Privacy policy

The provider (or its web hosting provider) collects data on every access to the website (known as server log files) for statistical analysis in the interests of operating, securing and optimising the website. The access data includes:

• Name of the web page accessed
• Date and time of the server request
• Browser type and browser version
• Operating system used
• IP address and the requesting provider.
• Referrer URL (the internet address of the page visited previously)
• Name of the file retrieved and the volume of data transferred
• Message indicating whether the retrieval was successful

The provider reserves the right to review the log data retrospectively if specific indications give rise to a justified suspicion of unlawful use.

This data is not merged with other data sources.

The basis for the data processing is Art. 6(1)(b) GDPR, which permits the processing of data for the performance of a contract or for pre-contractual measures.

Complete protection of your data against access by third parties cannot be guaranteed when data is transmitted over the internet (e.g. email communication), owing to possible security vulnerabilities.

When you use the website, confidential personal data is collected that may make it possible to identify you personally. This includes, for example, your name, telephone number and address, as well as all data that you send us when registering, processing a payment, performing a contract and creating your customer account.

To protect the security of your personal data during transmission, we use SSL encryption (Secure Socket Layer).

Cookies are small text files that make it possible to store specific, device-related information on the user's access device. On the one hand, they make websites easier to use and so benefit users (e.g. by storing login data). On the other hand, they are used to record statistical data on the use of the website and to analyse it in order to improve the website. A basic distinction is made between two types of cookies: session cookies, which are deleted as soon as you close your browser, and cookies that remain stored on your device until you delete them. Users can influence the use of cookies. Most browsers have an option that restricts or completely prevents the storage of cookies. However, please note that our website and services will only function to a limited extent if you block the use of cookies.

Cookies that are required to carry out the electronic communication process or to provide certain functions you have requested (e.g. a shopping basket function) are stored on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in storing cookies in order to provide its services in a technically error-free and optimised manner.

You can manage many online advertising cookies from companies via the US site aboutads.info/choices or the EU site youronlinechoices.com/uk/your-ad-choices.

We use Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager is a tool that allows us to integrate tracking or statistics tools and other technologies on our website. Google Tag Manager itself does not create user profiles, does not store cookies and does not carry out any analyses of its own. It serves solely to manage and deliver the tools integrated through it. However, Google Tag Manager does record your IP address, which may also be transferred to Google's parent company in the United States.

Google Tag Manager is used on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in the quick and straightforward integration and management of various tools on its website. Where consent has been requested, processing takes place solely on the basis of Art. 6(1)(a) GDPR and Section 25(1) TTDSG, insofar as the consent covers the storage of cookies or access to information on the user's device (e.g. device fingerprinting) within the meaning of the TTDSG. Consent can be withdrawn at any time.

Our website uses the booking technology vioma BOOKING, provided by vioma GmbH, Industriestraße 27, 77656 Offenburg ("vioma"). We have concluded a data processing agreement with vioma.

When you make an online booking or a booking enquiry via our website, we need your email address, your travel dates, the product booked, your title and your first name and surname in order to process it. In individual cases your telephone number is also requested so that we can contact you quickly, particularly with regard to unforeseeable circumstances that affect your booking.

To calculate the applicable price of your trip, we need the dates of your stay, the product selected, the number of people travelling and an indication of which of them are adults and which are children. If you are travelling with children, their ages are also requested so that the price can be calculated correctly. We also ask for your preferred means of payment for the trip. If an advance payment applies to your travel parameters, you will be redirected to a payment service provider for secure processing of the advance payment once you have selected your preferred means of payment. Any further details in the form are provided on a voluntary basis.

Your data for the online booking and the online booking enquiry is processed on the basis of Art. 6(1)(b) GDPR and serves the performance of a contract or the implementation of pre-contractual measures.

The data you send us remains with us until the purpose for storing it no longer applies (e.g. once your request has been dealt with). Mandatory statutory provisions, in particular statutory retention periods, remain unaffected.

Google Analytics cookies are stored on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in analysing user behaviour in order to optimise both its website and its advertising in a targeted way.

This website uses Google Analytics, a web analytics service provided by Google Inc. ("Google"). Google Analytics uses what are known as "cookies", text files that are stored on users' computers and that enable an analysis of their use of the website. The information generated by the cookie about users' use of this website is generally transferred to a Google server in the USA and stored there.

