Privacy Policy

The controller within the meaning of data protection laws, in particular the EU General Data Protection Regulation (GDPR), is:

GesundLand Vulkaneifel GmbH
Leopoldstr. 9a
54550 Daun
Email: info@gesundland-vulkaneifel.de
Phone: +49 6592 951 370

Effective as of March 30, 2022

We are very pleased that you are interested in our company. Data protection is a top priority for the management of GesundLand Vulkaneifel GmbH, Daun (hereinafter referred to as “GesundLand Vulkaneifel”). This Privacy Policy applies to your use of our websites and our social media pages. In general, you can use our websites without providing any personal data. However, if a data subject wishes to use specific services offered by our company via our website, the processing of personal data may be necessary. If the processing of personal data is necessary and there is no legal basis for such processing, we generally obtain the consent of the data subject.

The processing of personal data—such as a data subject’s name, address, email address, or phone number—is always carried out in accordance with the General Data Protection Regulation (GDPR) and in compliance with the country-specific data protection regulations applicable to us. Through this Privacy Policy, we aim to inform the public about the nature, scope, and purpose of the personal data we collect, use, and process. Furthermore, this Privacy Policy informs data subjects of their rights.

GesundLand Vulkaneifel GmbH, Daun, as the data controller, has implemented numerous technical and organizational measures to ensure the most comprehensive protection possible of the personal data processed via this website. Nevertheless, internet-based data transmissions may inherently involve security vulnerabilities, meaning that absolute protection cannot be guaranteed. For this reason, any data subject is free to provide personal data to us through alternative means, such as by telephone.

1 Definitions

This Privacy Policy is based on the terminology used in the General Data Protection Regulation (GDPR). Our Privacy Policy is intended to be easy to read and understand for the general public as well as for our customers and business partners. To ensure this, we would like to explain certain terms in advance.

In this Privacy Policy, we use the following terms, among others:

a) Personal Data

Personal data refers to any information relating to an identified or identifiable natural person (hereinafter referred to as the “data subject”). A natural person is considered identifiable if they can be identified, directly or indirectly, in particular by association with an identifier such as a name, an identification number, location data, an online identifier, or one or more specific characteristics that reflect the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

b) Data Subject

A data subject is any identified or identifiable natural person whose personal data is processed by the controller.

c) Processing

Processing means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, distribution, or any other form of making available, the matching or linking, the restriction, erasure, or destruction.

d) Restriction of processing

Restriction of processing means the marking of stored personal data with the aim of limiting its future processing.

e) Data Controller

The controller is the natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of the processing of personal data. If the purposes and means of such processing are determined by Union law or the law of the Member States, the controller or the specific criteria for its designation may be provided for under Union law or the law of the Member States.

f) Processor

A processor is a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller.

g) Recipient

A recipient is a natural or legal person, public authority, agency, or other body to whom personal data is disclosed, regardless of whether or not that body is a third party. However, public authorities that may receive personal data in the course of a specific investigative mandate under Union law or the law of the Member States are not considered recipients.

h) Third Party

A third party is a natural or legal person, public authority, agency, or other body other than the data subject, the controller, the processor, and the persons authorized to process the personal data under the direct responsibility of the controller or the processor.

i) Consent

Consent means any freely given, specific, informed, and unambiguous indication of the data subject’s wishes, expressed by a statement or by a clear affirmative action, by which the data subject signifies agreement to the processing of personal data relating to him or her.

2 Name and Address of the Data Controller

The controller within the meaning of Article 4(7) of the GDPR is:

GesundLand Vulkaneifel GmbH
Leopoldstraße 9a
54550 Daun/Vulkaneifel
Phone: +49 (0) 6592 951370
Fax: +49 (0) 6592 951320
Email: info@gesundland-vulkaneifel.de
Website: www.gesundland-vulkaneifel.de

Inquiries and requests for information, correction, restriction, or erasure may be sent by mail to this address or by email to datenschutz@gesundland-vulkaneifel.de.

3 Name and Address of the Data Protection Officer

The data protection officer of the data controller is:

Günter Hilgers
EcoVisio GmbH
Rheinwerkallee 3
53227 Bonn
Email: datenschutz@gesundland-vulkaneifel.de

Any data subject may contact our Data Protection Officer directly at any time with any questions or suggestions regarding data protection.

4 Contact Information for the Supervisory Authority (Rhineland-Palatinate)

The competent supervisory authority for the data controller is:

Name: State Commissioner for Data Protection and Freedom of Information, Rhineland-Palatinate
Address: Hintere Bleiche 34
City: 55116 Mainz
Phone: +49 (0) 6131 / 8920-0
Fax: +49 (0) 6131 / 8920-299
Email: poststelle@datenschutz.rlp.de

5 External Hosting

This website is hosted by an external service provider (host). The service was contracted with

Hetzner Online GmbH
, Industriestraße 25
, 91710 Gunzenhausen

. Personal data collected on this website is stored on the host’s servers. This may primarily include IP addresses, contact requests, metadata and communication data, contract data, contact information, names, website visits, and other data generated through a website.

The use of the hosting provider is for the purpose of fulfilling our contractual obligations to our potential and existing customers (Art. 6(1)(b) GDPR) and in the interest of ensuring the secure, fast, and efficient provision of our online services by a professional provider (Art. 6(1)(f) GDPR).

Our hosting provider will process your data only to the extent necessary to fulfill its service obligations and will follow our instructions regarding this data.

Conclusion of a Data Processing Agreement

To ensure data processing complies with data protection regulations, a data processing agreement in accordance with Art. 28 GDPR has been concluded with the service provider.

6 Cookies

A cookie is a small data file that is stored on your device and contains data such as personal page settings and login information. This data file is generated by the web server to which you have established a connection via your web browser and is sent to you. In general, we use cookies to analyze interest in our websites and to improve their user-friendliness. In principle, you can access our websites without cookies. However, if you wish to use our websites to their fullest extent or in a convenient manner, you should accept the cookies that enable the use of certain features or make the user experience more convenient. You can find the purposes for which we use cookies in the consent management section when you first visit our website or, thereafter, by accessing the cookie settings under “Cookies” on our website.

When you use our websites, you will be asked to consent to the use of cookies, unless they are necessary for the proper functioning of the website. You can decide whether to consent to the use of cookies requiring consent via the Consent Manager on our website.

You also have the option to configure your browser so that cookies are displayed before they are stored, so that only certain cookies are accepted or rejected, or so that cookies are rejected altogether. Please note that changes to browser settings always apply only to the respective browser. If you use different browsers or switch devices, you will need to reconfigure the settings. In addition, you can delete cookies from your storage device at any time. For information on cookie settings, how to change them, and how to delete cookies, please refer to your web browser’s help function.

The most common types of cookies are explained below for your understanding:

6.1 Session Cookies

While you are active on a website, a session cookie is temporarily stored on your computer’s memory; this cookie contains a session ID to prevent you from having to log in again each time you change pages, for example. Session cookies are deleted when you log out or expire automatically once your session has ended.

6.2 Persistent or Session-Tracking Cookies

A persistent or session cookie stores a file on your computer for the period specified in its expiration date. These cookies allow websites to remember your information and settings for your next visit. This results in faster and more convenient access, since, for example, you won’t have to reselect your language setting for our portal. Once the expiration date has passed, the cookie is automatically deleted when you visit the website that created it.

6.3 Third-Party Cookies

Third-party cookies come from providers other than the website operator. They can be used, for example, to collect information for advertising, customized content, and web statistics.

6.4 Flash Cookies

Flash cookies are data elements stored on your computer by websites that use Adobe Flash. Flash cookies have no expiration date.

6.5 Borlabs Cookie

6.5.1 Description and Purpose of Data Processing

Our website uses Borlabs Cookie’s consent technology to obtain your consent to the storage of certain cookies in your browser or to the use of certain technologies, and to document this in compliance with data protection regulations. The provider of this technology is Borlabs—Benjamin A. Bornschein, Rübenkamp 32, 22305 Hamburg (hereinafter “Borlabs”).

When you visit our website, a Borlabs cookie is stored in your browser, which records the consents you have granted or any revocations of those consents. This data is not shared with the provider of Borlabs Cookie.

6.5.2 Legal Basis for Processing

The Borlabs Cookie Consent technology is used to obtain the legally required consents for the use of cookies. The legal basis for this is Article 6(1)(c) of the GDPR.

