§ 7 – Use of Google Analytics
Provided you have given your consent, we use the web analytics service ‘Google Analytics’ (version ‘Google Analytics 4’) from Google Inc. on our website.
Google Analytics uses so-called cookies, which are text files stored on your computer that enable an analysis of your use of the website.
We only use Google Analytics with IP anonymisation enabled. Consequently, your IP address is truncated by Google within Member States of the European Union or in other signatory states to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there.
We use the Google Analytics feature ‘Google Signals’ to collect and analyse information about your user behaviour. If you are logged in to your Google Account, this also takes place across devices and platforms (so-called ‘cross-device tracking’); if you have enabled personalised adverts, interest-based and demographic data (such as age and gender) are also collected.
We synchronise, manage and visualise the data collected, together with data from other sources, using Google Looker Studio in dashboards and reports to analyse results and optimise our website.
On our behalf, Google will use the information collected to evaluate your use of the website, to compile reports on website activity and to provide the website operator with further services relating to website and internet usage. This is done using pseudonymised user profiles – meaning they do not contain any unique data such as a name or email address.
The IP address transmitted by your browser as part of Google Analytics is not combined with other data held by Google. In particular, the following data is
collected during your visit to the website:
- your approximate location,
- the time of the request
- your truncated IP address
- your user behaviour,
- Pages you have visited,
- your purchases and downloads,
- Technical information about your browser, operating system and device,
- Your internet service provider,
- the referrer URL.
The data and associated cookies are deleted after 14 months. Data for which the retention period has expired is automatically deleted once a month.
You can prevent cookies from being stored by adjusting the settings in your browser software; however, please note that in this case you may not be able to make full use of all the functions of this website.
You can prevent the collection of data generated by the cookie and relating to your use of the website (including your IP address) by Google, as well as the processing of this data by Google, by downloading and installing the browser plug-in available via the following link: https://tools.google.com/dlpage/gaoptout?hl=de
Data processing in connection with Google Analytics is carried out on the basis of your consent pursuant to Article 6(1)(a) of the GDPR, which was requested, for example, when you consented to the storage of cookies. You may withdraw your consent at any time. The easiest way to do so is via our Consent Manager or by installing Google’s browser add-on, which is available via the following link: https://tools.google.com/dlpage/gaoptout?hl=de/.
Google acts as a data processor and we have entered into a corresponding contract with Google. The information generated by the cookie and the (usually truncated) IP addresses relating to your use of this website are generally transmitted to a Google server in the USA and processed there. Google participates in the EU-US Data Privacy Framework, which came into force on 10 July 2023, and has thereby formally committed itself to the US Department of Commerce to comply with the principles of the EU-US Data Privacy Framework. Google’s EU-US Data Privacy Framework registration can be viewed at https://www.dataprivacyframework.gov/s/participant-search/participant-detail?id=a2zt000000001L5AAI&status=Active. In accordance with the European Commission’s Adequacy Decision of 10 July 2023, the EU-US Data Privacy Framework guarantees an adequate level of data protection, i.e. one that is substantively equivalent to that of the EU.
Further information on Google Analytics or information from the third-party provider: Google Dublin, Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001, can be found
at https://marketingplatform.google.com/about/analytics/terms/de/ (Terms of Service), at https://support.google.com/analytics/answer/6004245?hl=de/ (information on data processing when using Google Analytics), and at https://policies.google.com/privacy?hl=de&gl=de (Privacy Policy – general information on data processing, which, according to Google, also applies to Google Analytics).
§ 8 – Microsoft Clarity
We use the web analytics service Microsoft Clarity, provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland, to analyse the use of our website, improve it regularly and make it more interesting for you as a user. In doing so, Microsoft collects the following data:
- IP address
- Location data
- Browser information
- Screen resolution
- Language settings
- Websites/subpages visited
- Date and time of website visit
- Clicks, scrolling and mouse movements
- Session recordings (videos of user interactions)
- Heatmap data (visualisation of user interactions)
This data is provided to us solely in aggregated, anonymised form, meaning that we cannot draw any conclusions about individual users from the data provided. In the case of session recordings, sensitive data that could allow conclusions to be drawn about the user’s identity is masked by Microsoft Clarity.
