Privacy Policy

Privacy Policy in accordance with the GDPR

1 Name and address of the data controller
WUND Holding GmbH, Badeparadies Schwarzwald TN GmbH, Badewelt Sinsheim GmbH, Thermen & Badewelt Euskirchen GmbH and Therme Horizon GmbH (formerly BLUPHORIA GmbH) act as joint controllers with regard to the processing of personal data in the area of 'Central Customer Management' in accordance with Article 26 of the GDPR.
Your point of contact for the purposes of the European General Data Protection Regulation (GDPR) and other national data protection laws of the Member States, as well as other data protection provisions, is:

Badewelt Sinsheim GmbH
Badewelt 1
94889 Sinsheim
Telephone: +49 (0) 7261 / 4028-0
Email: info@badewelt-sinsheim.de

WUND Holding GmbH
Bergheimer Straße 3
88677 Markdorf
Telephone: +49 (0) 7541 / 206-0
Email: info@wund.de

Badeparadies Schwarzwald TN GmbH
Am Badeparadies 1
79822 Titisee-Neustadt
Telephone: +49 (0) 7651 / 9360-333
Email: shop@badeparadies-schwarzwald.de

Thermen & Badewelt Euskirchen GmbH
Thermenallee 1 (Stresemannstraße 999)
D-53879 Euskirchen
Telephone: +49 (0) 2251 / 1485-0
Email: info@badewelt-euskirchen.de

Therme Horizon GRS GmbH (formerly BLUPHORIA GmbH)
Luisenstr. 14
D-80333 Munich
Telephone: +49 (0) 7544 / 96591-0
Email: info@bluphoria.de
(hereinafter referred to as 'joint controllers' or 'we' or 'our')

2 Name and address of the Data Protection Officer
We attach great importance to the protection of your personal data. To reflect this commitment, we have commissioned a consultancy firm specialising in data protection and data security to manage these key issues. We are advised by:
actago GmbH
Straubinger Straße 7
94405 Landau an der Isar
Email: datenschutz@wund.de

3 General information on data processing
3.1 Scope of the processing of personal data
As a general rule, we process your personal data only to the extent necessary to provide our services. The processing of your personal data is normally carried out solely on the basis of your consent. An exception applies in cases where it is not possible to obtain consent in advance for practical reasons, or where the processing of your personal data is permitted by law.

3.2 Legal basis for the processing of personal data
Where we seek your consent to process personal data, Article 6(1)(a) of the GDPR serves as our legal basis.
Where the processing of personal data is necessary for the performance of a contract between you and us, Article 6(1)(b) of the GDPR serves as our legal basis. This also applies to processing operations necessary for the implementation of pre-contractual measures.
Where the processing of personal data is necessary to comply with a legal obligation to which we are subject, Article 6(1)(c) of the GDPR serves as our legal basis.
Where the processing of personal data is necessary to protect your vital interests or those of another natural person, Article 6(1)(d) of the GDPR serves as our legal basis.
Where processing is necessary to safeguard a legitimate interest of ours or of a third party, and your interests, fundamental rights and freedoms do not override the former interest, Article 6(1)(f) of the GDPR serves as the legal basis for the processing.

3.3 Data erasure and retention period
Your personal data will be erased or blocked as soon as the purpose for which it was stored no longer applies. Data may also be retained if this is provided for by European or national legislation in EU regulations, laws or other provisions to which we are subject. Data will also be blocked or deleted when a retention period prescribed by the aforementioned standards expires, unless there is a need to continue storing the data for the conclusion or performance of a contract.

4 Provision of the website and creation of log files
4.1 Description and scope of data processing
Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing device. The following data is collected in this process:
• the browser types and versions used,
• the operating system used by the accessing device,
• the website from which an accessing device reaches our website (known as the referrer),
• the sub-pages on our website accessed via the visiting system,
• the date and time of access to the website,
• an Internet Protocol address (IP address),
• the Internet service provider of the visiting system, and
• other similar data and information used for security purposes in the event of attacks on our information technology systems.

The data is also stored in our system's log files. This data is not stored together with other personal data of the user.

4.2 Legal basis for data processing
The legal basis for processing your personal data in the context of providing the website and creating log files is Art. 6(1)(f) GDPR.

4.3 Purpose of data processing
The temporary storage of your personal data by us is necessary to enable the website to be delivered to your computer. To this end, your personal data must be stored for the duration of the session.
Your personal data is stored in log files to ensure the functionality of the website. In addition, we use your personal data to optimize the website and ensure the security of our information technology systems. Your personal data is not analyzed for marketing purposes in this context.
These purposes also constitute our legitimate interest in data processing pursuant to Art. 6(1)(f) GDPR.

4.4 Data Retention Period
Your personal data will be deleted as soon as it is no longer required for the purpose for which it was collected. In the case of collecting your personal data for the provision of the website, this is the case as soon as the respective session has ended.

In the case of storing your personal data in log files, these will be deleted after a maximum of seven days. Storage beyond this period is possible. In this case, your personal data will be deleted or anonymized so that it is no longer possible to identify the requesting client.

4.5 Right to Object and Erasure
The collection of your personal data for the provision of the website and the storage of your personal data in log files is essential for the operation of the website. Consequently, you have no right to object.

5 Use of Cookies
5.1 Description and Scope of Data Processing
Our website uses cookies. Cookies are text files that are stored in the internet browser or by the internet browser on the user's computer system. When a user visits a website, a cookie can be stored on the user's operating system. This cookie contains a unique string of characters that allows the browser to be uniquely identified when the website is visited again.

When you access this website, we store cookies (text files) on your device that are valid for the duration of your visit ("session cookies"). We use these exclusively during your visit to our website. After your visit ends, your browser will automatically delete these cookies.

When you access this website, we store cookies on your device. These have a validity period of:

Name: Storage duration:
• CookieConsent 1 year
• PHPSESSID Session
• SERVERID Session
• AWSALBCORS 6 days
• mtpConfigFeed-1073168833 Persistent
• mtpConfigFeed2084259555 Persistent
• mtpConfigFeed-951572081 Persistent
• mtpConfigFeedBase-1073168833 Persistent
• mtpConfigFeedBase Persistent
• mtpConfigFeedBase-951572081 Persistent
• mtpDeckchairSprite-1073168833 Persistent
• mtpDeckchairSprite Persistent
• mtpDeckchairSprite-951572081 Persistent
• mtpTemplates-1073168833 Persistent
• mtpTemplates2084259555 Persistent
• mtpTemplates-951572081 Persistent
• mtpTranslations-1073168833 Persistent
• mtpTranslations2084259555 Persistent
• mtpTranslations-951572081 Persistent
• mtracking.gif End of session
• rc::a Persistent
• rc::c Persistent
• loglevel:userlike Persistent
• accomodationIds-# 1 day
• _ga 2 years
• _ga_# 2 years
• _gat 1 day
• _gid 1 day
• collect Session
• td End of session
• mtc_sid Persistent
• TDCPM 1 year
• TDID 1 year
• _fbp 3 months
• mtc_id Persistent
• __ptq.gif End of session
• __cf_bm 1 day
• mtc_id End of session
• mtc_sid End of session
• ads/ga-audiences End of session
• __hssc End of session
• __hssrc End of session
• __hstc 6 months
• hubspotutk 6 months

We use them to improve the use of the site and to offer visitors additional functions. Most browsers are set to accept cookies by default; however, you can disable this function—either for the current session or permanently—via your internet browser settings.

5.2 Legal basis for data processing
The legal basis for processing your personal data in connection with the use of technically necessary cookies is Section 25 (2) No. 2 of the TTDSG (Telecommunications-Telemedia Data Protection Act) and Article 6 (1) (f) of the GDPR.
For cookies that are not technically necessary, the legal basis is Section 25 (1) of the TTDSG and Article 6 (1) (a) of the GDPR.

5.3 Purpose of processing
Technically necessary cookies are used to make using our website easier for you. Certain functions of our website cannot be provided without the use of cookies. These functions require your internet browser to be recognized again after navigating to a different page. User data collected via technically necessary cookies is not used to create user profiles.

Analytical cookies are used for the purpose of improving the quality of our website and its content. These analytical cookies allow us to understand how the website is used, enabling us to continuously optimize our services.
Our legitimate interest in processing your personal data pursuant to Article 6 (1) (f) of the GDPR lies in these purposes.

5.4 Duration of storage
Your personal data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected; this applies in particular when cookies are deactivated.

5.5 Right to object and removal
Cookies are stored on your computer and transmitted from there to our website. You therefore have full control over the use of cookies. You can deactivate or restrict the transmission of cookies by changing the settings in your internet browser. Cookies that have already been stored can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to use all the website's functions to their full extent.
The transmission of Flash cookies cannot be prevented via your internet browser settings. This requires changing the settings of the Adobe Flash Player.

