Privacy Policy

General

Personal data

The subject of privacy is personal data (hereinafter referred to as „data“), i.e. any information relating to an identified or identifiable natural person. Examples of such information include name, address, occupation, e-mail address, state of health, income, marital status, genetic characteristics, telephone number and, if applicable, user data such as the IP address.

Controller

The Controller for processing your personal data in the context of using the website https://www.mercure-hotel-koeln-belfortstrasse.de/en (hereinafter referred to as the „website“) is Business Hotels GmbH (hereinafter referred to as the „Operator“ or „Controller“). The contact details are as follows:

Data protection officer

The data protection officer is reachable at datenschutz@eventhotels.com.

Right to object

If you want to object to the processing of your data by the Operator in accordance with this privacy policy entirely or for individual measures, you can use the contact details, which are stated under the imprint. Please note that in the event of such an objection, the use of the website and the access of the services provided may be restricted or not possible at all.

Scope and purposes of data processing, legal bases, provision of data and storage period

Access and use of the website

Each time the website and its subpages are accessed, usage data is transferred by the respective internet browser and stored in log files (server log files). The stored data records contain the following data:

• date and time of access
• name of the subpage which is accessed
• IP address
• referrer URL (original URL from which you have accessed the website)
• data volume transferred
• product and version information of the browser used

The log files are evaluated by the Operator in anonymised form in order to continuously improve the website and make it more user-friendly, to find and rectify faults more quickly and control server capacities. For example, it can be understood at which time the use of the website is particularly popular and the Operator can provide appropriate data volume.

The admissibility of this processing is based on Art. 6 para. 1 f) GDPR. The legitimate interest of the Operator lies in providing a website with information and offering services to customers as well as optimising the operation of the website. The provision of data is neither prescribed by law nor contractually. The consequence of not providing personal data is that the data cannot be used to optimise the website.

Your IP address will be deleted or anonymised after termination of use. In the case of anonymisation, the IP addresses are changed in such a way that they can no longer be assigned to an identified or identifiable natural person or can only be assigned with a disproportionate large amount of time, costs and effort.

Contact form and e-mail at a click

If you wish to get in touch with the Operator, a corresponding contact form is available. You must enter the following information in this form:

• name
• e-Mail address
• message

In addition, you can voluntarily provide the following information:

• telephone number
• company address

Furthermore, you have the option to open an e-mail directed to the Operator at just one click on the website. The e-mail address linked to your e-mail program is automatically used as the sender. If you do not want your e-mail address to be retrieved in this way, you can change it in the settings of your respective e-mail program.

The admissibility of this processing is based on Art. 6 para. 1 b) GDPR stating that the processing is lawful if it is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

The personal data processed will be deleted after expiry of the legal retention periods unless the Controller has a legitimate interest in further storage. In any case, only the data will continue to be stored that is necessary to achieve the corresponding purpose. As far as possible, the personal data is anonymised.

Advertising

The Operator may use your data for advertising purposes. The admissibility of this processing is based on Art. 6 para. 1 f) GDPR stating that the processing is lawful if it is necessary for the purposes of preserving the legitimate interests pursued by the Controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. The use of data for advertising purposes constitutes a legitimate interest of the Operator according to Art. 6 para. 1 f) GDPR. The Operator is dependent on actively presenting the services to new and existing customers. As a customer of the Operator, you will regularly receive product recommendations by e-mail, which are based on the services you have already used. By doing this, the Operator would like to provide you with information about the services that may be of interest to you on the basis of your last booking.

The legal basis is specified in Art. 6 para. 1 f) GDPR in connection with § 7 para. 3 UWG (German Act Against Unfair Competition).

The provision of data is neither prescribed by law nor contractually. The consequence of not providing personal data is that you cannot be contacted for advertising purposes.

The personal data processed for the purpose of advertising will be deleted unless the Controller has a legitimate interest in further storage. In any case, only the data will continue to be stored that is necessary to achieve the corresponding purpose.

