Privacy Policy

We, as the operator of the websites at www.maerklineum.de (also "website"), are
responsible for the processing of personal data of the visitor ("you") of the website in
accordance with applicable data protection laws, in particular the General Data Protection
Regulation ("GDPR").
With the following privacy notice we transparently inform you, within the scope of our
information obligations (Art. 13 et seq. GDPR), about our processing of your personal data
when using our website and on which legal basis we may process your personal data. You
will also receive information regarding your data subject rights and competent supervisory
authorities.

1.    Information on the data controller
Märklin Spielwaren Vertriebs-GmbH
Reuschstraße 6
D-73033 Göppingen
Germany
 
Phone: +49 (0) 71 61 / 608-289
Fax: +49 (0) 71 61 / 608-151
E-mail address: info(at)maerklineum.de

2.    Data Protection Officer
We have appointed a company data protection officer.
Andreas Zimmermann
Liststraße 4
73035 Göppingen

E-mail: a.zimmermann@maerklin.de   
Phone: +49(0)7161-9880478

3.    Informational use of our website
When you call up our website merely to visit it, so-called log files are processed by being
automatically recorded by our system.
The following log files are processed automatically:
*    IP address of the requesting computer
*    Type of Internet browser used
*    Operating system and its version
*    Operating system interface
*    Pages accessed
*    Date and time of the visit
*    Time zone difference from Greenwich Mean Time (GMT)
*    Access status/http status code
*    Transmitted data volume
*    Referrer
The log files contain your IP address, but it is shortened before storage. Therefore, an
assignment to you is not possible and your data is also not stored together with other
personal data.
The short-term processing of your data for anonymisation purposes is necessary to provide
our website. This purpose also justifies our legitimate interest in processing your data on the
legal basisof Art. 6 para. 1 sentence 1 lit. f GDPR.
 
4.    Website hosting:
Our website is operated on the servers of the provider 21TORR GmbH, Heinestr. 72, 72762
Reutlingen, with server location in Germany. This means that the data we collect when you
visit this website is stored by our hoster.
The legal basis for processing your personal data is Art. 6 para. 1 sentence 1 lit. f GDPR, as
it is in our legitimate interest to use the services of a professional provider for the secure and
efficient provision of our website. We have concluded a data processing agreement with
21TORR GmbH.

5.    Contact via e-mail, fax or telephone
You have the option of contacting us by e-mail, fax or telephone. Your personal data
transmitted in this way will be stored by us. The data is processed exclusively in order to deal
with your contact request appropriately, which corresponds to our legitimate interest. The
legal basis for the processing of your personal data is Art. 6 para. 1 sentence 1 lit. f GDPR.
The data is stored until it is no longer required to achieve the purpose of the conversation
with you and the matter of your contact request has been comprehensively clarified.
If your contact request is aimed at concluding a contract with us, the additional legal basis
for processing your personal data is Art. 6 para. 1 sentence 1 lit. b GDPR. This data is stored
for as long as it is required for the execution of the contract or the pre-contractual measures.
Beyond that, we only store your data in order to comply with legal obligations (e.g. tax
obligations) (Art. 6 para. 1 sentence 1 lit. c GDPR).
You can inform us at any time (see section 1 above) that you would like us to delete the data
provided in the course of the conversation. In this case, all personal data of the conversation
will be deleted, if permissible, and a continuation of the conversation is not possible.

6.    Newsletter
6.1    Subscription to our newsletter
On our website, we offer you the opportunity to subscribe to our newsletter free of charge. In
addition to your declaration of consent, we need your e-mail address. Further information,
e.g. your name, is voluntary and serves to address you personally.
We will only send you the newsletter if you first confirm your registration to us via a
confirmation e-mail sent to you for this purpose by clicking on the link provided. This is to
ensure that only you can subscribe to the newsletter. Your confirmation in this regard must
be made promptly after receipt of the confirmation e-mail, otherwise your newsletter
registration will be automatically deleted from our database.
The legal basis for the newsletter dispatch as well as voluntary additional information is Art.
6 para. 1 sentence 1 lit. a GDPR. By sending the newsletter registration, you agree to the
processing of your data by us.
In addition, we store the time (date and time) of the transmission of your data to us, as well
as your IP address, as part of your newsletter registration. The processing of this data
corresponds to our legitimate interest pursuant to Art. 6 (1) sentence 1 lit. f GDPR in order to
ensure the security of our systems and to counteract misuse. In the case of the confirmation
e-mail sent for control purposes, we also save the date and time of the click on the
confirmation link and your IP address in order to be able to trace any possible misuse of your
e-mail address at a later date.
Your data will be processed exclusively in connection with the sending of newsletters. The
purpose of processing your e-mail address is to be able to send you the newsletter. Further
data within the scope of the registration process serve either to address you personally or
also to ensure the security of our services and to prevent misuse of the e-mail address used.
Your data will only be stored for as long as is necessary to achieve the purpose. Your e-mail
address will therefore be stored for the duration of your active newsletter subscription if you
have given your consent for this. The data that we additionally collect automatically during
your subscription (IP address, date and time) will be deleted at the latest when you end your
newsletter subscription.

