Privacy notice

 

We take data protection seriously

It is important for us to protect your privacy when processing personal data. When you visit our website, by default our web servers store the IP of your Internet service provider, the website you visit us from, the web pages you visit on our site and the date and duration of your visit. This information is essential for the technical transmission of the web pages and secure server operation. There is no personalised analysis of this information.

If you send us data via the contact form, these data will be stored on our servers as part of the data backup process. Your data will only be used by us to process your enquiry. Your data will be treated as strictly confidential. They will not be passed on to third parties.

Data controller:

Edelwies Freizeit GmbH

Dießenbach 3

94362 Neukirchen

Tel.: 0 99 61 / 61 05

info@edelwies.com

Personal data

Personal data refers to information about you as a person. This includes your name, your address and your email address. You are not required to disclose any personal data in order to use our website. In some cases, we need your name and address as well as other information in order to provide you with the service you want.

The same applies if we send you information in response to your request or if we answer your enquiries. In these cases, we will always point this out to you. We also only store data that you have sent to us automatically or voluntarily.

If you use one of our services, we generally only collect the data necessary to provide you with our service. We may ask you for additional information, but this is voluntary. Whenever we process personal data, we do so in order to be able to offer you our service or to pursue our commercial objectives.

Contacting us

When you contact us (e.g. using a contact form, by email, telephone or social media), the details of the people making the enquiry are processed as far as it is necessary to respond to the contact enquiries and any requested measures.

Contact enquiries are answered in the context of contractual or pre-contractual relationships in order to meet our contractual obligations or to respond to (pre)contractual enquiries and otherwise on the basis of legitimate interests in responding to the enquiries.

 

Types of processed data: Inventory data (e.g. names, addresses), contact data (e.g. email addresses, telephone numbers), content data (e.g. entries in online forms).

Data subjects: Communication partners.

Purposes of the processing: Contact enquiries and communication.

Legal basis: Contract compliance and precontractural enquiries (Article 6(1)(b) GDPR), Legitimate interests (Article 6(1)(f) GDPR).

 Automatically stored data

 Server log files

The provider of the website automatically collects and stores information in server log files which your browser automatically sends to us. These are:

 

Data and time of the request

Name of the file requested

Page from which the file is requested

Access status (file transferred, file not found, etc.)

Web browser and operating system used

Complete IP address of the requesting computer

Volume of data transferred

 

This data is not merged with other data sources. Processing is carried out in accordance with Article 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website.

For reasons of technical security, in particular to defend against attempted attacks on our web server, this data is stored by us for a short period of time. It is not possible for us to identify individual persons from this data. After seven days at the latest, the data is anonymised by shortening the IP address at domain level so that it is no longer possible to establish a link to the individual user. The data is also processed in anonymised form for statistical purposes; it is not compared with other databases or passed on to third parties, even as extracts.

Cookies

When you visit our website, we may store information on your computer in the form of cookies. Many cookies contain a cookie ID. A cookie ID is a unique identifier of the cookie. It consists of a character string that allows websites and servers to be assigned to the specific Internet browser in which the cookie was stored. This enables the websites and servers visited to distinguish the individual browser of the data subject from other Internet browsers that contain other cookies. A specific Internet browser can be recognised and identified via the unique cookie ID.

By using session cookies, the data controller can provide the users of this website with a user-friendly services, which would not be possible without using cookies. Without consent, we only use technically necessary cookies on the legal basis of legitimate interest in accordance with Article 6(1)(f) GDPR.

We only use personal cookies to improve our website or for marketing/advertising purposes with your consent. The first time you visit our website you can choose to consent to tracking or analysis via the cookie banner that appears. Your data may be passed on to partners or third-party providers. These cookies are only stored if you explicitly consent to this; the legal basis is then your consent in accordance with Article 6(1)(a) GDPR.

Registration on the website

 The data subject has the option of registering on the data controller’s website by providing personal data. The following personal data is collected: Name, address, telephone number, email address, date of birth, bank details.

By registering on the controller’s website, the IP address assigned by the data subject’s internet service provider (ISP), the date and time of registration are also stored. This data is stored against the background that this is the only way to prevent misuse of our services and, if necessary, to enable criminal offences to be investigated. In this respect, the storage of this data is necessary to safeguard the controller. This data is not passed on to third parties unless there is a legal obligation to do so or if passing it on serves the purpose of criminal prosecution.