Newsletter

You can additionally subscribe to an e-mail newsletter in order to obtain further information about the Operator’s services, the partner hotels and the Eventhotels Group. The Operator uses the service rapidmail of rapidmail GmbH, Augustinerplatz 2, 79098 Freiburg, Germany for sending newsletters. The so-called double opt-in process is used to send the newsletter, i.e. you will only receive a newsletter by e-mail if you have previously explicitly confirmed that the newsletter service is to be activated. Once you have activated the newsletter, you will receive a notification e-mail, including a link for activation. You will only receive the newsletter if you click on this link. You can deactivate the newsletter at any time. For this purpose, please contact the Operator or use the unsubscribe link provided in each newsletter.

The admissibility of this processing is based on Art. 6 para. 1 a) GDPR stating that the processing is lawful if the data subject has given consent to the processing of his or her personal data for one or more specific purposes. The provision of your data is optional, but necessary to receive the newsletter.

Your data will be deleted after withdrawal of your consent unless the Controller has a legitimate interest in further storage. This may be the case if the Operator must continue to store your data according to a contract conclusion with you. In any case, only the data will continue to be stored that is necessary to achieve the corresponding purpose.

Online conference request

You have the option to request a conference on the website. Therefore, the following personal data is required:

• start
• end
• number of participants
• e-mail address
• company address & contact details

In addition, you can voluntarily provide the following information:

• type / name of the event
• rooms required
• catering
• technical equipment
• additional wishes
• PDF Upload
• name
• telephone number

The admissibility of this processing is based on Art. 6 para. 1 b) GDPR stating that the processing is lawful if it is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. The provision of data is necessary, otherwise you are not able to send a conference request to the Operator.

The personal data processed will be deleted after expiry of the legal retention periods unless the Controller has a legitimate interest in further storage. In any case, only the data will continue to be stored that is necessary to achieve the corresponding purpose. As far as possible, the personal data is anonymised.

Online hotel booking

You have the option to book an accommodation through the website. Therefore, the Operator uses the booking machine D-Edge, which is operated by D-Edge SAS, HQ 14/16, boulevard Poissonnière, 75009 Paris, France. You are forwarded to the website of D-Edge for bookings. Personal data such as name, address and e-mail address as well as payment details are then required. You will find further information in the privacy policy of D-Edge https://www.d-edge.com/privacy-policy/.

The booking details are transferred to us by D-Edge for the performance of a contract.

The admissibility of this processing is based on Art. 6 para. 1 b) GDPR stating that the processing is lawful if it is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. The provision of data is necessary, otherwise you are not able to make a reservation/booking.

The personal data processed will be deleted after expiry of the legal retention periods unless the Controller has a legitimate interest in further storage. In any case, only the data will continue to be stored that is necessary to achieve the corresponding purpose. As far as possible, the personal data is anonymised.

Guest review

You can write a review online of your stay at Mercure Koeln Belfortstraße. For this purpose, the Operator uses the review platform TrustYou of TrustYou GmbH, Steinerstrasse 15, 81369 Munich, Germany. The reviews collected by TrustYou are published on the Operator’s website.

The admissibility of this processing is based on Art. 6 para. 1 f) GDPR stating that the processing is lawful if it is necessary for the purposes of preserving the legitimate interests pursued by the Controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. The legitimate interest of the Operator lies in the public presentation of the company through guest reviews.

The provision of data is neither prescribed by law nor necessary for the conclusion of a contract. The consequence of not providing data is that you are not able to write a review. You will find more information in the privacy policy of TrustYou https://analytics.trustyou.com/surveys/static/guest-privacy-policy-en.pdf.

Application

You have the option to open an e-mail directed to the Operator for application purposes at just one click on the website. The e-mail address linked to your e-mail program is automatically used as the sender here. If you do not want your e-mail address to be retrieved in this way, you can change it in the settings of your respective e-mail program.

The Operator processes your data for the purpose of the application procedure and to reply to your message.