Where IP anonymisation is activated on this website, however, Google will first truncate users' IP addresses within Member States of the European Union or in other contracting states to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transferred to a Google server in the USA and truncated there. IP anonymisation is active on this website. On behalf of the operator of this website, Google will use this information to evaluate users' use of the website, to compile reports on website activity and to provide the website operator with further services relating to website and internet use.

The IP address transmitted by your browser as part of Google Analytics is not merged with other Google data. Users can prevent the storage of cookies by selecting the appropriate setting in their browser software; however, we would point out that in this case users may not be able to use all the functions of this website to their full extent. Users can also prevent Google from collecting the data generated by the cookie and relating to their use of the website (including their IP address) and from processing this data, by downloading and installing the browser plug-in available at the following link: http://tools.google.com/dlpage/gaoptout?hl=de.

As an alternative to the browser add-on, or within browsers on mobile devices, please click this link to prevent Google Analytics from collecting data within this website in future. An opt-out cookie is then placed on your device. If you delete your cookies, you will need to click this link again.

To display fonts consistently, this site uses what are known as Google Fonts, which are provided by Google. The Google Fonts are installed locally. No connection to Google servers is established in the process.

Further information on Google Fonts can be found at https://developers.google.com/fonts/faq and in Google's privacy policy: https://policies.google.com/privacy?hl=de.

On this website we use active JavaScript content from external providers. When you access our website, these external providers may receive personal information about your visit to our website. Data may be processed outside the EU in the process. You can prevent this by installing a JavaScript blocker such as the browser plug-in "NoScript" (www.noscript.net) or by deactivating JavaScript in your browser. However, please note that our website and services will only function to a limited extent if you block the use of JavaScript.

Third-party content, such as videos from YouTube, maps from Google Maps, RSS feeds or graphics from other websites, may be integrated into this website. This always requires the providers of this content (hereinafter referred to as "third-party providers") to be aware of users' IP addresses. Without the IP address, they could not send the content to the browser of the user concerned. The IP address is therefore required to display this content. We endeavour to use only content whose providers use the IP address solely to deliver the content. However, it is beyond our control if third-party providers store the IP address, e.g. for statistical purposes. Insofar as we are aware of this, we inform users about it.

(1) These pages use social plug-ins from the social network Facebook (Facebook, 1601 South California Avenue, Palo Alto, CA 94304, USA). This plug-in enables you to bookmark these pages and so share them with other members of the social network. You can recognise this plug-in by the Facebook logo or the typical "Like" button. An overview of the Facebook plug-ins can be found at http://developers.facebook.com/docs/plugins/.

(2) We use what is known as the two-click solution. This means that when you visit our site, as a rule no personal data is initially passed on to Facebook. We give you the option of communicating directly with Facebook via the button. Only if you click on the marked field and thereby activate it does Facebook receive the information that you have accessed the relevant page of our website.

The data is passed on regardless of whether you have a Facebook account and are logged in there.

a) If you click the Facebook "Like" button while you are logged in to your Facebook account, the content of these pages can also be linked to your Facebook profile. In this case, Facebook can also assign your visit to these pages to your user account. If you press the activated button and, for example, link the page, Facebook also stores this information in your user account and shares it publicly with your contacts. We recommend that you log out regularly after using a social network, and in particular before activating the button, as this allows you to avoid an association with your profile.

b) If you are not a member of Facebook or have logged out of Facebook before visiting this page, it is still possible that Facebook will find out and store your IP address. If you do not want Facebook to be able to assign your visit to our pages to your Facebook user account, you must log out of Facebook before visiting our website or must not activate the plug-in.

As a rule, the following data is transmitted to Facebook in the process:

• Browser-related data such as IP address, browser type, operating system, time and date of the request, web page visited.
• User ID (if logged in to a Facebook account)

According to Facebook, IP addresses in Germany are anonymised immediately after collection. Activating the plug-in therefore means that personal data about you is transmitted to Facebook and stored in the USA. As Facebook collects data primarily via cookies, we recommend that you delete all cookies via your browser's security settings before clicking on the greyed-out box.

(3) We have no influence on the data collected or on the data processing operations, nor are we aware of the full extent of the data collection, the purposes of the processing or the storage periods. We also have no information on the deletion of the collected data by Facebook.

