Privacy Policy

1. General

1.1 What is personal data
Personal data is information that discloses or can disclose the user's identity. We adhere to the principle of data avoidance. As far as possible, we refrain from collecting personal data.

1.2 Handling of personal data
Personal data is used exclusively to establish the contract, define its content, and implement or process the contractual relationship (Art. 6 (1) (b) GDPR).

Beyond that, personal data will only be processed if we have received your consent to do so (Art. 6 (1) (a) GDPR) or if it is data whose processing is necessary for our legitimate interests and insofar as the balancing of interests shows that no overriding interests, fundamental rights or freedoms on your part are opposed (Art. 6 (1) (f) GDPR).

We may use processors to process your personal data, with whom we have concluded a data processing agreement where necessary, but we will not pass on personal data to third parties beyond this.

Only for the fulfilment of the contract will the data be passed on to the shipping company commissioned with the delivery, insofar as this is necessary to deliver ordered goods. The payment data required for the processing of payments will be passed on to the credit institution commissioned with the payment and, if applicable, to the commissioned and selected payment service provider.

Your personal data is processed in the EU and in countries classified as safe or adequate by the EU. If personal data is processed in the USA, we ensure that the services we use are certified under the “EU-US Data Privacy Framework”.

1.3 Usage data
When visiting the website, general technical information is collected. This is the IP address used, time, duration of the visit, browser type and, if applicable, the page of origin. This usage data is registered in a log file for technical reasons and can be used and stored for statistical evaluation of this website. This usage data is not linked to your other personal data. The legal basis is our legitimate interest in the secure and trouble-free operation of the website (Art. 6 (1) (f) GDPR).

1.4 Duration of storage
After the purpose for which the data was collected has ended, we store your personal data only as long as this is required by law (especially tax law).

The following retention periods apply, for example:

Type of data	Retention period
Tax-related data	10 years
Commercial or business correspondence (including emails and faxes) and other documents relevant for taxation purposes.	6 years from the end of the calendar year in which the last entry was made in the books, the inventory, the opening balance sheet, the annual financial statement, or the management report was prepared, the commercial or business correspondence was received or sent, the accounting voucher was created, the record was made, or the other documents were created.
Transaction and registration data	10 years from the end of the calendar year in which the last entry was made in the books, the inventory, the opening balance sheet, the annual financial statement, or the management report was prepared, the commercial or business correspondence was received or sent, the accounting voucher was created, the record was made, or the other documents were created.
Data protection consents for data processing	For as long as the data subject may assert their rights.
(Electronic) correspondence that is not relevant for tax purposes	As long as necessary for the fulfilment of tasks, unless the processing is required for the establishment, exercise, or defence of legal claims.
Usage data pursuant to Section 1.3 of this Privacy Policy	Maximum of 30 days

1.5 Electronic withdrawal from contracts
We process personal data in connection with electronic withdrawals from contracts in order to comply with statutory obligations concerning the provision and documentation of the withdrawal channel. The legal basis for this processing is Art. 6 (1) (c) GDPR. The data processed includes, in particular: name, email address and, where applicable, postal address (to the extent required for the identification of the contract), contract/order details (e.g. order number), timestamps and, for technical reasons, the IP address (for evidentiary purposes and to prevent misuse).

2. Your rights

2.1 Information
You can request information from us as to whether we are processing personal data about you and if so, you have a right to be informed about this personal data and to receive the further information referred to in Art. 15 GDPR.

2.2 Right to rectification
You have the right to rectification of inaccurate personal data concerning you and may request the completion of incomplete personal data in accordance with Art. 16 GDPR.

2.3 Right to erasure
You have the right to demand that we delete the personal data concerning you without undue delay. We are obliged to delete them without delay, in particular, if one of the following reasons applies:

Your personal data is no longer necessary for the purposes for which it was collected or otherwise processed.
You withdraw your consent on which the processing of your data was based, and there is no other legal basis for the processing.
Your data has been processed unlawfully.

The right to erasure does not exist insofar as your personal data is required to assert, exercise, or defend our legal claims.