The admissibility of this processing is based on § 26 BDSG (Federal Data Protection Act) (new) stating that personal data of employees may be processed for employment-related purposes where necessary for hiring decisions. If you do not provide the Operator with the requested information and documents, you will not be considered in the application procedure. The provision of data is prescribed contractually.

Application documents received by the Operator will be stored for 6 months after refusal unless the applicant has given consent to further storage. You will find further details in the applicant information on privacy.

Oaky

The operator uses the upselling tool Oaky of Oaky B.V., Leidseplein 1-3, 1017 PR, Amsterdam, The Netherlands, on its website. The operator can contact you with this tool and make you suitable offers to your current booking. These offers can then be added to the existing booking.

If necessary, the data may also be transferred to the USA. The transfer of your personal data to the USA is carried out using standard data protection clauses pursuant to Art. 46 para. 2 c) GDPR, which were issued by the European Commission pursuant to Art. 93 para. 2 GDPR. Information on the standard data protection clauses can be found on the website of the European Commission (https://ec.europa.eu/info/index_de).

The admissibility of this processing is based on Art. 6 para. f) GDPR stating that the processing is lawful if it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. The legitimate interest of the operator lies in the provision of additional offers and booking options to you. The provision of the data is neither required by law nor for contractual purposes. If you do not provide the data, no additional offers can be sent to you.

The personal data processed for the aforementioned purposes will be deleted after using the Oaky service or insofar as you object to the processing for advertising purposes, unless the operator has a legitimate interest in further storage. In any case, only those data will continue to be stored that are absolutely necessary to achieve the corresponding purpose.

For more information about the processing of your personal data, please refer to the privacy policy of Oaky https://oaky.com/en/security?page=privacy-policy.

straiv by Code2Order

The operator uses the tool straiv by CODE2ORDER of CODE2ORDER GmbH, Eichwiesenring 4F, 70567 Stuttgart. With this tool the operator is able to provide you with several information about your stay as well as further services and offers (e.g. wake-up-call, room service, etc.). Furthermore he can provide you with a digital guest folder.

The admissibility of this processing is based on Art. 6 para. 1 f) GDPR, possibly in connection with § 7 para. 3 Act against unfair competition (UWG), stating that the processing is lawful if it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. The legitimate interest of the operator lies in the provision of additional offers, services and information to you. The provision of the data is neither required by law nor for contractual purposes. If you do not provide the data, no additional offers can be sent to you.

With the use of this service you have also the option to get so called push notifications to new offers and promotions.

The admissibility of this processing is based on Art. 6 para. 1 a) GDPR stating that the processing is lawful if the data subject has given consent to the processing of his or her personal data for one or more specific purposes. The provision of the data is neither required by law nor for contractual purposes. If you do not provide the data, neither a digital guest folder nor additional offers can be provided to you.

The personal data processed for the aforementioned purposes will be deleted after using the service or after revocation of your consent, unless the operator has a legitimate interest in further storage. In any case, only those data will continue to be stored that are absolutely necessary to achieve the corresponding purpose.

Chat application

Our website uses the chat application of DialogShift GmbH, Rheinsberger Str. 76/77, 10115 Berlin. This application processes and stores data for the purpose of web analysis, to operate the chat application and to answer queries.

For the operation of the chat function, the chat texts are stored and a cookie with a unique ID is set – this is used to recognise you as a customer.

A cookie is a small text file that is stored locally in the cache on your device. Using this cookie, our application recognises the device and can retrieve past chat logs. This cookie is stored for 90 days since last use. You can disable the storage of cookies in your browser settings. However, without the use of cookies, the chat function cannot be performed.

The possible disclosure of e.g. name, e-mail address or a telephone number is voluntary and with the consent to temporarily use and store this data for the purpose of contacting you until the end of the contact. This personal data is deleted after 90 days.

The legal basis for data processing is Article 6 (1) lit. F GDPR based on our legitimate interest in effective customer support, for statistical analysis of user behaviour and for optimisation purposes of our offers.

DialogShift provides further information on the collection and use of data and on your rights and options for protecting your privacy at https://www.dialogshift.com/de/dsgvo.

