Privacy Policy in accordance with the GDPR

Contents

1) Name and address of the data controller
2) Name and address of the data protection officer
3) General information on data processing

• 3.1 Scope of the processing of personal data
• 3.2 Legal basis for the processing of personal data
• 3.3 Data erasure and retention period

4) Provision of the website and creation of log files

• 4.1 Description and scope of data processing
• 4.2 Legal basis for data processing
• 4.3 Purpose of data processing
• 4.4 Retention period
• 4.5 Options for objection and erasure

5) Use of cookies

• 5.1 Description and scope of data processing

6) Newsletter

• 6.1 Description and scope of data processing
• 6.2 Legal basis for data processing
• 6.3 Purpose of data processing
• 6.4 Retention period
• 6.5 Options to object and have data deleted

Privacy Policy in accordance with the GDPR

1) Name and address of the data controller

WUND Holding GmbH, Badeparadies Schwarzwald TN GmbH, Badewelt Sinsheim GmbH, Thermen & Badewelt Euskirchen GmbH and BLUPHORIA GmbH act as joint controllers with regard to the processing of personal data in the area of 'Central Customer Management' in accordance with Article 26 of the GDPR.
Your point of contact for the purposes of the European General Data Protection Regulation (GDPR) and other national data protection laws of the Member States, as well as other data protection provisions, is:

Thermen & Badewelt Euskirchen GmbH
Thermenallee 1 (Stresemannstraße 999)
D-53879 Euskirchen
Telephone: +49 (0) 2251 / 1485-0
Email: info@badewelt-euskirchen.de

Badeparadies Schwarzwald TN GmbH

Am Badeparadies 1
79822 Titisee-Neustadt
Telephone: +49 (0) 7651 / 9360-333
shop@badeparadies-schwarzwald.de

WUND Holding GmbH
Bergheimer Straße 3
88677 Markdorf
Telephone: +49 (0) 7541 / 206-0
Email: info@wund.de

Badewelt Sinsheim GmbH
Badewelt 1
94889 Sinsheim
Telephone: +49 (0) 7261 / 4028-0
Email: info@badewelt-sinsheim.de

BLUPHORIA GmbH
Bergheimer Straße 3
88677 Markdorf
Telephone: +49 (0) 7544 / 96591-0
E-Mail: info@bluphoria.de

 

2) Name and address of the Data Protection Officer

We attach great importance to the protection of your personal data. To reflect this, we have commissioned a consultancy firm specialising in data protection and data security to take charge of these key issues. We are advised by:

actago GmbH
Straubinger Straße 7
94405 Landau an der Isar
Email: datenschutz@wund.de

3) General information on data processing

3.1 Scope of the processing of personal data

We generally process your personal data only to the extent necessary to provide our services. The processing of your personal data is normally carried out solely on the basis of your consent. An exception applies in cases where it is not possible to obtain consent in advance for practical reasons, or where the processing of your personal data is permitted by law.

 

3.2 Legal basis for the processing of personal data

Where we seek your consent for the processing of personal data, Article 6(1)(a) of the GDPR serves as our legal basis.

Where the processing of personal data is necessary for the performance of a contract between you and us, Article 6(1)(b) of the GDPR serves as our legal basis. This also applies to processing operations necessary for the implementation of pre-contractual measures.

Where the processing of personal data is necessary to comply with a legal obligation to which we are subject, Article 6(1)(c) of the GDPR serves as our legal basis.

Where the vital interests of you or another natural person necessitate the processing of personal data, Article 6(1)(d) of the GDPR serves as our legal basis.

Where processing is necessary to safeguard a legitimate interest of ours or of a third party, and your interests, fundamental rights and freedoms do not override the former interest, Article 6(1)(f) of the GDPR serves as the legal basis for the processing.

3.3 Data erasure and retention period

 

Your personal data will be deleted or blocked as soon as the purpose for which it was stored no longer applies. Data may also be stored if this is provided for by European or national legislation in EU regulations, laws or other provisions to which we are subject. Data will also be blocked or deleted when a retention period prescribed by the aforementioned standards expires, unless there is a need to continue storing the data for the conclusion or performance of a contract.

4) Provision of the website and creation of log files

4.1 Description and scope of data processing

Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing device. The following data is collected in this process:

the browser types and versions used,
the operating system used by the accessing device,
the website from which an accessing device reaches our website (known as a 'referrer'),
the sub-pages on our website accessed via the visiting system,
the date and time of access to the website,
an Internet Protocol address (IP address),
the Internet service provider of the visiting system, and
other similar data and information used for security purposes in the event of attacks on our IT systems.
This data is also stored in our system's log files. This data is not stored together with any other personal data relating to the user.

 

4.2 Legal basis for data processing

The legal basis for the processing of your personal data in connection with the provision of the website and the creation of log files is Article 6(1)(f) of the GDPR.

4.3 Purpose of data processing

The temporary storage of your personal data by us is necessary to enable the website to be delivered to your computer. To this end, your personal data must be stored for the duration of the session.

Your personal data is stored in log files to ensure the website functions properly. In addition, we use your personal data to optimise the website and to ensure the security of our IT systems. Your personal data is not analysed for marketing purposes in this context.

These purposes also constitute our legitimate interest in data processing pursuant to Article 6(1)(f) of the GDPR.

 

4.4 Duration of storage

Your personal data will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected. Where your personal data is collected for the purpose of providing the website, this will be the case as soon as the relevant session has ended.

Where your personal data is stored in log files, it will be deleted after seven days at the latest. Storage beyond this period is possible. In this case, your personal data will be deleted or anonymised so that it is no longer possible to identify the client that accessed the site.

4.5 Options to object and have data removed

The collection of your personal data for the purpose of providing the website and the storage of your personal data in log files is strictly necessary for the operation of the website. Consequently, you have no right to object.

5) Use of cookies

5.1 Description and scope of data processing

Our website uses cookies. Cookies are text files that are stored in the web browser or by the web browser on the user's computer system. When a user visits a website, a cookie may be stored on the user's operating system. This cookie contains a distinctive string of characters that enables the browser to be uniquely identified when the website is visited again.

 

When you access this website, we store cookies (text files) on your device which remain valid for the duration of your visit to the website ("session cookies"). We use these exclusively whilst you are visiting our website. Once your visit has ended, your browser will automatically delete these cookies.

When you access this website, we store cookies on your device. These are valid for:

Name: Duration:

 

• TDCPM 1 year
• TDID 1 year
• _fbp 3 months
• _ga 2 years
• _ga_# 2 years
• _gat_ 1 day
• _gid 1 day
• collect End of session
• ads/ga-audiences End of session
• CookieConsent 1 year
• PHPSESSID End of session
• SERVERID End of session
• AWSALBCORS 6 days
• rc::a Persistent
• rc::c End of session
• __cf_bm 1 day
• loglevel:userlike Persistent
• accomodationIds-# 1 day
• td End of session
• __ptq.gif End of session 
• mtpConfigFeed# Persistent
• mtpConfigFeedBase# Persistent
• mtpDeckchairSprite# Persistent
• mtpTemplates# Persistent
• mtpTranslations# Persistent
• mtracking.gif End of session
• __hssc End of session
• __hssrc End of session
• __hstc 6 months
• hubspotutk 6 months

We use these to improve the user experience on the website and to offer visitors more features. Most browsers are set to accept the use of cookies,

but you can disable this function via your internet browser settings, either for the current session or permanently.

5.2 Legal basis for data processing

The legal basis for the processing of your personal data in connection with the use of technically necessary cookies is Section 25(2)(2) of the TTDSG and Article 6(1)(f) of the GDPR. For cookies that are not technically necessary, the legal basis is derived from Section 25(1) of the TTDSG and Article 6(1)(a) of the GDPR.

 

5.3 Purpose of processing

The use of technically necessary cookies serves to make it easier for you to use our website. Some functions of our website cannot be provided without the use of cookies. For these, it is necessary for your web browser to be recognised even after you have navigated to another page. The user data collected by technically necessary cookies is not used to create user profiles.

Analytics cookies are used to improve the quality of our website and its content. These cookies enable us to understand how the website is used, allowing us to continuously optimise our service.

These purposes also constitute our legitimate interest in processing your personal data in accordance with Article 6(1)(f) of the GDPR.

5.4 Duration of storage

Your personal data will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected; this is particularly the case when cookies are deactivated.

 

5.5 Option to object and delete

Cookies are stored on your computer and transmitted from it to our website. You therefore have full control over the use of cookies. By changing the settings in your web browser, you can disable or restrict the transmission of cookies. You can delete cookies that have already been stored at any time. This can also be done automatically. If cookies are disabled for our website, you may no longer be able to make full use of all the website's functions.

The transmission of Flash cookies cannot be prevented via your web browser settings. To do this, you will need to change the settings in Adobe Flash Player.

6 Newsletter

6.1 Description and scope of data processing

Our website offers a newsletter through which we keep you informed about news and offers. If you wish to subscribe to the newsletter, you must provide a valid email address. By subscribing to the newsletter, you agree to receive it and to the procedures described.

The following details must be provided to subscribe to the newsletter:

• Email address (mandatory field)
• Title
• First name
• Surname
• Date of birth

 

The newsletter is sent via the provider HubSpot, based at 25 First Street, Cambridge, MA 02141, USA. Information on the data protection policy of the mailing service provider is available at: https://legal.hubspot.com/de/privacy-policy

6.2 Legal basis for data processing

The legal basis for the processing of your personal data in connection with the sending of the newsletter is, where consent has been given, Article 6(1)(a) of the GDPR, or, following the sale of goods or services, the statutory authorisation under Section 7(3) of the Unfair Competition Act (UWG).

6.3 Purpose of data processing

The collection of your personal data serves the purpose of sending you the newsletter. The purpose of processing your personal data in connection with the sending of the newsletter is to promote the sale of goods or services.

6.4 Duration of storage

Your personal data will be erased as soon as it is no longer necessary for the purpose for which it was collected. Your personal data will therefore be stored for as long as your newsletter subscription remains active.

 

6.5 Right to object and right to have data erased

You may cancel your subscription to the newsletter at any time. A link for this purpose is included in every newsletter. Cancelling your subscription also allows you to withdraw your consent.

7) Registration

7.1 Description and Scope of Data Processing

You must register on our website to speed up the conclusion of the contract. The processing of your personal data therefore contributes to the performance of the contract or to the implementation of pre-contractual measures.

The following data is stored during registration:

• Title*
• First name*
• Surname*
• Email*
• Confirm email*
• Telephone*
• Street*
• House number*
• Postcode*
• Town/city*
• Country*

*Mandatory field

Reference is made to this privacy policy in connection with the processing of data as part of the registration process. Registration is carried out via the service provider HubSpot, whose registered office is at 25 First Street, Cambridge, MA 02141, USA. Information on the service provider's privacy policy is available at: https://legal.hubspot.com/de/privacy-policy

7.2 Legal basis for data processing

The legal basis for the processing of your personal data as part of the registration process is Article 6(1)(b) of the GDPR.

7.3 Purpose of data processing

Your registration facilitates the conclusion of contracts between you and us. The processing of your personal data as part of the registration process is therefore necessary for the performance of a contract between you and us or for the implementation of pre-contractual measures.

7.4 Duration of storage

Your data will be erased as soon as it is no longer required to fulfil the purpose for which it was collected. In the case of data collected during the registration process for the purpose of fulfilling a contract or taking pre-contractual measures, this is the case when your personal data is no longer required for the performance of the contract. Even after the contract has been concluded, there may still be a need to store the contractual partner's personal data in order to comply with contractual or legal obligations.

 

7.5 Right to object and right to erasure

You may cancel your registration at any time. You may have your personal data amended at any time. If your personal data is required for the performance of a contract or for the implementation of pre-contractual measures, early deletion of your personal data is only possible insofar as no contractual or statutory obligations preclude such deletion.