When the data subject registers and voluntarily provides personal data, this allows the controller to offer the data subject content or services which, due to their nature, can only be offered to registered users. People who are registered can change the personal data provided during registration at any time or to have it completely deleted from the controller’s database.

We undertake to treat the personal access data confidentially and not to make it accessible to unauthorised third parties. We cannot accept any liability for misused passwords unless we are responsible for the misuse.
The “stay logged in” function is provided to make your visit to our website as pleasant as possible. This function allows you to use our services without having to log in again each time. For security reasons, however, you will be asked to enter your password again if, for example, your personal details need to be changed or you wish to place an order. We recommend that you do not use this function if the computer is used by other users. Please note that the “stay logged in” function is not available if you use a setting that automatically deletes stored cookies after each session.

Consent using Cookie Script

Our website uses the consent technology of Cookie Script to obtain your consent to the storage of certain cookies on your device or to the use of certain technologies and to document this in compliance with data protection regulations. The provider of this technology is Objectis Ltd, Žalgirio st. 88, LT-09303 Vilnius, Lithuania (hereinafter referred to as “Cookie Script”).

Cookie Script is installed locally on our servers, so no connection is established to the servers of the provider of Cookie Script. Cookie Script stores a cookie in your browser in order to be able to assign the consents given or their revocation to you. The data collected in this way is stored until you ask us to delete it, to delete the Cookie Script cookie yourself or if the purpose for storing the data no longer applies. This does not affect any mandatory statutory retention obligations.

Cookie Script is used to obtain the legally required consent for the use of cookies. The legal basis for this is Article 6(1)(c) GDPR.

Google Maps

This site uses the map service Google Maps. The provider is Google Ireland Limited (‘Google’), Gordon House, Barrow Street, Dublin 4, Ireland.

To use the functions of Google Maps, it is necessary to save your IP address. This

information is usually transmitted to a Google server in the USA and stored there.
The provider of this site has no influence over this data transfer. If Google Maps is activated, Google may use Google Web Fonts for the purpose of standardising the display of fonts. When you access Google Maps, your browser loads the required web fonts into your browser cache in order to display texts and fonts correctly.

We use Google Maps in the interest of offering an appealing presentation of our online

services and to make it easy to find the places we identify on the website. This represents a legitimate interest within the meaning of Article 6(1)(f) GDPR. If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Article 6(1)(a) GDPR and 25(1) TTDSG (Telecommunications Telemedia Data Protection Act [Telekommunikations-Telemedien-Datenschutzgesetz]), insofar as the consent includes the storage of cookies or access to information in the user’s terminal device (e.g. device fingerprinting) within the meaning of the TTDSG. Consent can be revoked at any time.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission.

Details can be found here:

https://privacy.google.com/businesses/gdprcontrollerterms/ und

https://privacy.google.com/businesses/gdprcontrollerterms/sccs/.

You can find more information on the handling of user data in Google’s privacy policy: https://policies.google.com/privacy?hl=de.

Google Tag Manager

 We use the Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager is a tool that enables us to integrate tracking or statistical tools and other

technologies on our website. The Google Tag Manager itself does not create

user profiles, does not store cookies and does not carry out any independent analyses. It is only used to manage and display the tools integrated through it. However, Google Tag Manager records your IP address, which may also be transmitted to Google’s parent company in the United States.

The Google Tag Manager is used on the basis of Article 6(1)(f) GDPR . The

website operator has a legitimate interest in the quick and easy integration and management of various tools on its website. If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Article 6(1)(a) GDPR and 25(1) TTDSG, insofar as the consent includes the storage of cookies or access to information in the user’s terminal device (e.g. device fingerprinting) within the meaning of the TTDSG. Consent can be revoked at any time.

Google Analytics

This website uses functions provided by the web analytics service Google Analytics. The provider is Google Ireland Limited (‘Google’), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics enables the website operator to analyse the behaviour of website visitors. In doing so, the website operator receives various usage data, such as page views, length of visit, operating systems used and origin of the user. This data is assigned to the user’s end device. It is not assigned to a device ID.

We can also use Google Analytics to record your mouse and scroll movements and clicks, among other things

. Google Analytics also uses various modelling approaches to supplement the recorded data records and uses machine learning technologies for data analysis.

Google Analytics uses technologies that enable the user to be recognised for the purpose of analysing user behaviour (e.g. cookies or device fingerprinting). The information collected by Google about the use of this website is generally transmitted to a Google server in the USA and stored there.

