Privacy Policy

for the use of the Skiline Services of Alturos Destinations GmbH by the User via the Internet portal www.skiline.cc, the Skiline App as well as via third-party systems that offer the use of Skiline Services

Version: May 15th, 2022

1 Responsible Party

It is of special concern to Alturos Destinations GmbH (ALTUROS) to protect your data. When processing your personal data, we comply with the applicable data protection provisions in accordance with the General Data Protection Regulation (GDPR).

The responsible party for the storage and processing of personal data is Alturos Destinations GmbH, Lakeside B03, A-9020 Klagenfurt, Phone +43 (0)463 24 94 45, Email privacy-protection@alturos.com.

Ms. Eva Plaschke acts as external data protection officer for Alturos Destinations GmbH.

Contact: Eva Plaschke, EQT-Unternehmensberatung e.U./Erfolg durch Qualität und Transparenz, Althofen 49, A-9131 Grafenstein, Phone +43 (0) 664 829 79 49, E-Mail eva.plaschke@alturos.com.

2 Information About the Processing of Your Personal Data

In the course of your registration or use the Skiline service, users of the Skiline service provide data that allows conclusions to be drawn about their person by means of a declaration of consent. This includes the following personal data:

· First Name
3 Last Name
· Email Address
4 Date of Birth
· Sex, Gender
5 Street, House Number
· Postal Code, City
6 Country

If the user is 14 years of age or younger, he or she must first obtain the consent of his or her parent/guardian before sending data to Alturos via our website or app. Without this consent, the provision of data is prohibited. In the case that data is submitted to us, we will stop processing such data as soon as we become aware of it. The facts regarding the storage and processing of personal data are explained below.

6.1 Visiting the Website

· Purpose: If our website is used for information purposes only (no registration and no transmission of other information), personal data that is transmitted from your browser to our server is collected. This is technically necessary to display our website and to ensure the stability and security of the website.
7 Legal basis: legitimate interest (Art. 6 § 1(f) GDPR)
· The following data is processed: IP address, date and time of the request, GMT time zone difference, content of the request (specific page), access status/HTTP status code, amount of data transferred, requesting website, browser, operating system and interface, language and version of the browser software
8 Storage period: As long as you are using our website.
· Recipient/recipient categories: data processors

8.1 Electronic enquiries through the website

· Purpose: processing of enquiries sent by email or using the website contact form.
9 Legal basis: performance of a contract, taking steps prior to entering a contract (point (b) of Article 6(1) GDPR)
· The following personal data are processed: Master Data.
10 Duration of storage: until the enquiry has been answered. If any statutory retention requirements apply, processing will be restricted for the duration of the relevant period.
· Recipient/categories of recipient: processor(s)

10.1 User administration, legal disputes

· Purpose: Processing of personal data, so that the user can use the Skiline service free of charge.
11 Legal basis: consent (Art. 6 § 1(a) GDPR), performance of a contract with the data subject (Art. 6 § 1(b) GDPR), fulfillment of a legal requirement (Art. 6 § 1(c) GDPR), legitimate interest, in particular the defense against, exercise and assertion of legal claims (Art. 6 § 1(f) GDPR), explicit consent (Art. 9 § 2(a) GDPR)
· The following personal data is processed: Master Data
12 Storage period: Until the termination of the business relationship or until the expiry of the applicable statutory retention or limitation periods. In addition, data is stored until the conclusion of any litigation in which it is required as evidence.
· Recipient/recipient categories: organizers, service providers, legal representatives, certified accountants, tax offices, courts and government authorities

12.1 Customer Service and Marketing

· Purpose: Processing of customer and prospective customer data for the initiation of a business relationship regarding the services offered, the sending of additional product information in the course of the contractual relationship as an additional service, conducting advertising measures and newsletter delivery; customer relation management.
13 Legal basis: consent (Art. 6 § 1(a) GDPR), performance of a contract with the data subject (Art. 6 § 1(b) GDPR), fulfillment of a legal requirement (Art. 6 § 1(c) GDPR), legitimate interest, in particular the defense against, exercise and assertion of legal claims (Art. 6 § 1(f) GDPR)
· The following personal data is processed for the sending of additional travel or leisure information in the course of the contractual relationship as an additional service and the newsletter delivery via our website: Master Data
14 Storage period: The data is stored until the end of the contractual relationship provided no extended contractual or statutory retention periods apply.
· Recipient/recipient categories: service providers

15 Rights of Data Subjects

15.1 You have the following rights with regard to your personal data:

· Right of access (Art. 15 GDPR),
16 Right to rectification (Art. 16 GDPR) or erasure (Art. 17 GDPR),
· Right to restriction of processing (Art. 18 GDPR),
17 Right to data portability (Art. 20 GDPR),
· Right to object to processing (Art. 21 GDPR).

17.1 Right of Revocation

If you have given us your consent for the processing of your personal data, you can also revoke your consent at any time. Your revocation does not affect the legality of the data processing prior to revocation.

17.2 Right to Object

If the processing of your personal data is subject to a balancing of interests (Art. 6 § 1(f) GDPR: legitimate interests), you have the right to object to the processing at any time for reasons arising from your particular situation. When exercising your right to object, we ask you to explain your reasons why we should not process your personal data as we do. We will review the facts and either stop or adjust the data processing or demonstrate our compelling legitimate grounds to continue the data processing. We will also continue the data processing if it serves the assertion, exercise or defense of legal claims. You may object to the processing of data for the purposes of direct advertising and data analysis at any time. In this case, we will stop the data processing.