Furthermore, any linking of the data provided via Microsoft Clarity with Google Analytics is carried out by us only in such a way that it does not allow individual users to be identified. In addition, Microsoft Clarity states that it never sells user data to third parties.
To collect data, Microsoft Clarity uses JavaScript code embedded in our website. This code sets cookies and uses the browser’s local storage to store information and ensure the tool functions correctly. All relevant information regarding the cookies, including their names, purpose and retention period, is set out in our detailed list of cookies used.
The data collected by Microsoft Clarity is stored for a period of up to 13 months. Once this period has expired, or upon termination of use of the service, the data will be deleted, provided there are no statutory retention obligations.
Further details can be found at https://learn.microsoft.com/en-us/clarity/setup-and-installation/data-retention. We recommend checking these links regularly for changes, as Microsoft may update the way Clarity works and how it processes data.
We have also entered into a data processing agreement with Microsoft.
The legal basis for the processing of your data is Article 6(1)(a) of the GDPR, i.e. data is processed only with your consent. You may withdraw your consent at any time; the easiest way to do so is via our Cookie Manager. Your data may also be processed on servers belonging to Microsoft Corporation, 1 Microsoft Way, Redmond, WA 98052, i.e. in the USA. Microsoft participates in the EU-US Data Privacy Framework, which came into force on 10 July 2023, and has thereby formally committed itself to the US Department of Commerce to comply with the principles of the EU-US Data Privacy Framework. Microsoft’s EU-US Data Privacy Framework registration can be viewed at https://www.dataprivacyframework.gov/list. In accordance with the European Commission’s adequacy decision of 10 July 2023, the EU-US Data Privacy Framework guarantees an adequate level of data protection, i.e. one that is substantively equivalent to that of the EU. In addition, we have agreed so-called standard contractual clauses with Microsoft, the purpose of which is to ensure an adequate level of data protection in the third country.
Further information is available at https://clarity.microsoft.com. For more information on how Microsoft Clarity handles user data, please refer to Microsoft’s Privacy Statement: https://privacy.microsoft.com/de-de/privacystatement.
§ 9 – Use of social media plug-ins
Our website uses social plugins (‘plugins’) from social networks. This serves to safeguard our overriding legitimate interests, following a balancing of interests, in the optimal marketing of our services in accordance with Article 6(1), first sentence, point (f) of the GDPR. To enhance the protection of your data when you visit our website, the plugins are not integrated without restriction, but are incorporated into the page solely via an HTML link (the so-called ‘Shariff solution’ from c’t). This integration ensures that, when you access a page on our website that contains such plugins, no connection is yet established with the servers of the respective social network provider. If you click on one of the buttons, a new window will open in your browser and take you to the respective service provider’s page, where you can (after entering your login details, if required) click the ‘Like’ or ‘Share’ button, for example. For information on the purpose and scope of data collection, as well as the further processing and use of the data by the providers on their websites, and your rights in this regard and the settings available to protect your privacy, please refer to the providers’ privacy policies.
https://help.instagram.com/155833707900388
§ 10 – Integration of Google Maps
1. On this website, we use the ‘Google Maps’ mapping service provided by Google Inc. (registered office at 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; hereinafter ‘Google’). This enables us to display interactive maps directly on the website and allows you to use the map function conveniently.
2. When you visit the website, Google receives information that you have accessed the relevant page of our website. In addition, the data specified in § 2 of this policy is transmitted. This occurs regardless of whether Google provides a user account through which you are logged in, or whether no user account exists. If you are logged in to Google, your data will be directly associated with your account. If you do not wish your data to be associated with your Google profile, you must log out before activating the button. Google stores your data as usage profiles and uses them for the purposes of advertising, market research and/or tailoring its website to users’ needs. Such analysis is carried out in particular (even for users who are not logged in) to deliver personalised advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles; to exercise this right, you must contact Google.
