Rockhead! Die Gravelbiketour in Sachsen: Data protection

Privacy policy

1. Introduction

With the following information, we would like to provide you, as a “data subject,” with an overview of how we process your personal data and your rights under data protection laws. In general, you can use our website without providing any personal data. However, if you wish to use specific services offered by our company via our website, the processing of personal data may be necessary. If the processing of personal data is necessary and there is no legal basis for such processing, we will generally obtain your consent.

The processing of personal data—such as your name, your address, or your email address, is always carried out in accordance with the General Data Protection Regulation (GDPR) and in compliance with the state-specific data protection regulations applicable to “Marketing-Gesellschaft Oberlausitz-Niederschlesien mbH.” Through this Privacy Policy, we would like to inform you about the scope and purpose of the personal data we collect, use, and process.

As the data controller, we have implemented numerous technical and organizational measures to ensure the most comprehensive protection possible of the personal data processed via this website. Nevertheless, internet-based data transmissions may inherently involve security vulnerabilities, meaning that absolute protection cannot be guaranteed. For this reason, you are free to provide us with personal data through alternative channels, such as by phone or mail.

You, too, can take simple and easy-to-implement measures to protect yourself against unauthorized access to your data by third parties. Therefore, we would like to provide you with some tips on how to handle your data securely:

Protect your account (login, user account, or customer account) and your IT system (computer, laptop, tablet, or mobile device) with strong passwords.
Only you should have access to these passwords.
Make sure you only use your passwords for a single account (login, user account, or customer account).
Do not use the same password for different websites, applications, or online services.
This is especially important when using publicly accessible IT systems or those shared with others: You should always log out after each session on a website, application, or online service.

Passwords should consist of at least 12 characters and be chosen so that they cannot be easily guessed. Therefore, they should not contain common everyday words, your own name, or the names of relatives, but should include uppercase and lowercase letters, numbers, and special characters.

2. Data Controller

The data controller within the meaning of the GDPR is:

Tourismusverband Oberlausitz e.V.
Humboldtstraße 25
02625 Bautzen
Representative of the Data Controller: Nicole Huber

3. Data Protection Officer

Please note that no Data Protection Officer needs to be appointed.

Contact person for data protection matters: no obligation to designate one

Email: info@oberlausitz.com

4. Definitions

This Privacy Policy is based on the terminology used by the European legislative and regulatory authorities when enacting the General Data Protection Regulation (GDPR). Our Privacy Policy is intended to be easy to read and understand for the general public as well as for our customers and business partners. To ensure this, we would like to explain the terms used in advance.

In this Privacy Policy, we use the following terms, among others:

Personal Data
Personal data refers to any information relating to an identified or identifiable natural person. A natural person is considered identifiable if they can be identified, directly or indirectly—in particular by association with an identifier such as a name, an identification number, location data, an online identifier, or one or more specific characteristics that reflect the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
Data Subject
A data subject is any identified or identifiable natural person whose personal data is processed by the data controller (our company).
Processing
Processing means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, distribution, or any other form of making available; the alignment or combination; the restriction; the erasure; or the destruction.
Restriction of processing
Restriction of processing is the marking of stored personal data with the aim of restricting its future processing.
Profiling
Profiling is any form of automated processing of personal data consisting of the use of such personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person’s work performance, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements of that natural person.
Pseudonymization
Pseudonymization is the processing of personal data in such a way that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures that ensure the personal data is not attributed to an identified or identifiable natural person.
Data Processor A data processor is a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the data controller.
Recipients
Arecipient is a natural or legal person, public authority, agency, or other body to whom personal data is disclosed, regardless of whether or not that entity is a third party. However, public authorities that may receive personal data in the course of a specific investigative mandate under Union law or the law of the Member States are not considered recipients.
Third Party
Athird party is a natural or legal person, public authority, agency, or other body other than the data subject, the controller, the processor, and the persons authorized to process the personal data under the direct responsibility of the controller or the processor.
Consent
Consent is any freely given, specific, informed, and unambiguous indication of the data subject’s wishes, expressed in the form of a statement or other unambiguous affirmative action, by which the data subject indicates that they consent to the processing of their personal data.

5. Legal Basis for Processing

Art. 6(1)(a) of the GDPR (in conjunction with § 25(1) of the TTDSG) serves as the legal basis for our company’s processing operations in which we obtain consent for a specific processing purpose.