(4) Facebook stores the data collected about you as usage profiles and uses these for the purposes of advertising, market research and/or the needs-based design of its website. Such an evaluation is carried out in particular (including for users who are not logged in) to display needs-based advertising and to inform other users of the social network about your activities on our website. Through the plug-ins we offer you the opportunity to interact with the social networks and other users, so that we can improve our website and make it more interesting for you as a user.

This website contains links to external sites. We are responsible for our own content. We have no influence over the content of external links and are therefore not responsible for it; in particular, we do not adopt that content as our own. If you are directed to an external site, the privacy policy provided there applies. If you notice any unlawful activities or content on this site, you are welcome to let us know. In that case we will review the content and respond accordingly.

When you contact the provider (for example via the contact form or by email), your details are stored in order to process the enquiry and in case follow-up questions arise. This data is not passed on without your consent.

The data you send us when contacting us is processed on the basis of your consent (Art. 6(1)(a) GDPR). You may withdraw your consent at any time. The lawfulness of the data processing carried out up to the withdrawal remains unaffected by the withdrawal.

The data you provide when contacting us remains with us until you ask us to erase it, withdraw your consent to its storage or the purpose for storing the data no longer applies. Statutory retention periods remain unaffected.

We use the newsletter to keep you informed about us and our offers. If you would like to receive the newsletter, we need a valid email address from you as well as information that allows us to verify that you are the owner of the email address provided or that its owner agrees to receive the newsletter. No further data is collected. This data is used only for sending the newsletter and is not passed on to third parties. When you subscribe to the newsletter, we store your IP address and the date of subscription. This storage serves solely as proof in the event that a third party misuses an email address and subscribes to the newsletter without the knowledge of the person entitled to it. You may at any time withdraw your consent to the storage of the data and the email address and to their use for sending the newsletter. You can do so via a link in the newsletters themselves, in your profile area or by sending a message to the contact details given above.

We have appointed an external data protection officer for our company.

Mr Dieter Grohmann
AKWISO Datenschutz & Audit
Beethovenstraße 23
87435 Kempten
Germany
Phone: 0831 / 512 470 30
Email: dg@akwiso.de
Website: www.akwiso.de

If personal data concerning you is processed, you are a data subject within the meaning of the GDPR and you have the following rights in relation to the controller:

• Right of access
• Right to rectification
• Right to restriction of processing
• Right to erasure
• Right to notification
• Right to data portability
• Right to object to processing
• Right to withdraw consent under data protection law
• Right not to be subject to an automated decision
• Right to lodge a complaint with a supervisory authority

(1) You may request confirmation from the controller as to whether personal data concerning you is being processed by us. Where such processing takes place, you may at any time request from the controller information, free of charge, about the personal data stored about you and about the following:
a) the purposes for which the personal data is processed;
b) the categories of personal data that are processed;
c) the recipients or categories of recipients to whom the personal data concerning you has been or will be disclosed;
d) the planned duration of storage of the personal data concerning you or, if specific information on this is not possible, the criteria for determining the storage period;
e) the existence of a right to rectification or erasure of the personal data concerning you, a right to restriction of processing by the controller or a right to object to this processing;
f) the existence of a right to lodge a complaint with a supervisory authority;
g) all available information about the source of the data where the personal data is not collected from the data subject;
h) the existence of automated decision-making, including profiling, pursuant to Art. 22(1) and (4) GDPR and, at least in these cases, meaningful information about the logic involved and the significance and envisaged consequences of such processing for the data subject.

(2) You have the right to request information on any transfer of the personal data concerning you to a third country or to an international organisation. In this context, you may request to be informed of the appropriate safeguards pursuant to Art. 46 GDPR in connection with the transfer.

You have the right to obtain from the controller without undue delay the rectification and/or completion of the personal data concerning you, insofar as the personal data processed is inaccurate or incomplete.

(1) You may request the controller to restrict the processing of the personal data concerning you without undue delay under the following conditions:
a) if you contest the accuracy of the personal data concerning you, for a period enabling the controller to verify the accuracy of the personal data;
b) the processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead;

(2) Where the processing of the personal data concerning you has been restricted, this data may, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. If the processing has been restricted in accordance with the above conditions, you will be informed by the controller before the restriction is lifted.