3. The information collected is stored on Google’s servers, including in the USA. Google participates in the EU-US Data Privacy Framework, which came into force on 10 July 2023, and has thereby formally committed itself to the US Department of Commerce to comply with the principles of the EU-US Data Privacy Framework. Google’s EU-US Data Privacy Framework registration can be viewed at https://www.dataprivacyframework.gov/list. In accordance with the European Commission’s adequacy decision of 10 July 2023, the EU-US Data Privacy Framework guarantees an adequate level of data protection, i.e. one that is substantively equivalent to that of the EU. In addition, we have agreed so-called standard contractual clauses with Google, the purpose of which is to ensure an adequate level of data protection in the third country.
4. Further information on the purpose and scope of data collection and its processing by the plug-in provider Google can be found in the privacy policy. There you will also find further information on your rights and the settings available to protect your privacy: https://www.google.de/intl/de/policies/privacy.
Data processing in connection with Google Maps is carried out on the basis of your consent pursuant to Article 6(1)(a) of the GDPR, which was requested, for example, when you consented to the storage of cookies. You may withdraw your consent at any time.
§ 11 – Data security
During your visit to the website, we use the widely adopted SSL (Secure Socket Layer) protocol in conjunction with the highest level of encryption supported by your browser. This is usually 256-bit encryption. If your browser does not support 256-bit encryption, we will use 128-bit v3 technology instead. You can tell whether a particular page on our website is being transmitted in encrypted form by the closed key or padlock symbol displayed in the status bar at the bottom of your browser.
We also employ appropriate technical and organisational security measures to protect your data against accidental or deliberate manipulation, partial or complete loss, destruction or unauthorised access by third parties. Our security measures are continuously improved in line with technological developments.
§ 12 Embedding of YouTube videos 1
. We have embedded YouTube videos into our online service; these are stored on https://www.YouTube.com and can be played directly from our website. [These are all embedded in ‘enhanced privacy mode’, i.e. no data about you as a user is transmitted to YouTube unless you play the videos. Only when you play the videos is the data referred to in paragraph 2 transmitted. We have no control over this data transfer.] This serves to safeguard our overriding legitimate interests, following a balancing of interests, in the optimal marketing of our services in accordance with Article 6(1), first sentence, point (f) of the GDPR.
2. When you visit the website, YouTube receives the information that you have accessed the relevant subpage of our website. In addition, the data specified in § 2 of this statement is transmitted. This occurs regardless of whether YouTube provides a user account through which you are logged in, or whether no user account exists. If you are logged in to Google, your data will be directly associated with your account. If you do not wish your data to be associated with your YouTube profile, you must log out before clicking the button. YouTube stores your data as usage profiles and uses them for the purposes of advertising, market research and/or tailoring its website to users’ needs. Such analysis is carried out in particular (even for users who are not logged in) to deliver personalised advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles; to exercise this right, you must contact YouTube.
3. Further information on the purpose and scope of data collection and its processing by YouTube can be found in the privacy policy. There you will also find further information on your rights and settings options for protecting your privacy: https://www.google.de/intl/de/policies/privacy. Google also processes your personal data in the USA and has opted into the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.
§13 Integration of OpenStreetMap
We use the OpenStreetMap mapping service on this website. This enables us to display interactive maps directly on the website and allows you to use the map function conveniently.
When you visit the website, OpenStreetMap receives the information that you have accessed the relevant page of our website. In addition, the data specified in § 2 of this policy, as well as data relating to your interaction with the map, is transmitted.
Further information on the purpose and scope of data collection and its processing by the plug-in provider, the OpenStreetMap Foundation (OSMF), can be found in their privacy policy. There you will also find further information on your rights and the settings available to protect your privacy: https://wiki.osmfoundation.org/wiki/Privacy_Policy.
Data processing in connection with OpenStreetMap is carried out on the basis of your consent pursuant to Article 6(1)(a) of the GDPR, which was requested, for example, when you consented to the storage of cookies. You may withdraw your consent at any time.
§14 Use of imx.Platform white-label widgets
This website integrates white-label widgets from the imx.Platform. The white-label widgets are used to integrate data (tourism businesses, attractions, events, tours, tourist offers, etc.) from the tourism database of FWTM GmbH & Co. KG, which is based on the imx.Platform software, into the website.