If the processing of personal data is necessary for the performance of a contract to which you are a party—as is the case, for example, with processing operations required for the delivery of goods or the provision of other services or consideration— the processing is based on Article 6(1)(b) of the GDPR. The same applies to processing operations necessary for the implementation of pre-contractual measures, such as in cases of inquiries regarding our products or services.

If our company is subject to a legal obligation that requires the processing of personal data—such as to fulfill tax obligations—the processing is based on Article 6(1)(c) of the GDPR.

In rare cases, the processing of personal data may be necessary to protect the vital interests of the data subject or another natural person. This would be the case, for example, if a visitor were injured on our premises and their name, age, health insurance information, or other vital information had to be disclosed to a doctor, a hospital, or other third parties. In such cases, the processing would be based on Article 6(1)(d) of the GDPR.

Finally, processing operations may be based on Article 6(1)(f) of the GDPR. This legal basis applies to processing operations not covered by any of the aforementioned legal bases, provided that the processing is necessary to safeguard a legitimate interest of our company or a third party, unless the interests, fundamental rights, and fundamental freedoms of the data subject take precedence. We are permitted to carry out such processing operations in particular because they were specifically mentioned by the European legislator. In this regard, the legislator took the view that a legitimate interest could be assumed if you are a customer of our company (Recital 47, Sentence 2 of the GDPR).

Our services are generally intended for adults. Persons under the age of 16 may not provide us with any personal data without the consent of their parents or legal guardians. We do not request, collect, or disclose any personal data from children or adolescents to third parties.

6. Transfer of Data to Third Parties

Your personal data will not be transferred to third parties for purposes other than those listed below.

We will only disclose your personal data to third parties if:

you have given us your explicit consent to do so pursuant to Article 6(1)(a) of the GDPR,
the disclosure is permitted under Article 6(1)(f) of the GDPR to protect our legitimate interests, and there is no reason to believe that you have an overriding legitimate interest in preventing the disclosure of your data,
there is a legal obligation to disclose the data pursuant to Article 6(1)(c) of the GDPR, and
this is legally permissible and necessary under Article 6(1)(b) of the GDPR for the performance of contractual relationships with you.

To protect your data and, if necessary, to enable data transfers to third countries (outside the EU/EEA), we have entered into data processing agreements based on the European Commission’s Standard Contractual Clauses. If the Standard Contractual Clauses are insufficient to ensure an adequate level of security, your consent pursuant to Article 49(1)(a) of the GDPR may serve as the legal basis for transfers to third countries. This does not apply, however, to data transfers to third countries for which the European Commission has issued an adequacy decision pursuant to Article 45 of the GDPR.

Your personal data will not be transferred to third parties for purposes other than those listed below.

We will only disclose your personal data to third parties if:

you have given us your explicit consent pursuant to Article 6(1)(a) of the GDPR,
the disclosure is permitted under Article 6(1)(f) of the GDPR to protect our legitimate interests, and there is no reason to believe that you have an overriding legitimate interest in preventing the disclosure of your data,
there is a legal obligation to disclose the data pursuant to Article 6(1)(c) of the GDPR, and
this is legally permissible and necessary under Article 6(1)(b) of the GDPR for the performance of contractual relationships with you.

As part of the processing operations described in this Privacy Policy, personal data may be transferred to the United States. The United States does not have an adequate level of data protection (ECJ: Schrems II ruling). In particular, U.S. investigative authorities may compel U.S. companies to hand over or disclose personal data without the data subjects having an effective legal remedy against such action. Consequently, there is a general possibility that your personal data may be processed by U.S. investigative authorities. We have no control over these processing activities. To protect your data, we have entered into data processing agreements based on the European Commission’s Standard Contractual Clauses. If the Standard Contractual Clauses are insufficient to ensure an adequate level of security, your consent pursuant to Article 49(1)(a) of the GDPR may serve as the legal basis for the transfer to third countries. This does not apply, however, to data transfers to third countries for which the European Commission has issued an adequacy decision pursuant to Article 45 of the GDPR.

7. Technology

7.1 SSL/TLS Encryption

This site uses SSL or TLS encryption to ensure the security of data processing and to protect the transmission of confidential content—such as orders, login credentials, or contact requests—that you send to us as the operator. You can recognize an encrypted connection by the fact that “https://” appears in the browser’s address bar instead of “http://,” as well as by the padlock icon in your browser’s address bar.

We use this technology to protect the data you transmit.

