Privacy policy

Privacy policy

1 Information on the collection of personal data

(1) In the following, we provide information about the processing of personal data when using our website. Personal data is all data that can be related to you personally, e.g. name, address, e-mail addresses, user behavior. With this privacy policy, we would like to inform you about our processing procedures and at the same time comply with the legal obligations, in particular from the EU General Data Protection Regulation (GDPR).

(2) The controller pursuant to Art. 4 (7) GDPR is

Triebswetter Felix & Kandler Felix Kulturveranstaltungen GbR

Äußeres Pfaffengäßchen 34, 86152 Augsburg,

E-mail: info@taverntours.de.

(3) When you contact us by e-mail or via a contact form, we will store and process the data you provide (your e-mail address, your name and telephone number if applicable) in order to answer your questions. We delete the data arising in this context if the inquiry is assigned to a contract, after the contract period, otherwise after the storage is no longer required, or restrict the processing if there are statutory retention obligations. The legal basis for the processing is Art. 6 para. 1 lit. a) GDPR – i.e. your express consent. If you make your request for the purpose of fulfilling a contract or for the implementation of pre-contractual measures, or if it relates to this, the processing is carried out in accordance with Art. 6 para. 1 lit. b) GDPR. Otherwise, the legal basis is Art. 6 para. 1 lit. f) GDPR. Our legitimate interest lies in processing and responding to your request addressed to us.

(4) If we use contracted service providers for individual functions of our offer or wish to use your data for advertising purposes, we will always carefully select and monitor these service providers and inform you in detail below about the respective processes. In doing so, we will also state the specified criteria for the storage period and the respective legal basis.

2 External hosting

This website is hosted externally. The personal data collected on this website is stored on the servers of the hoster(s). This may include IP addresses, contact requests, meta and communication data, contract data, contact details, names, website accesses and other data generated via a website.

External hosting is carried out in our legitimate interest in the secure, fast and efficient provision of our online offer by a professional provider (Art. 6 para. 1 lit. f GDPR). If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG, insofar as the consent includes the storage of cookies or access to information in the user’s terminal device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent can be revoked at any time.

Our host(s) will only process your data to the extent necessary to fulfill its performance obligations and follow our instructions with regard to this data.

We use the following hoster:

IONOS SE

Elgendorfer Str. 57

56410 Montabaur

We have concluded a data processing agreement (DPA) for the use of the above-mentioned service. This is a contract prescribed by data protection law, which ensures that it processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

3 Your rights

(1) You have the following rights vis-à-vis the controller with regard to your personal data:

-Right to information:

In particular, you have a right to information about your personal data processed by us, the processing purposes, the categories of personal data processed, the recipients or categories of recipients to whom your data has been or will be disclosed, the planned storage period or the criteria for determining the storage period, the existence of a right to rectification, erasure, restriction of processing, objection to processing, complaint to a supervisory authority, the origin of your data if it was not collected by us from you, the existence of automated decision-making including profiling and, if applicable, meaningful information on the logic involved and the scope and intended effects of such processing on you, as well as your right to be informed of the guarantees pursuant to Art. 46 GDPR if your data is transferred to third countries;

-Right to rectification or erasure:

You have the right to immediate correction of incorrect data concerning you and/or completion of your incomplete data stored by us; you have the right to demand the deletion of your personal data if the requirements of Art. 17 para. 1 GDPR are met. However, this right does not exist in particular if the processing is necessary to exercise the right to freedom of expression and information, to fulfill a legal obligation, for reasons of public interest or to assert, exercise or defend legal claims;

-Right to restriction of processing:

You have the right to demand the restriction of the processing of your personal data as long as the accuracy of your data, which you dispute, is being verified, if you refuse to delete your data due to inadmissible data processing and instead demand the restriction of the processing of your data, if you need your data to assert, exercise or defend legal claims after we no longer need this data after the purpose has been achieved or if you have lodged an objection for reasons of your particular situation, as long as it is not yet clear whether our legitimate reasons prevail;

-Right to revoke consents granted:

If you have given your consent to the processing of your data, you can withdraw this at any time. Such a revocation affects the permissibility of the processing of your personal data after you have given it to us. The permissibility of the processing of your data up to the time of your revocation remains unaffected.

-Right to data portability:

You have the right to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format or to request that it be transmitted to another controller, insofar as this is technically feasible;

(2) You also have the right to complain to the competent data protection supervisory authority about the processing of your personal data by us.

4 Processing of personal data when visiting our website

When using the website for information purposes, i.e. simply viewing it without registering and without providing us with any other information, we process the personal data that your browser transmits to our server. The data described below is technically necessary for us to display our website to you and to ensure stability and security and must therefore be processed by us. The legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR:

-IP address

-Date and time of the request

-Time zone difference to Greenwich Mean Time (GMT)

-Content of the request (page visited)

-Access status/HTTP status code

-Volume of data transferred in each case

-previously visited page

-Browser

-Operating system

-Language and version of the browser software.