6.2    Newsletter service provider:
To send the newsletter, we use the services of Inxmail GmbH, Wentzingerstr. 17, 79106
Freiburg, Germany, to whom we pass on the data you provided when registering for the
newsletter. The data you enter for the purpose of receiving the newsletter (e.g. e-mail
address) is stored on Inxmail's servers in the EU.
This disclosure is made in accordance with Art. 6 para. 1 lit. f GDPR and serves our
legitimate interest in using a newsletter system that is effective in advertising, secure and
user-friendly.
The processing of your data by Inxmail is carried out on the basis of an order processing
agreement in accordance with Art. 28 GDPR, which we have concluded with Inxmail.

6.3    Newsletter tracking:
Due to a "web beacon" or "tracking pixel" implemented in our newsletter (this is a pixel-sized
file), we can track whether the newsletter has been opened. This is done by loading the
graphic together with all other images from the server when the e-mail is opened. This image
call is tracked and enables the evaluation of the opening rate.
In addition, we can track whether links contained in the newsletter have been clicked on. This
is done by temporarily redirecting the recipient via the server of our newsletter service
provider after clicking on a link and then forwarding the recipient to the target address.
Within the scope of tracking, technical information (e.g. IP address, browser as well as time
of retrieval and opening of the newsletter) is also recorded and statistically evaluated. The
data is collected exclusively in pseudonymised form and is not linked to your other personal
data; direct personal reference is excluded. We receive aggregated statistics that are
automatically created by our service provider (see above). As a rule, we only have a view of
the percentage of recipients who have opened the newsletter or which content was
particularly well received. This data is used exclusively for the statistical analysis of
newsletter campaigns and can be used by us to better adapt future newsletters to the
interests of the recipients. If you wish to object to the data analysis for statistical evaluation
purposes, you must unsubscribe from the newsletter.
The evaluation of your user behaviour only takes place if you have consented to the
newsletter dispatch and the associated personalised data evaluation. The legal basis for the
data processing is your consent in accordance with § 25 para. 1 TTDSG and Art. 6 para. 1
sentence 1 lit. a GDPR.
We have concluded a data processing agreement with Inxmail, by which we oblige
Inxmail to protect our customers' data and not to pass it on to third parties. You can
view Inxmail's privacy policy here:
www.inxmail.de/datenschutz

WITHDRAWAL OF CONSENT / Unsubscribe Newsletter
You can unsubscribe or cancel our newsletter at any time. Unfortunately, a separate
revocation of your consent to newsletter tracking is not possible. If you wish to object to
newsletter tracking, you must therefore also unsubscribe from the newsletter.  You will find
the link to do so at the end of each newsletter. You can also unsubscribe from the newsletter
at any time by sending a message to us (section 1) or via the following link:
www.maerklineum.de/de/newsletter/abbestellen.
By doing so, you withdraw your consent with effect for the future or object to any further use
of your data for the purpose of sending and tracking the newsletter. After unsubscribing, your
e-mail address will be deleted from our newsletter distribution list immediately, unless you
have expressly consented to further use of your data or we reserve the right to use data
beyond this, which is permitted by law and about which we inform you in this declaration. The
withdrawal of your consent does not affect the lawfulness of the processing carried out on
the basis of the consent until the revocation.

7.    Direct marketing
If you leave personal data when using our services, for example a purchase via our website,
we reserve the right to process your e-mail address, your first and last name, your postal
address and - insofar as we have received this additional information from you as part of the
contractual relationship - your title, academic degree, year of birth and your professional,
industry or business name for direct advertising measures, for example to send you our
newsletter or to send you postal advertising letters for the purchase of further products (e.g.
vouchers for our online shop). This is done exclusively in the context of direct advertising for
our own or similar goods or services.
The legal basis for sending advertising by post after an order is Art. 6 para. 1 sentence 1 lit.
f GDPR. The legal basis for sending newsletters in connection with the sale of goods or
services is Art. 6 para. 1 sentence 1 lit. f GDPR in conjunction with. § 7 para. 3 UWG. The
processing of your personal data for the purpose of postal and/or electronic direct advertising
corresponds to our legitimate interest.
If we send you a newsletter following an order on our website, we store your e-mail address
for the purpose of advertising our own or similar goods or services until you unsubscribe from
the newsletter (cf. para. 6). You can object to the storage and use of your data for the
purpose of direct advertising at any time by sending us a message to this effect (section 1).