6.5.3 Duration of Storage, Right to Object, and Option to Delete

The collected data will be stored until you request its deletion, delete the Borlabs cookie yourself, or the purpose for storing the data no longer applies. Otherwise, the cookies will be automatically deleted after 12 months. Mandatory statutory retention periods remain unaffected. Details on the processing of Borlabs cookies can be found at de.borlabs.io/kb/welche-daten-speichert-borlabs-cookie/.

6.5.4 Data Processing on Behalf of a Client

Borlabs Cookie Consent Technology is operated on our own servers. No personal data is transferred.

7 Collection of General Data and Information

Our website collects a range of general data and information each time a data subject or an automated system accesses the website. This general data and information is stored in the server’s log files. The following may be collected: (1) the browser types and versions used, (2) the operating system used by the accessing system, (3) the website from which an accessing system reaches our website (known as the referrer), (4) the subpages on our website accessed via an accessing system, (5) the date and time of access to the website, (6) an Internet Protocol (IP) address, (7) the Internet service provider of the accessing system, and (8) other similar data and information used for security purposes in the event of attacks on our information technology systems.

We do not draw any conclusions about the data subject when using this general data and information. Rather, this information is required to (1) correctly deliver the content of our website, (2) to optimize the content of our website as well as the advertising on it, (3) to ensure the ongoing functionality of our information technology systems and the technology of our website, and (4) to provide law enforcement authorities with the information necessary for criminal prosecution in the event of a cyberattack. We therefore evaluate this anonymously collected data and information both for statistical purposes and with the aim of enhancing data protection and data security within our company, ultimately to ensure an optimal level of protection for the personal data we process. The anonymous data from the server log files is stored separately from any personal data provided by a data subject.

In addition, we also use so-called local storage and session storage technology (also referred to as “local data,” “local storage,” and “session storage”). With local storage, data is stored locally in your browser’s cache; this data remains even after you close the browser window or exit the program and can be read if you do not actively clear the cache. Local storage allows your preferences when using our websites to be stored on your computer and accessed by you. The function of session storage is essentially the same as that of local storage as described above, except that the corresponding data is automatically removed from your browser’s cache immediately after you close the browser (“session”).

Third parties cannot access the data stored in Local Storage or Session Storage. It is not shared with third parties nor used for advertising purposes. In particular, this technology is used to present our content to you in an appealing graphical format (e.g., pop-up windows, etc.) and to personalize our offerings and the navigation on our pages for you. You can manage local storage content in your browser via the “History” or “Local Data” settings, depending on which browser you use. If you restrict the functions described above, this may result in limited functionality.

Legal basis for the processing of personal data

Art. 6(1)(f) of the GDPR (legitimate interest). Our legitimate interest consists of maintaining the compatibility and stability of this web application for as many users as possible, including combating misuse and resolving malfunctions.

Retention Period

The aforementioned technical data is deleted as soon as it is no longer needed to ensure the compatibility of this web application for all visitors. We have no control over how long the data is stored in your local storage. You can manage local storage content in your browser via the “History” or “Local Data” settings, depending on which browser you use. If you restrict the described functions accordingly, this may result in limited functionality.

SSL or TLS Encryption

For security reasons and to protect the transmission of confidential content—such as requests you send to us as the site operator—this site uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that the browser’s address bar changes from “http://” to “https://” and by the lock icon in your browser’s address bar.

When SSL or TLS encryption is enabled, the data you transmit to us cannot be read by third parties.

8 Scope and Purpose of the Data Collected

8.1 GesundLand Vulkaneifel – General

Each time a webpage or a file accessible via a web browser is requested, the following data is stored:

the requested web page or file,
the date and time of the request,
the amount of data transferred,
a description of the web browser type and operating system used,
and the IP address of the requesting computer.
This information is used to optimize the websites of GesundLand Vulkaneifel GmbH and to log any potential attacks on our services via the Internet.

8.2 GesundLand Vulkaneifel – Contact Form

If you submit inquiries to us via the contact form, the information you provide in the inquiry form—including the contact details you enter there—will be stored by us for the purpose of processing your inquiry and in case of follow-up questions. We will not disclose this data without your consent.

The processing of this data is based on Article 6(1)(b) of the GDPR, provided that your inquiry is related to the performance of a contract or is necessary for the implementation of pre-contractual measures.

The data you enter in the contact form will remain with us until the purpose for storing the data no longer applies (e.g., after your inquiry has been fully processed) or until you request that we delete the data in accordance with Article 17 of the GDPR. Mandatory legal provisions—in particular retention periods—remain unaffected.

8.3 GesundLand Vulkaneifel – Inquiries via Email, Phone, or Fax

If you contact us via email, phone, or fax, your inquiry—including all personal data contained therein (name, inquiry)—will be stored and processed by us for the purpose of handling your request. We will not disclose this data without your consent.

The processing of this data is based on Article 6(1), first sentence, letter b of the GDPR, provided that your inquiry is related to the performance of a contract or is necessary for the implementation of pre-contractual measures (e.g., questions about our products, our company, or other matters).

The data you have provided will remain with us until the purpose for storing the data no longer applies (e.g., after your inquiry has been fully processed) or until you request that we delete the data in accordance with Article 17 of the GDPR. Mandatory legal provisions—in particular retention periods—remain unaffected.

8.4 GesundLand Vulkaneifel – Bookings

To enable your online bookings/direct bookings of lodging services and other travel services, we have integrated reservation systems into our website.

8.4.1 Deskline

Deskline is the reservation system provided by feratel media technologies AG, Maria-Theresien-Straße 8, A-6020 Innsbruck.

We have integrated Deskline via an API. When you make a reservation, you will be redirected to Deskline’s website. The data collected during the accommodation booking: First name, last name, email address, phone number, street, house number, ZIP code, city, and your travel dates (check-in, check-out, number of guests, type of accommodation, etc.) are stored and processed in Deskline’s reservation system.

The data is used exclusively to process your reservation and is not used for any other purposes (e.g., advertising).

For further information on the processing of your data in Deskline, please refer to the company’s privacy policy at www.feratel.de/datenschutz/ and www.feratel.com/datenschutz.html.

8.4.2 Regiondo

When you book a tour through our website, this is done via the service provider Regiondo, whose booking form is integrated into our website. The provider is Regiondo GmbH, Grafinger Straße 6, 81671 Munich.

When you use Regiondo on our website, information regarding your use of the site—including your IP address—is transmitted to a Regiondo server and stored there. This data is only transmitted when Regiondo is used. The transmission to, and processing by, Regiondo is governed by Regiondo’s privacy policy.

Legal Basis for Processing

Data processing is based on contractual agreements for booking tours via our website (Art. 6(1)(b) GDPR).

Data Transfer:

The contractor is authorized to enter into subcontracting relationships for the fulfillment of the tasks assigned to it. The following applies to the transfer and processing of personal data by the contractor and its subcontractors: the transfer and processing take place exclusively on servers located within the territory of the Federal Republic of Germany, in a member state of the European Union, or in another signatory state to the Agreement on the European Economic Area. To the extent that the Provider’s data is transferred to and stored in a third country, Regiondo ensures that such data transfers comply with applicable data protection laws. For more information on data processing, please refer to the applicable privacy policy of Regiondo GmbH at pro.regiondo.com/de/datenschutz/.

Regiondo also engages subcontractors based in the United States to fulfill orders. Please note that the European Court of Justice has determined that the United States has an inadequate level of data protection by EU standards. There is therefore a risk that your data may be processed by U.S. authorities for monitoring and surveillance purposes, possibly without any legal recourse available to you. In such a case, the transfer is based on your consent (by using Regiondo services on our site) pursuant to Article 6(1)(a) in conjunction with Article 49(1)(a) of the GDPR, as the use of Regiondo means that a data transfer to the United States cannot be ruled out.

Data Processing on Behalf of a Client

We have entered into a data processing agreement with Regiondo and fully comply with the requirements of the German data protection authorities when using Regiondo.

For more information about Regiondo, please refer to Regiondo’s privacy policy at: pro.regiondo.com/de/datenschutz/.

9 Newsletter Distribution via CleverReach

This website uses CleverReach to send newsletters. The provider is CleverReach GmbH & Co. KG, Mühlenstr. 43, 26180 Rastede. CleverReach is a service that allows for the organization and analysis of newsletter distribution. The data you provide to subscribe to the newsletter (e.g., email address) is stored on CleverReach’s servers in Germany or Ireland.