8) Contact form and contacting us by email

8.1 Description and scope of data processing

Our website features a contact form which can be used to contact us electronically. If you make use of this option, the data entered in the form will be transmitted to us and stored. This data comprises:

• First name*
• Surname*
• Street
• House number
• Town/city
• Postcode
• Country
• Email address*
• Telephone number
• Your message*
• *Mandatory field

Your consent to the processing of this data is obtained as part of the submission process, and reference is made to this privacy policy.

 

Alternatively, you may contact us via the email address provided. In this case, the personal data you provide in your email will be stored. In this context, the data will not be passed on to third parties. The data will be used exclusively for the purpose of handling the correspondence.

8.2 Legal basis

The legal basis for the processing of your personal data, which is transmitted when you contact us via the contact form or by email, is Article 6(1)(f) of the GDPR. If the purpose of contacting us via the contact form or by email is to conclude a contract, Article 6(1)(b) of the GDPR constitutes an additional legal basis for the processing.

8.3 Purpose of data processing

The processing of your personal data when you contact us via the contact form or by email serves solely to handle your enquiry.

8.4 Duration of storage

Your personal data will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected.

For personal data entered via the contact form and that sent by email, this is the case once the conversation has ended. The conversation is deemed to have ended when it is clear from the circumstances that the matter in question has been conclusively resolved.

 

Any personal data collected in addition during the submission process will be deleted within seven days at the latest.

8.5 Options to object and have data deleted

You may at any time object, with future effect, to the processing of your personal data in connection with contacting us via the contact form or by email. In such a case, the conversation between you and us cannot be continued. All personal data stored in the course of establishing contact will be deleted in this instance.

9) Third-party applications embedded on the website

9.1 Marketing automation with HubSpot

 

On this website, we use the HubSpot service for various purposes. HubSpot is a US-based software company with its registered office at 25 First Street, Cambridge, MA 02141, USA.
HubSpot is an integrated software solution that enables us to manage various aspects of our online marketing. These include, amongst others:
•
Email marketing / newsletter distribution using various subscription models
•
Social media publishing & reporting
•
Reporting
•
Contact management (e.g. user segmentation & CRM)
•
Landing pages
•
Contact forms
•
"MyBLUPHORIA" Loyalty Points Programme
Our registration service enables visitors to our website to find out more about our company, download content and provide their contact details and other demographic information. This information, together with the content of our website, is stored on servers belonging to the Josef Wund Spa Group in Germany. Access by HubSpot is permitted only under strict conditions. We may use the data to contact visitors to our website and to determine which of our company's services are of interest to them. All information we collect is subject to this privacy policy. We use all collected information solely to optimise our marketing activities and to contact interested visitors to our website.
HubSpot tracks visitors using browser cookies. Every time a visitor lands on your website, the HubSpot software checks whether a tracking cookie is present. If no cookie is present, one is assigned to the user. This cookie logs all the pages that the individual subsequently visits.
As part of the optimisation of our marketing activities, the following data may be collected and processed via HubSpot:

• Geographical location
• Browser type
• Navigation information
• Referrer URL
• Performance data
• Information on how often the application is used
• Mobile app data
• Login details for the HubSpot subscription service
• Files viewed on the site
• Domain names
• Pages viewed
• Aggregated usage
• Operating system version
• Internet service provider
• IP address
• Device identifier
• Duration of visit
• Where the application was downloaded from
• Operating system
• Events occurring within the application
• Access times
• Clickstream data
• Device model and version

 

In addition, we also use HubSpot to provide contact forms.
The legal basis for the processing is your consent in accordance with Article 6(1)(a) of the GDPR. If you do not wish the aforementioned data to be collected and processed via HubSpot, you may withhold your consent or withdraw it at any time with future effect.
Personal data will be retained for as long as is necessary to fulfil the purpose of the processing. The data will be deleted as soon as it is no longer required to fulfil that purpose. As part of the processing via HubSpot, data may be transferred to the USA.
The new data protection framework ('EU-US Data Privacy Framework') promotes secure data transfers between the EU and the US, thereby addressing the data protection concerns that have existed since the European Court of Justice's Schrems II ruling. However, this only applies if the companies or organisations to which personal data is transferred are certified under the new agreement. Through certification, US companies undertake to comply with certain data protection obligations, which are modelled on those set out in the European GDPR. HubSpot is a certified company under the new agreement. You can view this here: https://www.dataprivacyframework.gov/s/participant-search/participant-de-tail?id=a2zt0000000TN8pAAG&status=ActiveFurthermore, the security of the transfer is also safeguarded by so-called standard contractual clauses, which ensure that the processing of personal data is subject to a level of security that complies with the GDPR. Should the standard contractual clauses not be sufficient to ensure an adequate level of security, your consent may serve as the legal basis for the transfer to third countries in accordance with Article 49(1)(a) of the GDPR.

The personal data we collect via HubSpot may be used jointly by all affiliated spas within the Josef Wund Spa Group (WUND Holding GmbH, Badeparadies Schwarzwald, Thermen & Badewelt Sinsheim, Thermen & Badewelt Euskirchen, BLUPHORIA GmbH (as joint controllers within the meaning of Article 26 of the GDPR)) for the purpose of sending cross-site marketing communications, etc. The legal basis for this is Article 6(1)(a), (b) and (f) of the GDPR. Processing takes place only within the scope of the consent given for the respective thermal spas whose newsletters have been subscribed to.
Further information on HubSpot can be found at: https://legal.hubspot.com/de/privacy-policy

 

9.2 Google Tag Manager

We use Google Tag Manager, provided by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; "Google"), on our website. If you are habitually resident in the European Economic Area or Switzerland, Google Ireland Limited (Gordon House, Barrow Street,
Dublin 4, Ireland) is the data controller responsible for your data. Google Ireland Limited is therefore the
Google affiliate responsible for processing your data and ensuring compliance with
applicable data protection laws.
This application manages JavaScript tags and HTML tags, which are used to implement, in particular, tracking and analytics tools. The purpose of data processing is
to tailor the design of our website to your needs and to optimise it.
Google Tag Manager itself does not store cookies, nor does it process personal data. However, it enables the triggering of further tags that may collect
and process personal data.
Further information on terms of use and data protection can be found here:
https://www.google.com/intl/de/tagmanager/use-policy.html

9.3 Web tracking with Google Analytics (GA 4)

9.3.1 Scope of the processing of personal data

 

This website uses Google Analytics 4, Google's latest web analytics service. This is provided by
Google Ireland Limited (Gordon House, 4 Barrow Street, Dublin, D04 E5W5, Ireland). We
use Google Analytics to analyse our users' browsing behaviour.
Google Analytics uses so-called 'cookies', text files that are stored on your computer
and which enable an analysis of your use of the website.
The information generated by the cookie regarding your use of this website is usually
stored on a server within the EU and transmitted to a Google server in the USA. With Google
Analytics 4, IP address anonymisation is enabled by default. Due to IP anonymisation, your IP address is truncated by Google within Member States of the European Union or in other States to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there.
By using the code "anonymizeIp", we enable the anonymised collection of IP addresses
(known as IP masking). The software runs exclusively on our website's servers. Users' personal data is stored only there. The data is not passed on to third parties.

During your visit to the website, your user behaviour is recorded in the form of 'events'. Events
may include:

• Page views

• First visit to the website
• Start of the session
• Your 'click path', interaction with the website
• Scrolls (whenever a user scrolls to the bottom of the page (90%))
• Clicks on external links
• Internal search queries
• Interaction with videos
• File downloads
• Adverts viewed / clicked on
• Language setting

The following is also recorded:

• Your approximate location (region)
• Your IP address (in truncated form)
• Technical information about your browser and the devices you use (e.g.
language setting, screen resolution)
• Your internet service provider
• The referrer URL (the website or advert through which you arrived at this website)

We use Google Signals. This enables Google Analytics to collect additional information about users who have enabled personalised adverts (interests and demographic data), and adverts
can be served to these users in cross-device remarketing campaigns.

9.3.2 Legal basis for the processing of personal data

The legal basis for the processing of your personal data is Article 6(1)(a) of the GDPR.

 

9.3.3 Purpose of data processing

On behalf of the operator of this website, Google will use this information to evaluate your use
of the website and to compile reports on website activity. The reports provided by Google Analytics are used to analyse the performance of our website and the success of our marketing campaigns.

 

9.3.4 Duration of storage

The data we send, which is linked to cookies, is automatically deleted after 14 or 26 months. Data for which the retention period has expired is automatically deleted once a month.

 

9.3.5 Options for objection and erasure

You may withdraw your consent at any time with future effect by accessing your browser's cookie settings and changing your selection there. The lawfulness of the processing carried out on the basis of
your consent up until the time of withdrawal remains unaffected.
You can also prevent cookies from being stored in the first place by adjusting the settings of your
browser software accordingly. However, if you configure your browser to reject all cookies, this may result in restricted functionality on this and other websites.
You can also prevent the collection of data generated by the cookie and relating to your use of the website (including your IP address) by Google, as well as the processing of this data by Google,
by:

• not giving your consent to the setting of the cookie, or
downloading and installing the browser add-on to deactivate Google Analytics
(https://tools.google.com/dlpage/gaoptout?hl=de).

• Further information on the terms of use of Google Analytics and on data protection at
Google can be found at https://marketingplatform.google.com/about/analytics/terms/de/ and
at https://policies.google.com/?hl=de

9.3.6 Google Signale

This website actively uses Google Signals in conjunction with Google Analytics 4. This updates the existing Google Analytics features (advertising reports, remarketing, cross-device reports and
interest-based reports, including demographic characteristics) to provide an aggregated
profile of your anonymised data, provided you have enabled personalised adverts in your Google Account.
This constitutes cross-device tracking. This means that your data can be analysed
across different devices. By enabling Google Signals, data is collected and linked to your Google
account. Thanks to the activation of Google Signals, we can launch cross-device marketing campaigns.
These analyses also help us to better assess your behaviour, preferences and interests. This
enables us to optimise and tailor our services and products. The data collected is
stored for 14 months and then expires. Please note that this data collection only takes place
if you have enabled personalised advertising in your Google Account. The data is always
stored anonymously and transferred to the USA. You can also
manage or delete this data in your Google Account.
Further information on the terms of use and data protection can be found at:
https://policies.google.com/privacy?hl=de

9.4 Google Web Fonts

To ensure consistent font display, this website may use what are known as Google Web Fonts.
When these fonts are used, your browser downloads the required fonts from our website system. These are then temporarily stored in what is known as the browser cache to ensure the fonts are displayed correctly.
Your browser does not establish a connection to Google's servers during this process. This ensures that Google does not gain any knowledge of your visit or your IP address.

9.5 Doubleclick by Google

This website contains components from DoubleClick by Google. DoubleClick is a trademark of
Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), under which specific
online marketing solutions are marketed to advertising agencies and publishers.
DoubleClick by Google transmits data to the DoubleClick server with every impression, as well as with clicks or other activities.
Each of these data transmissions triggers a cookie request to your
browser. If the browser accepts this request, DoubleClick sets a cookie on your IT system.
The purpose of the cookie is to optimise and display advertising. Among other things, the cookie is
used to serve and display user-relevant adverts, as well as to generate reports on advertising campaigns or to improve them. Furthermore, the cookie serves to prevent the same advert from being displayed multiple times.
DoubleClick uses a cookie ID, which is required to carry out the technical process.
The cookie ID is required, for example, to display an advert in a browser. DoubleClick can also use the cookie ID to track which adverts have already been displayed in a browser, in order to prevent duplicate displays. Furthermore, the cookie ID enables DoubleClick to track conversions.
A DoubleClick cookie does not contain any personal data. However, a DoubleClick cookie may
contain additional campaign identifiers. A campaign identifier is used to identify the
campaigns with which you have already come into contact.
Each time you visit one of the individual pages of this website, which is operated by us and on which a DoubleClick component has been integrated, the web browser on your IT system is prompted by
the relevant DoubleClick component to transmit data to Google for the purposes of online advertising and the settlement of commissions. As part of this technical process,
Google becomes aware of data which Google also uses to generate commission statements. Google
can, amongst other things, track that you have clicked on certain links on our website.
You can prevent DoubleClick and our website from setting cookies at any time by
adjusting the settings in your web browser accordingly. Furthermore, cookies that have already been set
can be deleted at any time via your web browser or other software programmes.
You have given your consent to this via our opt-in cookie banner in accordance with Article 6(1)(a) of the GDPR.
Further information and the applicable data protection provisions of DoubleClick by Google can
be found at www.google.com/intl/de/policies/.