6 Newsletter
6.1 Description and scope of data processing
Our website offers a newsletter through which we inform you about news and offers. If you wish to subscribe to the newsletter, you must provide a valid email address. By subscribing to the newsletter, you consent to receiving the newsletter and to the procedures described.
The following data must be provided to sign up for the newsletter:
• Email address (mandatory field)
• Salutation
• First name
• Last name
• Date of birth
The newsletter is sent by the provider HubSpot, based at 25 First Street, Cambridge, MA 02141, USA. Information regarding the dispatch service provider's data protection policies can be found at: https://legal.hubspot.com/de/privacy-policy

6.2 Legal basis for data processing
The legal basis for processing your personal data in connection with sending the newsletter is Article 6(1)(a) of the GDPR (where consent has been given) or the statutory permission under Section 7(3) of the UWG (Act Against Unfair Competition) following the sale of goods or services.

6.3 Purpose of data processing
Your personal data is collected for the purpose of sending the newsletter to you. The purpose of processing your personal data in the context of newsletter distribution is to promote the sale of goods or services.

6.4 Storage period
Your personal data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. Accordingly, your personal data will be stored for as long as the newsletter subscription remains active.

6.5 Right to object and option to unsubscribe
You may cancel your newsletter subscription at any time. A corresponding link is provided in every newsletter. Cancelling the subscription also serves as a withdrawal of consent.

7 Registration
7.1 Description and scope of data processing
You must register on our website to expedite the conclusion of a contract. Consequently, the processing of your personal data contributes to the performance of a contract or the implementation of pre-contractual measures.
The following data is stored during registration:
• Salutation*
• First name*
• Last name*
• E-mail*
• E-mail (confirmation)*
• Telephone*
• Street*
• House number*
• Postal code*
• City/Town*
• Country*
*Mandatory field
Reference is made to this privacy policy regarding data processing during the registration process. Registration is handled via the provider HubSpot, based at 25 First Street, Cambridge, MA 02141, USA. Information regarding the service provider's data protection policies can be found at: https://legal.hubspot.com/de/privacy-policy

7.2 Legal basis for data processing
The legal basis for processing your personal data in the context of registration is Art. 6(1)(b) GDPR.

7.3 Purpose of data processing
Your registration facilitates the conclusion of contracts between you and us. Processing your personal data during registration is therefore necessary for the performance of a contract between you and us or to take steps prior to entering into a contract.

7.4 Duration of storage
Your data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected. With regard to data collected during the registration process for the performance of a contract or to take steps prior to entering into a contract, this is the case when your personal data are no longer required for the execution of the contract. Even after the contract has been concluded, it may be necessary to store the contracting party's personal data in order to comply with contractual or statutory obligations.

7.5 Right to object and right to erasure
You have the option to cancel your registration at any time. You may have the personal data stored about you modified at any time. If your personal data are required for the performance of a contract or to take steps prior to entering into a contract, early erasure of your personal data is only possible if contractual or statutory obligations do not prevent such erasure.

8 Contact form and contact via e-mail
8.1 Description and scope of data processing
Our website features a contact form that can be used for electronic contact. If you make use of this option, the data entered into the input fields will be transmitted to us and stored. This data includes:
• First name*
• Last name*
• Street
• House number
• City/Town
• Postal code
• Country
• E-mail address*
• Telephone
• Your message*
*Mandatory field
Your consent to the processing of the data is obtained during the submission process, and reference is made to this privacy policy.
Alternatively, you may contact us via the provided e-mail address. In this case, the personal data transmitted with the e-mail will be stored. No data is passed on to third parties in this context. The data is used exclusively for processing the conversation.

8.2 Legal basis
The legal basis for processing your personal data transmitted when contacting us via the contact form or e-mail is Art. 6(1)(f) GDPR. If the contact via the contact form or e-mail aims at the conclusion of a contract, Art. 6(1)(b) GDPR serves as an additional legal basis for the processing.

8.3 Purpose of data processing
Processing your personal data when you contact us via the contact form or e-mail serves solely to handle your inquiry.

8.4 Duration of storage
Your personal data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected.
For personal data from the contact form's input fields and data sent via e-mail, this is the case once the conversation has ended. The conversation is considered concluded when the circumstances indicate that the matter in question has been definitively resolved.
Any additional personal data collected during the transmission process will be deleted after a period of seven days at the latest.

8.5 Options for Objection and Removal
You have the right to object to the processing of your personal data—whether collected via the contact form or email—at any time, with effect for the future. In such a case, the conversation between you and us cannot be continued. All personal data stored during the course of the contact process will be deleted in this event.

9 Third-Party Applications Integrated into the Website
9.1 Marketing Automation with HubSpot
We use the service HubSpot on this website for various purposes. HubSpot is a software company based in the USA (25 First Street, Cambridge, MA 02141, USA).
HubSpot is an integrated software solution that allows us to manage various aspects of our online marketing. These include, among others:
• Email marketing / newsletter distribution via various subscription models
• Social media publishing & reporting
• Reporting
• Contact management (e.g., user segmentation & CRM)
• Landing pages
• Contact forms
• "MyBLUPHORIA" loyalty bonus point program
Our sign-up service enables website visitors to learn more about our company, download content, and provide their contact details as well as other demographic information. This information, along with our website content, is stored on servers belonging to the Thermengruppe Josef Wund in Germany. Access by HubSpot is permitted only under strict conditions. We may use this data to contact website visitors and to determine which of our company's services are of interest to them. All information we collect is subject to this privacy policy. We use all collected information exclusively to optimize our marketing activities and to contact interested website visitors.
HubSpot tracks visitors using browser cookies. Each time a visitor lands on the website, the HubSpot software checks for the presence of a tracking cookie. If no cookie is found, one is assigned to the user. This logs all pages subsequently visited by the individual.
As part of the optimization of our marketing activities, the following data may be collected and processed via HubSpot:
• Geographic location
• Browser type
• Navigation information
• Referral URL
• Performance data
• Information on the frequency of application usage
• Mobile app data
• Login information for the HubSpot subscription service
• Files viewed locally
• Domain names
• Pages viewed
• Aggregate usage
• Operating system version
• Internet service provider
• IP address
• Device identifier
• Duration of visit
• Source of application download
• Operating system
• Events occurring within the application
• Access times
• Clickstream data
• Device model and version
In addition, we use HubSpot to provide contact forms.
The legal basis for this processing is your consent pursuant to Art. 6(1)(a) GDPR. If you do not wish for the aforementioned data to be collected and processed via HubSpot, you may withhold your consent or withdraw it at any time with effect for the future.
Personal data is retained for as long as is necessary to fulfill the purpose of the processing. The data is deleted as soon as it is no longer required to achieve that purpose. Data may be transferred to the USA as part of the processing via HubSpot.
The new data protection framework ("EU-U.S. Data Privacy Framework") facilitates secure data transfer between the EU and the USA, thereby addressing the data protection concerns that have existed since the European Court of Justice's *Schrems II* ruling. However, this applies only if the companies or entities to which personal data is transferred are certified under the new agreement. Through certification, US companies commit to complying with specific data protection obligations modeled on those of the European GDPR. HubSpot is a certified company under the new agreement. You can verify this here: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?id=a2zt0000000TN8pAAG&status=Active
Furthermore, the security of the transfer is safeguarded by so-called Standard Contractual Clauses, which ensure that the processing of personal data is subject to a level of security equivalent to that required by the GDPR. Should the Standard Contractual Clauses prove insufficient to establish an adequate level of security, your consent pursuant to Art. 49(1)(a) GDPR may serve as the legal basis for the transfer to third countries. The personal data we collect via HubSpot may be processed and accessed jointly by all affiliated thermal spas within the Josef Wund thermal spa group (WUND Holding GmbH, Badeparadies Schwarzwald, Thermen & Badewelt Sinsheim, Thermen & Badewelt Euskirchen, and Therme Horizon GmbH (formerly BLUPHORIA GmbH)—acting as joint controllers pursuant to Art. 26 GDPR) for purposes such as cross-location promotional mailings. The legal basis for this is Art. 6(1)(a), (b), and (f) GDPR. Processing takes place only within the scope of the consent granted for the specific thermal spas whose newsletters have been subscribed to.
Further information on HubSpot can be found at: https://legal.hubspot.com/de/privacy-policy

9.2 Google Tag Manager
We use Google Tag Manager, provided by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; "Google"), on our website. If you have your habitual residence in the European Economic Area or Switzerland, Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) is the controller responsible for your data. Accordingly, Google Ireland Limited is the Google affiliate responsible for processing your data and ensuring compliance with applicable data protection laws.
This application is used to manage JavaScript and HTML tags employed to implement tools such as tracking and analytics services. The data processing serves the purpose of designing and optimizing our website to meet user needs.
Google Tag Manager itself does not store cookies or process personal data. However, it enables the triggering of other tags that may collect and process personal data.
Further information regarding terms of use and data protection can be found here: https://www.google.com/intl/de/tagmanager/use-policy.html