7.2 Data Collection When Visiting the Website

When you use our website solely for informational purposes—that is, if you do not register or otherwise provide us with information—we collect only the data that your browser transmits to our server (in so-called “server log files”). Our website collects a range of general data and information each time you or an automated system accesses a page. This general data and information is stored in the server’s log files. The following may be collected:

browser types and versions used,
the operating system used by the accessing system,
the website from which an accessing system reaches our website (so-called “referrer”),
the subpages on our website accessed via an accessing system,
the date and time of access to the website,
a truncated Internet Protocol address (anonymized IP address), as well as
the Internet service provider of the accessing system.

We do not draw any conclusions about your identity when using this general data and information. Rather, this information is needed to

deliver the content of our website correctly,
optimize the content of our website and the advertising on it,
ensure the continued functionality of our IT systems and the technology behind our website, and
to provide law enforcement agencies with the information necessary for criminal prosecution in the event of a cyberattack.

We therefore evaluate this collected data and information both for statistical purposes and with the aim of enhancing data protection and data security within our company, ultimately to ensure an optimal level of protection for the personal data we process. The anonymous data from the server log files is stored separately from any personal data provided by a data subject.

The legal basis for data processing is Article 6(1)(f) of the GDPR. Our legitimate interest stems from the purposes of data collection listed above.

8. Cookies

8.1 General Information on Cookies

Cookies are small files that your browser automatically creates and that are stored on your IT system (laptop, tablet, smartphone, etc.) when you visit our website.

The cookie stores information that is specific to the device you are using. However, this does not mean that we thereby gain direct knowledge of your identity.

We use cookies to make your experience with our website more enjoyable. For example, we use so-called session cookies to recognize that you have already visited certain pages on our website. These are automatically deleted when you leave our site.

In addition, to optimize user-friendliness, we also use temporary cookies that are stored on your device for a specific, predetermined period of time. If you visit our site again to use our services, the system automatically recognizes that you have previously visited us and recalls the entries and settings you made, so you do not have to re-enter them.

We also use cookies to collect statistical data on the use of our website and to evaluate our offerings for the purpose of optimization. These cookies allow us to automatically recognize that you have previously visited our website when you return. The cookies set in this way are automatically deleted after a defined period of time. The respective storage duration of the cookies can be found in the settings of the consent tool used.

8.2 Legal Basis for the Use of Cookies

The data processed by the cookies, which is necessary for the proper functioning of the website, is therefore required to safeguard our legitimate interests and those of third parties pursuant to Article 6(1)(f) of the GDPR.

For all other cookies, you have provided your consent via our opt-in cookie banner in accordance with Article 6(1)(a) of the GDPR.

8.3 Information on Blocking Cookies in Common Browsers

Through the settings of the browser you are using, you can delete cookies, allow only selected cookies, or disable cookies entirely at any time. For more information, please visit the support pages of the respective providers:

9. Content on Our Website

9.1 We have integrated Jotform into this website.

The provider is Jotform Inc., 111 Pine St., Suite 1815, San Francisco, California 94111, USA—hereinafter referred to as Jotform. Jotform enables us to create online forms to collect messages, inquiries, and other submissions from our website visitors. All data you enter is processed on Jotform’s servers. The use of Jotform is based on our legitimate interest in determining your request in the most user-friendly manner possible (Art. 6(1)(f) GDPR). If consent has been requested, processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TTDSG, insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g., device fingerprinting) within the meaning of the TTDSG. Consent may be revoked at any time. The data you enter in the form will remain with us until you request its deletion, revoke your consent to its storage, or the purpose for storing the data no longer applies (e.g., after your request has been processed). Mandatory legal provisions—in particular retention periods—remain unaffected. Data transfers to the U.S. are safeguarded by EU Standard Contractual Clauses that we have entered into with Jotform. You can find details here: https://www.jotform.com/gdpr-compliance/dpa/.

10. Newsletter Distribution

10.1 Newsletter Distribution to Existing Customers

If you have provided us with your email address when purchasing goods or services, we reserve the right to periodically send you offers via email for similar goods or services from our product range as those you have already purchased. For this purpose, we are not required to obtain separate consent from you pursuant to Section 7(3) of the German Unfair Competition Act (UWG). Data processing in this regard is based solely on our legitimate interest in personalized direct marketing pursuant to Article 6(1)(f) of the General Data Protection Regulation (GDPR). If you initially objected to the use of your email address for this purpose, we will not send you any emails. You have the right to object to the use of your email address for the aforementioned promotional purpose at any time, with future effect, by notifying the data controller named at the beginning of this notice. You will only incur transmission costs in accordance with standard rates. Upon receipt of your objection, the use of your email address for marketing purposes will be discontinued immediately.