17.3 Exercise of Your Rights

To exercise your rights, you must inform us in person, by telephone or in writing. The request should be made to Alturos Destinations GmbH, Lakeside B03, A-9020 Klagenfurt, Phone: +43 (0) 463/24 94 45. We can only provide you with information if you can identify yourself.

17.4 Complaint to the Supervisory Authority

If you believe that the storage and processing of your personal information violates applicable data protection laws or your data protection claims have been violated, you have the right to file a complaint with the supervisory authority. The complaint should be addressed to the Austrian Data Protection Agency, Barichgasse 40-42, A-1030 Vienna.

18 Cookies

18.1 Definition of cookies

Our website uses HTTP cookies in order to store data specific to the individual user.

We clarify below what cookies are and why they are used so that you can better understand the following Privacy Statement.

Whenever you surf on the internet, you use a browser. Well-known browsers include for example Chrome, Safari, Firefox, Internet Explorer and Microsoft Edge. Most websites store small text files in your browser. These files are known as cookies.

It cannot be denied that cookies are genuinely useful. Almost all websites use cookies. More specifically, these cookies are HTTP cookies, as other types of cookie exist for other types of application. HTTP cookies are small files that are stored by our website on your computer. These cookie files are automatically stored in the cookie folder, which is like the “brain” of your browser. A cookie has a name and a value. When defining a cookie it is also necessary to indicate one or more attributes.

Cookies store certain user data relating to you, such as for example your language or personal page settings. If you return to our website, your browser sends the “user-specific” information back to our page. Thanks to cookies, our website knows who you are and provides you with the settings that you are used to. In some browsers each cookie has its own file, whereas in others such as for example Firefox all cookies are stored in one single file.

18.2 Types of cookie

It is possible to distinguish between 4 types of cookie:

Essential cookies
These cookies are necessary in order to ensure basic website functions. For example these cookies are required if a user puts a product in the basket then moves on to another page and only goes to the checkout at a later stage. Thanks to these cookies, the basket is not emptied, even if the user closes the browser window.

Functional cookies
These cookies collect information concerning user behaviour and whether the user has received any error messages. In addition, these cookies also measure loading times and how the website performs with different browsers.

Targeted cookies
These cookies ensure greater user friendliness. For example, they store locations, font sizes or form data that has been entered.

Advertising cookies
These cookies are also known as targeting cookies. They are intended to provide advertising that is individually tailored to the user. This can be extremely practical, but also very annoying.

You are normally asked whether you would like to allow this type of cookie the first time you visit a website. And naturally this decision itself is also stored in a cookie.

18.3 Right to object – ability to delete cookies

You can decide for yourself how and whether you would like to use cookies. Regardless of the service or website from which the cookies originate, you always have the option of erasing or disabling cookies, or only allowing certain types of cookie. For example, you can block cookies from third party providers, whilst allowing all other cookies.

If you would like to establish which cookies have been stored in your browser, change your cookie settings or delete cookies, you can do so within your browser settings:

· Chrome: Clear, enable, and manage cookies
19 Safari: Manage cookies and website data
· Firefox: Clear cookies and site data
20 Internet Explorer: Delete and manage cookies
· Microsoft Edge: Delete and manage cookies

If as a general rule you do not want any cookies, you can configure your browser in such a manner that you are always informed if a cookie is to be saved. You can decide for each individual cookie whether or not to allow the cookie. The procedure differs depending upon the browser. The easiest way of finding instructions is to enter search terms such as “delete cookies Chrome” or “disable cookies Chrome” into Google, if you are using a Chrome browser.

20.1 Legal basis

Since 2009 a so-called “Cookie Directive” has been applicable. It states that the storage of cookies requires your consent (point (a) of Article 6(1) GDPR). However, responses to this Directive within EU Member States have differed widely. In Austria, the Directive was implemented by Section 96(3) of the Austrian Telecommunications Act [Telekommunikationsgesetz, TKG].

Even if consent has not been obtained, essential cookies are justified by legitimate interests (point (f) of Article 6(1) GDPR), which in most cases are economic in nature. We would like to offer a pleasant user experience to visitors to the website, which in many cases means that particular cookies are absolutely essential.

If any cookies are used that are not absolutely essential, this only occurs with your consent. The legal basis for this is point (a) of Article 6(1) GDPR.

21 Google Analytics

21.1 Definition of Google Analytics

On our website we use the analysis tracking tool Google Analytics (GA) provided by the US company Google Inc. The company Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland) is responsible for all Google services within Europe. Google Analytics collects data about how you behave on our website. For example, if you click on a link, this action is stored in a cookie and sent to Google Analytics. We can use the reports that we receive from Google Analytics to tailor our website and our services better to your wishes. We describe the tracking tool in greater detail below and inform you in particular about which data are stored and how you can prevent this from happening.

Google Analytics is a tracking tool for analysing data traffic on our website. In order for Google Analytics to work, a tracking code is incorporated into the code for our website. If you visit our website, this code records your various actions on our website. Once you have left our website, these data are sent to Google Analytics servers and stored at that location.

Google process the data and we receive reports concerning your user behaviour. These may include, amongst others, the following types of report:

· Audience reports: audience reports enable us to find out more about our users and to know who exactly is interested in our services.
22 Ad reports: ad reports make it easier for us to analyse and improve our online advertising.
· Acquisition reports: acquisition reports provide us with helpful information about how we can get more people interested in our services.
23 Behaviour reports: here we find out how you interact with our website. We can identify the route by which you arrived at our website as well as the links that you have clicked on.
· Conversion reports: conversion means the way in which you carry out a pre-defined act on the basis of a marketing message. For example, this might concern how you turn from a mere visitor to the website into a customer or a subscriber to the newsletter. Using these reports we find out more about how our marketing initiatives are received by you. Our aim in doing so is to increase our conversion rates.
24 Real time reports: here we find out in real time what exactly is happening on our website. For example, we can see how many users are reading this text at any given time.