2.4 Right to restriction of processing
You have the right to demand that we restrict the processing of your personal data if

you dispute the accuracy of the data and we therefore verify the accuracy,
the processing is unlawful and you refuse the deletion and demand the restriction of use instead,
we no longer need the data, but you need it to assert, exercise or defend legal claims,
you have objected to the processing of your data and it has not yet been determined whether our legitimate reasons outweigh your reasons.

2.5 Right to data portability
You have the right to receive the personal data concerning you that you have provided to us in a structured, common and machine-readable format and you have the right to transfer this data to another controller without hindrance from us, provided that the processing is based on consent or a contract and the processing is carried out by us with the help of automated processes.

2.6 Right of withdrawal and right to object
To the extent that the processing of your personal data is based on your consent (Art. 6 (1) (a) GDPR), you have the right to withdraw your consent at any time. The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of the consent prior to its withdrawal. You can change or withdraw your consent to cookies and external content at any time via the icon at the bottom of every page.

To the extent that the processing of your personal data is based on Art. 6 (1) (e) GDPR or Art. 6 (1) (f) GDPR, you have the right, pursuant to Art. 21 GDPR, to object at any time, on grounds relating to your particular situation, to the processing of your personal data. In such a case, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defence of legal claims.

2.7 General and right to lodge a complaint
The exercise of your above rights is generally free of charge for you. You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

3. Data security

3.1 Data security
All data on our website is protected by technical and organisational measures against loss, destruction, access, modification and distribution. Data is transmitted between your browser and our website in encrypted form (HTTPS), as indicated by the padlock symbol in the address bar.

3.2 Sessions and cookies
To operate the website, we use cookies or server-side sessions in which data can be stored. Without your consent, we only use cookies that are strictly necessary for the provision of the digital service you have expressly requested (e.g. session cookie, storage of your cookie choice). The legal basis is Section 25 (2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act) in conjunction with Art. 6 (1) (f) GDPR.

All other cookies and external content (e.g. videos, maps, booking and rating widgets) are only loaded once you have consented to this (Section 25 (1) TDDDG, Art. 6 (1) (a) GDPR). A complete overview of all cookies and services used, including their storage period, can be found at the end of this privacy policy in the section “Cookies and consent management”.

4. Newsletter

If you register for our newsletter, we use the data required for this purpose or separately provided by you to send you our e-mail newsletter regularly based on your consent according to Art. 6 (1) (a) GDPR. We use the service provider rapidmail for registration and dispatch (see Section 6.5).
Unsubscribing from the newsletter is possible at any time and can be done either by sending us a message via the contact options provided in the imprint or via the link provided for this purpose in the newsletter. After unsubscribing, we will delete your e-mail address unless you have expressly consented to further use of your data or we reserve the right to use data in a manner that goes beyond this, which is permitted by law and about which we inform you in this policy.

5. Presence on social media platforms

We use the following social media platform for corporate presentation and communication (explicit reference is made to the privacy policy and opt-out option linked below).

Facebook (Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland)
Privacy policy: https://www.facebook.com/about/privacy/
Opt-out: https://www.youronlinechoices.com

This social media platform may process personal data outside the EU; in this respect, we refer to the above privacy policy.
The social media platform may create usage profiles from your usage behaviour and the resulting interests and actions on your part and store cookies on your computer in which your usage behaviour is stored. If you have an account on the social media platform and are logged in, your usage behaviour may even be stored independently of the device. For example, your usage profile can be used to place advertisements that presumably correspond to your interests.

We process the personal data exclusively for communicating with you via the social media platform and for optimising our online presence and ensure that no interests on your part are affected here that outweigh this legitimate interest on our part (Art. 6 (1) (f) GDPR). Insofar as you have already given the operator of the social media platform effective consent to the corresponding data processing, the processing of your personal data will also be based on this consent (Art. 6 (1) (a) GDPR).

6. Third-party services

6.1 Hosting and technical support
Our website is operated and hosted by an external service provider, Odenwald IT Service UG (haftungsbeschränkt), Schefflenzer Straße 3, 74743 Seckach, Germany. The servers are located in the data centre of Mittwald CM Service GmbH & Co. KG, Königsberger Straße 4–6, 32339 Espelkamp, Germany, which acts as a sub-processor. Data is processed exclusively in Germany.