10.2 Sendinblue

This website uses Sendinblue to send newsletters. The provider is Sendinblue GmbH, Köpenicker Str. 126, 10179 Berlin, Germany.

Sendinblue is a service that, among other things, allows for the organization and analysis of newsletter distribution. The data you provide for the purpose of subscribing to the newsletter is stored on Sendinblue’s servers in Germany.

If you do not wish to have your data analyzed by Sendinblue, you must unsubscribe from the newsletter. We provide a link for this purpose in every newsletter message. You can also unsubscribe from the newsletter directly on the website.

You may revoke the consent you have given at any time. You can also prevent the processing of your data at any time by unsubscribing from the newsletter. You can also prevent the storage of cookies by adjusting the settings in your web browser. You can also prevent the storage and transmission of personal data by disabling JavaScript in your web browser or by installing a JavaScript blocker (e.g., noscript.net or www.ghostery.com). Please note that taking these measures may result in some features of our website no longer being available.

With the help of Sendinblue, we are able to analyze our newsletter campaigns. For example, we can see whether a newsletter message was opened and which links, if any, were clicked. This allows us, among other things, to determine which links were clicked particularly frequently.

In addition, we can determine whether certain predefined actions were taken after the newsletter was opened or a link was clicked (conversion rate). For example, we can see whether you made a purchase after clicking a link in the newsletter.

Sendinblue also allows us to divide newsletter recipients into different categories (a process known as “clustering”). Newsletter recipients can be grouped, for example, by age, gender, or location. This enables us to better tailor the newsletters to the respective target audiences.

For detailed information on Sendinblue’s features, please visit the following link: https://www.newsletter2go.de/features/newsletter-software/.

Data processing is based on your consent in accordance with Article 6(1)(a) of the GDPR. You may withdraw this consent at any time. The lawfulness of data processing operations that have already taken place remains unaffected by the withdrawal.

The data you have provided to us for the purpose of subscribing to the newsletter will be stored by us until you unsubscribe from the newsletter and will be deleted from both our servers and Sendinblue’s servers after you unsubscribe. Data stored by us for other purposes (e.g., email addresses for the members’ area) remains unaffected by this.

You can view Sendinblue’s privacy policy at: https://www.newsletter2go.de/features/datenschutz-2/.

11. Our Activities on Social Media

To enable us to communicate with you on social media and keep you informed about our services, we maintain our own pages on these platforms. When you visit one of our social media pages, we are jointly responsible with the provider of the respective social media platform for the processing operations triggered thereby, within the meaning of Article 26 of the GDPR.

We are not the original provider of these pages, but merely use them within the scope of the options offered to us by the respective providers.
Therefore, as a precaution, we would like to point out that your data may also be processed outside the European Union or the European Economic Area. Using these platforms may therefore involve data protection risks for you, as it may be difficult to exercise your rights—such as the right to access, erasure, or objection— etc., may be more difficult, and processing on social networks is often carried out directly by the providers for advertising purposes or to analyze user behavior, without us having any influence over this. When the provider creates user profiles, cookies are often used, or your usage behavior is linked to the social media profile you have created.

The described processing of personal data is carried out in accordance with Art. 6(1)(f) of the GDPR on the basis of our legitimate interest and the legitimate interest of the respective provider to communicate with you in a modern manner and to inform you about our services. If you are required to provide consent to data processing as a user with the respective providers, the legal basis is Article 6(1)(a) of the GDPR in conjunction with Article 7 of the GDPR.

Since we do not have access to the providers’ databases, we would like to point out that the best way to exercise your rights (e.g., the right to access, rectification, erasure, etc.) is to contact the respective provider directly. We have provided further information regarding the processing of your data on social networks below for each social media provider we use:

11.1 Facebook

(Joint) Data Controller in Europe:
Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland

11.2 Instagram

(Joint) Data Controller in Germany:
Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland

11.3 YouTube

(Joint) Data Controller in Europe:
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

12. Web Analytics

12.1 Facebook Pixel (Custom Audience)

This website uses the “Facebook Pixel” from Meta Platforms, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA (“Meta”). If you provide your explicit consent, this allows us to track users’ behavior after they have viewed or clicked on a Facebook ad. This process is used to evaluate the effectiveness of Facebook ads for statistical and market research purposes and can help optimize future advertising campaigns.

