Data Protection Declaration

1. Data Protection at a glance

The following notes provide an initial overview of what happens to your personal data when you visit our website. Personal data are all data with which you can be personally identified. For more information regarding the subject Data Protection please refer to our data protection declaration in this text. This data protection declaration only refers to our websites. Should you be redirected to other sites via links on our sites, please obtain information about the respective handling of your data on these sites.

1.1. Data collection on our website

Who is responsible for collecting data on this website?

The data processing on this website is effected by the web site operator, whose contact dates are available in the Legal Notice of this website.

How do we collect your data?

Your data will be collected on the one hand because you disclose them to us. These may include data which you enter into a contact form or if you contact us by email.

Other data are collected automatically by our IT-system when you visit our website. These are mainly technical data (for example internet browser, operating system or time when you access the site). The collection of these data is done automatically as soon as you access our website.

1.2. What do we use your data for?

A part of the data is collected to ensure a correct provision of the website. Other data can be used to analyse your user behaviour.

1.3. What are your rights regarding your data?

You have the right to achieve at any time free information about the origin, the recipient and the purpose of your stored personal data. Furthermore you have the right to request the correction, blocking or deletion of these data. Please do not hesitate to contact the address indicated in the Legal Notice for questions in this matter and for further questions regarding the subject data protection. Furthermore you have the right to complain to the responsible supervisory authority.

1.4. Analysing tools and third party tools

When visiting our website, your surfing behaviour can be statistically evaluated. This is done in particular by cookies and with so-called analysing programmes. Analysing your surfing behaviour is generally done anonymously; the surfing behaviour cannot be traced back to you. You can object to this analysis or prevent it by not using certain tools. For details in this matter please refer to our data protection declaration under the heading “third party modules and analysing tools”. You can object to this analysis. For more information about your option to object please refer to this data protection declaration.

 

1. General information and mandatory information

2.1. Data protection

The operators of these sites take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this data protection declaration.

In using this website, different personal data will be collected. Personal data are data with which you can be personally identified. This data protection declaration explains which data we collect and what we use it for and it explains how we collect them and for what purpose.

We point out that data transfer on the Internet (for example when communicating by e-mail) can have security gaps. A complete protection of data against access by third parties is not possible.

2.2. Reference to the responsible body

The responsible body is the natural or legal person who decides alone or jointly with others on the purposes and means of processing personal data (for example names, e-mail addresses or the like).

The responsible body for processing data on this website is:

Staatsbad Bad Ems GmbH

Römerstraße 8

D-56130 Bad Ems

Phone: +49 (0) 2603 – 9730

email: datenschutz@staatsbad-badems.de

2.3. Revocation of your consent to processing data

Many data processing procedures are only possible with your express consent. You can revoke a granted consent at any time, simply by sending us an informal email. The legitimacy of the data processing effected until the date of revocation remains unaffected by the revocation.

2.4. Right to complain to the responsible supervisory authority

In case of offences in data-protection matters, the data subject has the right to complain to the responsible supervisory authority. The responsible supervisory authority in data-protection matters is the State Commissioner for Data Protection of the federal state in which our company is located. For a list of Commissioners for Data Protection and their contact dates please refer to the following link: https://www.bfdi.bund.de.

2.5. Right to data transfer

You have the right to request the handing out of data which we process automatically based on your consent or during the fulfilment of a contract either to yourself or to a third party in a common machine-readable format. If you request the direct data transfer to another controller this can only be effected as far as technically feasible.

2.6. Information, blocking, deletion

Within the framework of the applicable statutory regulations you have the right at any time to get free information on your stored personal data, their origin and recipient as well as the purpose of data processing and if applicable a right to rectification, blocking or deletion of these data. Please do not hesitate to contact the address indicated in the Legal Notice for questions in this matter and for further questions regarding the subject personal data.

2.7. Objection to advertising mails

This is to object to the use of contact data – which are disclosed as part of the obligation to provide a legal notice – for the transmission of not expressly solicited advertising and information materials. The operators of the sites expressly reserve the right to take legal action in case of an unsolicited transmission of advertising information such as spam emails.

 

1. Data collection on our website

3.1. Cookies

The websites sometimes use so-called cookies, which serve to make our sites more user-friendly, effective and secure. Cookies are small text files which are saved on your computer and stored in your browser.