9.6 Use of Cookiebot

We use features provided by Cookiebot on our website. Cookiebot is operated by Usercentrics A/S, Havnegade 39, 1058 Copenhagen, DK. Among other things, Cookiebot enables us
to provide you with a comprehensive cookie notice (also known as a cookie banner or cookie notice). By using this feature, data relating to you may be sent to Cookiebot or
Cybot, where it may be stored and processed.
You have the right to access and delete your personal data at any time.
You can prevent the collection and storage of data, for example, by refusing the use of cookies via the cookie notice.
Further information can be found at: https://www.cookiebot.com/de/privacy-policy/

 

9.7 Cloudfront

This website uses the Cloudfront Content Delivery Network (CDN). This is a service provided by Amazon Web
Services Inc., 410 Terry Avenue North, Seattle, WA 98109-5210. The CloudFront CDN provides copies of
a website's data on various Amazon Web Services (AWS) servers distributed worldwide. This results in faster website loading times, greater reliability and enhanced protection against data loss.

Some of the images and videos embedded on this website are retrieved from the CloudFront CDN when the page is accessed. When this occurs, information about your use of our website (such as your IP address) is transferred to Amazon's servers in other EU countries and stored there. This happens as soon as you access our website. The legal basis for the use of CloudFront is the user's consent in accordance with Article 6(1)(a) of the GDPR. The current privacy policy of Amazon Web Services can be found at: https://aws.amazon.com/de/privacy/

9.8 Delivr.js

This site uses a so-called 'Content Delivery Network' (CDN) provided by jsDelivr. The provider is Prospect One sp.z o.o., Królewska 65A/1, 30-081 Kraków, Poland (hereinafter referred to as 'JSDelivr').
A CDN is a service that enables content from our website – in particular large media files such as graphics or scripts – to be delivered more quickly via a network of servers distributed regionally and connected via the internet.
Technically, this involves routing the transfer of information between your browser
and our website via the JSDelivr network. This enables JSDelivr to analyse the data traffic between your browser and our website and to act as a filter between our
servers and potentially malicious data traffic from the internet. In doing so, JSDelivr may also
use cookies; however, these are used solely for the purpose described here. The processing
of users' data is carried out for the aforementioned purposes and to maintain the security and
functionality of the CDN.
To this end, the browser you are using must establish a connection to the CDN's servers. As a result, the CDN becomes aware that our website has been accessed via your IP address
.
The legal basis for the use of Delivr.js is the user's consent in accordance with Article 6(1)
(a) of the GDPR. Further information can be found in jsDelivr's privacy policy:
https://www.jsdelivr.com/privacy-policy-jsdelivr-com

9.9 Facebook
Our website uses plugins from the Facebook network, which is operated by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta").
When you click on the Facebook button, the plugin establishes a direct connection between your
browser and the Facebook server. This transmits information to Facebook that
you have visited our site using your IP address.
We are not aware of the purpose and scope of the data collection, nor of the further processing and use of this data by
Facebook. In this regard, and with regard to your rights and privacy settings, we ask you to refer to Instagram's privacy policy: https://de-de.facebook.com/privacy/policy

9.10 Instagram

Our website uses plugins from the Instagram network, which is operated by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta").
When you click on the Instagram button, the plugin establishes a direct connection between your
browser and the Instagram server. This transmits information to Instagram that
you have visited our site using your IP address.
We are not aware of the purpose and scope of the data collection, nor of the further processing and use of this data by
Instagram. In this regard, and with regard to your rights and privacy settings, we ask you to refer to Instagram's privacy policy: https://privacycenter.instagram.com/policy

9.11 Walls.io

Our website uses social media plugins and widgets from Walls.io. When these plugins are accessed,
your IP address and cookie information are transmitted to Walls.io; this is done solely for technical reasons necessary to provide the service. This data is stored by Walls.io in Europe only and is not passed on to third parties.
We use Walls.io's plugins to display a social media wall on our website.
Walls.io aggregates content from over 15 platforms, including Facebook, Twitter, Instagram, YouTube and
Pinterest. This content is published live on our website. For further information on data processing by Walls.io, please refer to Walls.io's privacy policy at
https://walls.io/privacy. Walls.io is operated by 'Die Socialisten' Social Software Development GmbH, Andreasgasse 6, Top 1, 1070 Vienna, Austria. By using our website, you declare your
consent to the collection and processing of information by Social
Software Development GmbH as described. The operation of Walls.io on our websites can be restricted
or completely prevented by adjusting the settings
in your browser. However, you will then also be unable to
use the social media wall on our website.

9.12 Meta-Pixel

Provided that you have given us your explicit consent (Art. 6(1)(a) GDPR) by clicking on a
button provided for this purpose, we use the "Meta Pixel" from Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, on our website. This
enables us to track users' behaviour after they have viewed or clicked on a Facebook advert.
This process is used to evaluate the effectiveness of Facebook adverts for statistical and market research purposes and may help to optimise future advertising campaigns.
The data collected is anonymous to us; therefore, it does not allow us to identify individual users.
However, the data is stored and processed by Facebook, meaning it can be linked to the relevant user profile, and Facebook may use the data for its own advertising purposes in accordance with the
Facebook Data Use Policy (https://www.facebook.com/about/privacy/).
By giving your consent, you allow Facebook and its partners to display adverts on and outside of Facebook. A cookie may also be stored on your computer for these purposes. Consent to the use of the Meta pixel may only be given by users aged 16 or over. If you are younger than this, please ask your parents or guardians for permission. To object to the use of cookies on your computer in general,
you can configure your web browser so that no further cookies can be stored on your computer
in future, or so that cookies already stored are deleted. However, disabling all cookies may
mean that some functions on our website will no longer work
. You can also disable the use of cookies by third-party providers, such as Meta, on the following
Digital Advertising Alliance website: http://www.aboutads.info/choices/

9.13 Conversions API

We use the Conversions API on this website. This is a server-side event tracking tool. The service is provided by Meta Platforms Ireland Limited, 4 Grand Canal Square,
Dublin 2, Ireland.
With the Conversions API, data is still collected on the client side and processed on our web server – however, data collection via the API also works if the Meta Pixel is
. A tracking code is then executed on the server, which sends the collected
events to the actual API on Meta's servers.
The legal basis for the processing of your personal data in connection with the use of
the Conversions API is Article 6(1)(a) of the GDPR.
There, the data from the API and that from the Meta Pixel are merged – the Conversions API therefore complements the tracking carried out by the Meta Pixel. Further information can be found at: https://www.facebook.com/business/help/2041148702652965?id=818859032317965
Further information from the third-party provider regarding data protection can be found on the following Facebook website: https://www.facebook.com/about/privacy. Information on the Facebook Pixel can be found on the following Facebook website: https://www.facebook.com/business/help/651294705016616

9.14 ajax.googleapis.com / jQuery

On our website, we use the jQuery JavaScript library. To improve the loading speed
of our website and thereby provide you with a better user experience, we use Google's CDN (content delivery network) to load this library.
It is highly likely that you have already used jQuery from the Google CDN
on another website. In that case, your browser can access the copy stored in the cache and
it does not need to be downloaded again.
If your browser does not have a cached copy or, for any other reason, needs to download the file from the
Google CDN, data will again be transferred from your browser to Google Inc. ("Google"). For further information on data processing by Google, please refer to Google's privacy policy, currently available at: https://www.google.de/intl/de/policies/privacy/

9.15 Cloudflare.com

This website uses services provided by 'Cloudflare' (provider: Cloudflare, Inc., 101 Townsend St, San Francisco,
CA 94107, USA).
Cloudflare operates a Content Delivery Network (CDN) and provides security features for the website (Web
Application Firewall). Data transfer between your browser and our servers
takes place via Cloudflare's infrastructure, where it is analysed to ward off attacks. Cloudflare
uses cookies for this purpose to enable you to access our website. The use of Cloudflare is in the interests of ensuring the secure use of our website and defending against malicious
external attacks. The legal basis for the use of Cloudflare.com is the user's
consent in accordance with Article 6(1)(a) of the GDPR.
Further information can be found in Cloudflare's privacy policy:
https://www.cloudflare.com/de-de/privacypolicy/

9.16 Google Maps
This website uses the Google Maps mapping service via an API. The provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
In order to use the functions of Google Maps, it is necessary to store your IP address. This information is usually transferred to a Google server in the USA and stored there.
The provider of this website has no influence over this data transfer.
Google Maps is used to ensure our online content is presented in an appealing way and to make it easy to locate the places listed on our website.
The use of Google Maps is based solely on consent in accordance with Article 6(1)(a) of the GDPR.
Further information on the handling of user data can be found in Google's Privacy Policy:
https://www.google.de/intl/de/policies/privacy/

9.17 Google Remarketing
Using Google's remarketing technology, users who have previously visited our websites are targeted again via interest-based advertising on sites within the Google Partner Network. Cookies are used to analyse interests when visiting the website, which can then be used for
relevant product advertising.
Provided that users have consented to Google linking their web and app browsing history to their Google Account and to information from our Google Account being used to personalise
adverts they see on the web, Google uses data from these signed-in users together with Google Analytics data to create
and define audience lists for cross-device remarketing. To support this function, Google Analytics collects Google-authenticated IDs for these users. This personal data from Google is temporarily linked to
our Google Analytics data in order to create audiences.
Further information and options for disabling this ad serving can be found at
http://www.google.com/settings/u/0/ads/anonymous?hl=de (click 'Ad settings', then 'Opt out').

9.18 Google reCaptcha
Google's reCaptcha may be used to prevent the misuse of forms.
In this case, the optional "remoteip" parameter is not set in the AI query. When using
reCaptcha, the data required for this is downloaded from Google by your browser. In doing so,
your browser establishes a connection to Google's servers, meaning that Google becomes aware of
the request and your IP address via our website. The website operator has no influence
over this data transfer.
The use of Google reCAPTCHA is in the interest of preventing the misuse of forms
and is intended to affect the user-friendliness of the website as little as possible. The reCAPTCHA offers mostly automatic recognition and a wide range of functions.
When Google reCAPTCHA is used, Google's separate data protection provisions apply. Further information can be found at https://www.google.de/intl/de/policies/privacy/

 

 

9.19The Trade Desk
On our website, we use the tool 'The Trade Desk' provided by The UK Trade Desk Ltd. (Co. No.
8539108), 10th Floor, 1 Bartholomew Close, London EC1A 7BL, United Kingdom. The Trade Desk offers
a technology known in the advertising industry as a Demand Side Platform (DSP). Put simply,
this means that digital advertising campaigns can be managed across a wide range of channels such as websites,
apps, audio platforms and smart TVs.
Cookies are used to collect pseudonymised data and data that cannot be used to identify individuals, which is then transmitted to The Trade Desk. This includes, in particular but not exclusively, your truncated and therefore pseudonymised IP address, the date and time of your visit to the website, the location of the device you are using to access our website (e.g. via the GPS signal of the device used, Bluetooth or the Wi-Fi signal), page views and interaction with the page, and the referring page (referrer). This data is transmitted to the Demand Side Platform, where it is linked to your pseudonymous ID. This takes place across websites on all platforms that use this technology. The purpose of data collection and processing is to deliver only those advertisements to you that are tailored to your previous interests and are therefore more relevant to you. Your personal data is pseudonymised before being transferred to The Trade Desk's Demand Side Platform. A transfer to a third country, namely the USA, takes place. The new data protection framework ('EU-US Data Privacy Framework') promotes secure data transfers between the EU and the USA and thus addresses the data protection concerns that have existed since the European Court of Justice's Schrems II ruling. However, this only applies if the companies or organisations to which personal data is transferred are certified under the new agreement. Through certification, US companies commit to complying with certain data protection obligations, which are modelled on those set out in the European GDPR.
The Trade Desk Inc. is a certified company under the new agreement. You can view this here: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?id=a2zt0000000TN8pAAG&status=Active
Further information on the technology used by The Trade Desk and on data protection can be found at the following link: http://thetradedesk.com/general/privacy-policy
We collect data on the basis of your consent, in accordance with Article 6(1)(a) of the GDPR, to the relevant data processing; you may withdraw this consent at any time by amending your privacy settings.