Content Delivery Network

The operator uses the KeyCDN content delivery network from the provider proinity LLC, Färberstrasse 9, 8832 Wollerau, Switzerland. KeyCDN is an online service that delivers large media files (such as graphics, page content, or scripts) through a network of regionally distributed servers connected via the Internet. This shortens the loading times of the website. Certain cookies are necessary to enable this function.

The legal basis for the use of KeyCDN with regard to accessing the end device is Section 25 (1) TDDDG (consent). The permissibility of further processing is also based on Article 6 (1) (a) GDPR (consent).

The provision of the data is neither legally required nor necessary for the conclusion of a contract. Failure to provide the data will result in the tool not being used.

The information processed via cookies is transferred to the provider in Switzerland and stored there. This is done in compliance with the special requirements of Articles 44 et seq. GDPR (in this case, the existence of an adequacy decision by the European Commission).

The personal data collected in the course of using KeyCDN will be deleted unless the operator has a legitimate interest in retaining it further. In any case, only the data that is absolutely necessary to achieve the relevant purpose will continue to be stored.

Further information on data processing by the provider can be found in KeyCDN’s privacy policy: https://www.keycdn.com/privacy/

Use of cookies

The Operator uses so-called cookies, which are small data packets normally consisting of letters and numbers and stored on a browser when you visit certain websites. Cookies enable the website to recognise your browser, track you visiting various sections of the website and identify you when you return to the website. Cookies do not contain any data that identifies you personally, but the information concerning you stored by the Operator can be assigned to the data obtained from and stored in the cookies.

Information that the Operator obtains from you using cookies may be used for the following purposes:

• recognising the user’s computer when visiting the website
• tracing the user’s surfing activities on the website
• improving the website’s user-friendliness
• evaluating the use of the website
• operating the website
• preventing fraud and improving the website’s security
• individual design of the website considering the user’s needs

Cookies do not cause any damage on a browser. They neither contain any viruses nor allow the Operator to spy on you. Two types of cookies are used:

• Temporary cookies are automatically deleted when your browser is closed (session cookies).
• Persistent cookies, in contrast, have a longer lifetime. This type of cookies enables you to be recognised again when you return to the website. You will find further information in the cookie settings.

The Operator is able to track your usage behaviour for the above-mentioned purposes and to an appropriate extent by using cookies. Moreover, cookies enable you to optimise your surfing on the Operator’s website. This information is only processed in anonymised form.

Setting cookies is legally permitted if the data processing involved is necessary for transmitting messages or providing a digital service (§ 25 para. 2 TDDDG). Any further data processing through cookies is only allowed with your consent (§ 25 para. 1 TDDDG). Data processing either occurs automatically, or the provision of your personal data is voluntary.

Cookie Declaration

To manage the cookies and similar technologies (tracking pixels, web beacons, etc.) used on our site and the related consents, we use the consent tool „Real Cookie Banner.“ Details on how „Real Cookie Banner“ works can be found at https://devowl.io/knowledge-base/real-cookie-banner-data-processing/.

The legal bases for processing personal data in this context are Art. 6 para. 1 lit. c GDPR and Art. 6 para. 1 lit. f GDPR. Our legitimate interest is in managing the cookies and similar technologies used and the corresponding consents.

The provision of personal data is neither contractually required nor necessary to enter into a contract. You are not obliged to provide personal data. If you do not provide the data, we cannot manage your consents.

Below, you will find options to exercise your rights:

• Change privacy settings
• View privacy settings history
• Revoke consents

You can also access these options via the fingerprint icon displayed on each page.

Use of tracking tools

Google Analytics

The Operator uses the web analysis service Google Analytics 4 of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. This service uses the above-described cookies to collect information such as your operating system, browser, IP address, the website accessed previously as well as the date and time of your visit to the Operator’s website. The information generated by the cookies about the use of the website will be transferred to a Google server in Ireland and stored there. If necessary, the data may also be transferred to the USA.

This is done in compliance with the specific requirements of Art. 44 et seq. GDPR (either by the existence of an adequacy decision by the European Commission or the use of standard contractual clauses). For more information, please refer directly to Google: https://policies.google.com/privacy/frameworks.