The use of this service is based on your consent in accordance with Article 6(1)(a) GDPR and 25(1) TTDSG. Consent can be revoked at any time. Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here:

https://privacy.google.com/businesses/controllerterms/mccs/.

We use Google Signals. When you visit our website, Google Analytics collects, among other things, your

location, search history and YouTube history as well as demographic data (visitor data). This data can be used for personalised advertising with the help of Google Signal. If you have a Google account, the visitor data from Google Signal is linked to your Google account and used for personalised advertising messages. The data is also used to compile anonymised statistics on the user behaviour of our users.

We have concluded a data processing agreement (DPA) in accordance with Article 28 GDPR with the above-mentioned provider. This is a contract prescribed by data protection law, which guarantees that the provider will only process the personal data of our website visitors in accordance with our instructions and in compliance with GDPR.

This website uses the “ecommerce measurement” function of Google Analytics. Ecommerce measurement allows the website operator to analyse the purchasing behaviour of website visitors to improve its online marketing campaigns. Information such as orders placed, average order values, shipping costs and the time from viewing to purchasing a product is recorded. This data can be summarised by Google under a transaction ID that is assigned to the respective user or their device.

Information about specific data processing on the website

Where applicable, in addition to the general information provided above, you will find details of individual data processing on our website below.

Applications and application procedures

Purpose of the processing	Applicant data is collected, processed and used for the purpose of selecting potential employees.
Where applicable, recipients (in the case of passing on data)	Data will not be passed on to third parties and/or a third country.
Where applicable, intention to transmit to a third country or international organisation (including information on adequacy decision of the Commission or suitable guarantees)	No transmission takes place and none is planned.
If known: Duration of data storage	The personal data of applicants that we do not hire will be stored for potential legal claims (e.g. under the General Equal Treatment Act (AGG [Allgemeines Gleichbehandlungsgesetz])) for the required period (maximum 6 months) and then immediately destroyed or deleted.
Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity	To ensure the application process is straightforward, it is necessary for you to provide us with the requested information truthfully.
Consequences of non-compliance (failure to provide the required data)	Failure to comply (i.e. failure to provide the required data) may result in you not being able to conclude an employment contract with us.
Where applicable, existence of automated decision-making	In this context, we do not use automated decision-making.
Where applicable, origin of the data (if not collected directly from the data subject)	As a rule, the data originates from the data subject themselves; however, it may also originate from third parties.
Where applicable, categories of personal data (if not collected directly from the data subject).	Master data, contact data, application data
Where applicable, change of purpose	If we take you on as an employee after the application process has been completed, the purpose for processing the relevant data will change: in this case, the data will be used in future to implement and maintain the employment relationship.

 

Contact form

Purpose of the processing	Processing and, if necessary, answering the enquiry of the person sending the form
Legal basis	Fulfilment of a contract (Article 6(1)(b) GDPR), if your enquiry serves to clarify a contractual relationship. Our legitimate interest (Article 6(1)(f) GDPR) for all other enquiries, as we are interested in a quick response to your enquiry.
Where applicable, recipients (in the case of passing on data)	Data will not be passed on to third parties and/or a third country.
Where applicable, intention to transmit to a third country or international organisation (including information on adequacy decision of the Commission or suitable guarantees)	No data transmission to a third country takes place and none is planned.
If known: Duration of data storage	See general time limits for data erasure
Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity	There is no obligation.
Consequences of non-compliance (failure to provide the required data)	None
Where applicable, existence of automated decision-making	In this context, we do not use automated decision-making.
Where applicable, origin of the data (if not collected directly from the data subject)	The data originates from the data subject.
Where applicable, categories of personal data (if not collected directly from the data subject).	In this context, we do not use automated decision-making.
Where applicable, change of purpose	None

 

Client account and product order

Purpose of the processing of general data	Data type Purpose of collection Salutation, title, first name, surname, street, no., postcode, city, country, date of birth (optional) Unique identification of the customer account, processing of the product purchase, delivery, payment transactions, processing of complaints Email address, password Authentication, independent resetting of the password Telephone number (optional) Contact by telephone
Legal basis	Fulfilment of a contract (Article 6(1)(b) GDPR)
Where applicable, recipients (in the case of passing on data)	Parcel service provider, logistics service provider, payment service provider
Where applicable, intention to transmit to a third country or international organisation (including information on adequacy decision of the Commission or suitable guarantees)	No data transmission to a third country takes place and none is planned.
If known: Duration of data storage	See general time limits for data erasure
Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity	The data (in the mandatory fields) must be provided as part of the underlying contract.
Consequences of non-compliance (failure to provide the required data)	It will not be possible to create a customer account in this case.
Where applicable, existence of automated decision-making	In this context, we do not use automated decision-making.
Where applicable, origin of the data (if not collected directly from the data subject)	The data originates from the data subject.
Where applicable, categories of personal data (if not collected directly from the data subject).	The data originates from the data subject.
Where applicable, change of purpose	None