Our newsletters sent via CleverReach allow us to analyze the behavior of newsletter recipients. Among other things, we can analyze how many recipients opened the newsletter and how often specific links within the newsletter were clicked. Using what is known as conversion tracking, we can also analyze whether a predefined action (e.g., purchasing a product on our website) took place after a link in the newsletter was clicked. For more information on data analysis by CleverReach newsletters, please visit: www.cleverreach.com/de/funktionen/reporting-und-tracking/.

Legal Basis for Processing

Data processing is based on your consent (Art. 6(1)(a) GDPR).

Withdrawal

You may withdraw your consent at any time by unsubscribing from the newsletter. The lawfulness of data processing operations that have already taken place remains unaffected by the withdrawal.

If you do not want your data analyzed by CleverReach, you must unsubscribe from the newsletter. We provide a link for this purpose in every newsletter message. You can also unsubscribe from the newsletter directly on the website.

Retention Period

The data you have provided to us for the purpose of receiving the newsletter will be stored by us until you unsubscribe from the newsletter and will be deleted from both our servers and CleverReach’s servers after you unsubscribe. Data stored by us for other purposes (e.g., email addresses for the members’ area) remains unaffected by this.

Data Processing on Behalf of the Client

We have entered into a data processing agreement with CleverReach and fully comply with the requirements of the German data protection authorities when using CleverReach.

For more information about CleverReach, please refer to CleverReach’s privacy policy at: www.cleverreach.com/de/datenschutz/.

10 Deletion and Blocking of Personal Data

Unless otherwise specified:

The data controller processes and stores the data subject’s personal data only for the period necessary to achieve the purpose of storage or to the extent required by laws or regulations to which the data controller is subject.

If the purpose of storage no longer applies or if a retention period prescribed by another competent legislative authority expires, the personal data will be blocked or deleted in accordance with legal requirements.

11 Rights of the Data Subject

a) Right of Access

You may exercise your right of access under Article 15 of the GDPR at any time to determine whether we are processing personal data concerning you.

b) Right to Rectification

You may exercise your right to rectification under Article 16 of the GDPR at any time and request the rectification of inaccurate personal data concerning you.

c) Right to restriction of processing

You may exercise your right to restriction of processing under Article 18 of the GDPR at any time and request that we restrict processing, provided the legal requirements for doing so are met.

d) Right to erasure

You may exercise your right to erasure under Article 17 of the GDPR at any time and request that personal data concerning you be erased without delay if such data is no longer necessary for the purposes for which it was collected or otherwise processed. This right to erasure may be subject to other legal obligations (e.g., retention requirements).

e) Right to Information

You may exercise your right to be informed under Article 19 of the GDPR at any time. If you have exercised your right to erasure, rectification, or restriction of processing of your personal data, we are obligated to notify all recipients to whom your personal data has been disclosed of the rectification, erasure, or restriction of processing, unless this proves impossible or involves disproportionate effort. You have the right to be informed of these recipients.

f) Right to Data Portability

You may exercise your right to data portability pursuant to Article 20 of the GDPR at any time. You have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, or to request that it be transmitted to another controller, if this is technically feasible.

g) Right to Object to Data Collection in Specific Cases and to Direct Marketing (Article 21 of the GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is carried out pursuant to Article 6(1)(e) or (f) of the GDPR; this also applies to profiling based on these provisions. You can find the respective legal basis on which processing is based in this Privacy Policy. If you object, we will no longer process your personal data in question, unless we can demonstrate compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the data subject, or the processing is necessary for the establishment, exercise, or defense of legal claims (objection under Article 21(1) of the GDPR).

If we process personal data for the purpose of direct marketing, the data subject has the right to object at any time to the processing of personal data for the purpose of such marketing; this also applies to profiling to the extent that it is related to such direct marketing. If the data subject objects to us processing their personal data for direct marketing purposes, we will no longer process the personal data for these purposes (objection under Article 21(2) of the GDPR).

h) Right to Withdraw Consent

You have the right to withdraw your consent to the processing of personal data at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent prior to its withdrawal.

12 Right to File a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, your workplace, or the location of the alleged infringement, if you believe that the processing of your personal data violates the GDPR.

Data Protection in Connection with Job Applications and the Application Process

We offer you the opportunity to apply for a position with us (e.g., via email, mail, or Facebook). Below, we provide information about the scope, purpose, and use of your personal data collected as part of the application process. We assure you that the collection, processing, and use of your data are carried out in accordance with applicable data protection laws and all other legal provisions, and that your data will be treated as strictly confidential.

Scope and Purpose of Data Collection

When you submit an application to us, we process your associated personal data (e.g., contact and communication information, application documents, notes taken during job interviews, etc.) to the extent necessary to decide whether to establish an employment relationship.

The legal basis for this is Section 26 of the New Federal Data Protection Act (BDSG-neu) under German law (initiation of an employment relationship), Art. 6(1)(b) of the GDPR (general contract initiation), and—provided you have given your consent—Art. 6(1)(a) of the GDPR. You may revoke your consent at any time.

Your personal data will be disclosed within our company exclusively to those individuals involved in processing your application.

If your application is successful, the data you submitted will be stored in our data processing systems pursuant to § 26 BDSG-neu and Art. 6(1)(b) GDPR for the purpose of carrying out the employment relationship.

Data Retention Period

If we are unable to offer you a position, if you decline a job offer, or if you withdraw your application, we reserve the right to retain the data you submitted on the basis of our legitimate interests (Article 6(1)(f) of the GDPR) for up to 6 months from the end of the application process (rejection or withdrawal of the application).

Thereafter, the data will be deleted and the physical application documents will be destroyed. The retention serves, in particular, as evidence in the event of a legal dispute. If it becomes apparent that the data will be required after the 6-month period has expired (e.g., due to an impending or pending legal dispute), the data will not be deleted until the purpose for continued retention no longer applies.

Data may also be retained for a longer period if you have provided your consent (Art. 6(1)(a) GDPR) or if statutory retention requirements prevent deletion.

13 Privacy Policy Regarding the Use and Operation of Fan Pages

13.1 Privacy Policy for the Facebook Fan Page

13.1.1 Data Controller

As the operator of this Facebook page, we (GesundLand Vulkaneifel GmbH, Leopoldstraße 9a, 54550 Daun/Vulkaneifel, Germany) are the joint controllers, together with the operator of the social network Facebook (Facebook Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland), within the meaning of Article 4(7) of the General Data Protection Regulation (GDPR). When you visit our Facebook page, personal data is processed by the data controllers. Below, we provide information about what data is involved, how it is processed, and what rights you have in this regard. As the controller of this page, we have entered into agreements with Facebook that, among other things, govern the terms of use for the Facebook page. The Facebook Terms of Service, as well as the other terms and policies listed at the end thereof, apply.

13.1.2 Purposes of Processing

The processing of this information is intended, among other things, to enable Facebook to improve its advertising system, which it distributes through its network. It is also intended to enable us, as the operators of the Facebook page, to obtain statistics that Facebook generates based on visits to our Facebook page. The purpose of this is to manage the marketing of our activities. For example, this enables us to gain insight into the profiles of visitors who engage with our Facebook page or use its features, so that we can provide them with more relevant content and develop features that may be of greater interest to them.

To help us better understand how we can use our Facebook page to achieve our goals more effectively, demographic and geographic analyses are also generated based on the collected information and made available to us. We can use this information to display targeted, interest-based advertisements without directly learning the visitor’s identity. If visitors use Facebook on multiple devices, data collection and analysis may also take place across devices, provided that the visitors are registered users who are logged into their own profiles on each device. The visitor statistics generated are transmitted to us exclusively in anonymized form. We do not have access to the underlying data.

13.1.3 Legal Basis and Legitimate Interests

We operate this Facebook page to present ourselves to Facebook users and other interested individuals who visit our Facebook page, and to communicate with them. The processing of users’ personal data is based on our legitimate interests in optimizing our corporate image (Art. 6(1)(f) GDPR).

13.1.4 Disclosure of Data

We have no influence over the collection of data by Facebook, nor over the data processing operations carried out by Facebook. Furthermore, we are not aware of the scope of data collection, the purposes of processing, or the retention periods applied. Therefore, the transfer of data in the form of anonymized statistics cannot be ruled out.

