should delete all links to or copies and replications of such personal data.
(2.3.3) The right to deletion does not exist insofar as the processing is necessary:
a. to exercise the right to freedom of expression and information;
b. for compliance with a legal obligation which requires processing under Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
c. for reasons of public interest in the area of public health pursuant to Article 9(2) (h) and (i) and Article 9(3) of the GDPR;
d. for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes pursuant to Article 89(1) of the GDPR, where the right referred to in paragraph 1 is likely to render impossible or seriously prejudice the achievement of the purposes of such processing; or
e. to assert, exercise or defend legal claims.
(2.4) Right to restriction of processing
Under the following conditions, you may request the restriction of the processing of personal data concerning you:
a. if you contest the accuracy of the personal data concerning you for a period enabling the controller to verify the accuracy of the personal data;
b. the processing is unlawful and you reject the deletion of the personal data and instead request restriction of the use of such personal data;
c. the controller no longer needs the personal data for the purposes of processing, but you need it for the assertion, exercise or defense of legal claims; or
d. if you have objected to the processing pursuant to Article 21(1) of the GDPR and it has not yet been determined whether the legitimate grounds of the controller outweigh your grounds.
Where the processing of personal data concerning you has been restricted, such data may be processed, with the exception of their storage, only with your consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or a Member State. If the restriction of processing has been effected in accordance with the above conditions, you will be informed by the controller before the restriction is lifted.
(2.5) Right to information
If you have asserted the right to rectification, deletion and restriction of processing against the controller, the controller is obliged to notify all recipients to whom the personal data concerning you has been disclosed of this authorization or deletion of the data or restriction of processing, unless this proves impossible or involves a disproportionate effort. You have the right to be informed about these recipients by the data controller.
(2.6) Right to data portability
You have the right to receive the personal data concerning you that you have provided to the controller in a structured, conventional and machine-readable format. In addition, you have the right to transmit this data to another controller without hindrance from the controller to whom the personal data was made available, provided that
a. the processing is based on consent pursuant to Article 6(1) (a) of the GDPR or Article 9(2) (a) of the GDPR or on a contract pursuant to Article 6(1) (b) of the GDPR and
b. the processing is carried out with the help of automated procedures.
In exercising this right, you also have the right to have the personal data concerning you transferred directly from one controller to another controller, insofar as this is technically feasible. Freedoms and rights of other persons must not be affected by this. The right to data portability does not apply to processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
(2.7) Right of objection
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data relating to you which is carried out on the basis of Article 6(1) (e) or (f) of the GDPR; this also applies to profiling based on these provisions.
The controller shall no longer process the personal data concerning you unless he can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defense of legal claims.
If the personal data concerning you is processed for the purpose of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing; this also applies to profiling, insofar as it is related to such direct marketing.
If you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for these purposes.
You have the possibility, in connection with the use of information society services - notwithstanding Directive 2002/58/EG - to exercise your right to object by means of automated procedures in which technical specifications are used.
(2.8) Right to revoke the declaration of consent under data protection law
You have the right to revoke your declaration of consent under data protection law at any time. The revocation of consent shall not affect the lawfulness of the processing carried out on the basis of this consent until revocation.
(2.9) Automated decision-making in individual cases including profiling
You have the right not to be subject to a decision based solely on automated processing - including profiling - which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision –
a. is necessary for the conclusion or performance of a contract between you and the controller,
b. is permitted by legislation of the Union or the Member States to which the controller is subject and that legislation contains appropriate measures to safeguard your rights and freedoms as well as your legitimate interests; or
c. with your express consent.
However, these decisions may not be based on special categories of personal data pursuant to Article 9(1) of the GDPR, unless Article 9(2) (a) or (g) applies and appropriate measures have been taken to protect the rights and freedoms as well as your legitimate interests.
With regard to the cases referred to in a. and c. above, the controller shall take reasonable steps to safeguard the rights and freedoms of, and the legitimate interests of the data subject, including at least the right to obtain the intervention of a person on the part of the controller, to express his or her point of view and to contest the decision.
(3) Without prejudice to any other administrative or judicial remedy, you shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, place of work or the place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.
§ 3 LEGAL BASIS OF THE PROCESSING
(1) Insofar as we request the consent of the data subject for processing operations on personal data, Article 6(1) (a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis.
(2) When processing personal data that is necessary for the performance of a contract to which the data subject is a party, Article 6(1) (b) of the GDPR serves as the legal basis. This also applies to processing operations that are necessary for the performance of pre-contractual measures.
(3) Insofar as the processing of personal data is necessary for the fulfillment of a legal obligation to which our company is subject, Article 6(1) (c) of the GDPR serves as the legal basis.
(4) In the event that vital interests of the data subject or another natural person make it necessary to process personal data, Article 6(1) (d) of the GDPR shall serve as the legal basis.