The data collected is anonymous to us and therefore does not allow us to draw conclusions about the identity of users. However, the data is stored and processed by Meta, allowing a link to the respective user profile and enabling Meta to use the data for its own advertising purposes in accordance with the Facebook Data Use Policy (https://www.facebook.com/about/privacy/). This enables Meta and its partners to display advertisements on and off Facebook. A cookie may also be stored on your computer for these purposes.

These processing operations take place exclusively upon the granting of explicit consent in accordance with Art. 6(1)(a) of the GDPR.

12.2 Google Analytics Universal

On our websites, we use Google Analytics, a web analytics service provided by Google Ireland Limited (https://www.google.de/intl/de/about/), Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). In this context, pseudonymized user profiles are created and cookies (see the “Cookies” section) are used. The information generated by the cookie regarding your use of this website, such as

the browser type and version,
the operating system used,
the referrer URL (the previously visited page),
the hostname of the accessing computer (IP address), and
the time of the server request,

are transmitted to a Google server in the United States and stored there. This information is used to evaluate the use of the website, to compile reports on website activity, and to provide other services related to website and Internet usage for the purposes of market research and to tailor the design of these web pages to user needs. This information may also be transferred to third parties if required by law or if third parties process this data on Google’s behalf. Under no circumstances will your IP address be merged with other data held by Google. IP addresses are anonymized so that they cannot be traced back to you (IP masking).

You can prevent the installation of cookies by adjusting your browser settings accordingly; however, please note that in this case, you may not be able to use all features of this website to their full extent.

These processing operations take place exclusively upon the granting of explicit consent in accordance with Art. 6(1)(a) of the GDPR.

You can also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address), as well as the processing of this data by Google, by downloading and installing a browser add-on (https://tools.google.com/dlpage/gaoptout?hl=de) .

You can view the Google Analytics privacy policy at: https://support.google.com/analytics/answer/6004245?hl=de.

12.3 Matomo

We have integrated the Matomo component from the provider InnoCraft Ltd., 150 Willis St, 6011 Wellington, New Zealand, into this website. Matomo is a web analytics software tool used to collect, gather, and analyze data on the behavior of website visitors. Among other things, data is collected on which website a data subject came from to reach a website (known as a “referrer”), which subpages of the website were accessed, and how often and for how long a subpage was viewed. This information is used to optimize the website and to conduct a cost-benefit analysis of online advertising.

The software runs on the data controller’s server, and the log files—which are sensitive under data protection law—are stored exclusively on this server.

Matomo sets a cookie on your IT system. Setting this cookie enables us to analyze the use of our website. Each time you visit one of the individual pages on this website, the Matomo component automatically prompts the web browser on your IT system to transmit data to our server for the purpose of online analysis. As part of this technical process, we obtain personal data, such as the IP address of the data subject, which we use, among other things, to track the origin of visitors and clicks.

Cookies are used to store personal information, such as the time of access, the location from which access originated, and the frequency of visits to our website. Each time you visit our website, this personal data—including the IP address of the internet connection you are using—is transmitted to our server. We store this personal data. We do not disclose this personal data to third parties.

These processing operations take place exclusively upon the granting of explicit consent in accordance with Article 6(1)(a) of the GDPR.

You can view Matomo’s privacy policy at: https://matomo.org/privacy/.

13. Plugins and Other Services

13.1 Google Photos

We use the online service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, to store images embedded on our website.

Embedding refers to the integration of specific third-party content (text, video, or image data) provided by another website (Google Photos) that then appears on our own website. A so-called embed code is used for embedding. If we have integrated an embed code, the external content from Google Photos is displayed immediately by default as soon as one of our web pages is visited.

Through the technical implementation of the embed code, which enables the display of images from Google Photos, your IP address is transmitted to Google Photos. Furthermore, Google Photos collects information about our website, the browser type used, the browser language, the time of access, and the duration of the visit. In addition, Google Photos may collect information about which of our subpages you visited, which links you clicked on, and other interactions you performed while visiting our site. This data may be stored and analyzed by Google Photos.

These processing operations take place exclusively upon the granting of explicit consent in accordance with Art. 6(1)(a) of the GDPR.