9.20 Userlike

This website uses Userlike's live chat software. Userlike uses cookies to store the content of the chat whilst you are waiting on the site and to connect you, where possible, with the same operator. The data collected is not used to personally identify visitors to the website; it is only combined with the personal data of the person using the pseudonym if personal data is voluntarily provided for the live chat whilst using the tool. Userlike's privacy policy can be found here: https://www.userlike.com/de/privacy_policy

9.21 Verwendung von YouTube-Videos
Videos from the external video platform YouTube are embedded on our website. By default, only deactivated thumbnails from the YouTube channel are embedded; these do not establish an automated connection to YouTube's servers. This means that the operator does not receive any data from the user when the web pages are accessed. You can decide for yourself whether to enable the YouTube videos. Only when you authorise the videos to play by clicking on 'Permanent activation' do you give your consent for the
necessary data (including the web address of the current page and the user's IP address) to be transmitted to the operator. To save the user's preferred setting, we set a cookie that stores the parameters. However, when these cookies are set, we do not store any personal data; they contain only anonymised data used to customise the browser. The videos are then active and can be played by the user. If you wish to disable the automatic loading of YouTube videos again, you can deselect the tick box for consent under the privacy icon. This will also update the cookie settings. YouTube is a service provided by YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA, a subsidiary of Google Inc., 1600 Amphitheatre Parkway, Mountain View, California 94043, USA. Further information on the purpose and scope of data processing (including outside the European Union and outside the USA), as well as information on privacy settings, can be found in the privacy policy: https://policies.google.com/privacy?hl=de&gl=de

9.22 Netigate
This website uses Netigate to send Net Promoter Score emails. The provider is Netigate Deutschland GmbH, Untermainkai 27–28, 60329 Frankfurt am Main, Germany. Net Promoter Score emails enable us to carry out customer surveys. This allows us, for example, to analyse whether, and if so how likely it is, that customers will recommend us to others. For detailed information on Netigate's functions, please refer to the following link: https://www.netigate.net/de/. Personal data may be processed during the customer survey. Data processing is carried out on the basis of a legitimate interest in accordance with Article 6(1)(f) of the GDPR in conjunction with Section 7(3) of the German Unfair Competition Act (UWG). You may object to this data processing at any time. The lawfulness of any data processing operations that have already taken place remains unaffected by your objection. The data you have provided to us for the purpose of sending emails will be stored by us or by Netigate until you raise an objection, and will be deleted following your objection to the sending of emails. For further details, please refer to Netigate's privacy policy at: https://www.netigate.net/de/impressum/#legal. We have entered into a data processing agreement (DPA) with Netigate in accordance with Article 28 of the GDPR.

Use of Netigate and Lumoa for customer surveys and feedback analysis

 

We use the Netigate survey tool to send out and conduct customer surveys (e.g. Net Promoter Score), and the Lumoa analytics tool to carry out further analysis of the customer feedback collected. The data collected as part of the surveys (e.g. contact details, survey responses, free-text feedback) is first recorded via Netigate and then transferred to Lumoa for automated analysis and classification. Lumoa is used for analysis (e.g. text analysis, sentiment analysis, classification and deriving insights), enabling us to evaluate feedback in a more structured manner and use it to improve quality and products.

Legal basis and purposes

The legal basis for the processing is Article 6(1)(f) of the GDPR (legitimate interest: improvement of products/services and customer satisfaction) or, where applicable, Article 6(1)(a) of the GDPR (consent), provided that consent has been obtained. Data processing is carried out exclusively for the purposes stated.

Data processing on behalf of the controller and responsibilities

Netigate and Lumoa process the data on our behalf as data processors; we have concluded corresponding data processing agreements with both providers. Data will only be disclosed to other third parties to the extent necessary to fulfil the stated purposes.

 

 

10) Social Media Presence

10.1 Presence on Facebook

To expand our online presence, we operate a Facebook page. This is a service provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.
Please note that you use this Facebook page and its features at your own risk. This applies in particular to the use of interactive features (e.g. commenting, sharing, rating).
When you visit our Facebook page, Facebook collects, amongst other things, your IP address and other information stored on your computer in the form of cookies. This information is used to provide us, as the operators of the Facebook pages, with statistical information on the usage of the Facebook page. Facebook provides further information on this at the following link: https://de-de.facebook.com/help/pages/insights

The data collected about you in this context is processed by Meta Platforms Ireland Limited and may be transferred to countries outside the European Union. Facebook describes in general terms, in its Data Use Policy, what information it receives and how it is used. There you will also find information on how to contact Facebook and on the options available for managing ad settings. The Data Use Policy is available via the following link: https://de-de.facebook.com/about/privacy

Facebook does not provide a clear and definitive explanation of how it uses data from visits to Facebook pages for its own purposes, to what extent activities on the Facebook page are attributed to individual users, how long Facebook stores this data, or whether data from a visit to the Facebook page is passed on to third parties; we are not aware of this information.

When you access a Facebook page, the IP address assigned to your device is transmitted to Facebook. According to Facebook, this IP address is anonymised (in the case of 'German' IP addresses) and deleted after 90 days. Facebook also stores information about its users' devices (e.g. as part of the 'Login Notification' feature); where applicable, this may enable Facebook to link IP addresses to individual users.

If you, as a user, are currently logged into Facebook, there is a cookie on your device containing your Facebook ID. This enables Facebook to track that you have visited this page and how you have used it. This also applies to all other Facebook pages.

Facebook buttons embedded in websites allow Facebook to track your visits to these websites and link them to your Facebook profile. This data can be used to tailor content or advertising to you.
If you wish to avoid this, you should log out of Facebook or deactivate the 'stay logged in' function, delete the cookies stored on your device, and close and restart your browser. This will delete any Facebook information that can be used to identify you directly. This allows you to use our Facebook page without your Facebook ID being disclosed. If you access interactive features on the page (such as 'Like', 'Comment', 'Share' or 'Messages'), a Facebook login screen will appear. Once you have logged in, Facebook will once again be able to recognise you as a specific user.

 

You can find information on how to manage or delete information held about you on the following Facebook Support pages: https://de-de.facebook.com/about/privacy#
As the provider of this information service, we also collect and process the following data resulting from your use of our service: publicly visible data from the data subject's user profile. This includes, for example, the username, profile picture and the content of comments posted in response to our posts.
Further information on Facebook and other social networks, and how you can protect your data, can also be found at https://youngdata.de/

10.2 Presence on Instagram
To expand our online presence, we operate an Instagram page. This is
a service provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.
Please note that you use this Instagram page and its features at your own risk. This applies in particular to the use of interactive features (e.g. commenting, sharing, rating). When you visit our Instagram page, Instagram collects, amongst other things, your IP address and other information
stored on your computer in the form of cookies. This information is used to provide us,
as the operators of the Facebook pages, with statistical information about the use of the Facebook page. Instagram provides further information on this via the following link: https://help.instagram.com/1896641480634370?ref=ig

The data collected about you in this context is processed by Meta Platforms Ireland Limited
and may be transferred to countries outside the European Union. Instagram describes, in general
terms, what
information it receives and how it is used in its Data Use Policy. There you will also find information on how to contact Instagram and on the options available for managing ad settings. The Privacy Policy is available at the following link: https://privacycenter.instagram.com/policy
Facebook does not clearly and conclusively specify how Instagram uses data from visits to Instagram pages for its own purposes, to what extent activity on the Instagram page is attributed to individual users, how long Facebook stores this data, or whether data from a visit to the Instagram page is passed on to third parties; we are not aware of this information. When you access an Instagram page, the IP address assigned to your device is transmitted to Instagram. According to Instagram, this IP address is anonymised (in the case of 'German' IP addresses) and deleted after 90 days. Instagram also stores information about its users'
devices (e.g. as part of the 'login notification' feature); where applicable, this may enable Instagram
to associate IP addresses with individual users. If you are currently logged in to Instagram, there is a cookie on your device containing your Instagram ID. This enables Instagram to track that you have visited this page and how you have used it. This also applies to all other Instagram pages. If you wish to avoid this, you should log out of Instagram or disable the 'stay logged in' function, delete the cookies stored on your device, and close and restart your browser. This will delete any Instagram information that could be used to directly identify
you. This allows you to use our Instagram page without your Instagram ID being revealed. If you access interactive features on the page (such as 'Like', 'Comment', 'Share' or 'Messages'), an Instagram login screen will appear. Once you have logged in, Instagram will once again recognise you as a specific user. You can find information on how to manage or delete the information Instagram holds about you
on the following Instagram Support pages: https://help.instagram.com/519522125107875/?helpref=hc_fnav&bc[0]=Instagram-Help-Centre&bc[1]=Privacy%20and%20Security

As the provider of this information service, we also collect and process the following data arising from
your use of our service: publicly visible data from the data subject's user profile. This
includes, for example, the username, profile picture and the content of comments posted in response to our posts.
Further information on Instagram and other social media platforms, and on how you can protect your data, can also be found at https://youngdata.de

10.3 Presence on TikTok
We use the TikTok platform to upload our own videos and make them publicly available.
TikTok is a service provided by a third party not affiliated with us, namely TikTok
Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland.
Please note that TikTok may use its own tracking tools, for which TikTok itself is responsible; please refer to TikTok's privacy policy for further details: https://www.tiktok.com/legal/privacy-policy?lang=de

10.4 Presence on YouTube
We use the YouTube.com platform to upload our own videos and make them publicly available. YouTube is a service provided by a third party not affiliated with us, namely Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Some web pages on our website contain links to YouTube. As a general rule, we are not responsible for the content of websites to which links are provided. However, should you follow a link to YouTube, please note that YouTube stores its users' data (e.g. personal information, IP address) in accordance with its own data usage policies and uses it for commercial purposes. YouTube content is embedded only in 'enhanced privacy mode'. YouTube provides this itself and thereby ensures that YouTube does not initially store any cookies on your device. However, when you access the relevant pages, your IP address and the additional data mentioned in section 4 are transmitted, thereby revealing, in particular, which of our web pages you have visited. This information cannot, however, be linked to you unless you have logged in to YouTube or another Google service (e.g. Google+) before accessing the page, or are permanently logged in. As soon as you start playing an embedded video by clicking on it, YouTube's enhanced privacy mode ensures that only cookies that do not contain any personally identifiable data are stored on your device, unless you are currently logged in to a Google service. These cookies can be prevented by adjusting your browser settings or using browser extensions. Address and link to the third-party provider's privacy policy:
Google/YouTube: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland –
Privacy policy: https://policies.google.com/privacy
Opt-out: https://adssettings.google.com/authenticated

11) Online Shop

Purchase of vouchers, products, packages, and admission tickets:
If you reserve a date-specific thermal bath admission, purchase vouchers, or acquire other products in our online shop on our website, the data you enter will be processed for the following purposes:
• To identify you as a customer and to process, fulfill, and handle your order
• Necessary correspondence with you regarding contract fulfillment
• Invoicing and handling of any potential liability claims
• Assertion, exercise, and defense of legal claims against you
In doing so, we process the following personal data:
• Form of address
• Surname, first name
• Street, postal code, city/town, country
• Telephone number
• E-mail address
• Password (optional; only if you create a customer account)
• Reservation history
Consequently, our processing serves the performance of a contract within the meaning of
Art. 6 (1) (b) GDPR.
We also process and use your data
• to create a customer account (optional; only if you create a customer account);
• to contact you, if requested by you or if necessary within the scope of a contractual relationship or permitted by law;
• for electronic advertising pursuant to Section 7 (3) UWG (Act Against Unfair Competition) for similar services offered by Thermen & Badewelt Sinsheim via e-mail, provided we obtained your e-mail address in connection with the sale of a service and you do not object to the use of your e-mail address. You may object to this use of your e-mail address at any time without incurring any costs other than the transmission costs at basic rates. If this legal basis does not justify electronic advertising, we will instead obtain your consent pursuant to Art. 6(1)(a) GDPR.
You may withdraw this consent at any time by clicking the unsubscribe link at the
end of the respective email newsletter.
Personal data collected by us is only disclosed to third parties where necessary for
contract performance or required by law:
• Contracts pursuant to Art. 28 GDPR have been concluded with any engaged data processors
to ensure secure data processing that complies with data protection regulations.
• Personal data collected by us is disclosed to the transport company commissioned with delivery
as part of contract performance, insofar as this is necessary for the delivery of the goods.
• We disclose your payment details to the commissioned financial institution for the purpose of processing payments.
Transfers to government bodies or authorities take place only
in accordance with mandatory national legal provisions.