The imx.Platform and the imx.Platform white-label widgets are provided and operated by infomax websolutions GmbH, Aichfeld 2, 83224 Grassau, Germany (hereinafter referred to as ‘infomax’). infomax operates its services exclusively on servers in Germany in accordance with German and European data protection regulations.
The following personal data is processed:
- IP address
- Date and time of access
- Device and browser information
The processing is carried out for the purpose of providing data (tourism businesses, attractions, events, tours, tourist offers, etc.) from the tourism database of FWTM GmbH & Co. KG. The legal basis is Article 6(1)(a) of the GDPR.
Infomax processes the data on our behalf on the basis of a contract in accordance with Article 28 of the GDPR. Your data will only be processed with your prior consent. The data collected is stored for a period of 7 days.
Further information on data protection at Infomax can be found at https://www.infomax-online.de/datenschutz
§15 Integration of Komoot content
On our website, we embed content from the komoot service provided by komoot GmbH, Kienberger Allee 4, 12529 Schönefeld, Germany (‘komoot’). This enables us, for example, to display routes, tours, collections, highlights or map content from komoot directly on our website.
When the embedded komoot content is loaded, your browser establishes a connection to komoot’s servers. In particular, your browser type and version, operating system, referrer URL, the URL of the page accessed, the date and time of the server request, and your IP address may be transmitted to komoot. Komoot states that the IP address automatically collected upon access is stored for 90 days.
The komoot content is only integrated once you have given your consent. The legal basis for the processing is Article 6(1)(a) of the GDPR. Insofar as information is stored on or read from your device as a result of the integration, this is also carried out on the basis of your consent in accordance with Section 25(1) of the TDDDG. You may withdraw your consent at any time with future effect via our Consent Manager. Without your consent, the embedded content will not be loaded; the rest of your use of our website remains unaffected.
The recipient of the data transmitted when you access the content is komoot GmbH. Further processing within the komoot service is carried out in accordance with komoot’s data protection provisions. There is no legal or contractual obligation to provide your data. Without your consent, only the embedded komoot content cannot be displayed directly on our website. We do not carry out any automated decision-making within the meaning of Article 22 of the GDPR as a result of this integration.
§16 Use of Google Ads Remarketing
1. We use Google Ads Remarketing on our website, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (‘Google’). This feature enables visitors to our website to be assigned to specific audience segments and, when they subsequently use Google services or other offerings connected to the Google advertising network, to be shown adverts tailored to their interests. Google now also refers to such audiences as ‘segments based on first-party data’.
2. For this purpose, the Google tag may collect information about your visit to our website and your interactions. This may include, in particular, your IP address, browser and device information, pages visited, time of visit, referrer information, as well as cookie, online and advertising identifiers. In the case of dynamic remarketing, depending on our configuration, additional information about specific content viewed on our website or actions carried out may also be transmitted to Google.
3. This integration takes place exclusively with your consent. The legal basis for the processing of personal data is Article 6(1)(a) of the GDPR; the storage of information on your device or access to information already stored is based on Section 25(1) of the TDDDG. You may withdraw your consent at any time with future effect via our Consent Manager. If you do not give your consent or withdraw it, Google Ads Remarketing will not be used on our website for this purpose. There is no obligation to give consent.
4. As part of remarketing, pseudonymous user profiles or target audience segments may be created for advertising purposes. The specific duration of membership of these target audience segments set by us is [to be added] days. Google currently sets a default duration of 30 days and a maximum of 540 days for such segments on the Display Network and in Google Search; however, the duration actually selected in our Google Ads account is decisive.
5. Under Google’s current privacy policy, Google Ads is generally treated as a service in which Google and the Google Ads customer are each independent data controllers for their respective processing activities, unless a special function explicitly configured as data processing on behalf of a client is used. Processing by Google LLC in the USA cannot be ruled out. Google LLC is certified under the EU-US Data Privacy Framework; where necessary, Google also uses standard contractual clauses.
6. No decision made exclusively by automated means on our part, which has legal effects on you or adversely affects you in a similarly significant manner, takes place as a result of remarketing.