(5) If the processing is necessary to protect a legitimate interest of our company or a third party and the interests, fundamental rights and freedoms of the data subject do not outweigh the first-mentioned interest, Article 6(1) (f) of the GDPR serves as the legal basis for the processing. The legitimate interest of our company lies in the performance of our business activities.
(6) Insofar as instructions are given below on the collection of individual personal data, reference is made separately in each case to the corresponding legal basis.
§ 4 COLLECTION OF PERSONAL DATA WHEN VISITING OUR WEBSITE
(1) In the case of exclusively informational use of the website, i.e. if you do not register or otherwise transmit information to us, we only collect the personal data that your browser transmits to our server. If you wish to view our website, we collect the following data, which is technically necessary for us to display our website to you and to ensure its stability and security (legal basis is Article 6(1) (f) of the GDPR):
- IP address
- Date and time of the request
- Time zone difference from Greenwich Mean Time (GMT)
- Content of the request (concrete page)
- Access status/HTTP status code
- Data volume transferred in each case
- Website from which the request comes
- Operating system and its interface
- Language and version of the browser software
(2) In addition to the aforementioned data, cookies are stored on your computer when you use our website. Cookies are small text files that are stored on your hard drive, assigned to the browser you are using, and through which the entity that sets the cookie (in this case through us) receives certain information. Cookies cannot execute programs or transfer viruses to your computer. They serve to make the Internet offer as a whole more user-friendly and effective.
a) This website uses the following types of cookies, the scope and functionality of which are explained below:
- Transient cookies (refer to b)
- Persistent cookies (refer to c)
b) Transient cookies are automatically deleted when you close the browser. These include in particular the session cookies. These store a so-called session ID, with which various requests from your browser can be assigned to the joint session. This allows your computer to be recognized when you return to our website. The session cookies are deleted when you log out or close the browser.
c) Persistent cookies are automatically deleted after a predefined duration, which may differ depending on the cookie. You can delete the cookies in the security settings of your browser at any time.
d) You can configure your browser settings according to your preferences and, for example, refuse to accept third-party cookies or all cookies. We would like to point out that this may prevent you from using all the functions of this website.
f) The Flash cookies used are not collected by your browser, but by your Flash plug-in. Furthermore, we use HTML5 storage objects that are stored on your terminal device. These objects store the required data regardless of the browser you use and have no automatic expiration date. If you do not want Flash cookies to be processed, you need to install an appropriate add-on. You can prevent the use of HTML5 Storage Objects by using private mode in your browser. In addition, we recommend that you manually delete your cookies and browser history on a regular basis.
§ 5 FURTHER FUNCTIONS AND OFFERS OF OUR WEBSITE
(1) In addition to the purely informational use of our website, we offer various services that you can use if you are interested. For this purpose, you will usually have to provide additional personal data that we use to provide the respective service and to which the aforementioned data processing principles apply.
(2) In some cases, we use external service providers to process your data. They have been carefully selected and commissioned by us, are bound by our instructions and are regularly inspected.
(3) Furthermore, we may pass on your personal data to third parties if promotional participations, competitions, contract conclusions or similar services are offered by us together with partners. You will receive more detailed information on this when you provide your personal data or below in the description of the offer.
(4) If our service providers or partners are located in a country outside the European Economic Area (EEA), we will inform you about the consequences of this circumstance in the description of the offer.
§ 6 OBJECTION TO OR REVOCATION OF THE PROCESSING OF YOUR DATA
(1) If you have given your consent to the processing of your data, you may revoke this consent at any time. Such revocation will affect the permissibility of processing your personal data after you have expressed it to us.
(2) Insofar as we base the processing of your personal data on the balance of interests, you may object to the processing. This is the case if the processing is not necessary, in particular for the performance of a contract with you, which is shown by us in each case in the following description of the functions. When exercising such an objection, we ask you to explain the reasons why we should not process your personal data as we have done. In the event of your justified objection, we will review the factual situation and either discontinue or adapt the data processing or show you our compelling, legitimate grounds on the basis of which we will continue the processing.
(3) Of course, you can object to the processing of your personal data for purposes of advertising and data analysis at any time. You can inform us of your objection to advertising using the following contact details:
- Josef-Buchinger-Straße 9, 94481 Grafenau, Germany
§ 7 INTEGRATION OF GOOGLE MAPS
(1) On this website we use the services of Google Maps. This allows us to show you interactive maps directly in the website and enables you to use the map function comfortably.
(2) By visiting the website, Google receives the information that you have called up the corresponding sub-page of our website. In addition, the data mentioned under Section 4 of this declaration will be transmitted. This occurs regardless of whether Google provides a user account through which you are logged in or whether no user account exists. If you are logged in to Google, your data is directly assigned to your account. If you do not want the assignment with your profile at Google, you must log out before activating the respective button. Google stores your data as usage profiles and uses it for the purpose of advertising, market research and/or demand-oriented design of its website. Such an evaluation is carried out in particular (even for users who are not logged in) for the provision of tailored advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles, and you must contact Google to exercise this right.
Status: November 2021