24.1 The purpose for which Google Analytics is used

We want to offer the best possible service to you. The statistics and data obtained from Google Analytics help us to achieve this goal.

After they have been statically assessed, the data provide us with a clear picture of the strengths and weaknesses of our website. First of all, we are able to optimise our website so that it is easier for people who are interested in it to find it on Google. Secondly, the data help us to understand you better as a visitor. This means that we know with a high degree of precision what aspects of our website we have to improve in order to provide you with the best possible service. We also use the data in order to conduct individual, cost-effective advertising and marketing. Ultimately, it only makes sense to display our products and services to people who

are interested in them.

Using a tracking code, Google Analytics generates a random, unique ID, which is associated with your browser cookie. This enables Google Analytics to recognise you as a new user. The next time you visit our website, you are recognised as a “returning” user. All data collected are stored along with this user ID. This makes it possible to include pseudonymised user profiles in reports.

In order to be able to analyse our website with Google Analytics, a property ID has to be embedded in the tracking code. The data are then stored in the corresponding property. Google Analytics 4 Property is used as standard for each newly created property. However, it is still possible to create the Universal Analytics Property as an alternative. Depending upon the property used, data are stored for different periods of time.

Your interactions with our website are measured using identifiers such as cookies and app instance IDs. Interactions are types of action that you carry out on our website. If you also use other Google systems (such as e.g. a Google account), data generated using Google Analytics can be cross-referenced with cookies of third party providers. Google does not pass on any Google Analytics data except with our approval as the website operator. Exceptions may apply if required by law.

An overview is provided below of the most important data collected by Google Analytics:

· Heatmaps: Google creates so-called “heatmaps”. Heatmaps display specifically the areas that you click on. This allows us to find out where you are browsing on our website.
25 Session duration: Google defines the session duration as the period of time that you spend on our website without leaving the site. The session ends automatically if you have been inactive for 20 minutes.
· Bounce rate: a bounce occurs if you visit only one page on our website and then leave the site again.
26 Account creation: if you create an account on our website or place an order, Google Analytics collects this information.
· IP address: the IP address is only displayed in truncated form in order to prevent it from being uniquely associated with any given user.
27 Location: the IP address enables the country and your approximate location to be determined. This process is also referred to as IP tracking.
· Technical information: technical information includes amongst other things your browser type, your internet provider and your screen resolution.
28 Referrer: both Google Analytics and we are naturally interested also in finding out via which website or advert you arrived at our website.

28.1 Right to object – right to erasure

According to EU data protection law, you have the right to obtain access to your data, to update them, to erase them and to restrict processing. Using the browser extension for disabling Google Analytics JavaScript (ga.js, analytics.js, dc.js), you can prevent Google Analytics from using your data. You can download and install the browser extension from https://tools.google.com/dlpage/gaoptout?hl=en-GB. Please note that this extension only disables data collection by Google Analytics.

As stated in section 4.3 of this Privacy Statement, it is possible to delete cookies as a general rule.

28.2 Legal basis

The use of Google Analytics is conditional upon your consent, which we will have obtained via our cookie pop-up. This consent is the legal basis according to point (a) of Article 6(1) GDPR (consent) for the processing of personal data that may be collected by the web analytics tool.

In addition to consent, we have a legitimate interest in analysing the behaviour of visitors to the website for the purpose of improving our content in both technical and financial terms. Google Analytics helps us to identify errors within the website, identify attacks and enhance cost-effectiveness. The legal basis for this is point (f) of Article 6(1) GDPR (legitimate interests). Nevertheless, we only use Google Analytics if we have obtained your consent.

Google processes data, amongst other locations, also in the USA. Please note that, in the view of the European Court of Justice, at the present time there is not an adequate level of protection for data transfers to the USA. This may entail various risks for the lawfulness and security of data processing.

Google uses the standard contractual clauses approved by the EU Commission (Article 46(2) and (3) GDPR) as a basis for data processing by recipients operating in third countries (outside the European Union, Iceland, Liechtenstein and Norway: and thus in particular in the USA) or for the transfer of data to such a country. These clauses oblige Google to maintain the EU level of data protection when processing relevant data, even outside the EU. The clauses are based on an implementing decision of the EU Commission. The decision and the clauses can be found inter alia here: https://ec.europa.eu/info/law/law-topic/data-protection_en.

29 Google Tag Manager

29.1 Definition of Google Tag Manager

On our website we use Google Tag Manager provided by the company Google Inc. The company Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland) is responsible for all Google services within Europe. Tag Manager is one of many useful marketing products provided by Google. We can use Google Tag Manager to integrate centrally and manage code fragments of various tracking tools that we use on our website.

In this Privacy Statement we would like to explain to you precisely what Google Tag Manager does, why we use it and in what form data are processed.

Google Tag Manager is an organisational tool that we can use to integrate and manage website tags centrally via a user interface. Tags are small fragments of code that record (track) for example your activities on our website. For this purpose JavaScript code fragments are embedded in our website’s source text. Tags often originate from Google’s own products such as Google Ads or Google Analytics; however, it is also possible to integrate and manage tags from other companies using the manager. These tags perform various tasks. They may collect browser data, feed data into marketing tools, incorporate buttons, save cookies and also track users across various other websites.