Google will use this information to evaluate website usage, compile reports on website activity for the operator, and provide other services related to website and internet usage. If legally required or if third parties process this data on Google’s behalf, Google will also pass this information on to these third parties. This usage occurs in an anonymized or pseudonymized form.

Furthermore, the operator uses Google Signals. This enables additional information about you to be collected in Google Analytics, provided you have activated personalized ads (especially interests and demographic data). Additionally, ads may be delivered to you in cross-device remarketing campaigns.

When using Google Analytics, no direct personal data is stored; only the IP address is retained. This information is used to automatically recognize you on your next visit to the operator’s website, facilitating easier navigation.

The legal basis for the use of Google Analytics concerning device access is § 25 para. 1 TDDDG (consent). The permissibility of usage data evaluation is also based on Art. 6 para. 1 a) GDPR (consent).

You can change your cookie settings at any time. The options to exercise your rights can be found on this page under „Cookie Declaration.“

Personal data collected through the use of tracking tools will be deleted unless the controller has a legitimate interest in further retention. In any case, only data that is essential to achieve the relevant purpose will continue to be stored. Whenever possible, personal data will be anonymized.

The provision of data is neither legally nor contractually required. Without the provision of data, Google Analytics cannot be used.

Google Ads

The Operator uses the conversion tracking Google Ads of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Ads sets a cookie when you click on an advertisement, which identifies which websites you visit. If you are afterwards on the website of the advertisement, Google recognises that you have accessed the website via the advertisement and used the services provided. The data is collected by Google Ireland and transferred to the Operator as statistical evaluations. Therefore, the Operator is able to recognise how attractive the advertisements are and improve the offer.

Data may also be transferred to servers in the USA, if applicable. This is done in compliance with the specific requirements of Art. 44 et seq. GDPR. For more information, please refer directly to Google: https://policies.google.com/privacy/frameworks.

This usage occurs in an anonymized or pseudonymized form.

The legal basis for the use of Google Ads concerning device access is § 25 para. 1 TDDDG (consent). The permissibility of evaluating usage data is also based on Art. 6 para. 1 a) GDPR (consent).

You can change your cookie settings at any time. The options to exercise your rights can be found on this page under „Cookie Declaration.“

Personal data collected through the use of tracking tools will be deleted unless the controller has a legitimate interest in further retention. In any case, only data that is strictly necessary to achieve the relevant purpose will continue to be stored. Whenever possible, personal data will be anonymized.

The provision of data is neither legally nor contractually required. Without providing this data, Google Ads cannot be used.

Google Marketing Platform

The Operator uses the analysis service Google Marketing Platform (hereinafter referred to as „GMP“) of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

GMP uses cookies that recognise which websites are visited and whether advertisements have already been displayed. The advertising should be made more individual and it should be prevented that advertisements are displayed more than once.

The data is collected by Google Ireland and transferred to the Operator as statistical evaluations. Therefore, the Operator is able to recognise how attractive the advertisements are and improve the offer.

If necessary, the data may also be transferred to servers in the USA. This is done in compliance with the specific requirements of Art. 44 et seq. GDPR (either through an adequacy decision by the European Commission or the use of standard contractual clauses). For more information, please refer directly to Google: https://policies.google.com/privacy/frameworks.

This usage occurs in an anonymized or pseudonymized form.

The legal basis for using the Google Marketing Platform concerning device access is § 25 para. 1 TDDDG (consent). The permissibility of evaluating usage data is also based on Art. 6 para. 1 a) GDPR (consent).

You can change your cookie settings at any time. The options to exercise your rights can be found on this page under „Cookie Declaration.“

Personal data collected through the use of tracking tools will be deleted unless the controller has a legitimate interest in further retention. In any case, only data that is strictly necessary to achieve the relevant purpose will continue to be stored. Whenever possible, personal data will be anonymized.

The provision of data is neither legally nor contractually required. Without providing this data, GMP cannot be used.

