A. Responsible for Data Processing

Responsible for the processing of personal data within this web presence in accordance with the General Data Protection Regulation (GDPR) is:

Mittelweser-Touristik GmbH
Lange Straße 18
31582 Nienburg
Phone: 05021 91763-0
Website: www.mittelweser-tourismus.de
Email: info@mittelweser-tourismus.de

With this privacy policy, we inform you about the scope of the processing of your personal data (hereinafter only "data").

B. Data Processing

In the context of operating our website, we process data. The processing of data also includes disclosure through transmission. For data transfers to the USA, there is an adequacy decision by the EU Commission, the EU-US Privacy Shield. In this, the Commission has certified that the guarantees for data transfer to the USA based on the EU-US Privacy Shield meet EU data protection standards. As far as we transmit data to the USA, we have marked the participation of our service providers in the EU-US Privacy Shield.

The specific data affected, processing purposes, legal bases, recipients, and transfers to third countries are listed below:

1. Log File

We log your visit to our websites. The following data are processed: the name of the webpage accessed, date and time of access, the transferred data volume, browser type and version, the operating system you used, referrer URL (the previously visited webpage), your IP address, and the requesting provider. This is necessary to ensure the security of the website. We process the data based on our legitimate interests according to Art. 6(1)(f) GDPR. The log file is deleted after seven days unless needed for clarification or proof of specific legal violations known within the retention period.

2. Hosting

In the context of hosting, all data processed in connection with the operation of this website are stored. This is necessary to enable the operation of the website. We process the data based on our legitimate interests according to Art. 6(1)(f) GDPR. We use services from a web hosting provider, to whom we transmit the above data.

3. Contact

If you contact us, your data (name, contact details if provided by you) and your message are processed solely for the purpose of handling and processing your inquiry. We process these data based on Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR. If you choose a third-party provider during contact, data may be forwarded to them as per your instructions.

4. Postal Dispatch of Brochures

We process your order data for sending our free brochures. The processing is based on our predominant interest in the optimal marketing of our online offer according to Art. 6(1)(f) GDPR. We transmit your address data to the company responsible for delivery.

5. Applications

If you contact us to send your application as an employee, e.g., via email or contact form, the data you provide (e.g., name, email address, desired location), your message, and the submitted application documents are processed solely for the purpose of handling your application. The legal basis is primarily § 26 BDSG (German Federal Data Protection Act). Data processing is permitted as it is necessary for the decision regarding employment.

If, after the application process, data needs to be retained for legal reasons, processing may occur based on our legitimate interests according to Art. 6(1)(f) GDPR, such as asserting or defending claims.

If you give us consent to retain your application documents in our applicant pool for future vacancies matching your profile, we will store them for that purpose. The legal basis for this processing is your prior consent according to Art. 6(1)(a) GDPR.

6. Integration of External Content

We use external dynamic content to optimize the presentation and offerings of our website. When visiting the website, an API request is automatically sent to the server of the respective content provider, transmitting certain log data (e.g., the user's IP address). The dynamic content is then transmitted to our website and displayed there.

The legal basis for this is your consent according to Art. 6(1)(a) GDPR, which we obtain beforehand.

We use external content in connection with the following functionalities:

6.1 Embedding YouTube Videos

We have embedded videos from YouTube, a service of Google LLC, Mountain View, California, USA, on our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When playing the videos, data may be transmitted to YouTube's servers in the USA. Google is certified under the EU-US Data Privacy Framework and is thus covered by the adequacy decision of the EU Commission for data transfers to the USA.

6.2 OpenStreetMap

We use the geo-data visualization service "OpenStreetMap" (also called "OSM") provided by the OpenStreetMap Foundation, 132 Maney Hill Road, Sutton Coldfield, West Midlands, B72 1JU, United Kingdom. OSM is used to offer an interactive map on our website, showing you how to find and contact us. This service allows us to display our website attractively by loading map data from an external server. The following data are transmitted to OSM's servers during display: the specific webpage you visited and your device's IP address. For more information on how user data is handled, please see OSM's privacy policy: https://wiki.osmfoundation.org/wiki/Privacy_Policy

The United Kingdom is among the third countries for which an adequacy decision by the EU Commission for data transfers exists.

The legal basis for data processing is your consent according to Art. 6(1)(a) GDPR.

You can revoke your consent at any time with effect for the future by adjusting your preferences in our consent banner.

7. Cookies

7.1 Use of Cookies

Our website uses cookies. Cookies are small text files stored on your device (PC, smartphone, tablet, etc.) and saved by your browser. Information about the specific cookies we use, their providers, and purposes can be found in our consent banner. There, you give your consent to the respective services, can revoke it, or adjust your settings later.

7.2 Our Consent Banner

To document your choices regarding data processing and to fulfill our data protection obligations, we use a consent banner. When you visit our website, your cookie preferences are queried via this banner. We then set a cookie that stores data about your consents or revocations. The data processing is carried out to fulfill our legal obligations according to Art. 6(1)(c) GDPR.

8 Matomo

To tailor our websites to your needs, we use the web analytics tool "Matomo." Matomo creates usage profiles based on pseudonyms. For this purpose, permanent cookies are stored on your device and read by us. This allows us to recognize and count returning visitors. We also use the Heatmap & Session Recording modules. Matomo's heatmap service shows us the areas of our website where the mouse moves most frequently or where clicks occur most often. The session recording service records individual user sessions. We can replay recorded sessions and analyze how our website is used. Data entered into forms are not recorded and are not visible at any time. You can find more information about Matomo's terms of use and data protection regulations at: https://matomo.org/privacy/

The legal basis for data processing is your consent according to Art. 6 para. 1 a) GDPR.

You can revoke your consent at any time with effect for the future by adjusting your preferences in our consent banner.

C. Duration of Data Storage

We store personal data only as long as it is necessary for the purposes for which it is processed or until you revoke your consent. If legal retention obligations apply, the storage period for certain data may be up to 10 years, regardless of the processing purposes.

D. Your Rights as a Data Subject

1. Right to Access

Upon request, you can at any time receive free information about all personal data we have stored about you.

2. Correction, Deletion, Restriction of Processing (Blocking), Objection

If you no longer agree with the storage of your personal data or if the data has become incorrect, we will, upon your instruction, delete or block your data or make the necessary corrections (as far as this is possible under applicable law). The same applies if you wish us to process your data only in a restricted manner in the future. You have the right to object, especially in cases where your data is necessary for performing a task in the public interest or where the data processing is based on our legitimate interest, including profiling based on that. You also have the right to object in cases of data processing for direct marketing purposes.

3. Right to Withdraw Consent for Future Effect

You can withdraw any consent you have given at any time with effect for the future. Your withdrawal does not affect the lawfulness of the processing carried out before the withdrawal.

4. Data Portability

If data processing is based on a contract, pre-contractual negotiations, consent, or automated procedures, you have the right to data portability. Upon request, we will provide you with your data in a common, structured, and machine-readable format, so that you can transfer the data to another controller if you wish.

5. Restriction of Processing

Data for which we are unable to identify the data subject, for example, if it has been anonymized for analysis purposes, are not covered by the above rights. The right to access, delete, block, correct, or transfer this data to another company may be possible if you provide us with additional information that allows us to identify you.

6. Exercising Your Data Subject Rights and Right to Complain

If you have questions about the processing of your personal data, or if you wish to access, correct, block, object to, or delete your data, or to transfer your data to another company, please contact us at info@mittelweser-tourismus.de. You also have the option to file a complaint with a supervisory authority regarding your data rights.