When you visit our Facebook page, it is possible that some of the information collected may also be processed outside the European Union by Facebook Inc., which is headquartered in the United States. Please note that the European Court of Justice has determined that the United States is a country with a level of data protection that is insufficient by EU standards. There is therefore a risk that your data may be processed by U.S. authorities for monitoring and surveillance purposes, possibly without any legal recourse available to you. You can decide for yourself in the consent management section of the Facebook page whether or not you wish to consent to such a transfer. In such a case, the transfer is based on your consent pursuant to Art. 6(1)(a) of the GDPR.

We ourselves do not disclose any personal data.

13.1.5 Options for Objection

Facebook users can use the ad preferences settings to control the extent to which their user behavior is tracked when visiting our Facebook page. Additional options are available through Facebook settings, the fan page’s consent management feature, or the form for exercising the right to object. Furthermore, the processing of information via the cookies used by Facebook can be prevented by disabling third-party cookies or Facebook cookies in your browser settings.

13.1.6 Nature of Joint Responsibility

The agreements with Facebook, including those regarding joint responsibility, essentially stipulate that requests for information and the exercise of other data subject rights should, as a matter of course, be directed to Facebook. This is because, as the provider of the social network and the ability to integrate Facebook Pages into it, Facebook alone has direct access to the necessary information and can also immediately take any necessary measures and provide information. Should our assistance nevertheless be required, you may contact us at any time.

13.1.7 Information on Contact Options and Additional Rights as a Data Subject

Further information regarding our contact details, the rights of data subjects vis-à-vis us, and how we otherwise process personal data can be found in this Privacy Policy. Information on Facebook’s handling of personal data can be found in its Privacy Policy.

13.2 Privacy Policy for Instagram

13.2.1 Data Controller

As the operator of this Instagram page, we (GesundLand Vulkaneifel GmbH, Leopoldstraße 9a, 54550 Daun/Vulkaneifel, Germany) are the joint data controllers, together with the operator of the social network Instagram (Facebook Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland), within the meaning of Article 4(7) of the General Data Protection Regulation (GDPR). When you visit our Instagram page, personal data is processed by the data controllers. Below, we provide information about what data is involved, how it is processed, and what rights you have in this regard.

As the controller of this page, we have entered into agreements with Facebook that, among other things, govern the terms of use for the Instagram page. The Instagram Terms of Use

at help.instagram.com/581066165581870, as well as the other terms and policies listed at the end of that page.

13.2.2 Purposes of Processing

The processing of this information is intended, among other things, to enable Facebook to improve its advertising system, which it distributes via its network. It is also intended to enable us, as the operators of the Instagram page, to obtain statistics that Facebook generates based on visits to our Instagram page. The purpose of this is to manage the marketing of our activities. For example, this enables us to gain insight into the profiles of visitors who engage with our Instagram page or use the page’s features, so that we can provide them with more relevant content and develop features that may be of greater interest to them.

To help us better understand how we can use our Instagram page to achieve our goals more effectively, demographic and geographic analyses are also generated based on the collected information and made available to us. We can use this information to display targeted, interest-based advertisements without directly learning the visitor’s identity. If visitors use Facebook on multiple devices, data collection and analysis may also take place across devices, provided that the visitors are registered users who are logged into their own profiles on each device.

The visitor statistics generated are transmitted to us exclusively in anonymized form. We do not have access to the underlying data.

13.2.3 Legal Basis and Legitimate Interests

We operate this Instagram page to present ourselves to Instagram users and other interested individuals who visit our Instagram page, and to communicate with them. The processing of users’ personal data is based on our legitimate interests in optimizing our corporate image (Art. 6(1)(f) GDPR).

13.2.4 Disclosure of Data

We have no influence over the collection of data by Instagram, nor over the data processing operations carried out by Facebook. Furthermore, we are not aware of the scope of data collection, the purposes of processing, or the retention periods. Therefore, the transfer of data in the form of anonymized statistics cannot be ruled out.

When you visit our Instagram page, it is possible that some of the information collected may also be processed outside the European Union by Facebook Inc., which is headquartered in the United States. Please note that the European Court of Justice has determined that the United States is a country with a level of data protection that is insufficient by EU standards. There is therefore a risk that your data may be processed by U.S. authorities for monitoring and surveillance purposes, possibly without any legal recourse available to you. You can decide for yourself in the consent management section of the Instagram page whether or not you wish to consent to such a transfer. In such a case, the transfer is based on your consent pursuant to Art. 49(1)(a) of the GDPR.

We do not disclose any personal data ourselves.

13.2.5 Options for Objection

Instagram users can use the advertising preferences settings to control the extent to which their user behavior is tracked when visiting our Instagram page. Additional options are available in the Facebook and Instagram settings at:

www.facebook.com/login.php
www.instagram.com/accounts/login/, the fan page’s consent management feature, or the form for exercising the right to object at:

www.facebook.com/help/contact/1994830130782319.

The processing of information via the cookies used by Facebook can also be prevented by disabling third-party cookies or Facebook cookies in your browser settings.

13.2.6 Nature of Joint Responsibility

13.2.7 Information on How to Contact Us and Other Rights as a Data Subject

Further information regarding our contact details, the rights of data subjects with respect to us, and how we otherwise process personal data can be found in this Privacy Policy.

Information on how Facebook handles personal data on Instagram can be found in its Privacy Policy at help.instagram.com/519522125107875

13.3 Privacy Policy for YouTube

13.3.1 Data Controller

As the operator of this YouTube page, we (GesundLand Vulkaneifel GmbH, Leopoldstraße 9a, 54550 Daun/Vulkaneifel, Germany) are jointly responsible with the operator of the YouTube website (YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA—a subsidiary of Google Inc., 160 Amphitheatre Parkway, Mountain View, CA 94043, USA) the data controller within the meaning of Article 4(7) of the General Data Protection Regulation (GDPR). When you visit our YouTube page, personal data is processed by the data controllers. Below, we provide information about what data is involved, how it is processed, and what rights you have in this regard.

All privacy settings for YouTube must be configured in your Google Account. As the controller of this site, we have entered into agreements with Google that, among other things, govern the terms of use for Google services (in this case, YouTube). The applicable terms of service are YouTube’s at: www.youtube.com/static and Google’s at: policies.google.com/terms

13.3.2 Purposes of Processing

The processing of this information is intended, among other things, to enable YouTube to improve its advertising system, which it distributes through its network. It is also intended to enable us, as the operator of the YouTube page, to obtain statistics that YouTube generates based on visits to our YouTube page. This is intended to help us manage the marketing of our activities. For example, it allows us to gain insight into the profiles of visitors who enjoy our YouTube channel or use its features, so that we can provide them with more relevant content and develop features that may be of greater interest to you.

To help us better understand how we can use our YouTube channel to achieve our goals more effectively, demographic and geographic analyses are also generated based on the collected information and made available to us. We can use this information to display targeted, interest-based advertisements without directly learning the visitor’s identity. If visitors use YouTube on multiple devices, data collection and analysis may also take place across devices, provided that the visitors are registered and logged into their own profiles on each device. The visitor statistics generated are transmitted to us exclusively in anonymized form. We do not have access to the underlying data.

13.3.3 Legal Basis and Legitimate Interests

We operate this YouTube page to present ourselves to YouTube users and other interested individuals who visit our YouTube page and to communicate with them. The processing of users’ personal data is based on our legitimate interests in optimizing our corporate image (Art. 6(1)(f) GDPR).

13.3.4 Disclosure of Data

We have no influence over the collection of data by Google, nor over the data processing operations carried out by Google. Furthermore, we are not aware of the scope of data collection, the purposes of processing, or the retention periods applied. Therefore, the transfer of data in the form of anonymized statistics cannot be ruled out.

When you visit our YouTube page, it is possible that some of the information collected may also be processed outside the European Union by YouTube LLC or Google Inc., both of which are based in the United States. Please note that the European Court of Justice has determined that the United States is a country with a level of data protection that is insufficient by EU standards. There is therefore a risk that your data may be processed by U.S. authorities for monitoring and surveillance purposes, possibly without any legal recourse. You can decide for yourself in the consent management section of the YouTube page whether or not you wish to consent to such a transfer. In such a case, the transfer is based on your consent pursuant to Art. 6(1)(a) of the GDPR.

We ourselves do not disclose any personal data.

13.3.5 Options for Objection

YouTube users can use the settings in their Google Account to control the extent to which their user behavior is tracked when visiting our YouTube page. See also: policies.google.com/privacy. Additional options are available through the fan page’s consent management feature.

The processing of information via cookies used by YouTube or Google can also be prevented by disabling third-party cookies or cookies from YouTube or Google in your browser settings.