Triptease

The Operator uses the analysis service Triptease of Triptease Ltd, Triptease Inc. and Triptease Pte Ltd., 15 Bishopsgate, London EC2N 4AF, United Kingdom, on the website. Triptease uses cookies in order to analyse the surfing behaviour on the website. The information collected are provided to the Operator in anonymous form as statistical evaluations. If necessary, the data may also be transferred by Triptease to Google servers in the USA. The transfer of your personal data to the USA is carried out using standard data protection clauses pursuant to Art. 46 para. 2 c) GDPR, which were issued by the European Commission pursuant to Art. 93 para. 2 GDPR. Information on the standard data protection clauses is available on the European Commission’s website (https://ec.europa.eu/info/index_de). You will find further information directly at Google https://policies.google.com/privacy/frameworks.

You will find further information in the privacy policy of Triptease https://www.triptease.com/en/privacy-policy/ as well as in its cookie policy https://www.triptease.com/en/cookie-policy/.

The legal basis for using Triptease with regard to device access is § 25 para. 1 TDDDG (consent). The permissibility of evaluating usage data is also based on Art. 6 para. 1 a) GDPR (consent).

You can change your cookie settings at any time.

Personal data collected through the use of tracking tools will be deleted unless the controller has a legitimate interest in further retention.

The provision of data is neither legally nor contractually required. Without providing this data, Triptease cannot be used.

Google Maps

The Operator uses the map service Google Maps, which is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. By using Google Maps, information about the website use (e.g. date and time of access, IP address etc.) is transferred to Google servers in Ireland and stored there. If necessary, the data may also be transferred to the USA. This is done in compliance with the specific requirements of Art. 44 et seq. GDPR (either through an adequacy decision by the European Commission or the use of standard contractual clauses). For more information, please refer directly to Google: https://policies.google.com/privacy/frameworks.

The data is used by Google for the purposes of advertising, market research and/or designing its website to meet specific needs. This can also be a link to your account provided you are logged in there. If you do not wish this, you need to log out before use.

Google’s terms of use and privacy provisions apply. If you deactivate or block Java Script in your browser settings, you can prevent Google Maps from operating.

The operator uses Google Maps to provide you with interactive maps for route planning.

The legal basis for using Google Maps with regard to device access is § 25 para. 1 TDDDG (consent). The permissibility of evaluating usage data is also based on Art. 6 para. 1 a) GDPR (consent).

You can change your cookie settings at any time.

Akismet

The Operator uses the service Akismet of Automattic Inc., 60 29th Street 343, San Francisco, CA 94107, USA, on the website, which sends comments to a server in the USA in order to check whether they are actually written comments or spam. This is done in compliance with the specific requirements of Art. 44 et seq. GDPR. You will find further information in the privacy policy of Automattic https://automattic.com/privacy/.

The legal basis for using Akismet concerning device access is § 25 para. 2 no. 2 TDDDG. Its use for website security (further processing) also represents a legitimate interest under Art. 6 para. 1 f) GDPR.

The provision of data is neither prescribed by law nor necessary for the conclusion of a contract. The consequence of not providing data is that you are not able to use corresponding comment functions.

The Operator does not store any personal data about the integration of Akismet.

Popup Maker

We use Popup Maker to control popups on our site. Popup Maker uses cookies to identify you as a user and ensure that popups are not displayed to you more than once. For more information, please visit Popup Maker at https://wppopupmaker.com/privacy-policy/.

The legal basis for using Popupmaker concerning device access is § 25 para. 1 TDDDG (consent). The permissibility of further processing is also based on Art. 6 para. 1 a) GDPR (consent).

The cookie stores the data for one day unless there is a legitimate interest in further storage.

Social Media Buttons

Facebook

The Operator uses a Facebook plugin on the website, which is operated by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. If necessary, the data may also be transferred to the USA. The transfer of your personal data to the USA is carried out using standard data protection clauses pursuant to Art. 46 para. 2 c) GDPR, which were issued by the European Commission pursuant to Art. 93 para. 2 GDPR. Information on the standard data protection clauses is available on the European Commission’s website. You will find further information at Facebook https://www.facebook.com/legal/EU_data_transfer_addendum as well as in the privacy policy of Facebook https://de-de.facebook.com/privacy/explanation.