12) Payment Services

12.1 Payment via Mastercard
When paying by credit card (Mastercard), we transmit your payment data to Mastercard Inc. as part of the payment processing procedure. Mastercard Europe SA (Chaussée de Tervuren 198A, B-1410 Waterloo, Belgium) is responsible for the European region. You can find out more about the data processed through the use of Mastercard in the privacy policy at: https://www.mastercard.de/de-de/datenschutz.html

12.2 Payment via Visa
When paying by credit card (Visa), we transmit your payment data to Visa Inc. as part of the payment processing procedure. Visa Europe Services Inc. (1 Sheldon Square, London W2 6TT, Great Britain) is responsible for the European region.
You can find out more about the data processed through the use of Visa in the privacy policy at: https://www.visa.de/nutzungsbedingungen/visa-globale-datenschutzmitteilung/mitteilung-zu-zustandigkeitsfragen-fur-den-ewr.html

12.3 Payment via PayPal
When paying via PayPal, credit card via PayPal, direct debit via PayPal, or—if offered—"purchase on invoice" via PayPal, we transmit your payment data to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter "PayPal"), as part of the payment processing procedure.
For the payment methods credit card via PayPal, direct debit via PayPal, or—if offered—"purchase on invoice" via PayPal, PayPal reserves the right to conduct a credit check. PayPal uses the result of the credit check regarding the statistical probability of payment default to decide whether to make the respective payment method available. The credit check may contain probability values ​​(so-called score values). To the extent that score values ​​are incorporated into the creditworthiness assessment result, they are based on a scientifically recognized mathematical-statistical method. Address data, among other factors, is included in the calculation of these score values. For further information regarding data protection—including details on the credit agencies used—please refer to PayPal's privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full. This processing is necessary to provide specific content and services on our website. The legal basis for this is Art. 6(1)(a) and (b) of the GDPR.

12.4 Payment via Sofortüberweisung (Instant Transfer)
On our website, we offer payment via "Sofortüberweisung" (instant transfer), among other methods. The provider of this payment service is Sofort GmbH, Theresienhöhe 12, 80339 Munich (hereinafter "Sofort GmbH"). Using the "Sofortüberweisung" procedure, we receive a payment confirmation from Sofort GmbH in real time and can immediately begin fulfilling our obligations. If you choose the "Sofortüberweisung" payment method, you transmit your PIN and a valid TAN to Sofort GmbH, allowing them to log in to your online banking account. After logging in, Sofort GmbH automatically checks your account balance and executes the transfer to us using the TAN you provided.

Subsequently, they immediately transmit a transaction confirmation to us. After logging in, your transactions, overdraft limit, and the existence of other accounts (as well as their balances) are also automatically checked. In addition to the PIN and TAN, the payment details you entered and your personal data are transmitted to Sofort GmbH. Personal data includes your first and last name, address, telephone number(s), e-mail address, IP address, and, where applicable, other data required for processing the payment. The transmission of this data is necessary to verify your identity beyond doubt and to prevent fraud attempts.

Your data is transmitted to Sofort GmbH based on Article 6(1)(a) and (b) of the GDPR. You may revoke your consent to data processing at any time. Such a revocation does not affect the validity of data processing operations that have already taken place.

For details regarding payment via Sofortüberweisung, please refer to the following links:
https://www.sofort.de/datenschutz.html

12.5 Payment via Amazon Pay
When paying via Amazon Pay, we transmit your payment data—primarily to Amazon Payments Europe s.c.a., and secondarily to Amazon EU SARL, Amazon Services Europe SARL, and Amazon Media EU SARL (all three based at 5, Rue Plaetis, L-2338 Luxembourg; collectively "Amazon Payments")—as part of the payment processing procedure. Amazon Payments reserves the right to conduct a credit check. Amazon Payments uses the result of this credit check—specifically regarding the statistical probability of payment default—to decide whether to make the respective payment method available. The credit check may include probability values ​​(so-called "score values"). Where score values ​​are included in the credit check result, they are based on a scientifically recognized mathematical-statistical method. Address data, among other factors, is incorporated into the calculation of these score values. Furthermore, Amazon Payments is entitled to share your data with third parties, including—but not limited to—banks, e-service providers, service partners, auditors, analytics services, credit agencies, marketing partners, cloud service providers, retargeting providers, and affiliated companies. The legal basis for this is Article 6(1)(a) and (b) of the GDPR. For further information regarding data protection—including details on the credit agencies used—please consult the Amazon Payments privacy policy:
pay.amazon.com/de/help/201751600

12.6 Payment via Apple Pay
For the "Apple Pay" payment method provided by Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, payment is processed via the "Apple Pay" function on your device (running iOS, watchOS, or macOS) by charging a payment card stored in Apple Pay. Apple Pay employs security features integrated into your device's hardware and software to protect your transactions. Consequently, authorizing a payment requires entering a passcode you have previously set and verifying the transaction using your device's "Face ID" or "Touch ID" function.

To process the payment, the information you provided during the ordering process, along with details about your order, is transmitted to Apple in encrypted form. Apple then re-encrypts this data using a developer-specific key before transmitting it to the payment service provider associated with the payment card stored in Apple Pay to execute the payment. This encryption ensures that only the website where the purchase was made can access the payment data. Once the payment has been made, Apple sends your device account number and a transaction-specific, dynamic security code to the originating website to confirm the successful payment. If personal data is processed during these transmissions, such processing occurs solely for the purpose of payment processing in accordance with Art. 6(1)(b) GDPR. Apple retains anonymized transaction data, including the approximate purchase amount, the approximate date and time, and an indication of whether the transaction was successfully completed. Anonymization ensures that any link to a specific individual is completely excluded. Apple uses this anonymized data to improve "Apple Pay" and other Apple products and services. When you use Apple Pay on an iPhone or Apple Watch to complete a purchase initiated via Safari on a Mac, the Mac and the authorizing device communicate via an encrypted channel on Apple's servers. Apple does not process or store any of this information in a format that could identify you personally. You can disable the option to use Apple Pay on your Mac via your iPhone's settings. Go to "Wallet & Apple Pay" and disable "Allow Payments on Mac".
For further information on Apple Pay privacy, please visit the following website:
https://support.apple.com/de-de/HT203027

13 Direct Marketing
13.1 Description and scope of data processing

Our company processes personal data, such as your name and address, to send you advertising by mail and thereby increase sales of goods or services.

13.2 Legal basis for data processing

The legal basis for processing your personal data for the purpose of direct marketing by mail is Art. 6(1)(f) GDPR.

13.3 Purpose of data processing

The purpose of processing your personal data for direct marketing by mail is to promote the sale of goods or services. This purpose constitutes our legitimate interest in processing the data pursuant to Art. 6(1)(f) GDPR.

13.4 Storage period

Your personal data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected; this applies in particular upon receipt of an objection.

13.5 Right to object and removal options
You may object to the processing of your personal data for direct marketing by mail
at any time, with effect for the future.

14) 14 Processing activities outside of joint controllership
14.1 Registration for applicant days
14.1.1 Description and scope of data processing

You can register on our website to participate in our applicant days, which are designed to facilitate the application process for you. Consequently, the processing of your personal data contributes to the organization or implementation of pre-contractual measures.
The following data is stored during registration:
• Salutation*
• First name*
• Last name*
• Street and house number*
• Postal code*
• City/Town*
• Country*
• E-mail*
• Telephone
*Mandatory field

It is also possible to upload application documents (CV, certificates, etc.) at the time of registration. We treat these documents with strict confidentiality; they serve to help us prepare individually for your participation in the applicant day. Reference is made to this privacy policy regarding data processing during the registration process.

14.1.2 Legal basis for data processing

The legal basis for processing your personal data in connection with registration for the applicant day is Art. 6(1)(b) GDPR in conjunction with Section 26 BDSG (Federal Data Protection Act).

14.1.3 Purpose of data processing

Your registration serves to facilitate the application process and enables the simplified conclusion of contracts between you and us. Processing your personal data as part of the registration process is therefore necessary to initiate a contract between you and us or to carry out pre-contractual measures.

14.1.4 Duration of storage
Your data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. If you register and the applicant day takes place, we will retain your data at least until the application process has been concluded. In the event of a rejection or the withdrawal of your application, we will retain your documents for a maximum of 6 months for the purpose of asserting, defending, or exercising legal claims; during this time, processing will be restricted to mere storage. If an employment relationship is established, relevant data from your application documents will be transferred to our employee records. Should you withdraw your registration prior to participating in the applicant day, your data will be deleted immediately.

14.1.5 Right to Object and Option for Removal
You have the option to cancel your registration at any time. You may request changes to the personal data stored about you at any time. If your personal data is required for the performance of a contract or to carry out pre-contractual measures, early deletion of your personal data is only possible provided that no contractual or statutory obligations or legitimate interests of the company prevent such deletion.

14.2 Application for a Thermencard / Premiumcard
14.2.1 Handling of Data Processing
You have the option to apply for a Thermencard / Premiumcard online via our website.
We process your data for the following purposes:
• Creation, personalization, provision, and administration of the Thermencard / Premiumcard
• Participation in customer promotions (loyalty gifts, bonuses, special offers) and loyalty programs
• Sending information regarding updates, offers, and promotions related to the Thermencard / Premiumcard (Thermencard / Premiumcard newsletter)
• Sending information by mail
• Regular dispatch of the Thermen & Badewelt Euskirchen email newsletter

14.2.2 Legal Basis for Data Processing
The processing of your data for the individual purposes is based on the following legal grounds:

• Performance of a contract pursuant to Art. 6 (1) (b) GDPR.
• Legitimate interest pursuant to Art. 6 (1) (f) GDPR in accordance with the provisions of Section 7

of the UWG (Act Against Unfair Competition). Legitimate interests pursued by the controller:
The dispatch of print media and the Thermencard / Premiumcard newsletter involves information relevant to Thermencard / Premiumcard users and is based on the controller's legitimate interest in conducting advertising activities. Regardless of the above, we may and will also contact you regarding questions or matters concerning the processing of the Thermencard / Premiumcard, provided this is necessary for the performance of the contract. Our legitimate interest in conducting advertising is not outweighed by any overriding interest of the data subject requiring protection, as we comply with the provisions of Section 7 (3) of the UWG (Act Against Unfair Competition) regarding email advertising. Accordingly, advertising via electronic mail is permitted without prior consent if we obtained your email address in the context of a contractual relationship, the advertising relates only to similar products, you have not objected to the use of your data for advertising purposes, and you are informed of your right to object both when the data is collected and during each instance of promotional use. If you no longer wish to receive advertising from us, you may object to the promotional use of your data for the future at any time. Please contact us at the following address:
datenschutz@badewelt-euskirchen.de or use the unsubscribe link at the bottom of every email newsletter.