13.3.6 Nature of Joint Responsibility

The agreements with YouTube and Google—including those regarding joint responsibility—essentially stipulate that requests for information and the exercise of other data subject rights should, as a matter of course, be directed to YouTube or Google. This is because, as providers of the social network and the ability to embed YouTube pages within it, YouTube or Google alone have direct access to the necessary information and can also immediately take any necessary measures and provide information. Should our assistance nevertheless be required, we can be contacted at any time.

13.3.7 Information on Contact Options and Additional Rights as a Data Subject

Further information regarding our contact details, the rights of data subjects vis-à-vis us, and how we otherwise process personal data can be found in this Privacy Policy.

Information on how YouTube (part of Google) handles personal data can be found in its Privacy Policy (https://policies.google.com/privacy?hl=de).

13.4 Privacy Policy for Pinterest

13.4.1 Data Controller

As the operator of this Pinterest page, we (GesundLand Vulkaneifel GmbH, Leopoldstraße 9a, 54550 Daun/Vulkaneifel, Germany) are the data controllers, together with the operator of the social network Pinterest (Pinterest Europe Ltd., 2nd Floor, Palmerston House, Fenian Street, Dublin 2, Ireland, a subsidiary of Pinterest Inc., 808 Brannan Street, San Francisco, CA 94103, USA)) are the data controllers within the meaning of Article 4(7) of the General Data Protection Regulation (GDPR). When you visit our Pinterest page, personal data is processed by the data controllers. Below, we provide information about what data is involved, how it is processed, and what rights you have in this regard. As the controller of this page, we have entered into agreements with Pinterest that, among other things, govern the terms of use for the Pinterest page. The Pinterest Terms of Service at policy.pinterest.com/de/terms-of-service and the Community Guidelines at policy.pinterest.com/de/community-guidelines apply.

13.4.2 Purposes of Processing

The processing of this information is intended, among other things, to enable Pinterest to improve its advertising system, which it distributes through its network. It is also intended to enable us, as the operator of the Pinterest page, to obtain statistics that Pinterest generates based on visits to our Pinterest page. This is intended to guide the marketing of our activities. For example, it enables us to gain insight into the profiles of visitors who appreciate our Pinterest page or use the page’s features, so that we can provide them with more relevant content and develop features that may be of greater interest to them.

To help us better understand how we can use our Pinterest page to achieve our goals more effectively, demographic and geographic analyses are also generated based on the collected information and made available to us. We can use this information to display targeted, interest-based advertisements without directly learning the visitor’s identity. If visitors use Pinterest on multiple devices, data collection and analysis may also take place across devices, provided that the visitors are registered users who are logged into their own profiles on each device. The visitor statistics generated are transmitted to us exclusively in anonymized form. We do not have access to the underlying data.

13.4.3 Legal Basis and Legitimate Interests

We operate this Pinterest page to present ourselves to Pinterest users and other interested individuals who visit our Pinterest page, and to communicate with them. The processing of users’ personal data is based on our legitimate interests in optimizing our corporate presentation (Art. 6(1)(f) GDPR).

13.4.4 Disclosure of Data

We have no influence over the collection of data by Pinterest, nor over the data processing operations carried out by Pinterest. Furthermore, we are not aware of the scope of data collection, the purposes of processing, or the retention periods. Therefore, the transfer of data cannot be ruled out.

When you visit our Pinterest page, it is possible that some of the information collected may also be processed outside the European Union by Pinterest Inc., which is headquartered in the United States. Please note that the European Court of Justice has determined that the United States is a country with a level of data protection that is insufficient by EU standards. There is therefore a risk that your data may be processed by U.S. authorities for monitoring and surveillance purposes, possibly without any legal recourse available to you. You can decide for yourself in the consent management section of the Facebook page whether or not you wish to consent to such a transfer. In such a case, the transfer is based on your consent pursuant to Art. 6(1)(a) of the GDPR.

We ourselves do not disclose any personal data.

13.4.5 Options for Objection

Pinterest users can control the extent to which their search results are tracked when visiting our Pinterest page at help.pinterest.com/de/article/your-privacy-and-data-settings. Additional options are available through the fan page’s consent management settings.

The processing of information via cookies used by Pinterest can also be prevented by disabling third-party cookies or Pinterest cookies in your browser settings.

13.4.6 Nature of Joint Responsibility

The agreements with Pinterest, including those regarding joint responsibility, essentially stipulate that requests for information and the exercise of other data subject rights should, as a matter of course, be directed to Pinterest. This is because, as the provider of the social network and the ability to embed Pinterest pages there, Pinterest alone has direct access to the necessary information and can also immediately take any necessary measures and provide information. Should our assistance nevertheless be required, you may contact us at any time. We have entered into a joint controller agreement with Pinterest. Joint responsibility for the processing of your data is governed by the Pinterest Data Sharing Addendum. The relevant provisions can be found in the appendix (EXHIBIT A) to the Pinterest Advertising Services Agreement at business.pinterest.com/en-gb/pinterest-advertising-services-agreement/.

13.4.7 Information on How to Contact Us and Other Rights as a Data Subject

Further information regarding our contact details, the rights of data subjects vis-à-vis us, and how we otherwise process personal data can be found in this Privacy Policy. Information regarding Pinterest’s handling of personal data can be found in their Privacy Policy at policy.pinterest.com/de/privacy-policy.

14 Analytics Tools

14.1 Privacy Policy Regarding the Use of Google Analytics (with Anonymization Function)

This website uses features of the web analytics service Google Analytics. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics uses so-called “cookies.” These are text files that are stored on your computer and enable an analysis of your use of the website. The information generated by the cookies regarding your use of this website is generally transmitted to a Google server in the United States and stored there.

Legal basis for processing:

The storage of “Google Analytics cookies” and the use of this tool are based on your consent within the consent management system. Processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR. You can revoke or modify your consent at any time in the consent management system.

You can configure your browser to notify you when cookies are set and to allow cookies only on a case-by-case basis, to block the acceptance of cookies in specific cases or generally, and to enable the automatic deletion of cookies when you close your browser. Disabling cookies may limit the functionality of this website.

Google also processes your personal data in the United States. Please note that the European Court of Justice has determined that the United States has an inadequate level of data protection by EU standards. There is therefore a risk that your data may be processed by U.S. authorities for monitoring and surveillance purposes, possibly without any legal recourse available to you. By consenting to the use of Google Analytics in the consent management system, you also consent to such a transfer to the United States. In such a case, the transfer is based on your consent to the use of Google cookies pursuant to Article 6(1)(a) in conjunction with Article 49(1)(a) of the GDPR, since consent to the use of Google cookies always entails the possibility of data transfer to the United States.

We ourselves do not disclose any personal data.

IP Anonymization

We have enabled the IP anonymization feature on this website. This causes Google to truncate your IP address within member states of the European Union or in other signatory states to the Agreement on the European Economic Area before it is transmitted to the United States. Only in exceptional cases is the full IP address transmitted to a Google server in the United States and truncated there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity, and to provide other services related to website and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics is not combined with other data held by Google.

Browser Plugin

You can prevent cookies from being stored via the consent management feature on the homepage or by adjusting your browser settings accordingly; however, please note that in this case, you may not be able to use all features of this website to their full extent. You can also prevent Google from collecting the data generated by the cookie and related to your use of the website (including your IP address), as well as prevent Google from processing this data, by downloading and installing the browser plugin available at the following link: tools.google.com/dlpage/gaoptout.

Objection to Data Collection

You can prevent Google Analytics from collecting your data either through the consent management feature on the homepage or by clicking the following link. In the latter case, an opt-out cookie will be set to prevent the collection of your data during future visits to this website: tools.google.com/dlpage/gaoptout

For more information on how Google Analytics handles user data, please see Google’s Privacy Policy: support.google.com/analytics/answer/6004245.

Data Processing

We have entered into a data processing agreement with Google and fully comply with the strict requirements of the German data protection authorities regarding the use of Google Analytics.

The Conference of Independent Federal and State Data Protection Supervisory Authorities (DSK) determined in its resolution dated May 12, 2020, that the data processed by Google Analytics constitutes personal data within the meaning of the GDPR.