9.3 Web tracking with Google Analytics (GA 4)
9.3.1 Scope of personal data processing
This website uses Google Analytics 4, the current web analytics service provided by Google. This service is provided by Google Ireland Limited (Gordon House, Barrow Street 4, Dublin, D04 E5W5, Ireland). We use Google Analytics to analyze our users' browsing behavior.
Google Analytics uses "cookies"—text files stored on your computer—that enable an analysis of your use of the website.
The information generated by the cookie regarding your use of this website is generally stored on a server within the EU and transmitted to a Google server in the USA. In Google Analytics 4, IP address anonymization is enabled by default. Due to IP anonymization, your IP address is truncated by Google within Member States of the European Union or in other states party to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there. By using the "anonymizeIp" code, we enable the anonymized collection of IP addresses (so-called IP masking). The software runs exclusively on our website's servers. Personal user data is stored only there. Data is not passed on to third parties.
During your visit to the website, your user behavior is recorded in the form of "events." Events may include:
• Page views
• First-time visit to the website
• Start of a session
• Your "click path" or interaction with the website
• Scrolls (whenever a user scrolls to the bottom of the page—90%)
• Clicks on external links
• Internal search queries
• Interaction with videos
• File downloads
• Ads viewed/clicked
• Language settings
The following are also recorded:
• Your approximate location (region)
• Your IP address (in truncated form)
• Technical information regarding your browser and the devices you use (e.g., language settings, screen resolution)
• Your internet service provider
• The referrer URL (the website or advertising medium via which you arrived at this website)
We use Google Signals. This enables Google Analytics to collect additional information about users who have enabled personalized ads (interests and demographic data), allowing ads to be served to these users in cross-device remarketing campaigns.

9.3.2 Legal basis for the processing of personal data
The legal basis for processing your personal data is Art. 6(1)(a) GDPR.

9.3.3 Purpose of data processing
On behalf of the operator of this website, Google will use this information to evaluate your use of the website and to compile reports on website activity. The reports provided by Google Analytics serve to analyze the performance of our website and the success of our marketing campaigns.

9.3.4 Storage duration
Data transmitted by us and linked to cookies is automatically deleted after 14 or 26 months, respectively. Data for which the retention period has expired is automatically deleted once a month.

9.3.5 Options to object and remove
You may revoke your consent at any time with effect for the future by accessing your browser's cookie settings and changing your selection. The lawfulness of processing based on consent prior to its revocation remains unaffected.
You can also prevent the storage of cookies from the outset by adjusting the settings of your browser software accordingly. However, if you configure your browser to reject all cookies, functionality on this and other websites may be restricted. Furthermore, you can prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) by Google, as well as the processing of this data by Google, by:
• not granting consent for the placement of the cookie, or
downloading and installing the browser add-on for deactivating Google Analytics (https://tools.google.com/dlpage/gaoptout?hl=de).
• Further information on the Google Analytics terms of use and data protection at Google can be found at https://marketingplatform.google.com/about/analytics/terms/de/ and at: https://policies.google.com/?hl=de

9.3.6 Google Signals
This website actively uses Google Signals in conjunction with Google Analytics 4. This updates existing Google Analytics features (advertising reports, remarketing, cross-device reports, and reports on interests including demographics) to create an aggregated profile of your anonymized data, provided you have enabled personalized ads in your Google account.
This involves cross-device tracking, meaning your data can be analyzed across multiple devices. Activating Google Signals results in data being collected and linked to your Google account. Enabling Google Signals allows us to launch cross-device marketing campaigns.
These analyses also help us better understand your behavior, preferences, and interests, enabling us to optimize and tailor our services and products. The collected data is stored for 14 months before expiring. Please note that this data collection only occurs if you have enabled personalized advertising in your Google account. The data is always stored in anonymized form and transferred to the USA. You can also manage or delete this data within your Google account.
Further information regarding terms of use and data protection can be found at:
https://policies.google.com/privacy?hl=de

9.4 Google Web Fonts
This website may use so-called Google Web Fonts to ensure the uniform display of fonts.
When using these fonts, your browser downloads the required fonts from our website system. These are then cached in your browser's cache to ensure the fonts are displayed correctly.
No connection to Google's servers is established by your browser during this process. This ensures that Google does not gain knowledge of your visit or your IP address.

9.5 DoubleClick by Google
This website contains components from DoubleClick by Google. DoubleClick is a brand of Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) under which specialized online marketing solutions are marketed to advertising agencies and publishers.
DoubleClick by Google transmits data to the DoubleClick server with every impression, click, or other activity. Each of these data transmissions triggers a cookie request to your browser. If the browser accepts this request, DoubleClick places a cookie on your IT system. The purpose of the cookie is to optimize and display advertisements. The cookie is used, among other things, to serve and display user-relevant advertisements and to generate or improve reports on advertising campaigns. Furthermore, the cookie serves to prevent the repeated display of the same advertisement.
DoubleClick uses a cookie ID, which is required to carry out the technical process. The cookie ID is needed, for example, to display an advertisement in a browser. Using the cookie ID, DoubleClick can also track which advertisements have already been displayed in a browser in order to avoid duplicate displays. Furthermore, the cookie ID enables DoubleClick to track conversions.
A DoubleClick cookie does not contain any personal data. However, a DoubleClick cookie may contain additional campaign identifiers. A campaign identifier serves to identify campaigns with which you have already interacted. Each time you access one of the individual pages of this website—which is operated by us and incorporates a DoubleClick component—the respective DoubleClick component prompts the internet browser on your IT system to transmit data to Google for the purposes of online advertising and commission settlement. As part of this technical process, Google obtains data that it also uses to generate commission statements. Among other things, Google is able to track that you have clicked on specific links on our website.
You can prevent the setting of cookies by DoubleClick and our website at any time by adjusting the settings of your internet browser accordingly. Furthermore, cookies that have already been set can be deleted at any time via your internet browser or other software programs.
You have provided your consent to this via our opt-in cookie banner, in accordance with Art. 6(1)(a) of the GDPR.
Further information and the applicable data protection provisions of DoubleClick by Google can be found at www.google.com/intl/de/policies/.

9.6 Use of Cookiebot
We use features provided by Cookiebot on our website. Cookiebot is operated by the company Usercentrics A/S, Havnegade 39, 1058 Copenhagen, DK. Among other things, Cookiebot enables us to display a comprehensive cookie notice (also referred to as a cookie banner) to you. By using this feature, your data may be transmitted to, stored by, and processed by Cookiebot or Cybot.
You have the right to access and delete your personal data at any time. You can prevent data collection and storage, for example, by rejecting the use of cookies via the cookie notice.
Further information can be found at: https://www.cookiebot.com/de/privacy-policy/

9.7 CloudFront
This website uses the CloudFront Content Delivery Network (CDN). This is a service provided by Amazon Web Services Inc., 410 Terry Avenue North, Seattle, WA 98109-5210. The CloudFront CDN makes copies of website data available on various Amazon Web Services (AWS) servers distributed globally. This results in faster website loading times, greater reliability, and enhanced protection against data loss. Some of the images and videos embedded on this website are retrieved from the CloudFront CDN when the page is accessed. This retrieval process involves the transmission of information regarding your use of our website (such as your IP address) to Amazon servers located outside the EU, where the data is stored. This occurs as soon as you visit our website. The legal basis for the use of CloudFront is user consent pursuant to Art. 6(1)(a) GDPR. You can find the current privacy policy of Amazon Web Services at: https://aws.amazon.com/de/privacy/

9.8 Delivr.js
This site uses a "Content Delivery Network" (CDN) provided by jsDelivr. The provider is Prospect One sp. z o.o., Królewska 65A/1, 30-081 Kraków, Poland (hereinafter referred to as "jsDelivr").
A CDN is a service used to deliver content from our online offering—particularly large media files such as graphics or scripts—more quickly by utilizing regionally distributed servers connected via the Internet. Technically, this involves routing the data transfer between your browser and our website through jsDelivr's network. This enables jsDelivr to analyze traffic between your browser and our website and to act as a filter between our servers and potentially malicious Internet traffic. In doing so, jsDelivr may also use cookies, though these are employed solely for the purposes described here. User data is processed for the aforementioned purposes and to maintain the security and functionality of the CDN.
To this end, the browser you use must establish a connection to the CDN's servers. As a result, the CDN becomes aware that our website has been accessed via your IP address.
The legal basis for the use of Delivr.js is the user's consent pursuant to Art. 6(1)(a) GDPR. Further information can be found in jsDelivr's privacy policy: https://www.jsdelivr.com/privacy-policy-jsdelivr-com