8.      Orders in our ticket shop
8.1    Placing an order
When you place an order in our ticket shop, we need the following data to fulfil the contract
with you:

• First name, last name and (invoice, delivery and e-mail) address in order to send you the order confirmation, your order and the invoice and to provide you with the contract documents immediately after the order.
• Telephone number (optional)
• Your payment information to process payment for your order

We also process the data required in each case in order to unwind our contract after a
withdrawal or return for any other reason or to check claims. In addition, we store your
aforementioned data in order to be able to display your order history on our website.
The legal basis for the processing of the data is Art. 6 para. 1 sentence 1 lit. b and f GDPR.
The data will be stored for as long as is necessary for order processing and within the scope
of our obligations under any website user contract with you. It is in our legitimate interests to
enable you to track your current and previous orders on our website. Furthermore, we only
store your data in order to comply with our legal obligations (e.g. tax obligations) (Art. 6 para.
1 sentence 1 lit. c GDPR). In this case, we block your data to the extent that it is only
processed for the necessary purposes.
In order to send you your order, we may pass on your address data to our shipping or
logistics service provider for the purpose of delivery. The legal basis for this data processing
is Art. 6 para. 1 sentence 1 lit. b and f GDPR. It is in our legitimate interests to use a
specialised shipping or logistics service provider to ship your orders.
In addition to the aforementioned data, we store the time (date and time) of the transmission
of your data to us, as well as your IP address. The processing of this data corresponds to our
legitimate interest (Art. 6 para. 1 sentence 1 lit. f GDPR) in order to ensure the security of our
systems and to counteract misuse. This additional data is deleted as soon as it is no longer
required, at the latest when the contract with you has been completed.

8.2    Payment methods:
If you select a payment provider on our site for payment, this provider also receives your
personal data, for example your name, address and bank account details. In addition, our
house bank receives your bank connection data when an electronic payment is received.
The legal basis for processing your personal data for payment purposes is Art. 6 para. 1
sentence 1 lit. b and f GDPR.

PayPal: If you pay on our website with PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A. 22-24
Boulevard Royal L-2449 Luxembourg), PayPal receives your payment data for payment
processing and it may be that PayPal carries out a credit check. You can find information on
this at: www.paypal.com/de/webapps/mpp/ua/privacy-full.

Credit card: When you pay with your credit card on our website, your credit card provider
receives the information that you have placed an order with us. Your credit card provider may
carry out a credit check. You can find more information about this on the respective website
of your credit card provider.
iDeal: When you pay on our website with iDeal (Currence iDEAL B.V., Gustav Mahlerplein
33-35, Amsterdam, the Netherlands, hereinafter "iDeal"), iDeal receives your payment data
for payment processing. Information on how iDeal processes your data can be found at
www.ideal.nl/en/privacy-cookie-statement/.

Giropay: If you pay on our website with Giropay (paydirekt GmbH, Stephanstr. 14-16, 60313
Frankfurt am Main (hereinafter "paydirekt")), paydirekt forwards your payment and
transaction data as well as information on the shopping basket to your bank. In addition, our
house bank receives your bank connection data for payment processing. You can find
information on this at: www.giropay.de/rechtliches/datenschutzerklaerung  

SOFORT Überweisung: If you select the payment method SOFORT Überweisung (Sofort
GmbH, Theresienhöhe 12, 80339 Munich) on our website, Sofort GmbH will receive your
personal data, for example your name, address and account details. You can find more
information on this at
www.sofort.com/payment/wizard/getCmsContent/data_protection/DE/0/de  

Mangopay: To enable payment processing, we use the "Mangopay" payment solution from
Mangopay S.A., 2 Avenue Amélie, L-1125 Luxembourg. When you make a payment by card
or other means of payment on our website, the personal data you provide in this context,
such as your first and last name, card number, card verification code and expiry date, are
processed by Mangopay for the purpose of payment processing. Mangopay also collects
your personal data, such as transaction data, when executing the payment order. Mangopay
also collects certain technical data relating to your device, electronic identifiers, IP address
and information about your interaction with our website for security and fraud prevention
purposes. For more information, please visit mangopay.com/privacy-statement   
 
8.3    Bookingkit
We have integrated the booking software of Bookingkit (bookingkit GmbH, Sonnenallee 223,
12059 Berlin, Germany) on our website. This means that the data you provide as part of your
order (see above) as well as technical personal data (e.g. your IP address) are processed via
this software solution. With the help of Bookingkit, we can offer you a simple automated
booking process and centrally manage all orders, process cancellations and issue invoices.
This corresponds to our legitimate interests according to Art. 6 para. 1 sentence 1 lit. f
GDPR.

9.    Links to social networks
On our website, we use small icons and other links that refer to our website on third-party
platforms (Facebook). These are hyperlinks, so no data is automatically transferred from you,
unless you click on the icons or the corresponding link. In this case, a new window opens in
your browser with the website of the third-party provider.