The personal data collected on this website is stored on these servers. This may include in particular:

IP addresses,
contact information,
contract data,
website access,
date and time of the request,
content of the request and HTTP status code,
amount of data transferred,
website from which the request originated,
information about browser and operating system

as well as other data generated via a website. The hosting provider is used for the purpose of fulfilling contracts with our potential and existing customers (Art. 6 (1) (b) GDPR) and in the interest of providing our online offering securely, quickly and efficiently through a professional provider (Art. 6 (1) (f) GDPR).

We have concluded a data processing agreement (Art. 28 GDPR) with Odenwald IT Service UG. It processes your data only to the extent necessary to provide the contractually agreed services and always in accordance with our instructions. The privacy policy of Odenwald IT Service UG can be found here: https://odenwald-it-service.de/datenschutz.html

6.2 Social media links
We have our own social media pages with third-party providers that can be reached via links from this website (Facebook). The links are simple references – merely visiting our website does not transfer any data to the platform. Only by clicking a link will you be taken to the third-party provider's website. To avoid unnecessary data transfer, we recommend that you log out of the respective third-party provider before using a corresponding link, so that usage profiles cannot be created by the third-party provider simply by using the link.

6.3 YouTube
This website contains embedded videos from YouTube. YouTube is a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). We use the privacy-enhanced mode (youtube-nocookie.com). The videos are only loaded once you have consented to this (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG); until then you will see a placeholder and no data is transferred to YouTube. Once loaded, your IP address and information about your device, among other things, are transmitted to Google; this may involve a transfer to the USA. Google is certified under the EU-US Data Privacy Framework. Further information can be found in Google's privacy policy: https://policies.google.com/privacy?hl=en

6.4 OpenStreetMap
We use the OpenStreetMap mapping service (operated by the OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom) to show you on an interactive map how to find and reach us. The map is only loaded once you have consented to this (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG). When the map is loaded, your IP address is transmitted to the servers of the OpenStreetMap Foundation. An adequacy decision of the European Commission exists for the United Kingdom. You can view the OpenStreetMap privacy policy here: https://wiki.osmfoundation.org/wiki/Privacy_Policy

6.5 rapidmail
We use the provider rapidmail (Positive Group Deutschland GmbH, Ingeborg-Krummer-Schroth-Straße 18a, 79106 Freiburg im Breisgau, Germany) for our newsletter. The registration form on our website is provided by rapidmail and is only loaded once you have consented to this (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG); in doing so, your IP address is transmitted to rapidmail. We use the so-called double opt-in procedure: you will first receive a confirmation e-mail to the address you provided, and your registration only becomes effective when you click the activation link it contains. We use your data exclusively for sending the newsletter, which may contain information or offers. rapidmail processes the data on our behalf; rapidmail is not permitted to use your data for other purposes, pass it on or sell it. The newsletter is only sent with your consent (Art. 6 (1) (a) GDPR), which you can withdraw at any time, e.g. via the unsubscribe link in the newsletter. You can view rapidmail's privacy policy here: https://www.rapidmail.de/datenschutz

6.6 HolidayCheck
We use the widget from HolidayCheck (operated by HolidayCheck AG, Bahnweg 8, 8598 Bottighofen, Switzerland) on our site to show you other guests' recommendation rate. The widget is only loaded once you have consented to this (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG). When it is loaded, your IP address, the date and time of your visit, the requesting page and other browser and device information are transmitted to the provider for technical reasons. An adequacy decision of the European Commission exists for Switzerland. You can view HolidayCheck's privacy policy here: https://www.holidaycheck.de/datenschutz

6.7 Booking.com rating
To show you our rating on Booking.com (Booking.com B.V., Oosterdokskade 163, 1011 DL Amsterdam, Netherlands), we embed a rating widget delivered via the HotelEmbed service (hotelembed.com / hotelstatic.com). The widget is only loaded once you have consented to this (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG). When it is loaded, your IP address and other browser and device information are transmitted to the provider of the widget for technical reasons. You can view Booking.com's privacy policy here: https://www.booking.com/content/privacy.en-gb.html