9.9 Facebook
Our website uses plugins from the Facebook network, operated by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta").
When you click the Facebook button, the plugin establishes a direct connection between your browser and the Facebook server. This transmits information to Facebook indicating that you have visited our site using your IP address.
We are not aware of the purpose and scope of data collection or the further processing and use of this data by Facebook. In this regard, and concerning your rights and privacy settings, please consult the relevant privacy information provided by Instagram: https://de-de.facebook.com/privacy/policy

9.10 Instagram
Our website uses plugins from the Instagram network, which is operated by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta").
When you click the Instagram button, the plugin establishes a direct connection between your browser and the Instagram server. This transmits information to Instagram indicating that you have visited our site using your IP address.
We are not aware of the purpose and scope of data collection or the further processing and use of this data by Instagram. In this regard, and concerning your rights and privacy settings, please consult Instagram's relevant privacy policy: https://privacycenter.instagram.com/policy

9.11 Walls.io
Our website uses social media plugins or widgets from Walls.io. When these plugins are accessed, your IP address and cookie information are transmitted to Walls.io; this occurs solely due to technical necessities required to provide the service. This data is stored by Walls.io exclusively within Europe and is not passed on to third parties.
We use Walls.io plugins to display a social media wall on our website. Walls.io aggregates content from over 15 platforms, including Facebook, Twitter, Instagram, YouTube, and Pinterest. This content is published live on our website. For further information regarding data processing by Walls.io, please consult the Walls.io privacy policy at https://walls.io/privacy. Walls.io is operated by "Die Socialisten" Social Software Development GmbH, Andreasgasse 6, Top 1, 1070 Vienna, Austria. By using our website, you consent to the described collection and processing of information by Social Software Development GmbH. The operation of Walls.io on our websites can be restricted or completely prevented via your browser settings; however, doing so means you will not be able to use the social media wall on our website.

9.12 Meta Pixel
Provided you have given us your express consent (Art. 6 para. 1 lit. a GDPR) by clicking the corresponding button, we use the "Meta Pixel" from Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, on our website. This allows user behavior to be tracked after users have viewed or clicked on a Facebook advertisement.
This process serves to evaluate the effectiveness of Facebook advertisements for statistical and market research purposes and can help optimize future advertising campaigns. The data collected is anonymous to us; therefore, it does not allow us to draw conclusions regarding the identity of the users. However, the data is stored and processed by Facebook, enabling a link to the respective user profile and allowing Facebook to use the data for its own advertising purposes in accordance with the Facebook Data Policy (https://www.facebook.com/about/privacy/).
By providing your consent, you enable Facebook and its partners to display advertisements on and off Facebook. A cookie may also be stored on your computer for these purposes. Consent to the use of the Meta Pixel may only be given by users who are over 16 years of age. If you are younger, please ask your legal guardians for permission. To generally object to the use of cookies on your computer, you can configure your internet browser to prevent cookies from being stored on your computer in the future or to delete cookies that have already been stored. However, disabling all cookies may result in certain functions on our websites no longer working correctly. You can also opt out of the use of cookies by third-party providers such as Meta via the Digital Advertising Alliance website at the following link: http://www.aboutads.info/choices/

9.13 Conversions API
We use the Conversions API on our website. This is a server-side event tracking tool. The service is provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland.

With the Conversions API, data is still collected on the client side and processed further on our web server; however, data collection via the API functions even if the Meta Pixel is blocked on the client side. A tracking code is executed on the server, sending the collected events to the actual API on Meta's servers.
The legal basis for processing your personal data in connection with the use of the Conversions API is Art. 6(1)(a) GDPR.
Data from the API and data from the Meta Pixel are merged there; the Conversions API thus supplements tracking via the Meta Pixel. Further information can be found at: https://www.facebook.com/business/help/2041148702652965?id=818859032317965
You can find further information regarding data protection from the third-party provider on the following Facebook webpage: https://www.facebook.com/about/privacy. You can find information about the Facebook Pixel on the following Facebook webpage: https://www.facebook.com/business/help/651294705016616

9.14 ajax.googleapis.com / jQuery
We use the jQuery JavaScript library on our websites. To increase our website's loading speed and thereby provide you with a better user experience, we use Google's CDN (Content Delivery Network) to load this library.
It is highly likely that you have already used jQuery via the Google CDN on another site. In that case, your browser can access the cached copy, and the file does not need to be downloaded again.
If your browser does not have a cached copy, or if it downloads the file from the Google CDN for any other reason, data will be transmitted from your browser to Google Inc. ("Google").
For further information regarding data processing by Google, please refer to Google's privacy policy, currently available at: https://www.google.de/intl/de/policies/privacy/

9.15 Cloudflare.com
This website uses services provided by "Cloudflare" (provider: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA).
Cloudflare operates a Content Delivery Network (CDN) and provides protective functions for the website (Web Application Firewall). Data transferred between your browser and our servers passes through Cloudflare's infrastructure, where it is analyzed to ward off attacks. To this end, Cloudflare uses cookies to facilitate your access to our website. The use of Cloudflare is based on the interest in ensuring the secure use of our online presence and defending against malicious external attacks. The legal basis for the use of Cloudflare.com is user consent pursuant to Art. 6(1)(a) GDPR.
Further information can be found in Cloudflare's privacy policy:
https://www.cloudflare.com/de-de/privacypolicy/

9.16 Google Maps
This site uses the Google Maps map service via an API. The provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
To use the functions of Google Maps, it is necessary to store your IP address. This information is generally transmitted to a Google server in the USA and stored there. The provider of this site has no influence on this data transmission.
Google Maps is used in the interest of an appealing presentation of our online services and to make it easy to find the locations we have listed on the website.
Google Maps is used only on the basis of consent pursuant to Art. 6 (1) (a) GDPR.
You can find more information on the handling of user data in Google's privacy policy: https://www.google.de/intl/de/policies/privacy/

9.17 Google Remarketing
Google's remarketing technology allows us to re-engage users who have previously visited our websites by displaying interest-based advertisements on sites within the Google Partner Network. Cookies enable the analysis of interests during a website visit, which can then be used to serve relevant product advertisements.
If users have consented to Google linking their web and app browsing history with their Google account and using information from their Google account to personalize ads they see across the web, Google uses data from these logged-in users—combined with Google Analytics data—to create and define audience lists for cross-device remarketing. To support this function, Google Analytics collects Google-authenticated IDs associated with these users. This personal data held by Google is temporarily linked with our Google Analytics data to form audience groups.
Further information and options for opting out of this type of advertising can be found at http://www.google.com/settings/u/0/ads/anonymous?hl=en (click the "Ad settings" link, then "Opt out").

9.18 Google reCAPTCHA
Google reCAPTCHA may be used to protect against form abuse. In this process, the optional "remoteip" parameter is not set during the API request. When reCAPTCHA is used, the data required for it is downloaded from Google by your browser. Your browser establishes a connection to Google's servers, allowing Google to become aware of the request and your IP address in connection with our website. The website operator has no control over this data transmission.
The use of Google reCAPTCHA serves the interest of preventing form abuse while aiming to minimize any impact on website usability. The CAPTCHA offers a wide range of functions and typically relies on automated detection.
When Google reCAPTCHA is accessed, Google's own data protection policies apply. Further information on this can be found at: https://www.google.de/intl/de/policies/privacy/

9.19 The Trade Desk
We use the tool "The Trade Desk," provided by The UK Trade Desk Ltd. (Co. No. 8539108), 10th Floor, 1 Bartholomew Close, London EC1A 7BL, United Kingdom, on our website. The Trade Desk offers technology known in the advertising industry as a Demand-Side Platform (DSP). In simple terms, this enables the management of digital advertising campaigns across a multitude of channels, such as websites, apps, audio platforms, and smart TVs.
Cookies are used to collect and transmit pseudonymized data—as well as data that does not serve to identify individuals—to The Trade Desk. This includes, in particular but not exclusively, your shortened (and thus pseudonymized) IP address, the date and time of the website visit, the location of the device used to access our website (e.g., via the device's GPS signal, Bluetooth, or Wi-Fi signal), page views, and interactions with the site and the referring page (referrer). This data is transmitted to the Demand-Side Platform and linked there to your pseudonymous ID. This occurs across websites on all platforms utilizing this technology. The purpose of this data collection and processing is to serve you only those advertisements that align with your previous interests and are therefore more relevant to you. Your personal data is pseudonymized by The Trade Desk prior to transmission to the Demand-Side Platform. Data is transferred to a third country (the USA).
The new data protection framework ("EU-U.S. Data Privacy Framework") facilitates secure data flows between the EU and the USA, thereby addressing the data protection concerns that have existed since the European Court of Justice's "Schrems II" ruling. However, this applies only if the companies or entities to which personal data is transferred are certified under the new agreement. Through certification, US companies commit to complying with specific data protection obligations modeled on the requirements of the European GDPR. The Trade Desk Inc. is a certified company under the new agreement. You can view this here:
https://www.dataprivacyframework.gov/s/participant-search/participant-detail?id=a2zt0000000TN8pAAG&status=Active
Further information regarding the technology used by The Trade Desk and data protection can be found at the following link: http://thetradedesk.com/general/privacy-policy
For data collection, we rely on your consent pursuant to Art. 6(1)(a) GDPR for the relevant data processing; you may withdraw this consent at any time by changing your privacy settings.