9.1    Facebook page (formerly "Facebook fan page")
We operate a so-called Facebook page on the social media platform Facebook (Meta
Platforms Ireland Limited, Serpentine Avenue, Block J, Dublin 4 Ireland (hereinafter:
"Meta")), which we link to on our website via the Facebook icon. As long as you do not click
on the link, Meta does not receive any data from you. If you click on the link, for example to
view our company presence on Facebook or to "like" our Facebook page, Meta will receive
data from you (which data Meta receives also depends on whether you are logged in to Meta
with your user profile while you click on the page or not). In addition, Meta uses so-called
cookies that are stored on your end device when you visit our Facebook page, even if you do
not have your own Facebook profile or are not logged into it during your visit to our Facebook
page. These cookies allow Meta to create user profiles based on your preferences and
interests and to show you advertising (inside and outside of Facebook) tailored to these.
Cookies remain on your device until you delete them. You can find more information about
the cookies used on Facebook at www.facebook.com/policies/cookies/.    
According to its own information, Meta uses this data for a wide variety of purposes and
transfers it worldwide, both internally to other Meta companies and to a wide variety of
external partners. Meta relies on various legal bases for this data processing, which you can
find in detail in Meta's data policy. You can find the data policy under the following link:
www.facebook.com/policy.php   
While Meta uses this data under its own responsibility for various purposes, we can only see
aggregated data, i.e. statistics (e.g. user growth, user demographics, use of individual
functionalities) on our company Facebook page, which no longer have any personal
reference. This data, called "page insights", is created on the basis of so-called "events"
logged by Meta. An "event" can be, for example, the fact that someone has marked a certain
post with a "Like". As the site operator, we do not have access to the personal data that is
processed in the context of events, but only to the summarised page insights. Events used to
create Page Insights do not store IP addresses, cookie IDs or any other identifiers
associated with individuals or their devices, other than a Facebook user ID for individuals
logged into Facebook. More information about Page Insights can be found at the following
link: www.facebook.com/legal/terms/information_about_page_insights_data  
According to the requirements of the GDPR, we are jointly responsible with Meta for the data
processing on our Facebook page (Art. 26 GDPR). Accordingly, we have concluded an
agreement with Meta, provided by Meta, in which this joint responsibility is regulated. You
can find the agreement in German under the following link:
www.facebook.com/legal/terms/page_controller_addendum   
It follows that Meta is primarily responsible for the aggregated Insight data. In addition, Meta
will comply with all obligations under the GDPR with regard to the processing of Insight Data
(including Art. 12, 13 GDPR, Art. 15-21 GDPR and Art. 32-34 GDPR). If you send us a
request regarding our Facebook page, we will inform Meta in a timely manner. Meta will
respond to the request in accordance with our agreement.
Our legitimate interests in the processing of personal data lie in the use and linking of
different communication channels, marketing via high-reach social media platforms and the
analysis and evaluation of the success of our communication and marketing efforts. The
legal basis for the processing is Art. 6 para. 1 sentence 1 lit. f GDPR. Insofar as you consent
to the data processing (in particular to the setting of cookies), the processing is also carried
out on the basis of § 25 Abw. 1 TTDSG or Art. 6 para. 1 sentence 1 lit. a GDPR.
If you use our Facebook page to contact us (e.g. by creating your own posts, responding to
one of our posts or by sending us private messages), we process the data you provide
exclusively in order to process your contact. The legal basis for the processing of your
personal data is thus Art. 6 para. 1 sentence 1 lit. f GDPR. It is our legitimate interest to
process your data transmitted to us in order to contact you. The data is stored until it is no
longer required to achieve the purpose of the conversation with you and the matter of your
contact has been fully clarified. You can inform us at any time that you would like us to delete
the data provided in the course of the conversation. In this case, all personal data of the
conversation will be deleted, if permissible, and a continuation of the conversation is not
possible.

9.2    Instagram, YouTube and Twitter
On our website we also set hyperlinks to internet presences on Instagram, YouTube and
Twitter. Please note in this respect that these pages are not operated by us, but by Gebr.
Märklin & Cie. GmbH, Stuttgarter Straße 55-57, 73033 Göppingen. We have no access to
these pages or to any statistics generated via these pages. Further information on this can
be found in the data protection information of Gebr. Märklin & Cie. GmbH, which is linked on
the respective websites.