Further information on the purpose and scope of data collection and its processing by the plug-in provider Google can be found in the privacy policy. There you will also find further information on your rights and the settings available to protect your privacy: https://www.google.de/intl/de/policies/privacy
§17 Integration of Google Fonts
1. On this website, we use the ‘Google Fonts’ service provided by Google Inc. (registered office at 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; hereinafter ‘Google’). This enables us to display various fonts directly on the website.
2. When you visit the website, Google receives information indicating that you have accessed the relevant page of our website. In addition, the data specified in § 2 of this policy is transmitted. This occurs regardless of whether Google provides a user account through which you are logged in, or whether no user account exists. If you are logged in to Google, your data will be directly associated with your account. If you do not wish your data to be associated with your Google profile, you must log out before activating the button. Google stores your data as usage profiles and uses them for the purposes of advertising, market research and/or tailoring its website to users’ needs. Such analysis is carried out in particular (even for users who are not logged in) to deliver personalised advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles; to exercise this right, you must contact Google.
3. The information collected is stored on Google’s servers, including in the USA. Google participates in the EU-US Data Privacy Framework, which came into force on 10 July 2023, and has thereby formally committed itself to the US Department of Commerce to comply with the principles of the EU-US Data Privacy Framework. Google’s EU-US Data Privacy Framework registration can be viewed at https://www.dataprivacyframework.gov/list. In accordance with the European Commission’s adequacy decision of 10 July 2023, the EU-US Data Privacy Framework guarantees an adequate level of data protection, i.e. one that is substantively equivalent to that of the EU. In addition, we have agreed so-called standard contractual clauses with Google, the purpose of which is to ensure an adequate level of data protection in the third country.
Further information on the purpose and scope of data collection and its processing by the plug-in provider Google can be found in the privacy policy. There you will also find further information on your rights and the settings available to protect your privacy: https://www.google.de/intl/de/policies/privacy.
Data processing in connection with Google Fonts is based on your consent in accordance with Article 6(1)(a) of the GDPR, which was requested, for example, when you consented to the storage of cookies. You may withdraw
your consent at any time
§18 Advertising with Facebook or Meta (Pixel and Conversion Tracking)
1. Advertising measures provided by Meta Platforms Ireland Limited (formerly Facebook) are used on our website. By integrating the so-called ‘Meta Pixel’ (formerly ‘Facebook Pixel’) into our website, we are able to display our advertising (‘Facebook Ads’) to users of our website and the Facebook social network, and to measure and evaluate its effectiveness (‘conversion tracking’). This connection between Facebook and our website is established technically via the ‘Meta Pixel’. The legal basis for the processing of your data is Article 6(1)(a) of the GDPR, i.e. the integration takes place only with your consent.
2. Due to the marketing tools used, your browser automatically establishes a direct connection to Facebook’s server when you visit our website. We have no influence over the scope and further use of the data collected by Facebook through the use of this tool and therefore outline the processes known to us as follows: Through the integration of the Meta Pixel, Facebook receives the information that you have visited the relevant page on our website or clicked on one of our adverts. If you are registered with a Facebook service, Facebook may associate your visit with your account. Even if you are not registered with Facebook or have not logged in, it is possible that the provider may obtain your IP address and other identifying characteristics and use them to build a profile.
3. The information collected is stored on servers belonging to Meta Platforms, Inc. (1601 Willow Rd., Menlo Park, CA 94025, USA) (formerly Facebook), including in the USA. Meta participates in the EU-US Data Privacy Framework, which came into force on 10 July 2023, and has thereby formally committed to the US Department of Commerce to comply with the principles of the EU-US Data Privacy Framework. Meta’s EU-US Data Privacy Framework registration can be viewed at https://www.dataprivacyframework.gov/list. In accordance with the European Commission’s adequacy decision of 10 July 2023, the EU-US Data Privacy Framework guarantees an adequate level of data protection, i.e. one that is substantively equivalent to that of the EU. In addition, we have agreed so-called standard contractual clauses with Meta, the purpose of which is to ensure compliance with an adequate level of data protection in the third country.