9.20 Userlike
This website uses live chat software from Userlike. Userlike uses cookies to store chat content while you wait on the site and to connect you with the same operator whenever possible. The data collected is not used to personally identify the website visitor; it is only linked to the personal data of the pseudonym holder if personal data is voluntarily provided for the live chat while using the tool. You can find Userlike's privacy policy here: https://www.userlike.com/de/privacy_policy

9.21 Use of YouTube videos
Videos from the external video platform YouTube are embedded on our website. By default, only inactive images from the YouTube channel are embedded; these do not establish an automated connection to YouTube's servers. Consequently, the operator receives no user data when the web pages are accessed.
You can decide for yourself whether to activate the YouTube videos. Only when you authorize video playback by clicking "Permanent activation" do you grant consent for the necessary data (including the URL of the current page and the user's IP address) to be transmitted to the operator.
To save your preferred setting, we place a cookie that stores the relevant parameters. However, no personal data is stored when these cookies are set; they contain only anonymized data used to configure the browser. Once this is done, the videos are active and can be played by the user. If you wish to disable the automatic loading of YouTube videos again, you can remove the consent checkbox via the privacy icon. This also updates the cookie settings.
YouTube is a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Further information regarding the purpose and scope of data processing (including processing outside the European Union and the USA) and details on privacy settings can be found in the privacy policy: https://policies.google.com/privacy?hl=de&gl=de

9.22 Mouseflow
This website uses Mouseflow, a web analytics tool provided by Mouseflow ApS, Flaesketorvet 68, 1711 Copenhagen, Denmark.
Data processing is carried out for the purpose of analyzing this website and its visitors. To this end, data is collected and stored for marketing and optimization purposes. Usage profiles may be created from this data under a pseudonym; cookies may be used for this purpose. The Mouseflow web analytics tool records randomly selected individual visits (using only anonymized IP addresses). This creates a log of mouse movements and clicks, intended to allow for the playback of random samples of website visits and the identification of potential improvements to the website. Data collected via Mouseflow will not be used to personally identify visitors to this website without the data subject's explicit consent, nor will it be combined with personal data regarding the holder of the pseudonym.
Personal data is processed based on the user's consent pursuant to Art. 6(1)(a) GDPR.
Consent may be withdrawn at any time with effect for the future.
You can find Mouseflow's privacy policy here: https://mouseflow.com/legal/company/privacy-policy/

9.23 Netigate
This website uses Netigate to send Net Promoter Score emails. The provider is Netigate Deutschland GmbH, Untermainkai 27-28, 60329 Frankfurt am Main, Germany.
Net Promoter Score emails enable us to conduct customer surveys. This allows us, for example, to analyze whether—or how likely—customers are to recommend us to others.
Detailed information regarding Netigate's functions can be found at the following link: https://www.netigate.net/de/ .
Personal data may be processed during the customer survey.

Data processing is carried out based on a legitimate interest pursuant to Art. 6(1)(f) GDPR in conjunction with Section 7(3) of the German Act Against Unfair Competition (UWG). You may object to this data processing at any time. The lawfulness of data processing operations already carried out remains unaffected by such an objection.
The data you have provided to us for the purpose of sending emails is stored by us and/or Netigate until you object; following an objection to the email dispatch, the data is deleted.
For further details, please refer to Netigate's privacy policy at: https://www.netigate.net/de/impressum/#legal
We have concluded a data processing agreement (DPA) with Netigate in accordance with Art. 28 GDPR.

10 Social Media Presences
10.1 Presence on Facebook
We maintain a Facebook page to supplement our online presence. This service is provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.
Please note that you use this Facebook page and its functions at your own risk. This applies in particular to the use of interactive functions (e.g., commenting, sharing, rating).
When you visit our Facebook page, Facebook collects, among other things, your IP address and other information present on your computer in the form of cookies. This information is used to provide us, as the operator of the Facebook page, with statistical data regarding the usage of the page. Facebook provides further information on this at the following link: https://de-de.facebook.com/help/pages/insights
The data collected about you in this context is processed by Meta Platforms Ireland Limited and may be transferred to countries outside the European Union. Facebook describes in general terms what information it receives and how it is used in its Data Policy. There, you can also find information on how to contact Facebook and on settings for advertisements. The privacy policy is available at the following link: https://de-de.facebook.com/about/privacy
Facebook does not clearly or conclusively state how it uses data from visits to Facebook pages for its own purposes, the extent to which activities on the Facebook page are linked to individual users, how long it stores this data, or whether data from a visit to the Facebook page is passed on to third parties; this information is unknown to us.
When accessing a Facebook page, the IP address assigned to your device is transmitted to Facebook. According to Facebook, this IP address is anonymized (in the case of "German" IP addresses) and deleted after 90 days. Furthermore, Facebook stores information about its users' devices (e.g., as part of the "login notification" feature); this may enable Facebook to link IP addresses to individual users.
If you are currently logged into Facebook, a cookie containing your Facebook ID is stored on your device. This allows Facebook to track the fact that you have visited this page and how you have used it. This also applies to all other Facebook pages. Facebook buttons embedded in websites allow Facebook to record your visits to those sites and link them to your Facebook profile. Based on this data, content or advertising can be tailored to you.
If you wish to avoid this, you should log out of Facebook (or disable the "stay logged in" feature), delete the cookies stored on your device, and close and restart your browser. This deletes Facebook information that could be used to identify you directly. You can then use our Facebook page without your Facebook ID being revealed. If you access interactive features on the page (Like, Comment, Share, Messages, etc.), a Facebook login prompt will appear. Once you log in, Facebook will again be able to identify you as a specific user.
Information on how to manage or delete information held about you can be found on the following Facebook support pages: https://de-de.facebook.com/about/privacy#
As the provider of this information service, we also collect and process the following data resulting from your use of our service: publicly viewable data from the user's profile. This includes, for example, the username, profile picture, and the content of comments posted on our entries.
Further information about Facebook and other social networks, as well as how to protect your data, can also be found at: https://youngdata.de/

10.2 Instagram Presence
To enhance our online presence, we offer an Instagram page. This is a service provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

Please note that you use this Instagram page and its features at your own risk. This applies in particular to the use of interactive features (e.g., commenting, sharing, rating).

When you visit our Instagram page, Instagram collects, among other things, your IP address and other information stored on your computer in the form of cookies. This information is used to provide us, as the operators of the Instagram page, with statistical information about the use of the page. Further information is available from Instagram at the following link: https://help.instagram.com/1896641480634370?ref=ig

The data collected about you in this context is processed by Meta Platforms Ireland Limited and may be transferred to countries outside the European Union. Instagram describes in general terms in its Data Policy what information it receives and how it uses it. There you will also find information about how to contact Instagram and how to adjust your ad settings. The Privacy Policy is available at the following link: https://privacycenter.instagram.com/policy
How exactly Instagram uses data from visits to Instagram pages for its own purposes, to what extent activities on the Instagram page are attributed to individual users, how long Instagram stores this data, and whether data from a visit to the Instagram page is shared with third parties is not fully and clearly explained by Instagram and is unknown to us.

When you access an Instagram page, the IP address assigned to your device is transmitted to Instagram. According to Instagram, this IP address is anonymized (for "German" IP addresses) and deleted after 90 days. Instagram also stores information about its users' devices (e.g., as part of the "Login Notifications" feature); this may allow Instagram to associate IP addresses with individual users.

If you are currently logged into Instagram, a cookie containing your Instagram ID is stored on your device. This allows Instagram to track that you visited this page and how you used it. This also applies to all other Instagram pages.

If you wish to prevent this, you should log out of Instagram or deactivate the "stay logged in" function, delete the cookies stored on your device, and close and restart your browser. This will delete Instagram information that could directly identify you. This way, you can use our Instagram page without revealing your Instagram ID. If you access interactive features of the page (like, comment, share, message, etc.), an Instagram login screen will appear. After logging in, you will again be identifiable to Instagram as a specific user.

Information on how to manage or delete information about you can be found on the following Instagram support pages: https://help.instagram.com/519522125107875/?helpref=hc_fnav&bc[0]=Instagram-Hilfebereich&bc[1]=Privatsph%C3%A4re%20und%20Sicherheit

As the provider of this information service, we also collect and process the following data from your use of our service: publicly visible data from the user profile. This includes, for example, the username, profile picture, and the content of comments posted on our posts.