10.    Cookie consent management
In order to obtain and document the consent of our visitors to the cookies and other
technologies we use, we use the cookie consent tool Usercentrics GmbH, Rosental 4, 80331
Munich, Germany.
In this context, the cookie consent tool sets technically necessary cookies to store your
cookie consents. These cookies store your consents that you gave when you entered the
website. If you wish to revoke these consents, simply delete the cookie in your browser.
When you re-enter/reload the website, you will be asked again for your cookie consent.
The legal basis for the use of the cookie consent tool and the setting of the technically
necessary cookies are Art. 6 para. 1 sentence 1 lit. c, f GDPR and § 25 para. 2 TTDSG. It is
in our legitimate interest to use the services of a professional service provider to manage and
document the cookie settings of our visitors.
We would like to point out that the aforementioned cookie consent tool is integrated via a so-
called Content Delivery Network (CDN), which is provided by SIMBA-DICKIE-GROUP
GmbH, Werkstraße 1, 90765 Fürth - Germany. For this purpose, your IP address is only
stored in the CDN's load balancer's main memory for the duration of the request and then
immediately deleted. This short-term processing of our visitors' IP address is technically
absolutely necessary for loading the cookie consent tool. No further storage takes place and
the IP address processed via the CDN is not processed for any other purposes.  The legal
basis for the short-term processing of your IP address for the purpose of loading the cookie
consent tool is Art. 6 para. 1 sentence 1 lit. f GDPR. In view of the low intensity of
intervention (short-term processing of the IP address for a limited processing purpose), the
integration of the cookie consent tool via the CDN corresponds to our legitimate interest in an
efficient and at the same time cost-effective implementation of this tool.

11.    Integration of YouTube videos
We integrate videos from YouTube (Google Ireland Limited, Gordon House, Barrow Street,
Dublin 4, Ireland) for the purpose of making our website more appealing. In the following, the
term "YouTube" is used for the video portal, the term "Google" for the operator of this portal.
When integrating YouTube videos, we use the extended data protection mode, in which,
according to the provider, information about you is only shared with Google if you activate
the video by clicking on the play button of the video.
If you activate the video, Google may use cookies to collect information for analysis and
advertising purposes and to improve the user experience. According to Google, the data is
processed pseudonymously. However, especially if you are logged in to your Google or
YouTube account, the data may be directly linked to these accounts.
According to its own information, Google uses this data for a wide variety of purposes and
transmits it to a wide variety of recipients, including those that are not located within the EU.
Google relies on various legal bases for this data processing. An overview is provided by
Google's privacy policy, which you can access at the following link:
policies.google.com/privacy  
In addition, it is possible that so-called Google Fonts (fonts provided by Google) will be
loaded when the video is played.
We have embedded YouTube videos on our website in such a way that they are only loaded
when you have given your consent. The legal basis for the integration of the YouTube
service on our website and the associated processing of your data is therefore your consent
in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR.
If YouTube sets cookies when you actively click on and play a YouTube video on our site, we
process your data on the basis of consent (§ 25 para. 1 TTDSG or Art. 6 para. 1 sentence 1
lit. a GDPR).
You can revoke your consent under the aforementioned legal bases at any time by changing
the data protection setting on our website.
Note on data transfers to the USA:
Google Ireland Ltd. is a subsidiary of the US Google group, so that your personal data may
also be transferred to US Google group companies (in particular Google LLC) and Google
servers located in the USA. The USA is a third country within the meaning of the GDPR for
which an adequacy decision of the EU Commission (the so-called "EU-US Data Privacy
Framework" or also "EU-US DPF") exists. Google LLC is certified as a US company under
the EU-US DPF, see www.dataprivacyframework.gov/s/participant-search/participant-
detail?id=a2zt000000001L5AAI&status=Active .

12. Timetable information on the bwegt website and timetable information widget on external websites
Note: The following information on data processing is provided by way of example and does not constitute legal advice. The yellow markings in particular must be adapted to individual circumstances. Please contact your data protection officer for support.

On our website, we offer the timetable information service of the website bwegt.de,
a service provided by MENTZ GmbH (Grillparzerstraße 18, 81675 Munich). To use the
form, the following non-personal data can be provided:

• Mobility restrictions
• Start and destination locations
• Departure/arrival time
• Journey period
• Means of transport
• Bicycle transport
• Transfer information
• Mobility restrictions

Your IP address is also processed when you use the form and to display the results. The local storage of the respective browser is used to utilise the complete functions of the electronic timetable information. In particular, the following information is stored depending on the function used:

• saveSettings: signals to the SL3+ when reloading that search options have been saved and are in local storage
• settings: search options such as desired means of transport, connection type, maximum walking time, etc.
• The last used size of the map in a detailed view (only in the mobile view)
• The last used size of the map in the standard view (only in the desktop view)
• favourites: the suggestions declared as favourites in the start and destination input
• lastODVSelected: the last selected elements in the start and destination input
• Status of the "Refresh every minute" checkbox (departure monitor)

We integrate the iFrame on our website on the basis of our legitimate interest (Art. 6 para. 1 sentence 1 lit. f GDPR) in order to offer users the advantages of direct timetable enquiry.