You can view Google’s privacy policy at: https://www.google.com/policies/privacy/.

13.2 Google Tag Manager

We use the Google Tag Manager service on this website. The operator of Google Tag Manager is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Ireland Limited is part of the Google group of companies, headquartered at 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

This tool allows “website tags” (i.e., keywords embedded in HTML elements) to be implemented and managed via a user interface. By using Google Tag Manager, we can automatically track which button, link, or personalized image you have actively clicked on and can then determine which content on our website is of particular interest to you.

The tool also triggers other tags, which may in turn collect data. Google Tag Manager does not access this data. If you have disabled tracking at the domain or cookie level, this setting remains in effect for all tracking tags implemented using Google Tag Manager.

These processing operations take place exclusively upon the granting of explicit consent in accordance with Art. 6(1)(a) of the GDPR.

For more information about Google Tag Manager and Google’s Privacy Policy, please visit: https://www.google.com/intl/de/policies/privacy/.

13.3 Google WebFonts

Our website uses so-called web fonts to ensure consistent font display. Google WebFonts are provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Ireland Limited is part of the Google group of companies, headquartered at 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

These processing activities take place exclusively upon the granting of explicit consent in accordance with Art. 6(1)(a) of the GDPR.

For more information about Google WebFonts and Google’s Privacy Policy, please visit: https://developers.google.com/fonts/faq; https://www.google.com/policies/privacy/.

13.4 OpenStreetMap

We have integrated map sections from the online mapping tool “OpenStreetMap” into our website. This is a so-called open-source mapping service that we can access via an API (application programming interface). This feature is provided by the OpenStreetMap Foundation, St. John’s Innovation Center, Cowley Road, Cambridge, CB4 0WS, United Kingdom. By using this service, you can, for example, view our location and make it easier to find your way here.

When you visit the subpages where OpenStreetMap is integrated, information about your use of our website (such as your IP address, browser data, device type, and operating system) is transmitted to OpenStreetMap and stored there.

To speed up the service, OpenStreetMap uses the Content Delivery Network (CDN) provided by Fastly, Inc., PO Box 78266, San Francisco, CA 94107, USA (Fastly). A CDN is a service that enables the content of our website—particularly large media files such as graphics or scripts—to be delivered more quickly using servers distributed regionally and connected via the Internet. Your data is processed exclusively for the aforementioned purposes and to maintain the security and functionality of the CDN.

For each instance of data processing, Fastly transfers personal data from the log files (e.g., IP addresses) to the United States, as certain servers used to process the log files are located only in the United States. Fastly has therefore committed to complying with the standards and regulations of European data protection law. Fastly’s current Privacy Policy can be found at: https://www.fastly.com/de/privacy/.

If consent has been obtained, processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR.

Detailed information about OpenStreetMap can be found at: https://wiki.osmfoundation.org/wiki/Privacy_Policy.

13.5 YouTube (Videos)

We have integrated YouTube components into this website. YouTube is operated by YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. YouTube, LLC is a subsidiary of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

If you are logged into YouTube at the same time, YouTube will recognize which specific page of our website you are visiting when you access a subpage that contains a YouTube video. This information is collected by YouTube and Google and associated with your YouTube account.

YouTube and Google always receive information via the YouTube component that you have visited our website whenever you are logged into YouTube at the same time you access our website; this occurs regardless of whether you click on a YouTube video or not. If you do not wish for this information to be transmitted to YouTube and Google, you can prevent the transmission by logging out of your YouTube account before visiting our website.

These processing activities take place exclusively upon your express consent in accordance with Article 6(1)(a) of the GDPR.

You can view YouTube’s privacy policy at https://www.google.de/intl/de/policies/privacy/.

13.6 This website uses Adobe web fonts to ensure consistent display of certain fonts.

The provider is Adobe Systems Incorporated, 345 Park Avenue, San Jose, CA 95110-2704, USA (Adobe). When you visit this website, your browser loads the required fonts directly from Adobe so that they can be displayed correctly on your device. In doing so, your browser establishes a connection to Adobe’s servers in the United States. As a result, Adobe becomes aware that this website has been accessed via your IP address. According to Adobe, no cookies are stored when the fonts are provided. The storage and analysis of the data are based on Article 6(1)(f) of the GDPR. The website operator has a legitimate interest in ensuring a consistent font display on its website. If consent has been requested, processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TTDSG, insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g., device fingerprinting) within the meaning of the TTDSG. Consent may be revoked at any time. Data transfers to the U.S. are based on the European Commission’s Standard Contractual Clauses. Details can be found here: https://www.adobe.com/de/privacy/eudatatransfers.html. For more information about Adobe Fonts, visit: https://www.adobe.com/de/privacy/policies/adobe-fonts.html. Adobe’s privacy policy can be found at: https://www.adobe.com/de/privacy/policy.html