Most of the cookies used by us are so-called “session-cookies”, which will be automatically deleted after having left the site. Other cookies remain stored on your device until you delete them. These cookies enable us to recognize your browser at your next visit.

You can set your browser such that you are informed about the setting of cookies and you allow cookies only in single cases, you can exclude the acceptance of cookies for certain cases or in general and you can activate the automatic deletion of cookies when closing the browser. A deactivation of cookies may restrict the functionality of this website.

Cookies which are required for the electronic communication process or for providing certain requested functions (for example shopping basket function) are stored on the basis of Art. 6 (1) lit. f GDPR. The website operator has a legitimate interest in storing cookies for providing their services in a technically correct and optimised way. As far as other cookies (for example cookies for analysing your surfing behaviour) are stored, those will be treated separately in this data protection declaration.

3.2. Server log files

The provider of the sites automatically collects and stores information in so-called server-log-files which your browser transmits to us automatically. These are:

– type and version of browser

– used operating system

– referrer URL

– host name of the accessing computer

– time of the server request

– IP address

These data are not merged with other data sources.

The data processing base is Art. 6 (1) lit. b GDPR, which allows the processing of data for fulfilling a contract or pre-contractual measures.

3.3. Contact form

If you transmit enquiries to us by means of the contact form, your details in this enquiry form and your indicated contact data will be stored with us for the purpose of processing the enquiry and for the case of follow-up questions. These data will not be disclosed without your consent.

The processing of the data indicated in the contact form is thus effected exclusively on the basis of your consent (Art. 6 (1) lit. a GDPR). You can revoke this consent at any time, simply by sending us an informal email. The legitimacy of the data processing processes effected until the date of revocation remains unaffected by the revocation.

The data indicated by you in the contact form will remain with us until your request for their deletion, your revocation of the consent to store them or if the purpose for the data storage ceases to exist (for example after having completed the processing of your enquiry). Statutory mandatory provisions – especially retention periods – remain unaffected.

3.4. Registration on this website

If you register on our website for using additional functions on the site, we will use the entered data only for the purpose of using the respective website or service for which you have registered. The mandatory information requested when registering must be indicated completely, otherwise we will reject the registration.

To inform you in case of important modifications for example in the scope of the offer or in case of technically required modifications, we will use the e-mail address which you had indicated when registering.

The processing of the data indicated when registering is effected on the basis of your consent (Art. 6 (1) lit. a GDPR). You can revoke a granted consent at any time simply by sending us an informal email. The legitimacy of the data processing that has already been carried out remains unaffected by the revocation.

The data collected by us when registering will be stored by us for as long as you are registered on our website and will be deleted subsequently. Statutory retention periods remain unaffected.

3.5. Processing of data (customers’ and contract data)

We collect, process and use personal data only in so far as they are required for the establishment, content or modification of the legal relationship (inventory data), which is based on Art. 6 (1) lit. b GDPR, which allows the processing of data for fulfilling a contract or pre-contractual measures. We collect, process and use personal data concerning the usage of our websites (user data) only in so far as this is required to allow the usage of this service to the user or for accounting purposes.

The collected customer’s data will be deleted after having completed the order or after having terminated the business relationship. Statutory retention periods remain unaffected.

3.6. Data transfer when concluding contracts for online shops, retailers and dispatch of goods

We only transmit personal data to third parties if this is required as part of the contract implementation for example to the companies which are charged with the delivery or the bank which is charged with the payment transaction. A further data transfer will not be effected or only in the case where you have given your express consent to the transfer. Your data will not be passed on to any third party without your express consent, for example for the purpose of advertising.

The data processing base is Art. 6 (1) lit. b GDPR, which allows the processing of data for fulfilling a contract or pre-contractual measures.

3.7. Data transfer at the time of contract conclusion for services and digital contents

We only transmit personal data to third parties if this is required as part of the contract implementation for example to the bank which is charged with the payment transaction.

A further data transfer will not be effected or only in the case where you have given your express consent to the transfer. Your data will not be passed on to any third party without your express consent, for example for the purpose of advertising.

The data processing base is Art. 6 (1) lit. b GDPR, which allows the processing of data for fulfilling a contract or pre-contractual measures.

 

1. Analysing tools and advertising

4.1. Web analysis with Google Analytics

This website can use Google Analytics, a web analysing service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland („Google“).