You can delete the additional data collected, which is stored in local storage for better usability, by deleting the stored data in your browser. Depending on the browser provider, this is possible in the settings. In addition, anonymous statistics are created for which the information provided on the start and destination stops, the desired departure or arrival time and the time of the query are used. No personal reference is possible here.
Further information on the processing of personal data by Mentz can be found
here: www.mentz.net/datenschutz/

13.    Google Tag Manager
We use the tag management system Google Tag Manager (hereinafter: "Google Tag
Manager") on our website, which is offered by Google Ireland Limited, Gordon House,
Barrow Street, Dublin 4, Ireland for users from the European Economic Area, Switzerland
and Liechtenstein and by Google LLC, 1600 Amphitheatre Parkway Mountain View, CA
94043, USA for all other users.
We have concluded a data processing agreement with Google in accordance with Art. 28
GDPR.
Google Tag Manager is a tag management platform that allows us to reload additional tools
using a so-called "tag". According to Google's own information, in order to be able to observe
the stability, performance and installation quality of the system and to obtain data for
diagnosis, certain aggregated data for tag triggering can be collected with Google Tag
Manager. According to Google's own statements at
support.google.com/tagmanager/answer/9323295, this data does not contain IP
addresses or measurement IDs that are linked to a specific person. With the exception of the
data in standard HTTP request logs, which are all deleted within 14 days of receipt, and the
diagnostic data described above, Google Tag Manager does not collect, store or share any
information about visitors to our website. This also applies to the URLs of visited pages.
If the tools loaded by Google Tag Manager collect data, Google Tag Manager does not
access this data. If a deactivation has been made at domain or cookie level, this remains in
place for all tracking tags implemented with Google Tag Manager.
The legal basis for the processing of this data is your consent pursuant to Art. 6 para. 1
sentence 1 lit. a GDPR. You can revoke your consent at any time by changing the data
protection setting on our website via the corresponding icon in the margin of the website.
You can revoke your consent under the aforementioned legal bases at any time by changing
the data protection setting on our website.
Note on data transfers to the USA:
Google Tag Manager is used on the basis of a contract that we have concluded with Google
Ireland Ltd. However, Google Ireland Ltd. is a subsidiary of the US company Google, so that
it is possible that your personal data will be transferred to US companies of Google (in
particular Google LLC) and Google servers located in the USA. The USA is a third country
within the meaning of the GDPR for which an adequacy decision of the EU Commission (the
so-called "EU-US Data Privacy Framework" or "EU-US DPF") exists. Google LLC is certified
as a US company under the EU-US DPF, see
www.dataprivacyframework.gov/s/participant-search/participant-
detail?id=a2zt000000001L5AAI&status=Active.

14.     Google Analytics 4
Our website implements the Google Analytics 4 analysis service, which is offered by Google
Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland for users from the European
Economic Area, Switzerland and Liechtenstein and by Google LLC, 1600 Amphitheatre
Parkway Mountain View, CA 94043, USA (hereinafter: "Google Analytics 4") for all other
users. Google's privacy policy can be found at the following link:
policies.google.com/privacy.  
We have concluded a data processing agreement with Google Ireland Limited in accordance
with Art. 28 GDPR.
Google Analytics 4 can record the following information, among others:

• Type of Internet browser used
• Internet browser version
• the operating system you are using,
• selected language,
• Data on the requesting terminal,
• Referrer (previously visited website),
• Your IP address (according to Google, the IP address is only used temporarily to
• determine a rough location of the requesting end device (city level) and is then
• deleted),
• (rough) location data, i.e. city (including its longitude and latitude), continent, country,
• region and subcontinent of the requesting terminal,
• Date and time of the server request,
• The session duration,
• Clicking and scrolling behaviour including playing media, internal searches, sharing content,
• Web shop interactions, such as product views and orders.

Google Analytics 4 only uses the IP address to derive location data. IP addresses are not
otherwise logged or stored, according to Google.
We are only shown statistics via Google Analytics 4, which we use to optimise our website
and offers. We have also configured Google Analytics 4 so that Google may not use the data
for its own analysis of online trends or to improve its own products and services.
Before we use Google Analytics 4 to analyse your website visit, we obtain your consent to
the processing of your personal data (Art. 6 para. 1 sentence 1 lit. a GDPR) and to the
setting of the necessary cookies (§ 25 para. 1 TTDSG) that may be associated with Google
Analytics 4.
For more information about the cookies we use, please see our cookie information.
The legal basis for the processing of your personal data and the setting of cookies within
the scope of Google Analytics 4 is therefore your consent pursuant to Section 25 (1) TTDSG
and Article 6 para. 1 sentence 1 lit. a GDPR.
You can revoke your consent under the aforementioned legal bases at any time by changing
the data protection setting on our website.
Note on data transfers to the USA:
Google Analytics 4 is used on the basis of a contract that we have concluded with Google
Ireland Ltd. However, Google Ireland Ltd. is a subsidiary of the US company Google, so that
it is possible that your personal data will be transferred to US companies of Google (in
particular Google LLC) and Google servers located in the USA. The USA is a third country
within the meaning of the GDPR for which an adequacy decision of the EU Commission (the
so-called "EU-US Data Privacy Framework" or "EU-US DPF") exists. Google LLC is certified
as a US company under the EU-US DPF, see
www.dataprivacyframework.gov/s/participant-search/participant-
detail?id=a2zt000000001L5AAI&status=Active.
You can also prevent the collection of your personal data by Google Analytics 4 and the
processing of this data by Google by downloading and installing the browser add-on
available under the following link (https://tools.google.com/dlpage/gaoptout?hl=de) to
deactivate Google Analytics.
You can also prevent the processing of your data within the scope of Google Analytics 4 by
clicking on the following link and bringing about an "opt-out": [Bitte den Link setzen - wie
dieser Link erzeugt werden kann, wird hier erklärt:
developers.google.com/analytics/devguides/collection/gajs/. In doing
so, an "opt-out cookie" will be set, which will prevent the collection of your user data on this
website in the future, unless the opt-out cookie is deleted.
Lastly, you can also prevent Google cookies from being stored directly yourself by making
the appropriate settings in your browser settings.