6.8 Booking tool
As a booking tool, we use the DIRS21 plugin of TourOnline AG, Borsigstraße 26, 73249 Wernau, Germany (www.dirs21.de) on our website. The booking widget is only loaded once you have consented to this (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG); in doing so, your IP address and technical browser information are transmitted to TourOnline AG. Alternatively, you can make your booking by telephone or e-mail at any time. If you use the booking tool, the data you provide as part of the booking (e.g. name, address, e-mail, booking details, payment information) is transmitted to TourOnline AG, stored and processed there in order to provide the service technically. The legal basis for this is Art. 6 (1) (b) GDPR (performance of a contract). You can view the privacy policy of TourOnline AG here: https://www.dirs21.de/disclaimer/

6.9 Vouchers
You can purchase our vouchers through our partner GastroGuide (operated by mes.mo GmbH, Herdweg 16, 73035 Göppingen, Germany), which is also your contractual partner. The GastroGuide voucher widget is only loaded once you have consented to this (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG); in doing so, your IP address and technical browser information are transmitted to GastroGuide. You can find GastroGuide's privacy policy here: https://www.gastroguide.de/footer/datenschutzerklaerung

6.10 Consent management with cookieblocker
To obtain and manage your consent, we use the cookieblocker service (https://cookieblocker.de) of Odenwald IT Service UG (haftungsbeschränkt), Schefflenzer Straße 3, 74743 Seckach, Germany. cookieblocker ensures that services requiring consent are only loaded after you have agreed. The service is operated exclusively in Germany; the consent banner is delivered directly from our own server. Details on the data stored, the storage period and your options for withdrawal can be found in the section “Cookies and consent management” at the end of this privacy policy.

7. Application procedure

You can apply to us electronically, by telephone and in writing. Of course, we will only use your information to process your application and will not pass it on to third parties. Please note that if you send your application by e-mail, unencrypted e-mails are not protected against unauthorised access. Your personal data will be deleted after completion of the application process, at the latest after 6 months, unless you have given us your express consent to store your data for longer or a contract has been concluded. The legal basis is Art. 6 (1) (b) GDPR (initiation of an employment relationship), for longer storage Art. 6 (1) (a) GDPR, and for the defence of any legal claims Art. 6 (1) (f) GDPR.

8. Contacting us

You are welcome to use the following contact options to contact us regarding data protection. Controller within the meaning of the GDPR:

Marita Schaffers GmbH
Edelfinger Str. 7
97980 Bad Mergentheim
Germany

E-mail: This email address is being protected from spambots. You need JavaScript enabled to view it.
Phone: +49 7931 9712 0

Cookies and consent management

This website uses cookies and similar technologies. We use technically necessary cookies on the basis of Section 25 (2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act) and Art. 6 (1) (f) GDPR; our legitimate interest lies in the secure and proper operation of the website. All other cookies and external services are only used with your consent (Section 25 (1) TDDDG, Art. 6 (1) (a) GDPR). Without your consent, the respective content and scripts are blocked.

To manage your consent, we use the cookieblocker service provided by Odenwald IT Service UG (haftungsbeschränkt), Schefflenzer Str. 3, 74743 Seckach, Germany. The provider acts as our processor pursuant to Art. 28 GDPR; a corresponding agreement is in place. The data is processed in data centres in Germany.

We store your decision in the cookie “cookieblocker” on your device (storage period 12 months). It contains a random consent ID, the selected categories and the time of your decision.

To comply with our accountability obligation under Art. 7 (1) GDPR, we log every decision with the consent ID, the selection, date and time, the page visited, the shortened IP address (the last digits are removed) and the browser and operating system in general terms. The legal basis is Art. 6 (1) (c) GDPR. The records are deleted after 36 months.

The consent banner is delivered directly from our own server; visiting our website does not establish any connection to the provider’s servers.

You can withdraw your consent at any time with effect for the future or change your selection – via the “Cookie settings” link or the cookie icon on every page or directly in the overview at the end of this privacy policy. The lawfulness of the processing carried out until the withdrawal remains unaffected.