Instagram

The controller uses an Instagram plugin on the website, which is operated by Meta Platforms Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2 Ireland. If necessary, data may also be transferred to the USA. The transfer of your personal data to the USA is carried out using standard data protection clauses in accordance with Art. 46 (2c) GDPR, which were issued by the European Commission in accordance with Art. 93 (2) GDPR. Further information can be found on Facebook at https://www.facebook.com/legal/EU_data_transfer_addendum and in Instagram’s privacy policy at https://help.instagram.com/519522125107875/.

Right of access, to rectification, erasure, restriction, object and data portability

Right of access (Art. 15 GDPR)

Upon request, the Operator provides you with information as to whether data is processed concerning you. The Operator makes every effort to process requests for information as quickly as possible.

Right to rectification (Art. 16 GDPR)

You have the right to obtain from the Controller an immediate rectification of inaccurate personal data concerning you.

Right to erasure (Art. 17 GDPR)

You have the right to obtain from the Operator the erasure of personal data concerning you immediately and the Operator is obliged to erase personal data immediately if one of the grounds stated in Art. 17 para. 1 a) – f) GDPR applies.

Right to restriction (Art. 18 GDPR)

You have the right to obtain from the Controller restriction of processing if one of the grounds stated in Art. 18 para. 1 a) – d) GDPR applies.

Right to object (Art. 21 GDPR)

You have the right to object, on grounds relating to your particular situation, at any time to processing of your personal data which is based on Art. 6 para. 1 e) or f) GDPR, including profiling based on those provisions. The Operator shall no longer process your personal data unless the Operator demonstrates compelling legitimate grounds for processing which override the interests, rights and freedoms of you or for the establishment, exercise or defence of legal claims. If personal data is processed for direct marketing purposes, you have the right to object at any time to processing of your personal data for such marketing, which includes profiling to the extent that it is related to such direct marketing.

You have the right to object, on grounds relating to your particular situation, to processing of your personal data for scientific or historical research purposes pursuant to Art. 89 para. 1 GDPR unless the processing is necessary for the performance of a task in the public interest.

Please use the contact address specified in the imprint for your notification.

Right to data portability (Art. 20 GDPR)

You have the right to receive your personal data, which you provided to the Operator, in a structured, commonly used and machine-readable format and have the right to transmit the data to another controller without hindrance from the operator to which the personal data has been provided, unless the processing is based on a consent pursuant to Art. 6 para. 1 a) GDPR, Art. 9 para. 2 a) GDPR or on a contract pursuant to Art. 6 para. 1 b) GDPR and the processing is carried out by automated means.

Withdrawal of consent

If you have given your consent to processing of your personal data and withdraw it, the processing shall not be affected before its withdrawal.

Right to complain (Art. 77 GDPR)

You have the right to lodge a complaint with a supervisory authority at any time.

Recipients

The data collected when you were accessing and using the website and the information you provided when contacting will be transmitted to the server and stored there. In addition, your data may be transferred to the following categories of recipients:

• Persons working for the Controller who are engaged in the processing (e.g. marketing department, personnel management, customer service)
• Processors (e.g. computer centre, IT service provider, software support, provider of analysis tools, mailing services)
• Operator’s contractual partners (e.g. banks, tax advisers)

To the extent that one of the recipients is located in a third country, the Operator shall comply with the principles of Art. 44 GDPR regarding the permissibility of data transfers to a third country, in particular through data transfers based on adequacy decisions (e.g. the EU-U.S. Data Privacy Framework) or subject to appropriate safeguards such as standard contractual clauses.

Links to third-party websites

When visiting the website, content linked to third-party websites may be displayed. The Operator has neither access to the cookies or other functions used by third parties nor can control them. Such third-party websites are not subject to the Operator’s privacy provisions.