15.    Google Maps
The map service Google Maps (Google LLC, 1600 Amphitheatre Parkway, Mountain View,
CA 94043, USA or in Europe: Google Ireland Limited, Gordon House, Barrow Street Dublin
4, Ireland) is integrated on our website (hereinafter: "Google Maps" or "Google"). This
allows us to show you interactive maps directly on the website and enables you to use the
map function conveniently.
In addition to the IP address, Google Maps may receive the date and time our site is
accessed, the internet address or URL of our site; furthermore, Google may process device
IDs, cookie information and location information for various purposes. If you are logged into a
Google service, Google may associate this data with your account (we have no control over
this).
Information on how Google uses location information can be found at:
policies.google.com/technologies/location-data. General information on
Google's data protection can be found at: policies.google.com/privacy.
Incognito mode: If you access our site with your iPad, iPhone or Android device, have
installed the Google Maps app on your device and have selected incognito mode there,
some Google Maps services will be deactivated. This may also affect the use of Google
Maps on our site.
You can find more information on incognito mode at:
support.google.com/maps/answer/9430563
=0 (iPhone/iPad) and
support.google.com/maps/answer/9430563
(Android).
The legal basis for the integration of Google Maps is Art. 6 para. 1 sentence 1 lit. f GDPR,
as it is in our legitimate interest to provide our customers with information on how to reach us
and to enable them to plan their route in a simple manner. There is an agreement on joint
responsibility between us and Google Maps pursuant to Art. 26 GDPR. You can access this
at: privacy.google.com/intl/de/businesses/mapscontrollerterms/.
Note on data transfers to the USA:
Google Maps is used on the basis of a contract that we have concluded with Google Ireland
Ltd. However, Google Ireland Ltd. is a subsidiary of the US company Google, so that it is
possible that your personal data will be transferred to US companies of Google (in particular
Google LLC) and Google servers located in the USA. The USA is a third country within the
meaning of the GDPR for which an adequacy decision of the EU Commission (the so-called
"EU-US Data Privacy Framework" or "EU-US DPF") exists. Google LLC is certified as a US
company under the EU-US DPF, see www.dataprivacyframework.gov/s/participant-
search/participant-detail?id=a2zt000000001L5AAI&status=Active.

16.    Use of service providers
We would like to point out that we may use service providers with whom we have concluded
processing contracts when processing your personal data. If processors in a third country
(not within the EU) carry out the data processing, we ensure that the level of protection of
your data guaranteed by the GDPR is not undermined (Art. 44 et seq. GDPR).  The legal
basis for the use of service providers is Art. 6 para. 1 sentence 1 lit. f GDPR. The
commissioning of service providers (specialists or other service providers in areas that we
cannot serve ourselves) is in our legitimate interest. If you would like to receive a copy of the
suitable or appropriate guarantees, please let us know (see point 1 above).

17.    Your rights
If we process your data, you are a "data subject" within the meaning of the GDPR. You have
the following rights: right of access, right of rectification, right to restrict processing, right of
erasure, right of information and right to data portability. In addition, you have a right to
object, a right of withdrawal and the right to lodge a complaint with a supervisory authority.
Below you will find some details on the individual rights:

17.1    Right of access
You have the right to request confirmation from us as to whether we are processing your
personal data. If we process your personal data, you have the right to obtain information in
particular about the processing purposes, categories of personal data, recipients or
categories of recipients, storage period, if applicable.    

17.2    Right of rectification
You have the right to rectify and/or complete the data we have stored about you if this data is
incorrect or incomplete. We will carry out the correction or completion without delay.

17.3    Right to restrict processing
Under certain circumstances, you have the right to request us to restrict the processing of
your personal data. An example of this is if you dispute the accuracy of your personal data
and we need to verify the accuracy for a certain period of time. For the duration of the
verification, your data will only be processed in a restricted manner. Another example of
restriction is if we no longer need your data but you need it for litigation.