14.2.3 Recipients
Your Thermencard / Premiumcard is processed exclusively by authorized employees of Thermen & Badewelt Euskirchen who have been contractually bound in writing to maintain confidentiality. For the purpose of sending electronic newsletters, we work with a data processor with whom a data processing agreement pursuant to Art. 28 GDPR has been concluded.

14.2.4 Storage period
We store your data:
• if processing is based on our legitimate interest, for no longer than until you object to such processing;
• if we require the data for the performance of a contract, for no longer than the duration of the contractual relationship with you or the duration of applicable statutory retention periods. Data stored by us is deleted when it is no longer required for its intended purpose and there are no legitimate interests or statutory retention obligations preventing such deletion. If the data is not deleted because it is required for other purposes permitted by law, its processing is restricted. This means the data is blocked and not processed for other purposes. This applies, for example, to user data that must be retained for commercial or tax law reasons.

14.2.5 Transfer to third countries
Data is not transferred to third countries outside the European Union.

14.2.6 Provision prescribed or required
The provision of your data is required for the creation and, if applicable, issuance of a new Thermencard / Premiumcard in the event of loss.

15) Legal Defense and Enforcement of Rights

15.1 Description and Scope of Data Processing
Our company seeks to protect itself against unjustified claims through legal defense.
Furthermore, we enforce claims and rights to which we are entitled. Processing personal data is necessary for this purpose. This data consists of legally relevant information concerning the data subjects.

15.2 Purpose of Data Processing
The purpose of processing your personal data in the context of legal defense and the enforcement of rights is to fend off unjustified claims and to legally enforce claims and rights. This purpose constitutes our legitimate interest in data processing pursuant to Art. 6(1)(f) GDPR.

15.3 Duration of Storage
Your personal data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected.

15.4 Possibilities for Objection and Removal
Processing your personal data for the purposes of legal defense and the enforcement of rights is strictly necessary for such defense and enforcement. Consequently, there is no possibility for you to object to this processing.

16) Categories of Recipients

Within our company, personal data is accessed by those units and departments that require it to fulfill the aforementioned purposes. In addition, we utilize various service providers and transmit your personal data to other trusted recipients. These may include, for example:
• Banks
• Scanning services
• Print shops
• Mailing houses
• IT service providers
• Lawyers, courts, and public authorities
Personal data is transmitted to countries outside the European Economic Area (EEA) only in the cases mentioned and provided that an adequate level of data protection is guaranteed in accordance with Art. 44 et seq. GDPR. 17) Rights of the data subject

17.1 Right of access
You may request confirmation from the controller pursuant to Art. 15 GDPR as to whether personal data concerning you is being processed by us.
If such processing is taking place, you may request information from the controller pursuant to Art. 15 para. 1 GDPR regarding:
• the purposes for which the personal data is processed,
• the categories of personal data being processed,
• the recipients or categories of recipients to whom the personal data concerning you has been or will be disclosed,
• the planned duration of storage of the personal data concerning you or, if
specific details are not possible, criteria for determining the storage period,
• the existence of a right to rectification or erasure of the personal data concerning you, a right to restriction of processing by us, or a right to object to such processing,
• the existence of a right to lodge a complaint with a supervisory authority,
• all available information regarding the source of the data if the personal data is not collected from the data subject,
• the existence of automated decision-making, including profiling, pursuant to Art. 22
paras. 1 and 4 GDPR and—at least in these cases—meaningful information about the
logic involved as well as the significance and the envisaged consequences of such processing for you. You have the right to request information as to whether the personal data concerning you is being transferred to a third country or to an international organization. In this context, you may request to be informed about the appropriate safeguards pursuant to Art. 46 GDPR regarding the transfer.
If such data is transferred to a third country or an international organization, you have the right, pursuant to Art. 15(2) GDPR, to be informed of the appropriate safeguards under Art. 46 GDPR regarding the transfer.

17.2 Right to rectification
Under Art. 16 GDPR, you have the right to rectification and/or completion vis-à-vis the controller if the processed personal data concerning you is incorrect or incomplete. We must carry out the rectification without undue delay.

17.3 Right to restriction of processing
As set out in Art. 18(1) GDPR, you may request the restriction of the processing of personal data concerning you under the following conditions:
• if you contest the accuracy of the personal data concerning you for a period enabling the controller to verify the accuracy of the personal data (Art. 18(1)(a) GDPR),
• the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead (Art. 18(1)(b) GDPR),
• we no longer need the personal data for the purposes of the processing, but they are required by you for the establishment, exercise, or defense of legal claims (Art. 18(1)(c) GDPR),
• if you have objected to processing pursuant to Art. 21(1) GDPR and it has not yet been determined whether our legitimate grounds override yours (Art. 18(1)(d) GDPR).
Where the processing of personal data concerning you has been restricted, such personal data shall—with the exception of storage—only be processed with your consent or for the establishment, exercise, or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State (Art. 18(2) GDPR).
If the processing has been restricted in accordance with the above conditions, you will be informed by us before the restriction is lifted (Art. 18(3) GDPR). 

17.4 Right to erasure
a) Obligation to erase
Pursuant to Art. 17(1) GDPR, you may request that we erase personal data concerning you without undue delay. We are also obliged to erase such data without undue delay if one of the following grounds applies:
• The personal data concerning you are no longer necessary for the purposes for which they were collected or otherwise processed (Art. 17(1)(a) GDPR).
• You withdraw your consent on which the processing was based pursuant to Art. 6(1)(a) or Art. 9(2)(a) GDPR, and there is no other legal ground for the processing (Art. 17(1)(b) GDPR).
• You object to the processing pursuant to Art. 21(1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21(2) GDPR (Art. 17(1)(c) GDPR).
• The personal data concerning you have been processed unlawfully (Art. 17(1)(d) GDPR).
• The erasure of the personal data concerning you is necessary for compliance with a legal obligation under Union or Member State law to which the controller is subject (Art. 17(1)(e) GDPR).
• The personal data concerning you have been collected in relation to the offer of information society services pursuant to Art. 8(1) GDPR (Art. 17(1)(f) GDPR). b) Information to third parties
If we have made the personal data concerning you public and are obliged to erase it pursuant to Art. 17(1) GDPR, we shall take reasonable measures—including technical measures—taking into account available technology and the cost of implementation, to inform the controllers processing the personal data that you, as the data subject, have requested the erasure of any links to, or copies or replications of, such personal data (Art. 17(2) GDPR).
c) Exceptions
The right to erasure does not apply to the extent that processing is necessary for one of the following reasons:
• for exercising the right of freedom of expression and information
(Art. 17(3)(a) GDPR).
• for compliance with a legal obligation which requires processing by Union or Member State law to which we are subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in us (Art. 17(3)(b) GDPR).
• for reasons of public interest in the area of ​​public health in accordance with Art. 9(2)(h) and (i) and Art. 9(3) GDPR (Art. 17(3)(c) GDPR).
• for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes in accordance with Art. 89(1) GDPR, insofar as the right referred to in section (a) is likely to render impossible or seriously impair the achievement of the objectives of that processing (Art. 17(3)(d) GDPR), or
• for the establishment, exercise, or defense of legal claims.

17.5 Right to be informed
If you have asserted the right to rectification, erasure, or restriction of processing against us, we are obliged under Art. 19 GDPR to communicate this rectification or erasure of data or restriction of processing to all recipients to whom the personal data concerning you have been disclosed, unless this proves impossible or involves disproportionate effort. You have the right to be informed by us about these recipients.

17.6 Right to data portability
Pursuant to Art. 20(1) GDPR, you have the right to receive the personal data concerning you, which you have provided to the controller, in a structured, commonly used, and machine-readable format. Furthermore, you have the right to transmit this personal data to another controller without hindrance from us, provided that:
• the processing is based on consent pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR or on a contract pursuant to Art. 6(1)(b) GDPR (Art. 20(1)(a) GDPR), and
• the processing is carried out by automated means (Art. 20(1)(b) GDPR).
Pursuant to Art. 20(2) GDPR, you also have the right to have the personal data concerning you transmitted directly from us to another controller, where technically feasible.
The exercise of the right under Art. 20(1) GDPR does not affect the right to erasure under Art. 17 GDPR. This does not apply to processing that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. This follows
from Art. 20(3) GDPR.
Pursuant to Art. 20(4) GDPR, the freedoms and rights of other persons must not be adversely affected by this.
The right to data portability does not apply to the processing of personal data necessary for the
performance of a task carried out in the public interest or in the exercise of official authority vested in us.

17.7 Right to object
Pursuant to Art. 21(1) GDPR, you have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions. We will no longer process the personal data concerning you unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or if the processing serves the establishment, exercise, or defense of legal claims. Where personal data concerning you are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing; this also applies to profiling to the extent that it is related to such direct marketing (Art. 21(2) GDPR). If you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for such purposes (Art. 21(3) GDPR). In the context of the use of information society services—and notwithstanding Directive 2002/58/EC—you have the option to exercise your right to object by automated means using technical specifications (Art. 21(5) GDPR). You also have the right to object, on grounds relating to your particular situation, to the processing of your personal data for scientific or historical research purposes or for statistical purposes pursuant to Art. 89(1) GDPR, unless the processing is necessary for the performance of a task carried out in the public interest (Art. 21(6) GDPR).

17.8 Right to withdraw consent under data protection law
Pursuant to Art. 7(3) GDPR, you have the right to withdraw your consent under data protection law at any time.
The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. You are informed of this prior to giving your consent.

17.9 Automated individual decision-making, including profiling
You have the right not to be subject to a decision based solely on automated processing—including profiling—which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision
1. is necessary for entering into, or the performance of, a contract between you and

17.10 Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority—particularly in the Member State of your habitual residence, place of work, or place of the alleged infringement—pursuant to Art. 77 GDPR if you consider that the processing of personal data concerning you infringes the GDPR. The supervisory authority with which the complaint has been lodged shall inform the complainant of the progress and the outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR (Art. 77 GDPR).
The competent supervisory authority for us is:
State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW)
https://www.ldi.nrw.de/, poststelle@ldi.nrw.de
The supervisory authority with which you have lodged a complaint will inform you of the progress and the outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR. Our Data Protection Officer is available to answer any questions you may have at any time.
In the context of joint controllership, you are also free to contact one of the relevant supervisory authorities responsible for the other subsidiaries of the Thermengruppe Josef Wund.
State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (LfDI BaWü)
https://www.baden-wuerttemberg.datenschutz.de/, poststelle@lfdi.bwl.de
18) Note regarding the privacy policy

Unless otherwise stipulated, the use of all information we hold about you is subject to this privacy policy. The company reserves the right to continuously update this privacy policy in line with necessary security measures and technological developments, and will announce any changes here.