In the opinion of the data protection supervisory authorities, the processing of personal data in connection with Google Analytics does not constitute data processing on behalf of a controller pursuant to Article 28 of the GDPR. Pursuant to Article 4(7) and Article 28(10) of the GDPR, the controller must determine the purposes and means of processing itself. This gives rise to the processor’s obligation to process the data exclusively on the instructions of the controller (Article 29 of the GDPR). However, when using Google Analytics, we as website operators do not solely determine the purposes and means of data processing. Rather, these are in part dictated exclusively by Google, meaning that Google itself is responsible in this regard. The supervisory authorities clarify this point as follows: “Although Google continues to offer a data processing agreement, it also specifies in the ‘Google Measurement Controller Data Protection Terms’ that Google and the user (website operator) are separately responsible for certain processing operations.” Furthermore, Google specifies in its Terms of Service that it processes the data for its own purposes, in particular for the purpose of providing its web analytics and tracking service. Pursuant to Article 28(10) of the GDPR, Google is therefore no longer considered a data processor. Taking into account the current case law of the European Court of Justice, Google and the Google Analytics user are jointly responsible for data processing, meaning that the requirements of Article 26 of the GDPR must be observed.”

We have entered into a joint controller agreement with Google.

We would also like to point out at this juncture that the DSK reserves the right to revise its opinion in light of any future—possibly differing—interpretation by the European Data Protection Board and the case law of the CJEU.

Demographic Features in Google Analytics

This website uses the “demographic characteristics” feature of Google Analytics. This allows reports to be generated that contain information about the age, gender, and interests of site visitors. This data is derived from Google’s interest-based advertising as well as from visitor data provided by third parties. This data cannot be attributed to any specific individual. You can disable this feature at any time via the ad settings in your Google Account or generally opt out of having your data collected by Google Analytics as described in the section “Objection to Data Collection.”

Nature of Joint Responsibility

Based on the agreements with Google, including those regarding joint responsibility, it essentially follows that requests for information and the exercise of other data subject rights should, for practical purposes, be directed to Google. This is because, as the provider of the social network and the ability to embed Google pages there, Google alone has direct access to the necessary information and can also immediately take any necessary measures and provide information. Should our assistance nevertheless be required, you may contact us at any time.

Retention Period

Data stored by Google at the user and event levels that is linked to cookies, user identifiers (e.g., User ID), or advertising IDs (e.g., DoubleClick cookies, Android Advertising ID) is deleted after 26 months. For details, please see the following link: support.google.com/analytics/answer/7667196

14 2. Google Ads (formerly Google AdWords)

14.2.1 Google Ads Conversion

This website uses Google AdWords. AdWords is an online advertising program provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

As part of Google AdWords, we use what is known as conversion tracking. We use the Google Ads Conversion service to draw attention to our attractive offers on external websites using advertising materials (so-called Google Ads). Our goal is to show you ads that are relevant to your interests, make our website more engaging for you, and ensure a fair calculation of advertising costs. When you click on an ad placed by Google, a cookie is set for conversion tracking. If the user visits certain pages on this website and the cookie has not yet expired, Google and we can recognize that the user clicked on the ad and was redirected to that page. The information collected using the conversion cookie is used to generate conversion statistics for AdWords customers who have opted in to conversion tracking. We learn the total number of users who clicked on their ad and were redirected to a page tagged with a conversion tracking tag. However, we do not receive any information that can be used to personally identify users.

We ourselves do not collect or process any personal data in connection with the aforementioned advertising measures.

Due to the marketing tools used, your browser automatically establishes a direct connection to Google’s server. We have no influence over the scope and further use of the data collected by Google through the use of this tool and therefore inform you based on our current knowledge: By integrating Ads Conversion, Google receives the information that you have accessed the relevant part of our website or clicked on one of our ads. If you are registered with a Google service, Google can associate the visit with your account. Even if you are not registered with Google or are not logged in, there is a possibility that the provider may obtain and store your IP address.

Legal basis for processing:

The storage of “Google cookies” and the use of this tool are based on your consent as part of our consent management process. Processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR.

Disclosure

Google also processes your personal data in the United States. Please note that the European Court of Justice has determined that the United States has an inadequate level of data protection by EU standards. There is therefore a risk that your data may be processed by U.S. authorities for monitoring and surveillance purposes, possibly without any legal recourse available to you. In such a case, the transfer is based on your consent to the use of Google cookies pursuant to Article 6(1)(a) in conjunction with Article 49(1)(a) of the GDPR, since consent to the use of Google cookies does not preclude data transfer to the United States.

Objection to Data Collection

If you do not wish to participate in tracking, you can object to this use by easily disabling the Google Conversion Tracking cookie via your web browser’s user settings. You will then not be included in the conversion tracking statistics.

For more information on the handling of user data in connection with Google AdWords and Google Conversion Tracking, please refer to Google’s Privacy Policy: www.google.de/policies/privacy/.

Retention Period

These cookies expire after 30 days and are not used to personally identify users.

14.2.2 Google Ads Remarketing

We use the remarketing feature within the Google Ads service. The remarketing feature allows us to show users of our website ads tailored to their interests on other websites within the Google advertising network (in Google Search, on YouTube—so-called “Google Ads”—or on other websites). To do this, we analyze users’ interactions on our website—for example, which offers the user has shown interest in—so that we can display targeted ads to users on other sites even after they have visited our website. To do this, Google stores a number in the browsers of users who visit certain Google services or websites in the Google Display Network.

These cookies are used to track these users’ visits. The cookies serve to uniquely identify a web browser on a specific device and are not used to identify an individual.

Legal basis for processing:

The storage of “Google remarketing cookies” and the use of this tool are based on your consent within the consent management system. Processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR. You can revoke or modify your consent at any time in the consent management system.

You can configure your browser to notify you when cookies are set, to allow cookies only on a case-by-case basis, to block cookies in specific cases or generally, and to enable the automatic deletion of cookies when you close your browser. Disabling cookies may limit the functionality of this website.

Google also processes your personal data in the United States. Please note that the European Court of Justice has determined that the United States has an inadequate level of data protection by EU standards. There is therefore a risk that your data may be processed by U.S. authorities for monitoring and surveillance purposes, possibly without any legal recourse available to you. By consenting to the use of Google Ads Remarketing in the consent management system, you also consent to such a transfer to the United States. In such a case, the transfer is based on your consent to the use of Google cookies pursuant to Article 6(1)(a) in conjunction with Article 49(1)(a) of the GDPR, since consent to the use of Google cookies does not preclude a data transfer to the United States.

We ourselves do not disclose any personal data.

Objecting to Data Collection

You can prevent participation in this tracking process in various ways:

a) by adjusting your browser settings accordingly; in particular, disabling third-party cookies will prevent you from receiving ads from third-party providers;

b) by installing the plug-in provided by Google at the following link: www.google.com/settings/ads/plugin;

c) by disabling interest-based ads from providers participating in the “About Ads” self-regulatory campaign via the link www.aboutads.info/choices; note that this setting will be reset if you clear your cookies;

d) by permanently disabling this feature in your Firefox, Internet Explorer, or Google Chrome browsers via the link www.google.com/settings/ads/plugin;

e) by adjusting the relevant cookie settings in the consent management tool.

Please note that in this case, you may not be able to fully use all features of this service.

Storage Period

Up to 180 days (for cookies used via this website).

15 Integration of Video Platforms (in this case: YouTube) on the Website

We have embedded YouTube videos on our website. This allows us to present interesting videos directly on our site. YouTube is a subsidiary of Google LLC. The “YouTube” video portal is operated by YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA.

These videos are all embedded in “enhanced privacy mode,” which means that no data about you as a user is transmitted to YouTube unless you play the videos. Only when you play the videos is the data described in the next paragraph transmitted. We have no control over this data transmission.

When you visit the website, YouTube receives the information that you have accessed the corresponding page of our website. This occurs regardless of whether you are logged in to a YouTube user account or do not have a user account. If you are logged in to Google, your data will be directly associated with your account. If you do not wish for this data to be associated with your YouTube profile, you must log out before activating the button. YouTube stores your data as usage profiles and uses them for advertising, market research, and/or to tailor its website to your needs. Such analysis is carried out in particular (even for users who are not logged in) to deliver targeted advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles; to exercise this right, you must contact YouTube.

Legal Basis for Processing

The storage of “YouTube cookies” and the use of this tool are based on your consent within the consent management system. Processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR. You can revoke or modify your consent at any time in the consent management system.