29.2 The purpose for which Google Tag Manager is used

We use various tracking tools, such as for example Google Analytics, in order to structure our website in the best way possible for you and other people interested in our products and services. The data collected by these tools show us what you are most interested in, where we can improve our services as well as which additional people we should present our services to. In order for this tracking to work properly, we must embed the corresponding JavaScript codes into our website. As a general rule, we could incorporate each code fragment of each individual tracking tool separately into our source text. However, that would take up a disproportionately large amount of time and it would be easy to lose sight of the general picture. For this reason we use Google Tag Manager. We can embed the necessary scripts straightforwardly and manage them from one single location. In addition, Google Tag Manager offers a user friendly user interface, for which no programming knowledge is required.

Tag Manager itself is a domain that does not save any cookies or store any data. It operates merely as a “manager” of the tags that have been deployed. The data record the individual tags from various web analysis tools. Data within Google Tag Manager are basically fed through to the individual tracking tools and are not stored.

However, this works very differently for the embedded tags of the various web analysis tools, such as for example Google Analytics. Depending upon the analysis tool, a variety of data concerning your online behaviour are collected, stored and processed, mostly using cookies. In order to find out more about this, please read the information contained in our Privacy Statement concerning the individual analytical and tracking tools that we use on our website.

In the Tag Manager account settings we have allowed Google to receive anonymized data from us. However, these data only relate to the exploitation and usage of our tag manager and not data that are stored via code fragments. We allow Google and other operators to receive selected data in anonymized form. We thus agree to the sharing of anonymous data relating to our website. Despite extensive research, we have been unable to establish precisely which summarised and anonymous data are shared. In any case, when doing so Google deletes all information that could be capable of identifying our website. Google collects data anonymously along with hundreds of other operators and identifies user trends with reference to benchmarking methods. Benchmarking involves the comparison of individual results with those of fellow competitors. It is possible to optimise processes based on the information collected.

Google Tag Manager itself does not store any cookies, but rather manages tags from various tracking websites

29.3 Legal basis

The use of Google Tag Manager is conditional upon your consent, which we will have obtained via our cookie pop-up. This consent is the legal basis according to point (a) of Article 6(1) GDPR (consent) for the processing of personal data that may be collected by the web analytics tool.

In addition to consent, we have a legitimate interest in analysing the behaviour of visitors to the website for the purpose of improving our content in both technical and financial terms. Google Tag Manager enables us to enhance cost-effectiveness. The legal basis for this is point (f) of Article 6(1) GDPR (legitimate interests). Nevertheless, we only use Google Tag Manager if we have obtained your consent.

Google processes data, amongst other locations, also in the USA. Please note that, in the view of the European Court of Justice, at the present time there is not an adequate level of protection for data transfers to the USA. This may entail various risks for the lawfulness and security of data processing.

Google uses the standard contractual clauses approved by the EU Commission (Article 46(2) and (3) GDPR) as a basis for data processing by recipients operating in third countries (outside the European Union, Iceland, Liechtenstein and Norway: and thus in particular in the USA) or for the transfer of data to such a country. These clauses oblige Google to maintain the EU level of data protection when processing relevant data, even outside the EU. The clauses are based on an implementing decision of the EU Commission. The decision and the clauses can be found inter alia here: https://ec.europa.eu/info/law/law-topic/data-protection_en.

If you would like to find out more about Google Tag Manager, we recommend that you consult the FAQs at https://support.google.com/tagmanager/?hl=en#topic=3441530.

30 Google Ads

30.1 Definition of Google Ads

We use Google Ads (formerly Google AdWords) for online marketing purposes in order to advertise our products and services. Our aim in doing so is to inform more people online about the high quality of our products. Within the ambit of our advertising via Google Ads on our website we use conversion tracking provided by the company Google Inc. However, within Europe the company Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland) is responsible for all Google services. Using this free tracking tool, we are able to tailor our advertising better to your interests and needs. In the following section we would like to inform you in greater detail about why we use conversion tracking, which data are stored in this regard, and how you can prevent these data from being stored.

Google Ads (formerly Google AdWords) is the in-house online advertising system of the company Google Inc. We are convinced about the quality of our products and would like as many people as possible to find out about our website. Google Ads offers the best online platform for doing so. Naturally, we also seek to gain a precise overview of the cost-benefit factor of our advertising initiatives. In order to do so we use the conversion tracking tool of Google Ads.

But what actually is conversion? Conversion happens when you turn from a purely interested website visitor into a visitor that actually carries out a specific action. This happens whenever you click on an advert of ours and subsequently carry out a particular action, such as for example visiting our website. Using Google’s conversion tracking tool, we record what happens after a user clicks on one of our Google Ads adverts. For example, we can see whether any products are purchased, whether any services are used or whether the user signs up for our newsletter.

30.2 The purpose for using Google Ads

We use Google Ads in order to make our products more visible on other websites. The aim is to ensure that our advertising campaigns actually reach only those people who are interested in our products. Using the conversion tracking tool, we are able to see which keywords, adverts, advert groups and campaigns result in the desired customer actions. We can see how many customers interact with our adverts on a device, and

whether these result in any conversion. Thanks to these data we can calculate our cost-benefit factor, gauge the success of individual advertising campaigns and consequently optimise our online marketing. We can also use the data obtained to make our website more interesting for you and further tailor our advertising individually to your needs.