13.7 We Use Outdooractive

To the extent that we use Outdooractive’s services on our website—in particular its map data—the following privacy policy applies in addition. Outdooractive provides electronic databases that you, as our users, can access via an electronic information portal in the digital tourism sector. This includes, for example, maps and route planning. Outdooractive receives the following data, which is technically necessary for Outdooractive to display the electronic databases to you and to ensure stability and security (the legal basis is Art. 6(1), sentence 1, lit. f of the GDPR): ? IP address ? Date and time of the request ? Time zone difference from Greenwich Mean Time (GMT) ? Content of the request (specific page) ? Access status/HTTP status code ? Amount of data transferred in each case ? Website from which the request originates ? Browser ? User’s location ? Operating system and its user interface ? Language and version of the browser software. Outdooractive uses cookies stored in your browser for analysis purposes. Outdooractive stores the information collected in this manner on servers in Germany and in third countries. You can control this analysis by deleting existing cookies and preventing the storage of cookies. Please note that if you prevent the storage of cookies, you may not be able to make full use of Outdooractive’s electronic databases. You can prevent cookies from being stored by adjusting your browser settings. The IP address transmitted by your browser is not combined with other data we collect. Outdooractive continues to use your GPS data when you use the electronic databases. We have no influence over the data collected or the data processing operations, nor are we aware of the full scope of data collection, the purposes of processing, or the retention periods. We also have no information regarding the deletion of the collected data by Outdooractive. Outdooractive stores the data collected about you as user profiles and uses them for market research and/or to tailor the electronic databases to user needs. You have the right to object to the creation of these user profiles; to exercise this right, you must contact Outdooractive. The legal basis for the use of Outdooractive’s services is Article 6(1)(f) of the GDPR. Further information on the purpose and scope of data collection and its processing by Outdooractive can be found in the privacy policy provided below. There you will also find further information on your rights in this regard and settings options for protecting your privacy. Privacy Policy of Outdooractive AG, Missener Straße 18, 87509 Immenstadt: corporate.outdooractive.com/de/datenschutzrichtlinien/ www.outdooractive.com/de/datenschutz.html

14. Your Rights as a Data Subject

14.1 Right to Confirmation

You have the right to request confirmation from us as to whether personal data concerning you is being processed.

14.2 Right of Access (Art. 15 GDPR)

You have the right to receive, at any time and free of charge, information from us regarding the personal data we have stored about you, as well as a copy of this data, in accordance with the provisions of the law.

14.3 Right to Rectification (Art. 16 GDPR)

You have the right to request the rectification of inaccurate personal data concerning you. Furthermore, you have the right to request the completion of incomplete personal data, taking into account the purposes of the processing.

14.4 Erasure (Art. 17 of the GDPR)

You have the right to request that we erase personal data concerning you without undue delay, provided that one of the grounds specified by law applies and provided that the processing or storage is not necessary.

14.5 Restriction of Processing (Art. 18 GDPR)

You have the right to request that we restrict the processing of your personal data if one of the statutory conditions is met.

14.6 Data Portability (Article 20 of the GDPR)

You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used, and machine-readable format. You also have the right to transmit this data to another controller to whom the personal data was provided, without hindrance from us, provided that the processing is based on consent pursuant to Art. 6(1)(a) of the GDPR or Art. 9(2)(a) of the GDPR or on a contract pursuant to Article 6(1)(b) of the GDPR, and the processing is carried out by automated means, provided that the processing is not necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.

Furthermore, when exercising your right to data portability pursuant to Art. 20(1) of the GDPR, you have the right to have the personal data transmitted directly from one controller to another, provided this is technically feasible and does not infringe upon the rights and freedoms of others.

14.7 Objection under Article 21 of the GDPR

You have the right, for reasons arising from your particular situation, to object at any time to the processing of personal data concerning you that is carried out on the basis of Article 6(1)(e) (data processing in the public interest) or (f) (data processing based on a balancing of interests) of the GDPR.