Data Transfer

Google/YouTube also processes your personal data in the United States. Please note that the European Court of Justice has determined that the United States has a level of data protection that is insufficient by EU standards. There is therefore a risk that your data may be processed by U.S. authorities for monitoring and surveillance purposes, possibly without any legal recourse available to you. By consenting to the use of YouTube in the consent management system, you also consent to such a transfer to the United States. In such a case, the transfer is based on your consent to the use of YouTube cookies pursuant to Article 6(1)(a) in conjunction with Article 49(1)(a) of the GDPR, since consent to the use of YouTube cookies does not preclude a data transfer to the United States.

We ourselves do not disclose any personal data.

Options for Objection

YouTube users can use the advertising preferences settings to control the extent to which their user behavior is tracked when visiting our YouTube page.

The processing of information via the cookies used by YouTube can also be prevented by disabling third-party cookies or cookies from YouTube and/or Google in your browser settings.

Please note that in this case, you may not be able to fully use all features of our website.

For more information on the purpose and scope of data collection and its processing by YouTube, please refer to the privacy policy. There you will also find further information about your rights and settings options for protecting your privacy: www.google.de/intl/de/policies/privacy.

16 Use of Script Libraries (in this case: Google Fonts)

To ensure that our content is displayed correctly and in a visually appealing manner across all browsers, we use “Google Fonts” from Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; hereinafter referred to as “Google”) on our website to display fonts.

We have integrated this script library locally on our web server so that no connection to Google is established when our website is accessed, and no “Google cookie” is set.

Legal Basis for Processing

The legal basis for the integration of Google Fonts is our legitimate interest pursuant to Art. 6(1), first sentence, lit. f of the GDPR in ensuring a correct and visually appealing presentation of the website. Since we have integrated the font library locally on our own web server, no data is transferred to Google. Accordingly, no explicit consent on your part is required for the use of Google Fonts.

Data Disclosure

Because the script library is integrated locally on our web server, no data is disclosed to third parties.

Retention Period

We do not collect any personal data through the local integration of the script library on our server.

17 Content Delivery Network (CDN)

17.1 Google CDN (Content Delivery Network)

We use the Google Cloud CDN content delivery network. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google offers a globally distributed Content Delivery Network. Technically, this means that the transfer of information between your browser and our website is routed through Google’s network. This allows us to improve the global accessibility and performance of our website.

The following data, for example, is processed:

Content data (e.g., test entries, photographs, videos)

Usage data (e.g., webpages visited, interest in content, access times)

Meta/communication data (device information, IP addresses)

Purpose of Data Processing

Data is processed exclusively to maintain the security and functionality of the CDN.

Legal basis for data processing

The use of Google Cloud CDN is based on our legitimate interest in providing our website as error-free and secure as possible (Art. 6(1)(f) GDPR).

Data Retention Period

We have no control over the specific retention period for the processed data; it is determined by Google. For more information about Google Cloud CDN, see here: cloud.google.com/cdn/docs/overview.

Data Transfer

Data transfers to the United States are based on the EU Commission’s Standard Contractual Clauses. Details can be found here: cloud.google.com/terms/eu-model-contract-clause.

Please note that the European Court of Justice has determined that the United States has an inadequate level of data protection by EU standards. There is therefore a risk that your data may be processed by U.S. authorities for monitoring and surveillance purposes, possibly without any legal recourse available to you. By consenting to the use of YouTube in the consent management system, you also consent to such a transfer to the United States. In such a case, the transfer is based on your consent to the use of CDN cookies pursuant to Article 6(1)(a) in conjunction with Article 49(1)(a) of the GDPR, since consent to the use of CDN cookies does not preclude a data transfer to the United States.

We ourselves do not disclose any personal data.

17.2 Bootstrap/jsdelivr CDN

We use the Bootstrap CSS framework on our website, whose official CDN is jsDelivr, operated by Prospect One Sp., Krolweska 65A, 30-081 Krakow, Poland (website: prospectone.io/).

The framework contains HTML- and CSS-based design templates for typography, forms, buttons, tables, grid systems, navigation, and other user interface elements, as well as additional, optional JavaScript extensions.

To make the best use of this library, we use a so-called CDN (Content Delivery Network) from jsdelivr. This results in significant performance benefits, and errors within the library are comprehensively fixed without requiring any additional intervention on our part.

Data Transmission

The transmission and processing of personal data take place exclusively on servers located in the European Union.

Data Storage and Legal Basis for Processing:

The storage of the Bootstrap cookie and the use of this tool are based on Article 6(1)(f) of the GDPR (legitimate interest).

Our legitimate interest is to maintain the compatibility and stability of this website for as many users as possible, including combating misuse and resolving malfunctions.

With regard to this processing, you have the right to object as set forth in Article 21. You can find more detailed information in this Privacy Policy.

For more information on how the transferred data is handled, please refer to the provider’s privacy policy at www.jsdelivr.com/privacy-policy-jsdelivr-com.

18 Other Tools

18.1 Google Maps

We use Google Maps on this website to visually display geographic information and provide directions. Google Maps is a mapping service operated by Google Ireland Limited, Google Building Gordon House, 4 Barrow Street, Dublin, D04 E5W5, Ireland (“Google”).

By using Google Maps, information about your use of this website—including your IP address and the (starting) address entered as part of the route planner function—may be transmitted to Google LLC, located at 1600 Amphitheatre Parkway, Mountain View, California, USA.

When you visit a webpage that contains Google Maps, your browser establishes a direct connection to Google’s servers. The map content is transmitted directly from Google to your browser and integrated into the website by your browser. Google Maps is integrated using Feratel’s resources. Google Maps is only activated once you begin using Deskline’s services.

The use of Google Maps is based on your explicit consent pursuant to Article 6(1)(a) of the GDPR, as you expressly consent to its use.

We have no influence over the scope of the data collected by Google. To the best of our knowledge, this includes at least the following data:

Date and time of the visit to the relevant website,

Internet address or URL of the website accessed,

IP address, and the (starting) address entered as part of route planning.

We also have no control over the further processing and use of the data by Google and therefore cannot assume any responsibility for this.

Please note that Google also processes your personal data in the United States. The European Court of Justice has determined that the United States has a level of data protection that is insufficient by EU standards. There is therefore a risk that your data may be processed by U.S. authorities for monitoring and surveillance purposes, possibly without any legal recourse available to you.

By consenting to the use of Deskline (by choosing to navigate to Deskline’s pages), you also consent to the transfer of your data to the United States. In such a case, the transfer is based on your consent to the use of Deskline pursuant to Article 6(1)(a) in conjunction with Article 49(1)(a) of the GDPR, since consent to the use of Deskline also constitutes consent to the use of Google Maps, and therefore a data transfer to the United States cannot be ruled out.

We ourselves do not disclose any personal data.

For information on the purpose and scope of data collection, as well as the further processing and use of the data by Google, and your related rights and privacy settings, please refer to Google’s Privacy Policy (https://policies.google.com/privacy?hl=de).

18.2 Google reCAPTCHA

We use “Google reCAPTCHA” (hereinafter “reCAPTCHA”) on our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”).

reCAPTCHA is designed to verify whether data entry on our websites (e.g., in a contact form) is performed by a human or by an automated program. To do this, reCAPTCHA analyzes the website visitor’s behavior based on various characteristics. This analysis begins automatically as soon as the website visitor enters the website.

For the analysis, reCAPTCHA evaluates various pieces of information, such as

IP address,
referrer URL (the address of the page from which a visitor comes)
browser type and browser language
one or more cookies that may identify
your browser the length of time the website visitor spends on the website, or
the date and time of your request
The data collected during the analysis is forwarded to Google.

The reCAPTCHA analyses run entirely in the background. Website visitors are not notified that an analysis is taking place.

Data Storage and Legal Basis for Processing:

The legal basis for data processing is your explicit consent to Google’s storage of the Google cookie for reCAPTCHA.

The storage of the cookie and the use of this tool are based on Article 6(1)(f) of the GDPR (legitimate interest). Our legitimate interest is to protect the website from automated spying, misuse, and spam. However, we do not use Google reCAPTCHA without your explicit consent.

Data Transfer

Google also processes your personal data in the United States. Please note that the European Court of Justice has determined that the United States has an inadequate level of data protection by EU standards. There is therefore a risk that your data may be processed by U.S. authorities for monitoring and surveillance purposes, possibly without any legal recourse available to you. By consenting to the use of Google Analytics in the consent management system, you also consent to such a transfer to the United States. In such a case, the transfer is based on your consent to the use of Google cookies pursuant to Article 6(1)(a) in conjunction with Article 49(1)(a) of the GDPR, since consent to the use of Google cookies does not preclude a data transfer to the United States.