Google Analytics uses so-called “Cookies”, which are text files that are stored on your computer and allow an analysis of how you use the web site. The storage of Google-Analytics cookies is based on Art 6 (1) lit. f GDPR.

The website operator has a justified interest in analysing the user’s behaviour to optimise their website as well as their advertising. The information created by the cookie about how you use this web site is in general transmitted to and stored on a Google server located in the U.S.A. In case of an activated IP-anonymisation in this website, your IP address will first be shortened by Google within the member states of the European Union or in other contracting member states of the Agreement on the European Economic Area. Only in exceptional cases will the complete IP address be transferred to a server of Google in the USA and shortened there.  On behalf of the operator of this website will Google use this information to evaluate the usage of the web site by you, to compile reports on web site activities and to provide further services associated with the usage of the web site and of the Internet to the website operator. The IP address transferred by your browser as part of Google Analytics will not be merged with other data of Google.

You can prevent the storage of cookies by appropriately setting your browser software, please note, however, that in such a case you will possibly not be able to benefit from the full functionality of this web site. Moreover you can prevent the collection of the data generated by the cookie which refer to your website usage (including your IP address) for Google as well as the processing of these data by Google by downloading and installing the browser plug-in available at the following link:

https://tools.google.com

https://tools.google.com/dlpage/gaoptout?hl=de

4.2. Objection to data collection

You can prevent the collection of your data by Google Analytics by clicking the following link. An opt-out cookie will be set which prevents the collection of your data when visiting this website in the future: deactivate Google Analytics for this website.

For more information on handling user data with Google Analytics refer to the data protection declaration of Google: https://support.google.com/analytics/.

4.3. Order data processing

As far as our website uses Google Analytics we have concluded a contract for order data processing with Google and fully comply with the strong stipulations of the German Data Protection Authority in using Google Analytics.

4.4. Demographic characteristics with Google Analytics

This website can use the function “demographic characteristics” of Google Analytics, which allows the creation of reports providing information on the age, gender and interests of the website visitors. These data originate from interest-related advertising of Google and from visitor data of third party providers. These data cannot be traced to a particular person. You can deactivate this function at any time in the Display Settings in your Google account or generally prohibit the collection of your data by Google Analytics as mentioned under the item “Objection to data collection”.

 

1. Newsletter

5.1. Newsletter information

If you want to receive the newsletter offered on this website we need your e-mail address and some information by which we can check whether you are the owner of the indicated e-mail address and agree to receive the newsletter. Further data are not collected or only on a voluntary basis. These data are exclusively used for sending the requested information and are not passed on to any third party.

The processing of the data indicated in the newsletter subscription form is effected exclusively on the basis of your consent (Art. 6 (1) lit. a GDPR). The given consent to store the data, the e-mail address and to use them for sending the newsletter can be revoked by you at any time, for example by the link “unsubscribe” in the newsletter. The legitimacy of the data processing operations that have already been carried out remains unaffected by the revocation.

Your data which are stored with us for the purpose of receiving the newsletter will be stored with us until you unsubscribe to the newsletter and will be deleted after having cancelled the newsletter. Data which are stored with us for other purposes (for example e-mail address for the member area) remain unaffected. 

 

1. Plug-ins and tools

It can happen that third party contents are integrated within this website such as YouTube videos, maps provided by Google Maps, RSS feeds or graphics of other websites. This always requires that the providers of these contents (hereinafter referred to as “third-party providers”) perceive the IP address of the users since they could not send the contents to the browser of the respective user without knowing the IP address. The IP address is thus required for the presentation of these contents. We make every effort to use only such contents whose respective providers use the IP address only for delivering the contents. However, we have no influence on whether the third party providers store the IP address e. g. for statistical purposes. As far as this is known to us we inform the users correspondingly.

6.1. YouTube

Our website can use plug-ins of the YouTube site operated by Google. The operator of the sites is YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA.

If you visit one of our sites equipped with a YouTube plug-in, a connection is made to the YouTube servers, giving information to the YouTube server about the site you visited.

If you are signed in in your YouTube account you enable YouTube to assign your surfing behaviour directly to your personal profile. You can prevent this by logging out from your YouTube account.

YouTube is used with the aim of presenting our websites in an attractive way. This is a justified interest in terms of Art. 6 (1) lit. f GDPR.