We have embedded a conversion tracking tag or a code snippet into our website in order to be able to analyse particular user actions more effectively. If you click on one of our Google Ads adverts, a “conversion” cookie is saved by a Google domain on your computer (normally in the browser) or mobile device. Cookies are small text files that store information on your computer. As soon as you complete an action on our website, Google recognises the cookie and logs your action as a so-called “conversion”. As long as you remain on our website and the cookie has not yet expired, both we and Google can recognise that you have found us via a Google Ads advert. The cookie is read and sent back to Google Ads along with the conversion data. It is also possible that other cookies may be used to measure conversions. Conversion tracking by Google Ads can be refined and enhanced further using Google Analytics. Cookies with the names “_gads” or “_gac” may be saved under our domain in relation to adverts displayed by Google at various locations online. Since September 2017, various campaign information from analytics.js has been stored with the _gac cookie. The cookie saves these data as soon as you access any of our pages for which automatic tag identification by Google Ads has been enabled. In contrast to the cookies used for Google Domains, Google can only read these conversion cookies whilst you are on our website. We do not collect or receive any personal data. We receive a report from Google containing statistical assessments. This means that we can discover for instance the total number of users who have clicked on our adverts and see which advertising measures have been successful.

30.3 Right to object – right to erasure

As stated in section 4.3 of this Privacy Statement, it is possible to delete cookies as a general rule.

You have the ability to opt out of conversion tracking by Google Ads. If you disable the Google conversion tracking cookie in your browser, you can block conversion tracking. If you do so, you will not be included within the tracking tool’s statistics.

30.4 Legal basis

If you have consented to Google Ads using conversion tracking, the legal basis for the respective data processing is this consent. This consent is the legal basis according to point (a) of Article 6(1) GDPR (consent) for the processing of personal data that may be collected by Google Ads conversion tracking.

We also have a legitimate interest in using Google Ads conversion tracking in order to optimise our online service and marketing initiatives. The legal basis for this is point (f) of Article 6(1) GDPR (legitimate interests). Nevertheless, we only use Google Ads conversion tracking if we have obtained your consent.

Google processes data, amongst other locations, also in the USA. Please note that, in the view of the European Court of Justice, at the present time there is not an adequate level of protection for data transfers to the USA. This may entail various risks for the lawfulness and security of data processing.

Google uses the standard contractual clauses approved by the EU Commission (Article 46(2) and (3) GDPR) as a basis for data processing by recipients operating in third countries (outside the European Union, Iceland, Liechtenstein and Norway: and thus in particular in the USA) or for the transfer of data to such a country. These

clauses oblige Google to maintain the EU level of data protection when processing relevant data, even outside the EU. The clauses are based on an implementing decision of the EU Commission. The decision and the clauses can be found inter alia here: https://ec.europa.eu/info/law/law-topic/data-protection_en.

31 Google AdSense

31.1 Definition of Google AdSense

We use Google AdSense on this website. This is an advertising program of the company Google Inc. The company Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland) is responsible for all Google services within Europe. Google AdSense enables us to display adverts on this website that are consistent with our focus. This means that we can offer you adverts that, ideally, constitute genuine added value for you. In this Privacy Statement concerning Google AdSense we explain to you why we use Google AdSense on our website, which data of yours are processed and stored, and how you can prevent these data from being stored.

The advertising program Google AdSense has existed since 2003. In contrast to Google Ads (formerly: Google AdWords), it is not possible to show one’s own advertising here. Google AdSense displays adverts on websites, such as for example our own. The greatest advantage of this advertising service compared to most others is that Google AdSense only shows you adverts that are consistent with our own content. Google has an algorithm, which calculates which adverts you will see. Of course, we only want to show you adverts that are interesting for you and that offer added value. Google examines with reference to your interests or your behaviour and with reference to our content which adverts are suitable for our website and for our users. At this point we would also like to point out that we are not responsible for selecting adverts. We only offer advertising space on our website. It is Google that selects the advertising that is displayed. Since August 2013, adverts have also been adapted to the relevant user interface. This means that adverts will be adapted to your end device, whether you are visiting our website using a smart phone, a PC or a laptop.

31.2 The purpose for which Google AdSense is used

We endeavour to maintain our website and keep it as up to date as possible at all times. Naturally, in doing so we would also like to obtain a financial result. For this reason we have decided to use advertising as a source of revenue. However, the most important thing for us is not to disrupt your visit to our website with this advertising. Using Google AdSense means that you are shown advertising that is consistent with our focus and your interests.

In a similar manner to Google Indexing for a website, a bot examines the relevant content and the relevant offers on the website. Adverts are then tailored to the content and displayed. In addition to the substantive overlap between adverts and our website content, AdSense also favours targeting based on interests. This means that Google also uses your data in order to display advertising that is specifically tailored to you. You will therefore see advertising which, ideally, offers genuine added value.

Cookies are used, amongst other things, in order for Google AdSense to be able to display advertising that is specifically tailored to you. Cookies are small text files that store particular information on your computer.

Within AdSense, cookies are intended to ensure better advertising. The cookies do not contain any data that could enable a person to be identified. However, it should be considered here that Google does not regard data such as for instance “pseudonymous cookie IDs” (the name or another identifying feature is replaced by a pseudonym) or IP addresses as information that could enable a person to be identified. Nonetheless, under the GDPR these data may qualify as personal data. Google AdSense sends a cookie to the browser after each impression (i.e. whenever you view an advert), each click and any other activity that triggers the Google AdSense server. If the browser accepts the cookie, it is stored there.

Under certain circumstances, third party providers may store cookies in your browser and read them or use web beacons in relation to AdSense in order to store the data that they receive by providing advertising on the website. Web beacons are small digital image files, which carry out a log file analysis and record the log file. This analysis enables statistical assessment for online marketing purposes.