The data is always deleted as soon as it is no longer necessary to process it. IP addresses in the logs are anonymized.

5 Other functions and offers on our website

(1) In addition to the purely informational use of our website, we offer various services that you can use if you are interested, which are presented in more detail below. To do so, you must generally provide additional personal data or we process such additional data that we use to provide the respective services. The aforementioned data processing principles apply to all data processing purposes described here.

(2) In some cases, we use external service providers to process your data. These are carefully selected by us, are bound by our instructions and are regularly monitored.

(3) Your personal data will not be passed on to third parties – via the service providers used and named by us.

If necessary, we may also process your personal data in order to assert and enforce rights or claims to which we are entitled or to defend ourselves against legal claims asserted against us. The same applies if the disclosure is necessary to defend against or prosecute criminal offenses and is required by law.

The legal basis for this processing is Art. 17 para. 3 lit. e GDPR and Art. 6 para. 1 sentence 1 lit. f) GDPR. Our overriding legitimate interest lies in the enforcement of rights and legal defense.

(4) Below we list the categories of recipients of your data, insofar as these can be passed on in accordance with the aforementioned requirements. These are in particular

IT service providers who support us in the provision of our services and in the administration and maintenance of our IT systems
Payment service providers/banks
Debt collection agencies and legal advisors in the event of the assertion or defense of claims
Public bodies and institutions, insofar as we are legally obliged to do so or you have commissioned us to do so.

(5) If personal data is sent to external servers in a third country, we have concluded agreements on order processing with the respective processor, which provide guarantees that the provisions of data protection law are complied with.

Your data will then only be processed in a third country if the requirements of Art. 44 et seq. GDPR are met. In the event of express consent to the transfer of personal data to third countries, data processing is carried out on the basis of Art. 49 para. 1 lit. a GDPR. Alternatively, your data may be processed on the basis of special guarantees or an EU adequacy decision, such as the Data Privacy Framework (DPF) or, if there is no adequacy decision for the third country, by agreeing EU standard data protection clauses, possibly in conjunction with additional guarantees to ensure compliance with the level of data protection in the European Union.

6 Use of our booking option

(1) If you wish to book a tour or purchase a voucher directly on our website, it is necessary for the conclusion of the contract that you provide your personal data, which we require for the purpose of processing your order. Mandatory information required for the processing of contracts is marked separately, further information is voluntary. The legal basis for this is Art. 6 para. 1 sentence 1 lit. b) GDPR.

(2) We store the data provided by you as part of the reservation for a maximum of 10 years. The legal basis for the storage are retention obligations under commercial and tax law.

(3) To prevent unauthorized access to your personal data by third parties, the order process is encrypted using SSL/TLS technology.

7 Objection to the processing of your data

(1) Insofar as we base the processing of your personal data on the balancing of interests, you can object to the processing. This is the case if, in particular, the processing is not necessary for the performance of a contract with you, which is described by us in the following description of the functions. When exercising such an objection, we ask you to explain the reasons why we should not process your personal data in the way we do. In the event of your objection, we will examine the situation and either discontinue or adapt the data processing or point out to you our compelling reasons worthy of protection on the basis of which we will continue the processing.

(2) Of course, you can object to the processing of your personal data for advertising and data analysis purposes at any time. The best way to object to advertising is to contact us using the contact details given above.

8 Profiling/Automated decision making

We do not create a profile of you. No purely automated decision-making process within the meaning of Art. 22 GDPR takes place as part of our processing.

9 Processing of data from your end devices (“Cookie-Policy“)

(1) In addition to the above-mentioned data, we use technical aids for various functions when you use our website, in particular cookies, which can be stored on your end device. When you access our website and at any time thereafter, you have the choice of whether you generally allow cookies to be set or which individual additional functions you would like to select. You can make changes in your browser settings. In the following, we first describe cookies from a technical point of view (2) before we describe the technically necessary cookies (3) that we use.

(2) Cookies are text files or information in a database that are stored on your hard disk and assigned to the browser you are using so that certain information can flow to the location that sets the cookie. Cookies cannot execute programs or transfer viruses to your computer, but are primarily used to make the website faster and more user-friendly. This website uses the following types of cookies, whose function and legal basis are explained below:

-Transient cookies: Such cookies, especially session cookies, are automatically deleted when the browser is closed or by logging out. They contain a so-called session ID. This allows various requests from your browser to be assigned to the shared session and your computer can be recognized when you return to our website.

-Persistent cookies: These are automatically deleted after a specified period, which varies depending on the cookie. You can view the cookies set and the duration at any time in your browser settings and delete the cookies manually. We do not currently use such cookies.

(3) Mandatory functions that are technically necessary to display the website: The technical structure of the website requires us to use technologies, in particular cookies. Without these technologies, our website cannot be displayed (completely correctly) or the support functions could not be enabled. These are basically transient cookies that are deleted at the end of your visit to the website, at the latest when you close your browser. You cannot deselect these cookies if you wish to use our website. The legal basis for this processing is Art. 6 para. 1 sentence 1 lit. f) GDPR.