19) Mouseflow

This website uses Mouseflow, a web analytics tool provided by Mouseflow ApS, Flaesketorvet 68, 1711 Copenhagen, Denmark. Data processing is carried out for the purpose of analyzing this website and its visitors. To this end, data is collected and stored for marketing and optimization purposes. Pseudonymized usage profiles may be created from this data. Cookies may be used for this purpose. The Mouseflow web analytics tool records randomly selected individual visits (using only anonymized IP addresses). This creates a log of mouse movements and clicks, with the aim of playing back selected website visits on a random sample basis and deriving potential improvements for the website. Data collected via Mouseflow is not used to personally identify visitors to this website without the data subject's explicit consent, nor is it combined with personal data regarding the holder of the pseudonym. Processing is based on Art. 6(1)(f) GDPR, reflecting the legitimate interest in direct customer communication and in designing the website to meet user needs. You have the right to object at any time—on grounds relating to your particular situation—to the processing of personal data concerning you that is based on Art. 6(1)(f) GDPR. To do so, you can globally deactivate recording for the browser you are currently using across all websites that employ Mouseflow by visiting the following link: https://mouseflow.de/opt-out/ 
If you are interested in a data processing agreement, you can conclude one with us directly online via RightSignature: https://mouseflow.de/gdpr/ 

20) Marketing Automation with HubSpot

We use the service HubSpot on this website for various purposes. HubSpot is a US-based software company located at 25 First Street, Cambridge, MA 02141, USA.
HubSpot is an integrated software solution that allows us to manage various aspects of our online marketing. These include, among others:
• Email marketing / newsletter distribution via various subscription models
• Social media publishing & reporting
• Reporting
• Contact management (e.g., user segmentation & CRM)
• Landing pages
• Contact forms
Our sign-up service enables website visitors to learn more about our company, download content, and provide their contact details as well as other demographic information. This information, along with our website content, is stored on HubSpot servers. We may use this data to contact website visitors and determine which of our company's services are of interest to them. All information we collect is subject to this privacy policy. We use all collected information exclusively to optimize our marketing efforts and to contact interested website visitors.
HubSpot tracks visitors using browser cookies. Whenever visitors land on the website, the HubSpot software checks for the presence of a tracking cookie. If no cookie is found, one is assigned to the user. This cookie logs all subsequent pages visited by that individual. As part of the optimization of our marketing activities, the following data may be collected and processed via HubSpot:
• Geographic location
• Browser type
• Navigation information
• Referral URL
• Performance data
• Information on the frequency of application usage
• Mobile app data
• Login information for the HubSpot subscription service
• Files viewed locally
• Domain names
• Pages viewed
• Aggregate usage
• Operating system version
• Internet Service Provider (ISP)
• IP address
• Device identifier
• Duration of visit
• Source of application download
• Operating system
• Events occurring within the application
• Access times
• Clickstream data
• Device model and version
In addition, we use HubSpot to provide contact forms.
The legal basis for this processing is your consent pursuant to Art. 6(1)(a) GDPR. If you do not wish for the aforementioned data to be collected and processed via HubSpot, you may refuse to give your consent or withdraw it at any time with effect for the future.
Personal data is retained for as long as necessary to fulfill the purpose of processing. The data is deleted as soon as it is no longer required to achieve that purpose. Data may be transferred to the USA as part of processing via HubSpot. The security of the transfer is safeguarded by Standard Contractual Clauses, which ensure that the processing of personal data is subject to a level of security equivalent to that of the GDPR. Should the Standard Contractual Clauses prove insufficient to establish an adequate level of security, your consent pursuant to Art. 49(1)(a) GDPR may serve as the legal basis for the transfer to third countries. Further information on HubSpot is available at: https://legal.hubspot.com/de/privacy-policy 

21) Walls.io plugin

Our website uses social media plugins or widgets from Walls.io. When you access these plugins, your IP address and cookie information are transmitted to Walls.io, solely due to technical requirements for offering the service. This data is only stored by Walls.io in Europe and is not passed on to third parties.
We use the Walls.io plugins to display a social media wall on our website. Walls.io aggregates content from over 15 platforms including Facebook, Twitter, Instagram, YouTube and Pinterest. These will be published live on our website. For further information on data processing by Walls.io, please see Walls.io's privacy policy at https://walls.io/privacy . Walls.io is operated by "Die Socialisten" Social Software Development GmbH, Andreasgasse 6, Top 1, 1070 Vienna, Austria. By using our website, you consent to the collection and processing of information by Social Software Development GmbH as described. The operation of Walls.io on our websites can be restricted or completely prevented via your browser settings; however, doing so means you will not be able to use the social media wall on our website.

22) Facebook Presence

We maintain a Facebook page to expand our online presence. This service is provided by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
Please note that you use this Facebook page and its functions at your own risk. This applies in particular to the use of interactive functions (e.g., commenting, sharing, rating).
When you visit our Facebook page, Facebook collects, among other things, your IP address and other information stored in cookies on your computer. This information is used to provide us, as the operator of the Facebook page, with statistical data regarding the use of the page. Facebook provides further information on this at the following link: https://de-de.facebook.com/help/pages/insights .
The data collected about you in this context is processed by Facebook Ltd. and may be transferred to countries outside the European Union. Facebook describes in general terms what information it receives and how that information is used in its Data Policy. There, you can also find information on how to contact Facebook and on settings options for advertisements. The Data Policy is available at the following link:
https://de-de.facebook.com/about/privacy 
You can find Facebook's complete data policies here:
https://de-de.facebook.com/help/568137493302217 
Facebook does not clearly or conclusively state—and we do not know—how it uses data from visits to Facebook pages for its own purposes, the extent to which activity on the Facebook page is linked to individual users, how long Facebook retains this data, or whether data from a visit to the Facebook page is passed on to third parties.
When a Facebook page is accessed, the IP address assigned to your device is transmitted to Facebook. According to Facebook, this IP address is anonymized (in the case of "German" IP addresses) and deleted after 90 days. Furthermore, Facebook stores information about its users' devices (e.g., via the "login notification" feature); this may enable Facebook to link IP addresses to individual users.
If you are currently logged into Facebook, a cookie containing your Facebook ID is stored on your device. This allows Facebook to track the fact that you have visited this page and how you have used it. This applies to all other Facebook pages as well. Facebook buttons embedded in websites allow Facebook to record your visits to those sites and link them to your Facebook profile. This data can be used to tailor content or advertising to you.
If you wish to avoid this, you should log out of Facebook (or disable the "keep me logged in" feature), delete the cookies stored on your device, and close and restart your browser. This deletes Facebook-related information that could directly identify you, allowing you to use our Facebook page without revealing your Facebook ID. If you access interactive features on the page (such as "Like," comment, share, messages, etc.), a Facebook login prompt will appear. Once you log in, Facebook will once again be able to identify you as a specific user. You can find information on how to manage or delete information held about you on the following Facebook Support pages: https://de-de.facebook.com/about/privacy# 

As the provider of the information service, we also collect and process the following data resulting from your use of our service: publicly viewable data from the data subject's user profile. This includes, for example, the username, profile picture, and the content of comments posted on our contributions.
You can also find further information about Facebook and other social networks, as well as how to protect your data, at youngdata.de.

23) Instagram

Our website uses plugins from the Instagram network, which is operated by Facebook Inc. 1601 S. California Ave, Palo Alto, CA 94304, USA ("Facebook").
When you click on the Instagram button, the plugin establishes a direct connection between your browser and the Instagram server. This sends Instagram the information that you have visited our site with your IP address.
We do not know the purpose and scope of the data collection and the further processing and use of this data by Instagram. In this regard and with regard to your rights and setting options to protect your privacy, we ask you to observe Instagram's corresponding data protection information: https://help.instagram.com/155833707900388 

24) Online Shop

When you reserve a date-specific thermal spa admission, purchase vouchers, or acquire other products via our website's online shop, the data you enter is processed for the following purposes:
• To identify you as a customer and to process, fulfill, and handle your order
• Necessary correspondence with you regarding contract fulfillment
• Invoicing and the handling of any potential liability claims
• Assertion, exercise, and defense of legal claims against you
In doing so, we process the following personal data:
• Form of address
• Surname, first name
• Street, postal code, city/town, country
• Telephone number
• E-mail address
• Password (optional; only if you create a customer account)
• Reservation history
Consequently, our processing serves the performance of a contract pursuant to
Art. 6 (1) (b) GDPR.
We also process and use your data
• to create a customer account (optional; only if you create a customer account);
• to contact you, if requested by you, or where necessary within the scope of a contractual relationship, or where permitted by law.
• For electronic advertising pursuant to Section 7 (3) of the UWG (Act Against Unfair Competition) regarding similar services offered by Thermen & Badewelt Sinsheim via e-mail, provided we obtained your e-mail address in connection with the sale of a service and you do not object to the use of said address. You may object to this use of your e-mail address at any time without incurring costs other than the transmission costs at basic rates. Should this legal basis prove insufficient to justify electronic advertising, we will instead obtain your consent pursuant to Art. 6 (1) (a) GDPR. You may revoke this consent at any time by clicking the unsubscribe link at the bottom of the respective e-mail newsletter. Personal data collected by us is only disclosed to third parties if necessary for contract fulfillment or required by law:
• Contracts pursuant to Art. 28 GDPR have been concluded with any engaged data processors to ensure secure data processing that complies with data protection regulations.
• During the ordering and shipping process, employees of WUND Holding—and, where applicable, Bluphoria GmbH—may view personal data related to the order when the relevant packages are being packed and prepared for shipment.
• Personal data collected by us is disclosed to the transport company commissioned with delivery as part of contract fulfillment, insofar as this is necessary for the delivery of the goods.
• We disclose your payment data to the commissioned financial institution for the purpose of processing payments. Data is transmitted to government institutions or authorities only where required by mandatory national legal provisions.

PayPal:
When paying via PayPal, credit card via PayPal, direct debit via PayPal, or—if offered—"purchase on invoice" via PayPal, we disclose your payment data to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter "PayPal") for the purpose of payment processing.
For the payment methods of credit card via PayPal, direct debit via PayPal, or—if offered—"purchase on invoice" via PayPal, PayPal reserves the right to conduct a credit check. PayPal uses the result of the credit check regarding the statistical probability of payment default to decide whether to make the respective payment method available.
The credit check may include probability values ​​(so-called score values). Where score values ​​are included in the credit check result, they are based on a scientifically recognized mathematical-statistical procedure. Address data, among other factors, is incorporated into the calculation of these score values. For further information regarding data protection—including details on the credit reference agencies used—please consult PayPal's privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full. This is necessary for providing certain content and services on our website.

Sofortüberweisung (Instant Transfer):
We offer payment via "Sofortüberweisung" (instant transfer) on our website, among other options. The provider of this payment service is Sofort GmbH, Theresienhöhe 12, 80339 Munich (hereinafter "Sofort GmbH").
Using the "Sofortüberweisung" process, we receive a payment confirmation from Sofort GmbH in real time and can immediately begin fulfilling our obligations.
If you choose the "Sofortüberweisung" payment method, you transmit your PIN and a valid TAN to Sofort GmbH, enabling them to log in to your online banking account. https://pay.amazon.com/de/help/201751600 

25) Netigate

This website uses Netigate to send Net Promoter Score emails. The provider is Netigate Deutschland GmbH, Untermainkai 27-28, 60329 Frankfurt am Main, Germany.
Net Promoter Score emails enable us to conduct customer surveys. This allows us, for example, to analyze whether—or how likely—customers are to recommend us to others.
Detailed information regarding Netigate's functions can be found at the following link: https://www.netigate.net/de/ .
Personal data may be processed during the customer survey.

Data processing is based on a legitimate interest pursuant to Art. 6(1)(f) GDPR in conjunction with Section 7(3) of the German Act Against Unfair Competition (UWG). You may object to this data processing at any time. The lawfulness of data processing operations already carried out remains unaffected by such an objection.
The data you have provided to us for the purpose of sending emails will be stored by us and/or Netigate until such time as you object; following an objection to the email dispatch, the data will be deleted.
For further details, please refer to Netigate's privacy policy at: https://www.netigate.net/de/impressum/#legal We have entered into a data processing agreement (DPA) with Netigate in accordance with Art. 28 GDPR.