Further information about Instagram and other social networks, and how you can protect your data, can also be found at: https://youngdata.de

10.3 Presence on TikTok
We use the TikTok platform to upload and publicly share our own videos. TikTok is a service provided by a third party unaffiliated with us—specifically, TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland.
Please note that TikTok may employ its own tracking tools, for which TikTok itself is responsible; in this regard, we refer you to TikTok's privacy policy: https://www.tiktok.com/legal/privacy-policy?lang=de

10.4 Presence on YouTube
We use the platform YouTube.com to upload and publicly share our own videos. YouTube is a service provided by a third party unaffiliated with us: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Some of our web pages contain links to the YouTube service. As a general rule, we are not responsible for the content of linked websites. However, if you follow a link to YouTube, please note that YouTube stores user data (e.g., personal information, IP address) and uses it for business purposes in accordance with its own data usage policies.
YouTube content is embedded using "enhanced privacy mode." This mode is provided by YouTube itself and ensures that YouTube does not initially store cookies on your device. However, when you access the relevant pages, your IP address and the other data mentioned in Section 4 are transmitted, thereby informing YouTube specifically which of our web pages you have visited. This information cannot be linked to you personally unless you are logged into YouTube or another Google service (e.g., Google+) at the time you access the page, or remain permanently logged in.
Once you start playing an embedded video by clicking on it, YouTube—even in enhanced privacy mode—stores cookies on your device that do not contain personally identifiable information, unless you are currently logged into a Google service. You can prevent these cookies by adjusting your browser settings or using browser extensions.
Address and link to the third-party provider's privacy policy:
Google/YouTube: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland – Privacy Policy: https://policies.google.com/privacy
Opt-out: https://adssettings.google.com/authenticated

11 Online Shop
Purchase of vouchers, products, packages, and admission tickets:
When you reserve a date-specific thermal bath admission, purchase vouchers, or acquire other products via our online shop on our website, the data you enter is processed for the following purposes:
• To identify you as a customer and to process, fulfill, and handle your order
• Necessary correspondence with you for the performance of the contract
• Invoicing and handling of any potential liability claims
• Assertion, exercise, and defense of legal claims against you
In doing so, we process the following personal data:
• Form of address
• Surname, first name
• Street, postal code, city/town, country
• Telephone number
• E-mail address
• Password (optional; only if you create a customer account)
• Reservation history
Consequently, our processing serves the performance of a contract pursuant to
Art. 6 (1) (b) GDPR.
We also process and use your data
• to create a customer account (optional; only if you create a customer account);
• to contact you, if requested by you or if necessary within the scope of a contractual relationship or permitted by law.
• For electronic advertising pursuant to Section 7 (3) of the UWG (Act Against Unfair Competition) regarding similar services offered by Thermen & Badewelt Sinsheim via e-mail, provided we obtained your e-mail address in connection with the sale of a service and you do not object to the use of said e-mail address. You may object to this use of your e-mail address at any time without incurring any costs other than the transmission costs at basic rates. Should this legal basis prove insufficient to justify electronic advertising, we will instead obtain your consent pursuant to Art. 6 (1) (a) GDPR. You may revoke this declaration of consent at any time by clicking the unsubscribe link at the bottom of the respective email newsletter.
Personal data collected by us is only passed on to third parties if necessary for contract fulfillment or required by legal provisions:
• Contracts pursuant to Art. 28 GDPR have been concluded with any engaged data processors to ensure secure data processing that complies with data protection regulations.
• Personal data collected by us is passed on to the transport company commissioned with delivery as part of contract fulfillment, insofar as this is necessary for the delivery of the goods.
• We pass on your payment details to the commissioned financial institution for the purpose of processing payments. Data is transmitted to government institutions or authorities only in accordance with mandatory national legal provisions.
12 "Thermensquad" Application
12.1 Description and scope of data processing
A form is embedded on our website that can be used to apply for the "Thermensquad" at Badewelt. The Thermensquad is a Badewelt campaign in which 30 selected participants receive a cooperation agreement with Badewelt based on the evaluation of a video posted on social media. Personal data must be provided for this purpose. This data includes:
• First and last name*
• Email address*
• Place of residence*
• Business tax number*
• Instagram or TikTok account*
*Mandatory field

• Your video*
*Required field

12.2 Legal basis
The legal basis for the processing of your personal data in the context of the application is Art. 6(1)(b) GDPR.

12.3 Purpose of data processing
If you contact us via the registration form, the processing of your personal data serves solely to handle your application.

12.4 Duration of storage
Your personal data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected.
If your application is unsuccessful, your personal data will be deleted no later than 6 months after the conclusion of the application process.

13 Payment services
13.1 Payment via Mastercard
When paying by credit card (Mastercard), we transmit your payment data to Mastercard Inc. as part of the payment processing. Mastercard Europe SA (Chaussée de Tervuren 198A, B-1410 Waterloo, Belgium) is responsible for the European region.
You can find out more about the data processed through the use of Mastercard in the privacy policy at: https://www.mastercard.de/de-de/datenschutz.html

13.2 Payment via Visa
When paying by credit card (Visa), we transmit your payment details to Visa Inc. as part of the payment processing procedure. Visa Europe Services Inc. (1 Sheldon Square, London W2 6TT, Great Britain) is responsible for the European region.
You can find out more about the data processed through the use of Visa in the privacy policy at: https://www.visa.de/nutzungsbedingungen/visa-globale-datenschutzmitteilung/mitteilung-zu-zustandigkeitsfragen-fur-den-ewr.html

13.3 Payment via PayPal
When paying via PayPal, credit card (via PayPal), direct debit (via PayPal), or—if offered—"purchase on invoice" (via PayPal), we transmit your payment data to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter "PayPal") as part of the payment processing.
For the payment methods credit card (via PayPal), direct debit (via PayPal), or—if offered—"purchase on invoice" (via PayPal), PayPal reserves the right to conduct a credit check. PayPal uses the result of the credit check regarding the statistical probability of payment default to decide whether to make the respective payment method available.
The credit check may contain probability values ​​(so-called score values). Where score values ​​are included in the credit check result, they are based on a scientifically recognized mathematical-statistical procedure. Address data, among other factors, are incorporated into the calculation of the score values. For further information regarding data protection, including details on the credit agencies used, please refer to PayPal's privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full. This is necessary for providing certain content and services on our website. The legal basis for this is Art. 6 (1) (a) and (b) GDPR.

13.4 Payment via Sofortüberweisung
On our website, we offer payment via "Sofortüberweisung" (instant bank transfer), among other methods. The provider of this payment service is Sofort GmbH, Theresienhöhe 12, 80339 Munich (hereinafter "Sofort GmbH").
Using the "Sofortüberweisung" procedure, we receive a payment confirmation from Sofort GmbH in real time and can immediately begin fulfilling our obligations. If you have chosen the "Sofortüberweisung" (instant bank transfer) payment method, you transmit your PIN and a valid TAN to Sofort GmbH, enabling them to log in to your online banking account. Once logged in, Sofort GmbH automatically checks your account balance and executes the transfer to us using the TAN you provided. It then immediately transmits a transaction confirmation to us. After logging in, your transaction history, overdraft limit, and the existence and balances of other accounts are also automatically checked.
In addition to the PIN and TAN, the payment details you entered and your personal data are transmitted to Sofort GmbH. Personal data includes your first and last name, address, telephone number(s), email address, IP address, and any other data required for payment processing. Transmitting this data is necessary to verify your identity beyond doubt and to prevent fraud attempts.
Your data is transmitted to Sofort GmbH based on Article 6(1)(a) and (b) of the GDPR. You may revoke your consent to data processing at any time. Such revocation does not affect the validity of data processing operations that have already taken place.
For details regarding payment via Sofortüberweisung, please refer to the following links: https://www.sofort.de/datenschutz.html

13.5 Payment via Amazon Pay
When paying via Amazon Pay, we transmit your payment data as part of the payment processing primarily to Amazon Payments Europe s.c.a., and secondarily to Amazon EU SARL, Amazon Services Europe SARL, and Amazon Media EU SARL—all three based at 5, Rue Plaetis, L-2338 Luxembourg (collectively "Amazon Payments").
Amazon Payments reserves the right to conduct a credit check. Amazon Payments uses the result of the credit check—specifically regarding the statistical probability of payment default—to decide whether to make the respective payment method available. The credit check may include probability values ​​(so-called "score values"). Where score values ​​are included in the credit check result, they are based on a scientifically recognized mathematical-statistical method. Address data, among other factors, is incorporated into the calculation of these score values.
Furthermore, Amazon Payments is entitled to share your data with third parties (including banks, e-service providers, service partners, as well as auditors, analytics services, credit agencies, marketing partners, cloud service providers, retargeting providers, and affiliated companies).
The legal basis for this is Art. 6(1)(a) and (b) of the GDPR.
For further information regarding data protection—including details on the credit agencies used—please refer to the Amazon Payments privacy policy:
pay.amazon.com/de/help/201751600