(1) You may request the controller to erase the personal data concerning you without undue delay, provided one of the following grounds applies:
a) The personal data concerning you is no longer necessary for the purposes for which it was collected or otherwise processed.
b) You withdraw the consent on which the processing was based pursuant to Art. 6(1)(a) or Art. 9(2)(a) GDPR, and there is no other legal basis for the processing.
c) You object to the processing pursuant to Art. 21(1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21(2) GDPR.
d) The personal data concerning you has been processed unlawfully.
e) The erasure of the personal data concerning you is necessary for compliance with a legal obligation under Union law or the law of the Member States to which the controller is subject.
f) The personal data concerning you was collected in relation to the offer of information society services pursuant to Art. 8(1) GDPR.

(2) Where the controller has made the personal data concerning you public and is obliged pursuant to Art. 17(1) GDPR to erase it, the controller shall, taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to inform controllers which are processing the personal data that you as the data subject have requested the erasure by them of all links to this personal data and of any copies or replications of this personal data.

(3) The right to erasure does not apply insofar as the processing is necessary
a) for exercising the right of freedom of expression and information;
b) for compliance with a legal obligation which requires processing under Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
c) for reasons of public interest in the area of public health pursuant to Art. 9(2)(h) and (i) and Art. 9(3) GDPR;
d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes pursuant to Art. 89(1) GDPR, insofar as the right referred to in section a) is likely to render impossible or seriously impair the achievement of the objectives of that processing, or
e) for the establishment, exercise or defence of legal claims.

If you have asserted your right to rectification, erasure or restriction of processing against the controller, the controller is obliged to notify all recipients to whom the personal data concerning you has been disclosed of this rectification, erasure or restriction of processing, unless this proves impossible or involves disproportionate effort. You have the right to be informed by the controller about these recipients.

(1) You have the right to receive the personal data concerning you that you have provided to the controller in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller to which the personal data was provided, where
a) the processing is based on consent pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR or on a contract pursuant to Art. 6(1)(b) GDPR and
b) the processing is carried out by automated means.

(2) In exercising this right, you also have the right to have the personal data concerning you transmitted directly from one controller to another, where this is technically feasible. The freedoms and rights of other persons must not be adversely affected by this.

(3) The right to data portability does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

(4) To assert the right to data portability, the data subject may contact the controller at any time.

(1) You have the right to object at any time, on grounds relating to your particular situation, to the processing of the personal data concerning you that is carried out on the basis of Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on those provisions.

(2) The controller will no longer process the personal data concerning you unless it can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

(3) Where the personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of the personal data concerning you for the purposes of such marketing; this also applies to profiling insofar as it is related to such direct marketing. If you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for these purposes.

(4) In connection with the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.

(5) To exercise the right to object, the data subject may contact the controller directly.

You have the right to withdraw your declaration of consent under data protection law at any time. The withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of the consent before its withdrawal. You may contact the controller for this purpose.

(1) You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision
a) is necessary for entering into, or the performance of, a contract between you and the controller,
b) is authorised by Union or Member State law to which the controller is subject and that law lays down suitable measures to safeguard your rights and freedoms and your legitimate interests, or
c) is made with your explicit consent.

(2) However, these decisions must not be based on special categories of personal data under Art. 9(1) GDPR, unless Art. 9(2)(a) or (g) GDPR applies and

suitable measures to safeguard your rights and freedoms and your legitimate interests have been taken.

(3) In the cases referred to in (1) and (3), the controller shall take suitable measures to safeguard your rights and freedoms and your legitimate interests, including at least the right to obtain human intervention on the part of the controller, to express your own point of view and to contest the decision.

(4) If the data subject wishes to assert rights relating to automated decisions, they may contact the controller at any time for this purpose.

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your place of residence, your place of work or the place of the alleged infringement, if you consider that the processing of the personal data concerning you infringes the GDPR. The supervisory authority with which the complaint has been lodged will inform the complainant of the progress and the outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.

We reserve the right to amend our data protection practices and this policy in order to adapt them, where necessary, to changes in relevant laws or regulations, or to better meet your needs. Any changes to our data protection practices will be announced here accordingly. Please note the current version date of the privacy policy.

Engel Obertal
Wellness & Genuss Resort
Rechtmurgstraße 28
72270 Baiersbronn

Phone: +49 (7449) 850
Fax: +49 (7449) 85200
himmlisch@engel-obertal.de