For more information on handling user data please refer to the data protection declaration of YouTube at: https://www.google.de/intl/de/policies/privacy

6.2. Google web fonts

This site uses so-called web fonts which are provided by Google to display fonts in a consistent way. When accessing a website, your browser loads the required web fonts into your browser cache in order to display texts and fonts correctly.

For this purpose, the browser used by you must connect to the Google servers. As a result, Google is informed that our website was accessed by your IP address. Google web fonts are used with the aim of presenting our websites in a consistent and attractive way. This is a justified interest in terms of Art. 6 (1) lit. f GDPR.

If your browser does not support web fonts, a standard font is used by your computer.

For more information on Google web fonts please refer to https://developers.google.com/fonts/faq and to the data protection declaration of Google: https://www.google.com/policies/privacy/.

6.3. Google Maps

This site can use the map service Google Maps by means of API. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

To use the functions of Google Maps it is required to store your IP address. This information will in general be transferred to a Google server in the USA and stored there. The provider of this site has no influence on this data transfer.

Google Maps is used with the aim of presenting our websites in an attractive way and of an easy findability of the places we have indicated on the website. This is a justified interest in terms of Art. 6 (1) lit. f GDPR.

For more information on handling user data please refer to the data protection declaration of Google: https://www.google.de/intl/de/policies/privacy/.

 

1. Payment providers

7.1. PayPal

On our website we offer among others the payment option PayPal if applicable. The provider of this payment service is PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter referred to as “PayPal”).

If you choose the payment option PayPal, the payment data entered by you are transferred to PayPal.

The transfer of your data to PayPal is based on Art. 6 (1) lit. a GDPR (consent) and Art. 6 (1) lit. b GDPR (processing to fulfil a contract). You have the possibility to revoke your consent to the processing of data at any time. A revocation has no effect on the effectiveness of data processing operations in the past.

7.2. Immediate transfer

On our website we offer among others the payment option “immediate transfer” if applicable. The provider of this payment service is Sofort GmbH, Theresienhöhe 12, 80339 Munich (hereinafter referred to as “Sofort GmbH”).

The method “immediate transfer” provides us a payment confirmation in real time by Sofort GmbH and we can start immediately to fulfil our liabilities.

If you have selected the payment option “immediate transfer” you transmit the PIN and a valid TAN to Sofort GmbH, with which they can log into your online banking account. After having logged in, Sofort GmbH automatically checks your account balance and carries out the bank transfer to us by means of the TAN transmitted by you. After that they transmit a transaction confirmation to us without delay. After logging in, your bank account turnover, the credit limit of the overdraft facility and the existence of other accounts and their balances will be automatically checked.

Besides the PIN and TAN, the payment data indicated by you and data about your person will be transmitted to Sofort GmbH. The data about your person are your given name and your family name, address, phone number(s), email address, IP address and other data required for the payment processing if applicable. The transfer of these data is necessary to ascertain your identity beyond doubt and to prevent fraud.

The transfer of your data to Sofort GmbH is based on Art. 6 (1) lit. a GDPR (consent) and Art. 6 (1) lit. b GDPR (processing to fulfil a contract). You have the possibility to revoke your consent to the processing of data at any time. A revocation has no effect on the effectiveness of data processing operations in the past.

For details regarding a payment by immediate transfer please refer to the following links: https://www.sofort.de/datenschutz.html and https://www.klarna.com/sofort/.

7.3. Paydirekt

On our website we offer among others the payment option by means of Paydirekt if applicable. The provider of this payment option is Paydirekt GmbH, Stephanstraße 14-16, 60313 Frankfurt am Main, Germany (hereinafter referred to as “Paydirekt”).

If you pay by means of Paydirekt they collect different transaction data and transfer them to the bank where you are registered with Paydirekt. Apart from the data required for the payment, Paydirekt collects – if applicable – further data as part of the transaction such as delivery address or single items in the shopping basket.

Paydirekt authenticates the transaction subsequently by means of the authentication procedure stored at the bank. The payment amount will then be transferred from your account to our account. Neither we nor any third party have access to your account details.

For more details reagarding the payment by Paydirekt please refer to the General terms and conditions and the data protection regulations of Paydirekt at:

https://www.paydirekt.de/agb/index.html.