Use of Netigate and Lumoa for customer surveys and feedback analysis

We use the survey tool Netigate to send and conduct customer surveys (e.g., Net Promoter Score) and the analysis tool Lumoa for the further evaluation of the customer feedback collected. Data collected during the surveys (e.g., contact details, survey responses, free-text feedback) is initially captured via Netigate and subsequently transmitted to Lumoa for automated analysis and classification. Lumoa is used for evaluation purposes (e.g., text analysis, sentiment analysis, classification, and deriving insights) to enable us to analyze feedback in a more structured manner and use it to improve quality and products.

Legal basis and purposes

The legal basis for processing is Art. 6(1)(f) GDPR (legitimate interest: improving products/services and customer satisfaction) or, where applicable, Art. 6(1)(a) GDPR (consent), provided consent is obtained. Data processing is carried out exclusively for the stated purposes.

Data processing and responsibilities

Netigate and Lumoa process the data on our behalf as data processors; we have concluded appropriate data processing agreements with both providers. Data is only disclosed to other third parties to the extent necessary to fulfill the stated purposes.

26) Application for a Thermencard / Premiumcard

26.1 Processing details: You have the option to apply for a Thermencard/Premiumcard online via our website. We process your data for the following purposes: • Creation, personalization, provision, and administration of the Thermencard/Premiumcard • Participation in customer promotions (loyalty gifts, bonuses, special offers) and loyalty programs • Sending information regarding updates, offers, and promotions related to the Thermencard/Premiumcard (Thermencard/Premiumcard newsletter) • Sending information by mail • Regular dispatch of the Therme Euskirchen email newsletter

26.2 Legal basis for data processing: The processing of your data for the individual purposes is based on the following legal grounds:
• Performance of a contract pursuant to Art. 6 (1) (b) GDPR
• Legitimate interest pursuant to Art. 6 (1) (f) GDPR in accordance with the provisions of Section 7 of the German Act Against Unfair Competition (UWG).
Legitimate interests pursued by the controller:
The dispatch of print media and the Thermencard/Premiumcard newsletter involves information relevant to Thermencard/Premiumcard users and is based on the controller's legitimate interest in conducting advertising. Regardless of this, we may and will also contact you regarding questions or issues concerning the administration of the Thermencard/Premiumcard, provided this is necessary for the performance of the contract.
Our legitimate interest in conducting advertising is not outweighed by any overriding interest of the data subject requiring protection, as we comply with the provisions of Section 7 (3) UWG regarding email advertising. Accordingly, advertising via email is permitted without prior consent if we obtained your email address in the context of a contractual relationship, the advertising relates only to similar products, you have not objected to the use of your data for advertising purposes, and you are informed of your right to object both when the data is collected and during each instance of promotional use.
If you do not wish to receive further advertising from us, you may object to the use of your data for advertising purposes at any time with future effect. Please contact us at the following address: datenschutz@badewelt-euskirchen.de  or use the unsubscribe link at the end of every email newsletter.

26.3 Recipients

Your Thermencard/Premiumcard is processed exclusively by authorized employees of Thermen & Badewelt Euskirchen GmbH who have been contractually bound in writing to maintain confidentiality. For the purpose of sending electronic newsletters, we work with a data processor with whom a data processing agreement pursuant to Art. 28 GDPR has been concluded.

26.4 Storage period

We store your data:
• if processing is based on our legitimate interest, for no longer than until you object to such processing.
• if we require the data to perform a contract, for no longer than the duration of the contractual relationship with you or the duration of statutory retention periods.
Data stored by us is deleted when it is no longer required for its intended purpose and provided that no legitimate interests or statutory retention obligations prevent such deletion.
If data is not deleted because it is required for other legally permissible purposes, its processing is restricted. This means the data is blocked and not processed for other purposes. This applies, for example, to user data that must be retained for commercial or tax law reasons.

26.5 Transfer to third countries
Data is not transferred to third countries outside the European Union.

26.6 Provision mandatory or required
Providing your data is necessary for the creation and, if applicable, re-issuance of a new Thermencard/Premiumcard in the event of loss.
27) Direct marketing

27.1 Description and scope of data processing
Our company processes personal data, such as your address and name, to send you advertising by mail and thereby increase sales of goods or services. 27.2 Legal basis for data processing
The legal basis for the processing of your personal data for the purpose of direct marketing by mail is Article 6(1)(f) of the EU GDPR.

27.3 Purpose of data processing
The purpose of processing your personal data for direct marketing by mail is to promote the sale of goods or services. This purpose constitutes our legitimate interest in data processing pursuant to Article 6(1)(f) of the EU GDPR.

27.4 Duration of storage
Your personal data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected; this applies in particular upon receipt of an objection.

27.5 Right to object and options for removal
You may object to the processing of your personal data for direct marketing by mail at any time with effect for the future.

28) Legal Defense and Enforcement of Legal Claims

28.1 Description and Scope of Data Processing
Our company seeks to protect itself against unjustified claims through legal defense. Furthermore, we enforce claims and rights to which we are entitled.
Processing personal data is necessary for this purpose.
This data consists of legally relevant information concerning the data subjects.

28.2 Purpose of Data Processing
The purpose of processing your personal data in the context of legal defense and the enforcement of legal claims is to fend off unjustified claims and to legally enforce our rights and entitlements. Our legitimate interest in processing the data pursuant to Art. 6(1)(f) of the EU GDPR lies in this purpose.

28.3 Duration of Storage
Your personal data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected.

28.4 Possibilities for Objection and Removal
Processing your personal data for the purposes of legal defense and the enforcement of legal claims is strictly necessary for these activities. Consequently, there is no option for you to object to this processing.

29) Categories of Recipients

Within our company, access to personal data is granted to those units and departments that require it to fulfill the aforementioned purposes. In addition, we utilize various service providers and transmit your personal data to other trusted recipients. These may include, for example:

Banks
Scanning services
Printing companies
Mailing houses (lettershops)
IT service providers
Lawyers and courts

30) Rights of Data Subjects

30.1 Right of Access
You may request confirmation from the controller, in accordance with Art. 15 of the EU GDPR, as to whether or not personal data concerning you is being processed by us. If such processing takes place, you may request information from the controller pursuant to Art. 15(1) of the EU GDPR regarding the following:

the purposes for which the personal data are processed
the categories of personal data being processed
the recipients or categories of recipients to whom the personal data concerning you have been or will be disclosed
the planned duration for which the personal data concerning you will be stored or, if specific details are not possible, the criteria used to determine the storage period
the existence of a right to rectification or erasure of the personal data concerning you, a right to restriction of processing by us, or a right to object to such processing
the existence of the right to lodge a complaint with a supervisory authority
all available information regarding the source of the data, if the personal data are not collected from the data subject
the existence of automated decision-making, including profiling, pursuant to Art. 22(1) and (4) of the EU GDPR and—at least in these cases—meaningful information about the logic involved as well as the significance and envisaged consequences of such processing for you. You have the right to request information as to whether the personal data concerning you are being transferred to a third country or an international organization. In this context, you may request to be informed of the appropriate safeguards pursuant to Art. 46 of the EU GDPR regarding the transfer. If this data is transferred to a third country or an international organization, you have the right, pursuant to Art. 15(2) of the EU GDPR, to be informed of the appropriate safeguards under Art. 46 of the EU GDPR regarding the transfer.

30.2 Right to rectification
Pursuant to Art. 16 of the EU GDPR, you have the right to obtain from the controller the rectification and/or completion of the personal data concerning you if such data is incorrect or incomplete. We must carry out the rectification without undue delay.

30.3 Right to restriction of processing
As provided for in Art. 18(1) of the EU GDPR, you may request the restriction of the processing of personal data concerning you under the following conditions:

if you contest the accuracy of the personal data concerning you for a period enabling the controller to verify the accuracy thereof (Art. 18(1)(a) of the EU GDPR)
the processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead (Art. 18(1)(b) of the EU GDPR)
we no longer need the personal data for the purposes of the processing, but you require it for the establishment, exercise, or defense.

30.4 Right to erasure

a) Obligation to erase

Pursuant to Art. 17(1) of the EU GDPR, you may request that we erase personal data concerning you without undue delay. We are also obliged to erase such data without undue delay if one of the following grounds applies:

The personal data concerning you are no longer necessary for the purposes for which they were collected or otherwise processed. (Art. 17(1)(a) EU GDPR)
You withdraw your consent on which the processing was based pursuant to Art. 6(1)(a) or Art. 9(2)(a) EU GDPR, and there is no other legal ground for the processing. (Art. 17(1)(b) EU GDPR)
You object to the processing pursuant to Art. 21(1) EU GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21(2) EU GDPR. (Art. 17(1)(c) EU GDPR)
The personal data concerning you have been processed unlawfully. (Art. 17(1)(d) EU GDPR)
The erasure of the personal data concerning you is necessary for compliance with a legal obligation under Union or Member State law to which the controller is subject. (Art. 17(1)(e) EU GDPR)
The personal data concerning you have been collected in relation to the offer of information society services pursuant to Art. 8(1) EU GDPR. (Art. 17(1)(f) GDPR)

b) Information to third parties

If we have made the personal data concerning you public and are obliged to erase it pursuant to Art. 17(1) GDPR, we shall take reasonable measures—including technical measures—taking into account available technology and the cost of implementation, to inform controllers processing the personal data that you, as the data subject, have requested them to erase any links to, or copies or replications of, such personal data. (Art. 17(2) GDPR)

c) Exceptions

The right to erasure does not apply to the extent that processing is necessary:

for exercising the right of freedom of expression and information (Art. 17(3)(a) GDPR)
for compliance with a legal obligation which requires processing by Union or Member State law to which we are subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in us (Art. 17(3)(b) GDPR)
for reasons of public interest in the area of ​​public health in accordance with Art. 9(2)(h) and (i) and Art. 9(3) GDPR (Art. 17(3)(c) GDPR)
for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes in accordance with Art. 89(1) GDPR, insofar as the right referred to in section a) is likely to render impossible or seriously impair the achievement of the objectives of that processing, or (Art. 17(3)(d) GDPR)
for the establishment, exercise, or defense of legal claims. (Art. 17(3)(e) GDPR)

30.5 Right to be informed
If you have exercised the right to rectification, erasure, or restriction of processing against us, we are obliged under Art. 19 GDPR to communicate this rectification or erasure of data or restriction of processing to all recipients to whom the personal data concerning you have been disclosed, unless this proves impossible or involves disproportionate effort. You have the right to be informed by us about these recipients.

30.6 Right to data portability
Pursuant to Art. 20(1) of the EU GDPR, you have the right to receive the personal data concerning you, which you have provided to the controller, in a structured, commonly used, and machine-readable format. You also have the right to transmit this personal data to another controller without hindrance from us, provided that

the processing is based on consent pursuant to Art. 6(1)(a) or Art. 9(2)(a) of the EU GDPR or on a contract pursuant to Art. 6(1)(b) of the EU GDPR, and (Art. 20(1)(a) of the EU GDPR)
the processing is carried out by automated means (Art. 20(1)(b) of the EU GDPR)

Furthermore, pursuant to Art. 20(2) of the EU GDPR, you have the right to have the personal data concerning you transmitted directly from us to another controller, where technically feasible.
The exercise of the right under Art. 20(1) of the EU GDPR does not affect the right to erasure under Art.

The competent supervisory authority for this website is:
The State Commissioner for Data Protection and Information Security of North Rhine-Westphalia (LDI NRW)
https://www.ldi.nrw.de/, poststelle@ldi.nrw.de

The supervisory authority with which you lodged the complaint will inform you of the status and outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 of the EU GDPR. Our Data Protection Officer is available to answer any questions you may have at any time.

31) Note regarding the Privacy Policy

Unless otherwise stipulated, the use of all information we hold about you is subject to this Privacy Policy. The company reserves the right to continuously update this Privacy Policy to reflect necessary security measures in line with technological developments and will announce any changes here.

As of: May 2025