Google can collect various information concerning your usage of our website from these cookies. This includes:

· information about how you engage with an advert (clicks, impression, mouse movements);
32 information about whether an advert has already been displayed in your browser at an earlier point in time. These data help to ensure that an advert is not repeatedly displayed to you.

As part of this process, Google analyses data concerning the advertising displayed along with your IP address and assesses these data. Google uses the data in the first instance in order to measure the efficacy of an advert and to improve advertising content. These data are not cross-referenced with any personal data that Google may hold concerning you from other Google services.

32.1 Right to object – right to erasure

As stated in section 4.3 of this Privacy Statement, it is possible to delete cookies as a general rule.

All “advertising cookies” can be disabled by downloading and installing the following browser plugins at https://support.google.com/ads/answer/7395996. Please note that, if you disable these cookies it will not prevent advertising in general from being displayed, but only block personalised advertising.

If you have a Google account, you can disable personalised advertising on the page https://adssettings.google.com/authenticated. Here too, after doing so you will still see adverts, although they will no longer be tailored to your interests. Adverts will nevertheless be displayed with reference to a variety of factors, such as your location, the browser type and the search terms used.

32.2 Legal basis

If you have consented to the usage of Google AdSense, the legal basis for the respective data processing is this consent. This consent is the legal basis according to point (a) of Article 6(1) GDPR (consent) for the processing of personal data that may be collected by Google AdSense .

We also have a legitimate interest in using Google AdSense in order to optimise our online service and marketing initiatives. The legal basis for this is point (f) of Article 6(1) GDPR (legitimate interests). Nevertheless, we only use Google AdSense if we have obtained your consent.

Google processes data, amongst other locations, also in the USA. Please note that, in the view of the European Court of Justice, at the present time there is not an adequate level of protection for data transfers to the USA.

This may entail various risks for the lawfulness and security of data processing.

Google uses the standard contractual clauses approved by the EU Commission (Article 46(2) and (3) GDPR) as a basis for data processing by recipients operating in third countries (outside the European Union, Iceland, Liechtenstein and Norway: and thus in particular in the USA) or for the transfer of data to such a country. These clauses oblige Google to maintain the EU level of data protection when processing relevant data, even outside the EU. The clauses are based on an implementing decision of the EU Commission. The decision and the clauses can be found inter alia here: https://ec.europa.eu/info/law/law-topic/data-protection_en.

33 AddThis

33.1 Definition of AddThis

On our website we use AddThis plugins provided by the company Oracle America, Inc. (500 Oracle Parkway, Redwood Shores, CA 94065, USA). You can use these plugins to share content from our website quickly and easily with other people. If you visit a website featuring an AddThis function, data may be transferred from you to the company AddThis for storage and processing. This Privacy Statement explains to you why we use AddThis, which data are processed and how you can prevent this transmission of data.

AddThis develops amongst other things software tools that are incorporated into websites in order to enable users to share content through various social medial channels or by email. In addition, AddThis also offers website analysis functions. The data collected are also used in order to offer interest-based advertising to internet users. The service is used by more than 15 million website visitors around the world.

33.2 Purpose of usage

If you click on the AddThis button you can share interesting content from our website through various social media channels such as Facebook, Twitter, Instagram or Pinterest. If you find our content interesting, we are naturally delighted if you also share it with your social community. The easiest way to do this is by using the AddThis button.

If you share content with AddThis whilst logged in to the respective social media account, certain data such as for example your visit to our website and the content shared may be associated with the user account on the social media channel concerned. AddThis uses cookies, pixels, HTTP headers and browser identifiers in order to collect data concerning your actions during your visit. In addition, some of these data are shared with third parties after they have been pseudonymised.
Here is a list of examples of possible ways in which data may be processed:

Unique IDs of a cookie saved in the browser

Address of the website visited

Time of the website visit

Search entries entered by a visitor before being referred to the website incorporating AddThis

Duration of the visit to a website

The IP address of the computer or mobile device

Mobile advertising IDs (Apple IDFA or Google AAID)

Information contained in HTTP headers or other transmission protocols used

The program (browser) or operating system (iOS) being used on the computer

Some examples of the cookies used by AddThis are provided below. Find out more about AddThis cookies at https://www.oracle.com/legal/privacy/addthis-privacy-policy.html.

33.3 Right to object, right to erasure

You have the right to access and to erase your personal data at any time. If you do not wish to see any further advertising based on the data collected by AddThis to be displayed, please click on the opt-out button at https://datacloudoptout.oracle.com/?tid=111996092. This will store an opt-out cookie, which you should not erase so that this setting can be maintained.

You can also set your user preferences for usage-based online advertising in the “Preference Management” section at https://www.youronlinechoices.com/at/.

Your browser offers you the option of preventing data processing or managing it according to your specific requirements. Data processing works slightly differently depending upon the specific browser. You can find links to the respective instructions for the most widely-used browsers in the “Cookies” section.

33.4 Legal basis

If you have consented to the processing and storage of your data by embedded social media components, this consent constitutes the legal basis for data processing (Art. 6 para. 1 lit. a GDPR). As a general rule, your data are also stored and processed on the basis of our legitimate interests (Art. 6 para. 1 lit. f GDPR) in speeding up and improving communication with you or with other customers and business partners. Nonetheless, we only use the embedded social media components with your consent. Most social media platforms also store cookies in your browser in order to collect data. We therefore recommend that you read carefully those parts of our Privacy Statement that concern cookies and also consult the privacy statements or cookie policies of the relevant service providers.