13.6 Payment via Apple Pay
For the "Apple Pay" payment method provided by Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, payment is processed via the "Apple Pay" function on your device (running iOS, watchOS, or macOS) by charging a payment card stored in Apple Pay. Apple Pay employs security features integrated into your device's hardware and software to protect your transactions. Consequently, authorizing a payment requires entering a passcode you have previously set and verifying the transaction using your device's "Face ID" or "Touch ID" function.
For payment processing purposes, the information you provide during the order process, along with details about your order, is transmitted to Apple in encrypted form. Apple then re-encrypts this data using a developer-specific key before transmitting it to the payment service provider associated with the payment card stored in Apple Pay to execute the payment. This encryption ensures that only the website where the purchase was made can access the payment data. Once the payment has been made, Apple sends your device account number and a transaction-specific, dynamic security code to the originating website to confirm the successful payment.
If personal data is processed during these transmissions, such processing occurs solely for the purpose of payment processing in accordance with Art. 6(1)(b) GDPR.
Apple retains anonymized transaction data, including the approximate purchase amount, the approximate date and time, and an indication of whether the transaction was successfully completed. Anonymization ensures that the data cannot be linked to any specific individual. Apple uses this anonymized data to improve "Apple Pay" and other Apple products and services.
When you use Apple Pay on an iPhone or Apple Watch to complete a purchase initiated via Safari on a Mac, the Mac and the authorizing device communicate via an encrypted channel on Apple's servers. Apple does not process or store any of this information in a format that could identify you personally. You can disable the option to use Apple Pay on your Mac within your iPhone's settings. Go to "Wallet & Apple Pay" and disable "Allow Payments on Mac."
For further information regarding Apple Pay privacy, please visit the following website: https://support.apple.com/de-de/HT203027

14 Direct Marketing
14.1 Description and scope of data processing
Our company processes personal data, such as your name and address, to send you advertising by mail and thereby increase sales of goods or services.

14.2 Legal basis for data processing
The legal basis for processing your personal data for the purpose of direct marketing by mail is Art. 6(1)(f) GDPR.

14.3 Purpose of data processing
The purpose of processing your personal data for direct marketing by mail is to promote the sale of goods or services. This purpose constitutes our legitimate interest in processing the data pursuant to Art. 6(1)(f) GDPR.

14.4 Storage period
Your personal data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected; this applies in particular upon receipt of an objection.

14.5 Right to object and removal
You may object to the processing of your personal data for direct marketing by mail at any time, with effect for the future.

15 Processing outside of joint controllership
15.1 Registration for applicant days
15.1.1 Description and scope of data processing
You can register on our website to participate in our applicant days; this is intended to facilitate the application process for you. The processing of your personal data therefore contributes to the organization or implementation of pre-contractual measures.
The following data is stored during registration:
• Salutation*
• First name*
• Last name*
• Street and house number*
• Postal code*
• City/Town*
• Country*
• E-mail*
• Telephone
*Mandatory field
It is also possible to upload application documents (CV, certificates, etc.) at the time of registration. We treat these documents with strict confidentiality and use them to prepare individually for your participation in the applicant day. Reference is made to this privacy policy regarding data processing during the registration process.
15.1.2 Legal basis for data processing
The legal basis for the processing of your personal data in connection with registration for the applicant day is Art. 6(1)(b) GDPR in conjunction with Section 26 BDSG.

15.1.3 Purpose of data processing
Your registration serves to facilitate the application process and enables the simplified conclusion of contracts between you and us. The processing of your personal data in connection with the registration is therefore necessary to initiate a contract between you and us or to carry out pre-contractual measures.

15.1.4 Duration of storage
Your data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. In the event of your registration and participation in the applicant day, we will store your data at least until the application process has been concluded. In the event of a rejection or the withdrawal of your application, we will retain your documents for a maximum of 6 months for the purpose of asserting, defending, or exercising legal claims; during this time, processing will be restricted to mere storage. If an employment relationship is established, relevant data from your application documents will be transferred to our employee records. Should you withdraw your registration prior to participating in the applicant day, your data will be deleted immediately.

15.1.5 Right to object and right to erasure
You have the option to cancel your registration at any time. You may also request that the personal data stored about you be modified at any time. If your personal data is required for the performance of a contract or the implementation of pre-contractual measures, early deletion of your personal data is only possible if there are no contractual or statutory obligations or legitimate interests of the company preventing such deletion.

15.2 Application for a Thermencard / Premiumcard
15.2.1 Processing details
You have the option to apply for a Thermencard / Premiumcard online via our website. We process your data for the following purposes:
• Creation, personalization, provision, and management of the Thermencard / Premiumcard
• Participation in customer promotions (loyalty gifts, bonuses, special offers) and loyalty programs
• Sending information regarding updates, offers, and promotions related to the Thermencard / Premiumcard (Thermencard / Premiumcard newsletter)
• Sending information by mail
• Regular dispatch of the Badewelt Sinsheim email newsletter
15.2.2 Legal basis for data processing
The processing of your data for the individual purposes is based on the following legal grounds:
• Performance of a contract pursuant to Art. 6 (1) (b) GDPR.
• Legitimate interest pursuant to Art. 6 (1) (f) GDPR in conjunction with the provisions of Section 7 of the Act Against Unfair Competition (UWG).
Legitimate interests pursued by the controller:
The dispatch of print media and the Thermencard / Premiumcard newsletter involves information relevant to Thermencard / Premiumcard users and is based on the controller's legitimate interest in advertising. Regardless of this, we may and will also contact you regarding questions or matters concerning the administration of the Thermencard / Premiumcard, provided this is necessary for the performance of the contract.
Our legitimate interest in advertising is not outweighed by any overriding interest of the data subject requiring protection, as we comply with the provisions of Section 7 (3) UWG regarding email advertising. Accordingly, advertising via electronic mail is permitted without prior consent if we obtained your email address in the context of a contractual relationship, the advertising relates only to similar products, you have not objected to the use of your data for advertising purposes, and you are informed of your right to object both when the data is collected and with each instance of promotional use. If you no longer wish to receive advertising from us, you may object to the use of your data for promotional purposes at any time with future effect. Please contact us at:
widerruf@badeweltsinsheim.de or use the unsubscribe link at the bottom of each email newsletter.

15.2.3 Recipients
Your Thermencard / Premiumcard is registered and processed exclusively by authorized employees of Badewelt Sinsheim GmbH who have been contractually bound to maintain confidentiality. For the purpose of electronically sending newsletters, we work with a data processor with whom a data processing agreement pursuant to Art. 28 GDPR has been concluded.

15.2.4 Storage period
We store your data:
• if processing is based on a legitimate interest on our part, for no longer than until you object to such processing.
• if we require the data to perform a contract, for no longer than the duration of the contractual relationship with you or the duration of statutory retention periods.
Data stored by us is deleted when it is no longer required for its intended purpose and there are no legitimate interests or statutory retention obligations preventing such deletion.
If data is not deleted because it is required for other legally permissible purposes, its processing is restricted. This means the data is blocked and not processed for other purposes. This applies, for example, to user data that must be retained for commercial or tax law reasons.

15.2.5 Transfer to third countries
Data is not transferred to third countries outside the European Union.

15.2.6 Provision mandatory or required
Providing your data is necessary for the creation and, if applicable, issuance of a new BADEPARADIES Card in the event of loss.

16 Legal defense and enforcement of rights
16.1 Description and scope of data processing
Our company aims to protect itself against unjustified claims through legal defense. We also enforce claims and rights to which we are entitled. Processing personal data is necessary for this purpose. This data consists of legally relevant information concerning the data subjects. 16.2 Purpose of data processing
The purpose of processing your personal data for the purposes of legal defense and the enforcement of legal rights is to defend against unjustified claims and to enforce claims and rights. This purpose constitutes our legitimate interest in the data processing pursuant to Art. 6(1)(f) GDPR.

16.3 Duration of storage
Your personal data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected.

16.4 Possibilities for objection and removal
The processing of your personal data for the purposes of legal defense and the enforcement of legal rights is strictly necessary for such defense and enforcement. Consequently, there is no possibility for you to object to this processing.

17 Categories of recipients
Within our company, access to personal data is granted to those units and departments that require it to fulfill the aforementioned purposes. In addition, we engage various service providers and transmit your personal data to other trusted recipients. These may include, for example:

• Banks
• Scanning services
• Print shops
• Mailing houses
• IT service providers
• Lawyers, courts, and public authorities
Personal data is transmitted to countries outside the European Economic Area (EEA) only in the cases mentioned and provided that an adequate level of data protection is guaranteed in accordance with Art. 44 et seq. of the GDPR.