4. You may withdraw your consent at any time, without this affecting the lawfulness of the processing carried out prior to the withdrawal. The easiest way to withdraw your consent is via our Consent Manager. Furthermore, (logged-in users only) can object via the provider’s function at the following link: www.facebook.com/settings/?tab=ads#_.
Further information on data processing by Facebook is available from Meta Platforms Inc., 1601 Willow Rd, Menlo Park, CA 94025, USA; Privacy Policy: www.facebook.com/about/privacy.
5. We also use the ‘Custom Audiences’ remarketing feature, which likewise utilises the Meta Pixel to display interest-based adverts when you visit our website or other websites that have also integrated the Meta Pixel. This enables us to show you adverts that are of interest to you, to make our website more appealing to you and to promote our services.
§ 19 Use of Microsoft Advertising
1. On our website, we use the online advertising and analytics service “Microsoft Advertising” (formerly “Bing Ads”) provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.
Microsoft Advertising enables us to place adverts on Microsoft websites and services such as MSN, Outlook.com, Bing and others, and to personalise and optimise them.
2. To this end, if you have arrived at our website via an advert placed through Microsoft Advertising, Microsoft Advertising will store a cookie in your browser for 30 days (known as a ‘conversion cookie’). This cookie is not used for personal identification. If you visit certain pages on our website before the cookie expires, we and Microsoft Advertising receive the information that someone has clicked on the advert and has thus been redirected to our site. The information collected using the conversion cookie is provided to us in aggregated, pseudonymised form and is used to generate conversion statistics for us as Microsoft Advertising customers, for example to determine the total number of users who have clicked on our adverts and been redirected to a website tagged with a conversion tracking tag. We are unable to personally identify the behaviour of individual website visitors in this process. Microsoft may also, under certain circumstances, track your usage behaviour across several of your devices using so-called cross-device tracking. You can disable this at https://choice.microsoft.com/de-de/opt-out. The data processed by Microsoft includes, amongst other things: IP address, browser type and version, time and duration of the website visit, browser settings, request, device type, operating system, search terms and queries, click behaviour, referrer URL, conversion data, demographic data, locations, interests and preferences, cookie IDs, and advertising IDs on mobile devices.
3. You can prevent the collection of data generated by the cookie and relating to your use of the website, as well as the processing of this data, by disabling cookies in your browser settings. However, this may mean that you are unable to make full use of all the functions of our website.
The legal basis for both the setting of the cookie and the processing of your personal data is your consent in accordance with Section 25 of the TDDDG or Article 6(1)(a) of the GDPR.
4. Microsoft Ireland Operations Limited is a subsidiary of Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA. It cannot be ruled out that the subsidiary permits or is required to permit access to personal data of European users, meaning that data processing may also take place in the USA. Microsoft participates in the EU-US Data Privacy Framework, which came into force on 10 July 2023, and has thereby formally committed itself to the US Department of Commerce to comply with the principles of the EU-US Data Privacy Framework. Microsoft’s EU-US Data Privacy Framework registration can be viewed at https://www.dataprivacyframework.gov/list. In accordance with the European Commission’s adequacy decision of 10 July 2023, the EU-US Data Privacy Framework guarantees an adequate level of data protection, i.e. one that is substantively equivalent to that of the EU. In addition, we have agreed so-called standard contractual clauses with Microsoft, the purpose of which is to ensure an adequate level of data protection in the third country.
Further information on Microsoft’s handling of personal data can be found at: https://privacy.microsoft.com/de-de/privacystatement.
§20 Use of data in the conduct of prize draws
If we receive your email address and other personal data, such as your surname and first name, from you as a result of your participation, this personal data will be used exclusively for the purpose of conducting the prize draw. If we identify you as a winner as part of the prize draw, you will be notified accordingly at the email address you have provided. The legal basis for this is Article 6(1)(b) of the GDPR, namely the conduct of the prize draw. Thereafter, this data will be deleted, provided this is not prevented by a statutory retention obligation.
The entry forms, and thus also the personal data of participants who have not won contained therein, will be destroyed in accordance with data protection regulations immediately after the prize draw has taken place.