 

General time limits for data erasure

After the storage purpose has ceased to apply, the retention periods are generally at least six or ten years. Data is generally deleted immediately in accordance with our deletion procedures, provided that this does not conflict with any retention obligation, necessity for contract fulfilment or a legitimate interest.

Deletion or blocking of personal data

We only store your personal data for the period required to fulfil the specified purpose. Once the purpose no longer applies and any retention periods have expired, your data will be deleted immediately. If deletion is not possible, the data will be blocked instead.

Safety

We have taken technical and administrative security precautions to protect your personal data against loss, destruction, manipulation and unauthorised access. All our employees and service providers working for us are obliged to comply with the applicable data protection laws.

Whenever we collect and process personal data, it is encrypted before it is transferred. This means that your data cannot be misused by third parties. Our security precautions are subject to a continuous improvement process and our data protection declarations are constantly being revised. Please ensure that you have the latest version.

General time limits for data erasure

After the storage purpose has ceased to apply, the retention periods are generally at least six or ten years. Data is generally deleted immediately in accordance with our deletion procedures, provided that this does not conflict with any retention obligation, necessity for contract fulfilment or a legitimate interest.

Deletion or blocking of personal data

We only store your personal data for the period required to fulfil the specified purpose. Once the purpose no longer applies and any retention periods have expired, your data will be deleted immediately. If deletion is not possible, the data will be blocked instead.

Rights of data subjects

 You have the right to information, correction, deletion or restriction of the processing of your stored data, a right to object to the processing as well as a right to data portability and to lodge a complaint in accordance with the requirements of data protection law.

Right to information:

You can request information from us as to whether and to what extent we process your data.

Right to rectification:

If we process your data and that data is incomplete or incorrect, you can request that we correct or complete it at any time.

Right to erasure:

You can demand that we erase your data if we process it unlawfully or if the processing disproportionately interferes with your legitimate interests. Please note that there may be reasons that prevent immediate erasure, e.g. in the case of statutory retention obligations.

Irrespective of the exercise of your right to erasure, we will erase your data immediately and completely, provided there are no legal or statutory retention obligations to the contrary.

Right to restriction of processing:

You can demand that we restrict the processing of your data if

– you contest the accuracy of the data, this applies for a period enabling us to verify the accuracy of the data

– the processing of the data is unlawful, but you oppose the erasure of the data and request the restriction of its use instead

– we no longer need the data for the intended purpose, but you still need this data for the assertion or defence of legal claims, or

– you have objected to the processing of the data.

Right to data portability:

You can request that we provide you with the data you have provided to us in a structured, commonly used and machine-readable format and that you can transmit this data to another controller without hindrance from us, provided that

– we process this data on the basis of your revocable consent or for the fulfilment of a contract between us, and

– this processing is carried out by automated means.

If technically feasible, you can request that we transfer your data directly to another controller.

Right to object:

If we process your data on the basis of legitimate interest, you can object to this data processing at any time; this would also apply to profiling based on these provisions. We will then no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or the processing serves the establishment, exercise or defence of legal claims. You can object to the processing of your data for the purpose of direct advertising at any time without giving reasons.

Right to lodge a complaint:

If you are of the opinion that we are violating German or European data protection law when processing your data, please contact us so that we can clarify any questions. Of course, you also have the right to contact the supervisory authority responsible for you, the appropriate state office for data protection supervision.

If you wish to assert one of these rights against us, please contact our data protection officer. In case of doubt, we may request additional information to confirm your identity.

Changes to this privacy policy

 We reserve the right to change our privacy policy if this should be necessary due to new technologies. Please ensure that you have the latest version. If fundamental changes are made to this privacy policy, we will announce these on our website.

All interested parties and visitors to our website can contact us regarding data protection issues at

Mr Bernhard Brunner

Projekt 29 GmbH & Co. KG
Ostengasse 14
93047 Regensburg

Tel.:  0941 2986930
Fax:  0941 29869316
Email: anfragen@projekt29.de
Internet: www.projekt29.de