18 Rights of data subjects
18.1 Right of access
You may request confirmation from the controller, in accordance with Art. 15 of the GDPR, as to whether or not personal data concerning you is being processed by us. If such processing takes place, you may request information from the controller pursuant to Art. 15(1) GDPR regarding the following:
• the purposes for which the personal data are processed,
• the categories of personal data being processed,
• the recipients or categories of recipients to whom the personal data concerning you have been or will be disclosed,
• the envisaged period for which the personal data concerning you will be stored, or, if specific details are not possible, the criteria used to determine that period,
• the existence of the right to request rectification or erasure of personal data concerning you, restriction of processing by us, or the right to object to such processing,
• the right to lodge a complaint with a supervisory authority,
• all available information as to the source of the data where the personal data are not collected from the data subject,
• the existence of automated decision-making, including profiling, referred to in Art. 22(1) and (4) GDPR and—at least in those cases—meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you. You have the right to request information as to whether the personal data concerning you are transferred to a third country or to an international organization. In this context, you may request to be informed of the appropriate safeguards pursuant to Art. 46 GDPR relating to the transfer.
If such data are transferred to a third country or to an international organization, you have the right, pursuant to Art. 15(2) GDPR, to be informed of the appropriate safeguards pursuant to Art. 46 GDPR relating to the transfer. 18.2 Right to rectification
Pursuant to Art. 16 GDPR, you have the right to obtain from the controller the rectification and/or completion of the personal data concerning you if such data is inaccurate or incomplete. We must carry out the rectification without undue delay.

18.2 Right to rectification
Pursuant to Art. 16 GDPR, you have the right to obtain from the controller the rectification and/or completion of personal data concerning you if such data is inaccurate or incomplete. We must carry out the rectification without undue delay.

18.3 Right to restriction of processing
As set out in Art. 18(1) GDPR, you may request the restriction of the processing of personal data concerning you under the following conditions:

• if you contest the accuracy of the personal data concerning you for a period enabling the controller to verify the accuracy of the personal data (Art. 18(1)(a) GDPR),
• the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead (Art. 18(1)(b) GDPR),
• we no longer need the personal data for the purposes of the processing, but they are required by you for the establishment, exercise, or defense of legal claims (Art. 18(1)(c) GDPR),
• if you have objected to processing pursuant to Art. 21(1) GDPR and it has not yet been determined whether our legitimate grounds override yours (Art. 18(1)(d) GDPR).
Where the processing of personal data concerning you has been restricted, such personal data shall—with the exception of storage—only be processed with your consent or for the establishment, exercise, or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State (Art. 18(2) GDPR). If the processing has been restricted in accordance with the aforementioned conditions, you will be informed by us before the restriction is lifted (Art. 18(3) GDPR).

18.4 Right to erasure
a) Obligation to erase
Pursuant to Art. 17(1) GDPR, you may request that we erase personal data concerning you without undue delay. We are also obliged to erase such data without undue delay if one of the following grounds applies:
• The personal data concerning you are no longer necessary for the purposes for which they were collected or otherwise processed (Art. 17(1)(a) GDPR).
• You withdraw your consent on which the processing was based pursuant to Art. 6(1)(a) or Art. 9(2)(a) GDPR, and there is no other legal ground for the processing (Art. 17(1)(b) GDPR).
• You object to the processing pursuant to Art. 21(1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21(2) GDPR (Art. 17(1)(c) GDPR).
• The personal data concerning you have been processed unlawfully (Art. 17(1)(d) GDPR).
• The erasure of the personal data concerning you is necessary for compliance with a legal obligation under Union or Member State law to which the controller is subject (Art. 17(1)(e) GDPR).
• The personal data concerning you have been collected in relation to the offer of information society services pursuant to Art. 8(1) GDPR (Art. 17(1)(f) GDPR). b) Information to third parties
If we have made the personal data concerning you public and are obliged to erase it pursuant to Art. 17(1) GDPR, we shall take reasonable measures—including technical measures—taking into account available technology and the cost of implementation, to inform controllers processing the personal data that you, as the data subject, have requested the erasure by them of any links to, or copies or replications of, those personal data (Art. 17(2) GDPR).
c) Exceptions
The right to erasure does not apply to the extent that processing is necessary for one of the following reasons:
• for exercising the right of freedom of expression and information
(Art. 17(3)(a) GDPR).
• for compliance with a legal obligation which requires processing by Union or Member State law to which we are subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in us (Art. 17(3)(b) GDPR).
• for reasons of public interest in the area of ​​public health in accordance with Art. 9(2)(h) and (i) and Art. 9(3) GDPR (Art. 17(3)(c) GDPR).
• for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes in accordance with Art. 89(1) GDPR, insofar as the right referred to in section (a) is likely to render impossible or seriously impair the achievement of the objectives of that processing (Art. 17(3)(d) GDPR), or
• for the establishment, exercise, or defense of legal claims (Art. 17(3)(e) GDPR). 18.5 Right to be informed
If you have exercised your right to rectification, erasure, or restriction of processing against us, we are obliged under Art. 19 GDPR to communicate this rectification or erasure of data or restriction of processing to all recipients to whom the personal data concerning you have been disclosed, unless this proves impossible or involves disproportionate effort. You have the right to be informed by us about these recipients.

18.6 Right to data portability
Pursuant to Art. 20(1) GDPR, you have the right to receive the personal data concerning you, which you have provided to the controller, in a structured, commonly used, and machine-readable format. You also have the right to transmit this personal data to another controller without hindrance from us, provided that
• the processing is based on consent pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR or on a contract pursuant to Art. 6(1)(b) GDPR (Art. 20(1)(a) GDPR), and
• the processing is carried out by automated means (Art. 20(1)(b) GDPR).
Furthermore, pursuant to Art. 20(2) GDPR, you have the right to have the personal data concerning you transmitted directly from us to another controller, where technically feasible.
Exercising the right under Art. 20(1) GDPR does not affect the right to erasure under Art. 17 GDPR. This does not apply to processing that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us. This follows from Art. 20(3) GDPR.
Pursuant to Art. 20(4) GDPR, the freedoms and rights of other persons must not be adversely affected by this.
The right to data portability does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us. 18.7 Right to object
Pursuant to Art. 21(1) GDPR, you have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions.
We will no longer process the personal data concerning you unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or if the processing serves the establishment, exercise, or defense of legal claims.
Where personal data concerning you are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing; this also applies to profiling to the extent that it is related to such direct marketing (Art. 21(2) GDPR).
If you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for such purposes (Art. 21(3) GDPR).
In the context of the use of information society services—and notwithstanding Directive 2002/58/EC—you have the option to exercise your right to object by automated means using technical specifications (Art. 21(5) GDPR).
Furthermore, you have the right to object, on grounds relating to your particular situation, to the processing of personal data concerning you for scientific or historical research purposes or for statistical purposes pursuant to Art. 89(1) GDPR, unless the processing is necessary for the performance of a task carried out for reasons of public interest (Art. 21(6) GDPR).

18.8 Right to withdraw consent under data protection law
Pursuant to Art. 7(3) GDPR, you have the right to withdraw your consent under data protection law at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. You are informed of this prior to giving your consent.

18.9 Automated individual decision-making, including profiling
You have the right not to be subject to a decision based solely on automated processing—including profiling—which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision:
1. is necessary for entering into, or the performance of, a contract between you and us,
2. is authorized by Union or Member State law to which we are subject and which lays down suitable measures to safeguard your rights and freedoms and legitimate interests, or
3. is based on your explicit consent.
This is derived from Art. 22(1) and (2) GDPR.
However, such decisions shall not be based on special categories of personal data referred to in Art. 9(1) GDPR, unless Art. 9(2)(a) or (g) GDPR applies and suitable measures to safeguard your rights and freedoms and legitimate interests are in place.
In the cases referred to in (1) and (3), we implement suitable measures to safeguard your rights and freedoms and legitimate interests, which include at least the right to obtain human intervention on the part of the controller, to express your point of view, and to contest the decision (Art. 21(3) and (4) GDPR). 18.10 Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, and pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority—particularly in the Member State of your habitual residence, place of work, or place of the alleged infringement—if you consider that the processing of personal data concerning you infringes the GDPR.
The supervisory authority with which the complaint has been lodged shall inform the complainant of the progress and the outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR (Art. 77 GDPR).
The competent supervisory authority for us is:
The State Commissioner for Data Protection and Information Security of Baden-Württemberg (LfDI BaWü)
https://www.baden-wuerttemberg.datenschutz.de/, poststelle@lfdi.bwl.de
The supervisory authority with which you have lodged a complaint will inform you of the progress and the outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR. Our Data Protection Officer is happy to assist you with any questions at any time.
In the context of joint controllership, you are also free to contact one of the relevant supervisory authorities responsible for the other subsidiaries of the Thermengruppe Josef Wund.
State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW)
https://www.ldi.nrw.de/, poststelle@ldi.nrw.de

19 Note on the Privacy Policy
Unless otherwise stipulated, the use of all information we hold about you is subject to this Privacy Policy.
The company reserves the right to continuously update this Privacy Policy to reflect necessary security measures in line with technological developments and will announce any such changes here.

As of: June 2026