17.4    Right of erasure
In certain situations, you have the right to demand that we erase your personal data
immediately. This is the case, for example, if we no longer need your personal data for the
purposes for which we collected the data or if we have processed your data unlawfully.
Another example would be if we process your data on the basis of your consent, you
withdraw your consent and we do not process the data on any other legal basis. However,
your right to erasure does not always exist. For example, we may process your personal data
to comply with a legal obligation or because we need it for litigation.  

17.5    Right of information
If you have exercised your right to rectify, erase or restrict the processing of your data, we
are obliged to notify all recipients to whom we have disclosed your personal data of the
rectification, erasure or restriction of the processing of your data, unless this proves
impossible or involves a disproportionate effort.

17.6    Right to data portability
You have the right, under certain conditions, to receive the personal data you have provided
to us in a structured, commonly used and machine-readable format and the right to have this
data transferred to another controller. This is the case where we process the data either on
the basis of your consent or on the basis of a contract with you and that we process the data
using automated procedures. You have the right to request that we transfer your personal
data directly to another controller, insofar as this is technically feasible and does not affect
the freedoms and rights of other persons.

17.7    Right to object
You have the right to object at any time, on grounds relating to your particular situation, to
the processing of your personal data based on Article 6 (1) sentence 1 lit. e or lit. f GDPR.
This also applies to profiling based on these provisions. We will no longer process your
personal data after an objection, unless we can demonstrate compelling legitimate grounds
for the processing which override your interests, rights and freedoms, or the processing
serves to assert, exercise or defend legal claims. If we process your personal data for the
purpose of direct marketing, you have the right to object at any time to the processing of your
personal data for the purpose of such marketing. This also applies to profiling insofar as it is
related to direct advertising. If you object to the processing of your personal data for direct
marketing purposes, we will no longer process it for these purposes.

17.8    Right of withdrawal
Pursuant to Art. 7 para. 3 GDPR, you have the right to withdraw your consent at any time.  
The withdrawal of consent does not retroactively invalidate the lawfulness of the processing.

17.9    Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a supervisory authority, without prejudice to any
other administrative or judicial remedy. In particular, you may exercise your right to lodge a
complaint in the Member State of your place of residence, place of work or place of the
alleged infringement if you consider that the processing of your personal data infringes the
GDPR.
You can find an overview of the respective data protection commissioners of the German
federal states as well as their contact details under the following link:
www.bfdi.bund.de/DE/Service/Anschriften/Laender/Laender-node.html

Last updated: October 2023

 
Cookie information

We use cookies on our website. Cookies are text files that are sent to your browser by our
web server when you visit our website and are stored on your computer for later retrieval.
Cookies are then sent to the server of our website with every server request or page call. A
cookie can therefore be used to identify your internet browser when you return to the
website. Some of the functions that we have integrated into our website also use web
storage objects. These work in a similar way to cookies, but are temporarily stored in your
browser and are generally not transmitted to the server.
There are session cookies, which delete themselves when you close the browser, and
there are persistent cookies, which are stored on the hard disk until their preset expiry date
is reached or until they are actively removed by you. Web storage objects are divided into
local storage objects, which never expire, and session storage objects, which are deleted
when the browser is closed.
With cookies, a distinction is made between first party cookies (only visible from the
domain you are currently visiting) and third party cookies (visible across domains and
regularly set by third parties).
Cookies and web storage objects are divided into the following categories:

Technically necessary: these are mandatory in order to navigate the website, use basic
functions and ensure the security of the website; they do not collect information about you for
marketing purposes nor do they store which web pages you have visited. The legal basis for
setting technically necessary cookies and web storage objects is Section 25 para. 2 TTDSG.
Optional: These are used, for example, for analysis and marketing purposes and to display
external content such as videos. Analysis cookies and web storage objects collect
information about how you use a website, which pages you visit and, for example, whether
errors occur during website use. Marketing cookies and web storage objects are used to
show you tailored advertising on the website or offers from third parties and to measure the
effectiveness of these offers. These are technologies that are not technically necessary. The
legal basis for the setting of these cookies and web storage objects is therefore your consent
in accordance with § 25 para. 1 TTDSG.
Please note the following: You can ensure yourself that no cookies and similar technologies
are stored on your computer at all, or that the storage of only certain cookies is permitted.
You can select this in your internet browser settings. You can also view and delete the stored
cookies there. If you block all cookies, it is possible that not all functions of our website will
be available to you.

Withdrawal and removal options:
As communicated in the introduction to this section, you can enable or restrict the
transmission of cookies and similar technologies by changing the settings in your internet
browser. You can delete cookies and web storage objects that have already been stored by
your internet browser at any time. If cookies and web storage objects are restricted or
deactivated for our website, it may not be possible to use all functionalities.

Information on the cookies set:

Last updated: October 2023