This also applies to profiling based on these provisions within the meaning of Article 4(4) of the GDPR.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or if the processing is necessary for the establishment, exercise, or defense of legal claims.

In certain cases, we process personal data for the purpose of direct marketing. You may object at any time to the processing of your personal data for such marketing purposes. This also applies to profiling to the extent that it is related to such direct marketing. If you object to the processing of your personal data for direct marketing purposes, we will no longer process your personal data for these purposes.

In addition, you have the right, for reasons arising from your particular situation, to object to the processing of personal data concerning you that we carry out for scientific or historical research purposes or for statistical purposes pursuant to Article 89(1) of the GDPR, unless such processing is necessary for the performance of a task carried out in the public interest.

You are free to exercise your right to object in connection with the use of information society services, notwithstanding Directive 2002/58/EC, by means of automated procedures that use technical specifications.

14.8 Withdrawal of Consent Under Data Protection Law

You have the right to withdraw your consent to the processing of personal data at any time with future effect.

14.9 Filing a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a supervisory authority responsible for data protection regarding our processing of personal data.

15. Routine Storage, Deletion, and Blocking of Personal Data

We process and store your personal data only for the period necessary to fulfill the purpose of storage or to the extent required by the laws to which our company is subject.

If the purpose of storage no longer applies or a prescribed retention period expires, the personal data will be routinely blocked or deleted in accordance with legal requirements.

16. Duration of Storage of Personal Data

The criterion for the duration of storage of personal data is the respective statutory retention period. Upon expiration of this period, the relevant data is routinely deleted, provided it is no longer required for the performance of a contract or for entering into a contract.

17. Validity and Changes to the Privacy Policy

This Privacy Policy is currently valid and was last updated in February 2023.

Due to the ongoing development of our website and services, or as a result of changes in legal or regulatory requirements, it may become necessary to amend this Privacy Policy. You can access and print the current version of the Privacy Policy at any time on our website at“https://www.oberlausitz.com/datenschutz.”

This Privacy Policy was created with the assistance of the data protection software: audatis MANAGER.

Analysis tools and advertising

Matomo

On this website, data is collected and stored using the web analysis service software Matomo (www.matomo.org), a service provided by InnoCraft Ltd, 150 Willis St, 6011 Wellington, New Zealand, ("Matomo") on the basis of our legitimate interest in the statistical analysis of user behavior for optimization and marketing purposes in accordance with Art. 6 para. 1 lit. f GDPR. Pseudonymized user profiles can be created and evaluated from this data for the same purpose. Cookies can be used for this purpose. Cookies are small text files that are stored locally in the cache of the website visitor's Internet browser. Among other things, cookies make it possible to recognize the Internet browser. The data collected using Matomo technology (including your pseudonymized IP address) is processed on our servers.
The information generated by the cookie in the pseudonymous user profile is not used to personally identify the visitor to this website and is not merged with personal data about the bearer of the pseudonym.
If you do not agree to the storage and analysis of this data from your visit, you can object to its storage and use at any time by clicking below. In this case, a so-called opt-out cookie will be stored in your browser, which means that Matomo will not collect any session data. Please note that the complete deletion of your cookies means that the opt-out cookie will also be deleted and may have to be reactivated by you.

Google AdSense

Our website uses the services of Google AdSense. This is a web analysis service provided by Google Inc. The analysis is made possible by so-called cookies and web beacons. Cookies are text files that are stored on your computer and make it possible to analyze the use of the website. Web beacons are invisible graphics that make it possible to create information about visitor traffic on the website. All information about the use of the website and advertising formats, including your IP address, is transmitted to Google Inc. and stored there. Contractual partners of Google Inc. may obtain this information. The IP address determined by Google AdSense will not be merged with other Google data. If you do not wish cookies to be stored on your computer, you can make the appropriate settings in your browser (see the general section of this statement on cookies for more information). Unfortunately, this may result in limited use of our website. By using this website, you consent to the collection of the above-mentioned information in the manner described. By using the website, you further consent to the transmission of the information to Google Inc. for the above-mentioned purpose.

Competitions

From time to time, we organize exciting competitions on our social media channels where you can win exclusive RockHead prizes. To ensure that participation is fair and transparent, we have summarized all the important conditions of participation in one document. In this document you will find out, among other things: Who may participate ; how participation works ; which deadlines must be observed ; how the winners are determined and notified ; what happens to your data, etc.

However, there are currently no competitions taking place.