AddThis processes data, amongst other locations, also in the USA. Please note that, in the view of the European Court of Justice, at the present time there is not an adequate level of protection for data transfers to the USA. This may entail various risks for the lawfulness and security of data processing.

AddThis uses the standard contractual clauses approved by the EU Commission (Article 46 para. 2 and 3 GDPR) as a basis for data processing by recipients operating in third countries (outside the European Union, Iceland, Liechtenstein and Norway: and thus in particular in the USA) or for the transfer of data to such a country. These clauses oblige AddThis to maintain the EU level of data protection when processing relevant data, even outside the EU. The clauses are based on an implementing decision of the EU Commission. The decision and the clauses can be found inter alia here: https://germany.representation.ec.europa.eu/index_de.

If you would like to find out more about how your data are processed by AddThis, you can find further information at https://www.oracle.com/legal/privacy/addthis-privacy-policy.html.

34 Facebook

34.1 Definition of Facebook

On our website we use selected tools of Facebook. Facebook is a social media network operated by the company Meta Platforms Inc. or, for the European Economic Area, the company Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. We can use this tool to offer the best possible service to you and other people who are interested in our goods and services.

Where any data are collected from you and forwarded via our embedded Facebook components or through our Facebook page, both we and Facebook Ireland Ltd. have the status of controllers. Facebook is the sole controller in respect of any subsequent processing of these data. Our joint obligations are also set out in a publicly available agreement available at https://www.facebook.com/legal/controller_addendum. This provides for instance that we must clearly inform you about how Facebook tools are used on our website. In addition, we are also responsible for ensuring that the tools embedded into our website are secure from a data protection perspective. Facebook on the other hand is responsible for ensuring data security for Facebook products. If you have any questions about how data are collected or processed by Facebook, please contact the company directly. If you submit any questions to us, we are obliged to pass these on to Facebook.

34.2 Purpose of usage

We only want to display our goods and services to people who are actually interested in them. We can use advertising (Facebook ads) to specifically reach these people. In order to ensure that the right adverts are displayed to our users, Facebook however needs to have information concerning their desires and needs. For this reason, the company is provided with information concerning user behaviour (and contact data) on our website. Facebook collects better user data as a result, enabling it to display appropriate advertising concerning our goods and services to potentially interested people. The tools thus allow specifically targeted advertising campaigns to be conducted on Facebook.

Facebook refers to data concerning your behaviour on our website as “event data”. These are also used for the provision of metrics and analytical services. Facebook is thus able to generate “campaign reports” on our behalf about how effective our advertising campaigns are. Analysis also gives us a better impression about how you use our services, website or products. This means that we can use some of these tools to optimise your user experience on our website. For example, you can share content from our website directly on Facebook using the social plugins.

Personal data (customer data) may be transmitted to Facebook whenever individual Facebook tools are used. Depending upon the tools used, customer data such as your name, address, telephone number and IP address may be transmitted.

Facebook uses this information in order to cross-reference the data with the data concerning you that it holds itself (if you have a Facebook account). So-called “hashing” occurs before customer data are transmitted to Facebook. This means that a dataset of any given size is transformed into a string of characters. This is also necessary in order to encrypt data.

“Event data” are transmitted in addition to contact data. “Event data” include any information that we receive from you through our website, such as which subpages you have visited or which products you have purchased from us. Facebook does not share the information received with third party providers (such as for example advertisers) unless the company has been expressly authorised or is legally obliged to do so. “Event data” may also be cross-referenced with contact data. This enables Facebook to display more personalised advertising. Facebook then erases the contact data after the cross-referencing process referred to above.

In order to be able to display optimised advertising, Facebook only uses event data after they have been amalgamated with other data (that have been collected by Facebook in another manner). Facebook also uses these event data for security, protection, development and research purposes. A considerable amount of these data are transferred to Facebook using cookies. Cookies are small text files that are used to store data or information in browsers. A different number of cookies are stored in your browser depending upon the tools used and whether you have a Facebook account. We consider individual Facebook cookies in greater detail in the respective descriptions of the various Facebook tools. General information about how Facebook cookies are used can also be found at https://www.facebook.com/policies/cookies.

34.3 Right to object, right to erasure

Under the terms of the General Data Protection Regulation, you have a right of access and the right to rectify, transfer and erase your data.

Data can only be erased entirely if you delete your Facebook account entirely. Here is how you can delete your Facebook account:

1) Click on Settings on the right-hand side of the Facebook page.

2) After this, click “Managing your account” in the left-hand column.

3) Click “Deactivating or deleting your account”.

4) Select “Delete account” and click “Continue to account deletion”

5) Enter your password, click “Continue” and then click “Delete account”.

The data that Facebook receives through our website is stored inter alia using cookies (e.g. for social plugins). You can disable, delete or manage specific individual cookies or all cookies in your browser settings. This works differently depending upon which specific browser you are using. You can find links to the respective instructions for the most widely-used browsers in the “Cookies” section.

If as a general rule you do not want any cookies, you can configure your browser in such a manner that you are always informed if a cookie is to be saved. You can decide for each individual cookie whether or not to allow it.

34.4 Legal basis

If you have consented to the processing and storage of your data by embedded Facebook tools, this consent constitutes the legal basis for data processing (Article 6 para. 1 lit. a GDPR). As a general rule, your data are also stored and processed on the basis of our legitimate interests (Art. 6 para. 1 lit. f GDPR) in speeding up and improving communication with you or with other customers and business partners. Nevertheless, we only use the tools if we have obtained your consent. Most social media platforms also store cookies in your browser in order to collect data. We therefore recommend that you read carefully those parts of our Privacy Statement that concern cookies and also consult Facebook’s Data Policy or Cookie Policy.