Borlabs Cookie

This website uses Borlabs Cookie, which sets a technically necessary cookie(borlabs-cookie) to store your cookie consent.

Borlabs Cookie does not process any personal data.

The borlabs cookie stores the consent you gave when you entered the website. If you wish to revoke this consent, simply delete the cookie in your browser. When you re-enter/reload the website, you will be asked for your cookie consent again

10 payment options

10.1 PayPal

We offer you the option of paying for your order via the payment service provider PayPal. If you choose this payment method, the amount to be paid by you together with your first and last name, delivery address, e-mail address, telephone number and IP address will be transmitted to PayPal (specifically to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg) so that you can authorize the payment to us via PayPal. A PayPal account is required for this. PayPal also offers the option of processing payments via credit cards or the SEPA scheme if a user does not have a PayPal account. Further data may have to be provided to PayPal for this purpose. Further information can be found in PayPal’s privacy policy at https://www.paypal.com/de/legalhub/paypal/privacy-full.

The legal basis for the associated data processing is Art. 6 para. 1 lit. b) GDPR, i.e. the fulfillment of a contract. The provision and processing of your data is necessary for the execution of the payment of your purchase via PayPal.

The data transmitted to PayPal may be transmitted by PayPal to credit agencies. This transmission is used for identity and credit checks. You can find more information on data protection at PayPal on the PayPal website at https://www.paypal.com/de/legalhub/paypal/privacy-full. Payment with PayPal is voluntary.

The legal basis for the associated data processing is Art. 6 para. 1 lit. f) GDPR. Our legitimate interest is to offer you an effective and secure payment option and to prevent fraud.

10.2 Bank transfer

You also have the option of paying for your order by direct bank transfer to us.

11 Social media presences

(1) We operate websites on various social media platforms. We operate these presences with the following providers, whose data protection notices can be found in the corresponding link:

Instagram: https://privacycenter.instagram.com/policy/

Facebook: https://www.facebook.com/privacy/policy/

(2) We use the technical platform and services of the providers for our social media presence. We would like to point out that you use our presence on social media platforms and their functions on your own responsibility. This applies in particular to the use of the interactive functions of the respective platform (e.g. commenting, sharing, rating). When you visit our websites, the providers of the social media platforms collect, among other things, your IP address and other information that is stored on your device in the form of cookies. This information is used to provide us, as the operator of the accounts, with statistical information about the interaction with us.

With regard to our presence on the aforementioned social media, we are jointly responsible with the operator of the respective social media platform for data processing, in particular in the context of statistics, analyses and similar provided to us by the operator. Corresponding agreements on joint responsibility exist in each case, if and insofar as joint responsibility exists.

(3) The data collected about you in this context is processed by the platforms and may be transferred to countries outside the European Union, in particular the USA. According to their own statements, all of the aforementioned providers maintain an adequate level of data protection. The transfer of data to the USA and the guarantees of an adequate level of data protection are ensured by the certification of all providers used by us within the framework of the EU-US Data Privacy Framework (DPF). We do not know how the social media platforms use the data from your visit to our account and interaction with our posts for their own purposes, how long this data is stored and whether data is passed on to third parties. Data processing may differ depending on whether you are registered and logged in to the social network or whether you visit the site as a non-registered and/or non-logged-in user. When you access a post or the account, the IP address assigned to your end device is transmitted to the provider of the social media platform. If you are currently logged in as a user, a cookie on your device can be used to track how you have moved around the network. Buttons integrated into websites enable the platforms to record your visits to these websites and assign them to your respective profile. This data can be used to tailor content or advertising to you. If you want to avoid this, you should log out or deactivate the “stay logged in” function, delete the cookies on your device and restart your browser.

(4) As the operator of the website on the respective platform, we also only process the data from your use of our service that you provide to us and that requires interaction. For example, if you ask a question that we can only answer by email, we will store your information in accordance with the general principles of our data processing, which we describe in this privacy policy. The legal basis for the processing of your data on the social media platform is Art. 6 para. 1 sentence 1 lit. f GDPR and, in the case of previously requested consent, Art. 6 para. 1 lit. a) GDPR.

(5) To exercise your rights as a data subject, you can contact us or the provider of the social media platform. If one party is not responsible for responding or must receive the information from the other party, we or the provider will then forward your request to the respective partner. Please contact the operator of the social media platform directly if you have any questions about profiling or the processing of your data when using the website. Only the respective provider has access to the user’s data and can take appropriate measures and provide information directly.

If you have any questions about the processing of your interaction with us on our site, please write to the contact details we have provided above.

(6) What information the social media platform receives and how it is used is described by the providers in their privacy policies (see link in the table above). There you will also find information about contact options and the settings options for advertisements.