Technically necessary cookies

cookieblocker (Cookie settings): Consent status, storage period 12 months
PHPSESSID / [Zufallswert] (Session (CMS)): Session identifier, storage period Session
display-popup-time-custom (DJ-Popup): Merkt sich, dass das Hinweis-Fenster angezeigt wurde, storage period 5 minutes

DIRS21 Booking (Functional)

We use DIRS21 Booking (Ermöglicht die Buchung von Hotelzimmern über ein Quick-Book-Widget). The service is only loaded after your consent; among other things, your IP address and information about your browser are transmitted to the provider. The provider is TourOnline AG, Borsigstraße 26, 73249 Wernau. The legal basis is your consent (Section 25 (1) TDDDG, Art. 6 (1) (a) GDPR), which you can withdraw at any time. Further information can be found in the privacy policy of DIRS21 Booking.

rapidmail (Functional)

We use rapidmail (Anmeldung zum Newsletter). The service is only loaded after your consent; among other things, your IP address and information about your browser are transmitted to the provider. The provider is Positive Group Germany GmbH (rapidmail), Ingeborg-Krummer-Schroth-Straße 18a, 79106 Freiburg im Breisgau. The legal basis is your consent (Section 25 (1) TDDDG, Art. 6 (1) (a) GDPR), which you can withdraw at any time. Further information can be found in the privacy policy of rapidmail.

OpenStreetMap (External media)

On some pages we embed content from OpenStreetMap (Display of interactive maps). It is only loaded when you click the placeholder or have consented to the “External media” category. Only then is a connection established to the provider’s servers, transmitting, among other things, your IP address. The provider is OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom. The legal basis is your consent (Section 25 (1) TDDDG, Art. 6 (1) (a) GDPR), which you can withdraw at any time. Further information can be found in the privacy policy of OpenStreetMap.

YouTube (External media)

On some pages we embed content from YouTube (Embedding of videos). It is only loaded when you click the placeholder or have consented to the “External media” category. Only then is a connection established to the provider’s servers, transmitting, among other things, your IP address. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The legal basis is your consent (Section 25 (1) TDDDG, Art. 6 (1) (a) GDPR), which you can withdraw at any time. The provider or its group of companies is also based outside the EU; a transfer of personal data to third countries, in particular the USA, cannot be ruled out. If the provider is certified under the EU-US Data Privacy Framework, the transfer is based on the adequacy decision of the European Commission (Art. 45 GDPR), otherwise on standard contractual clauses (Art. 46 GDPR). Further information can be found in the privacy policy of YouTube.

YSC: Counts views of embedded videos, storage period Session
VISITOR_INFO1_LIVE: Stores player settings, storage period 6 months
yt-remote-device-id (local storage): Device identifier for playback settings, storage period persistent
ytidb::LAST_RESULT_ENTRY_KEY (local storage): Stores the last used player state, storage period persistent

Booking.com Badge (HotelEmbed) (External media)

On some pages we embed content from Booking.com Badge (HotelEmbed) (Anzeige der Booking.com-Bewertung des Hotels). It is only loaded when you click the placeholder or have consented to the “External media” category. Only then is a connection established to the provider’s servers, transmitting, among other things, your IP address. The provider is HotelEmbed (hotelembed.com / hotelstatic.com), zeigt die Bewertung von Booking.com B.V., Amsterdam. The legal basis is your consent (Section 25 (1) TDDDG, Art. 6 (1) (a) GDPR), which you can withdraw at any time. Further information can be found in the privacy policy of Booking.com Badge (HotelEmbed).

GastroGuide (External media)

On some pages we embed content from GastroGuide (Einbettung eines Gutschein-Widgets zum Kauf von Restaurant-Gutscheinen). It is only loaded when you click the placeholder or have consented to the “External media” category. Only then is a connection established to the provider’s servers, transmitting, among other things, your IP address. The provider is mes.mo GmbH (GastroGuide), Herdweg 16, 73035 Göppingen. The legal basis is your consent (Section 25 (1) TDDDG, Art. 6 (1) (a) GDPR), which you can withdraw at any time. Further information can be found in the privacy policy of GastroGuide.

HolidayCheck (External media)

On some pages we embed content from HolidayCheck (Anzeige von Hotelbewertungen und Verlinkung zu HolidayCheck). It is only loaded when you click the placeholder or have consented to the “External media” category. Only then is a connection established to the provider’s servers, transmitting, among other things, your IP address. The provider is HolidayCheck AG, Bahnweg 8, 8598 Bottighofen, Switzerland. The legal basis is your consent (Section 25 (1) TDDDG, Art. 6 (1) (a) GDPR), which you can withdraw at any time. Further information can be found in the privacy policy of HolidayCheck.