Facebook processes your data, amongst other locations, also in the USA. Please note that, in the view of the European Court of Justice, at the present time there is not an adequate level of protection for data transfers to the USA. This may entail various risks for the lawfulness and security of data processing.

Facebook uses “standard contractual clauses” (Article 46 para. 2 and 3 GDPR) as a basis for data processing by recipients operating in third countries (outside the European Union, Iceland, Liechtenstein and Norway: and thus in particular in the USA) or for the transfer of data to such a country. Standard contractual clauses (SCC) are templates prepared by the EU Commission, which are intended to ensure that your data also comply with European data protection standards if they are transferred to and stored in third countries (such as the USA). By these clauses, Facebook undertakes to comply with European data protection standards when processing your relevant data, even if the data are stored, processed and managed in the USA. The clauses are based on an implementing decision of the EU Commission. You can find the decision and the respective standard contractual clauses inter alia here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=en

Facebook’s Data Processing Terms, which incorporate the standard contractual clauses, can be found at https://www.facebook.com/legal/terms/dataprocessing.

We hope that we have provided you with the most important information about how data are used and processed by Facebook tools. If you would like to find out more, such as how Facebook uses your data, we recommend that you consult the Data Policy at https://www.facebook.com/about/privacy/update.

35 YouTube

35.1 Definition of You Tube

We have embedded YouTube videos into our website. This means that you can view interesting videos directly on our website. YouTube is a video portal that has been a subsidiary of Google since 2006. The video portal is operated by YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. If you visit a page on our website into which a YouTube video has been embedded, your browser automatically establishes a connection with YouTube or Google servers. Various data are transmitted as a result (depending upon the settings). Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland) is the controller for all data processing in the European Economic Area.

We would like to explain to you in greater detail below precisely which data are processed, why we have embedded YouTube videos and how you can manage or erase your data.

You can use YouTube to view, assess, comment on and upload videos free of charge. Over the last few years YouTube has developed into one of the most important social media channels. In order to enable us to display videos on our website, YouTube provides a code snippet, which we have incorporated into our website.

35.2 Purpose of processing

YouTube is the video platform with the highest number of users and the best content. We endeavour to offer you the best possible user experience on our website, which naturally also has to include interesting videos. We can use our embedded videos to provide you with helpful content to complement our text and images. It also means that it is easier to find our website on the Google search engine via embedded videos. Even if we display adverts using Google Ads – thanks to the data collected – Google can actually only display these adverts to people who are interested in our products and services.

Whenever you visit one of our pages incorporating a YouTube video, YouTube stores at least one cookie containing your IP address and our URL. If you are logged in to your YouTube account, YouTube can allocate your behaviour on our website to your profile mostly using cookies. These include data such as session duration, bounce rate, approximate location, technical information such as browser type and screen resolution, as well as your internet provider. Other data may include contact data, any assessments, content shared on social media or whether the account has been added to your YouTube favourites.

If you are not logged in to a Google or YouTube account, Google stores data using a unique identifier that is associated with your device, browser or app. This means that it is possible for instance to maintain your preferred language settings. However, a large amount of interaction data cannot be stored as fewer cookies are used.

35.3 Right to object, right to erasure

As a general rule, you can erase data manually from your Google account. The function “Automatically Delete Google Location History and Activity Data” introduced in 2019 allows information to be stored and then erased – depending on your decision – after either 3 or 18 months.

Irrespective of whether or not you have a Google account, you can configure your browser in such a manner as to ensure that cookies are deleted or disabled by Google. This works differently depending upon which specific browser you are using. You can find links to the respective instructions for the most widely-used browsers in the “Cookies” section.

If as a general rule you do not want any cookies, you can configure your browser in such a manner that you are always informed if a cookie is to be saved. You can decide for each individual cookie whether or not to allow it.

35.4 Legal basis

If you have consented to the processing and storage of your data by embedded YouTube components, this consent constitutes the legal basis for data processing (Art. 6 para. 1 lit. a GDPR). As a general rule, your data are also stored and processed on the basis of our legitimate interests (Art. 6 para. 1 lit. f GDPR) in speeding up and improving communication with you or with other customers and business partners. Nonetheless, we only use the embedded YouTube components with your consent. YouTube also stores cookies in your browser in order to collect data. We therefore recommend that you read carefully those parts of our Privacy Statement that concern cookies and also consult the privacy statements or cookie policies of the relevant service providers.

YouTube processes data, amongst other locations, also in the USA. Please note that, in the view of the European Court of Justice, at the present time there is not an adequate level of protection for data transfers to the USA. This may entail various risks for the lawfulness and security of data processing.

YouTube uses the standard contractual clauses approved by the EU Commission (Article 46 para. 2 and 3 GDPR) as a basis for data processing by recipients operating in third countries (outside the European Union, Iceland, Liechtenstein and Norway: and thus in particular in the USA) or for the transfer of data to such a country. These clauses oblige YouTube to maintain the EU level of data protection when processing relevant data, even outside the EU. The clauses are based on an implementing decision of the EU Commission. The decision and the clauses can be found inter alia here: https://germany.representation.ec.europa.eu/index_de.

Since YouTube is a subsidiary of Google, there is one single Privacy Policy. If you would like to find out more about how your data are handled, we recommend that you consult the Privacy Policy at https://policies.google.com/privacy?hl=en.

36 Information concerning the transmission of data to international organisations

The data processed by us are not transmitted to international organisations.