We ourselves do not disclose any personal data.

Data Processing on Behalf of a Third Party

We have entered into a data processing agreement with Google.

Retention Period

30 days (cookies)

9 or 18 months (log data)

For more information about Google reCAPTCHA and Google’s Privacy Policy, please visit the following links:

www.google.com/intl/de/policies/privacy/ and www.google.com/recaptcha/intro/android.html.

18.3 DoubleClick

We use “DoubleClick” as an online marketing tool on our website. The providers are Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”).

DoubleClick uses cookies on your devices to display relevant advertisements to you. This helps prevent ads from being displayed multiple times. The cookies assign a pseudonymous identification number (ID) to the browser you are using to track which ads have been displayed in your browser and which ads you have clicked on.

The use of DoubleClick cookies merely enables Google and its partner websites to display ads based on your previous visits to our website or other websites on the Internet. The information generated by the cookies is transmitted by Google to a server in the United States for analysis and stored there. The data collected during the analysis is forwarded to Google. Google guarantees that this data will not be combined with other data collected by Google.

We use DoubleClick for marketing and optimization purposes.

Data Storage and Legal Basis for Processing:

The storage of cookies and the use of this tool are based on Article 6(1)(a) of the GDPR (consent), which you must provide as part of the consent management process on our website. We do not use DoubleClick without your explicit consent via the website’s consent management system.

Data Transfer

Google also processes your personal data in the United States. Please note that the European Court of Justice has determined that the United States has a level of data protection that is insufficient by EU standards. There is therefore a risk that your data may be processed by U.S. authorities for monitoring and surveillance purposes, possibly without any legal recourse available to you. By consenting to the use of DoubleClick cookies in the consent management system, you also consent to such a transfer to the United States. In such a case, the transfer is based on your consent to the use of Google cookies pursuant to Article 6(1)(a) in conjunction with Article 49(1)(a) of the GDPR, since consent to the use of Google cookies does not preclude a data transfer to the United States.

We ourselves do not disclose any personal data.

Data Processing

We have entered into a data processing agreement with Google based on the Standard Contractual Clauses to ensure the lawfulness of processing in the United States.

For more information about Google DoubleClick, please refer to Google’s Privacy Policy. You can find it at the following link: www.google.com/intl/de/policies/privacy/

18.4 Google Tag Manager

We use Google Tag Manager (hereinafter referred to as “GTM”) on this website to integrate various codes and services into our website in an organized and streamlined manner. GTM is operated by Google Ireland Limited, Google Building Gordon House, 4 Barrow Street, Dublin, D04 E5W5, Ireland (“Google”).

The tool itself (which implements the tags) is a cookie-free domain and does not store any personal data. The tool triggers other tags, which may in turn collect data. When a tag is triggered, GTM does not access this data.

Purposes of Processing

The purpose of using GTM is to simplify and streamline the integration of various services and to optimize their loading times. GTM enables us to reduce the maintenance and loading requirements of the website, thereby reducing the load on our server.

Personal Data Processed

GTM may process the following personal data:

IP address for identifying the end device (we anonymize this)

If deactivation has been performed at the domain or cookie level, it remains in effect for all tracking tags implemented using Google Tag Manager.

Data Processing on Behalf of a Client

We have entered into a data processing agreement with Google pursuant to Article 28 of the GDPR. To ensure appropriate safeguards in the context of any potential transfer and processing of personal data in the United States, this data processing agreement includes the Standard Contractual Clauses pursuant to Article 46 of the GDPR, along with supplementary commitments from Google. For more information on the Standard Contractual Clauses, please visit: ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu_de

Google processes data on our behalf to trigger the stored tags and display the services on our website. Google may transfer this information to third parties where required by law or where such third parties process the data on Google’s behalf.

Legal Basis for Processing

We process your personal data in accordance with Art. 6(1)(f) of the GDPR (Legitimate Interest) as described above, with the IP address anonymized. We have a legitimate interest in reducing the maintenance and loading time of our website and in providing you with fast page loading and an optimized user experience.

Disclosure of Data

We cannot rule out the possibility that Google may, under certain circumstances, also process personal data (see above) in the United States. Please note that the European Court of Justice has determined that the United States is a country with a level of data protection that is insufficient by EU standards. There is therefore a risk that your data may be processed by U.S. authorities for monitoring and surveillance purposes, possibly without any legal recourse available to you. By using our website, you consent to the use of GTM and to such a transfer to the United States.

We ourselves do not disclose any personal data.

19 Legal Basis for Processing

Unless otherwise specified:

Article 6(1), first sentence, letter a of the GDPR serves as the legal basis for our company’s processing operations in which we obtain consent for a specific processing purpose. If the processing of personal data is necessary for the performance of a contract to which the data subject is a party—as is the case, for example, with processing operations required for the delivery of goods or the provision of other services or consideration— the processing is based on Article 6(1), first sentence, subparagraph (b) of the GDPR. The same applies to processing operations necessary for the implementation of pre-contractual measures, such as in cases of inquiries regarding our products or services. If our company is subject to a legal obligation that requires the processing of personal data—such as to fulfill tax obligations—the processing is based on Article 6(1), first sentence, letter c of the GDPR. In rare cases, the processing of personal data may be necessary to protect the vital interests of the data subject or another natural person. This would be the case, for example, if a visitor were injured on our premises and their name, age, health insurance information, or other vital information subsequently had to be disclosed to a doctor, a hospital, or other third parties. In such cases, the processing would be based on Article 6(1), first sentence, (d) of the GDPR.

Finally, processing operations may be based on Article 6(1), first sentence, subparagraph (f) of the GDPR. This legal basis applies to processing operations not covered by any of the aforementioned legal bases, provided that the processing is necessary to safeguard a legitimate interest of our company or a third party, unless the interests, fundamental rights, and fundamental freedoms of the data subject take precedence. We are permitted to carry out such processing operations in particular because they have been specifically mentioned by the European legislature. In this regard, the legislator took the view that a legitimate interest could be assumed if the data subject is a customer of the controller (Recital 47, second sentence, of the GDPR).

20 Legitimate Interests in Processing Pursued by the Controller or a Third Party

If the processing of personal data is based on Article 6(1), first sentence, subparagraph (f) of the GDPR, our legitimate interest is the conduct of our business activities for the benefit of the well-being of all our employees and our shareholders.

21 Duration for Which Personal Data Is Stored

The criterion for the duration of the storage of personal data is the respective statutory retention period. Upon expiration of this period, the relevant data is routinely deleted, provided it is no longer necessary for the performance of a contract or for entering into a contract.

22 Legal or contractual requirements for providing personal data; necessity for entering into a contract; obligation of the data subject to provide personal data; possible consequences of failure to provide data

We would like to inform you that the provision of personal data is in some cases required by law (e.g., tax regulations) or may also result from contractual provisions (e.g., information about the contracting party).

In some cases, the conclusion of a contract may require that a data subject provide us with personal data, which we must subsequently process. For example, the data subject is obligated to provide us with personal data when our company enters into a contract with them. Failure to provide the personal data would mean that the contract with the data subject could not be concluded.

Before providing personal data, the data subject must contact one of our employees. Our employee will explain to the data subject, on a case-by-case basis, whether the provision of personal data is required by law or contract, or is necessary for the conclusion of the contract; whether there is an obligation to provide the personal data; and what the consequences of failing to provide the personal data would be.

23 Changes to This Privacy Policy

GesundLand Vulkaneifel GmbH reserves the right to amend this Privacy Policy. The most current version of the Privacy Policy is always available at www.gesundland-vulkaneifel.de/datenschutz.

This Privacy Policy was generated in the highlighted sections using the Privacy Policy Generator, developed in cooperation between DGD Deutsche Gesellschaft für Datenschutz GmbH, Dachau (available at: dsgvo-muster-datenschutzerklaerung.dg-datenschutz.de) and the law firm Wilde/Beuger/Solmecke Rechtsanwälte GbR, Cologne (available at: www.wbs-law.de/it-recht/datenschutzrecht/datenschutzerklaerung-generator/) These texts are subject to the copyright of DGD Deutsche Gesellschaft für Datenschutz GmbH, Dachau, and the law firm Wilde/Beuger/Solmecke Rechtsanwälte GbR, Cologne.

Information on the Collection of Personal Data Pursuant to Art. 13 of the GDPR for Visitors