Data protection

1. Data protection at a glance

General information

The following information provides a simplified overview of what happens to your personal data when you visit this website. Personal data is any data by which you can be personally identified. For detailed information on the subject of data protection, please refer to our Privacy Policy, which is reproduced after this text.

Data collection on this website

Who is responsible for data collection on this website?
The website operator is responsible for data processing on this website. Their contact details are found in the “Information about the controller” section of the Privacy Policy.

How do we collect your data?
Your data is collected firstly when you send information to us. This may be data that you enter in a contact form or elsewhere. Other data is collected automatically by our IT systems or with your consent when you visit the website. This mainly refers to technical data (e.g. internet browser, operating system, time of page access). The data is collected automatically as soon as you open this website.

For which purposes do we use your data?
Some of the data is collected to ensure that the website is provided without errors. Other data may be used to analyse your usage behaviour.

Which rights do you have in regard to this data?
You have the right at any time to obtain without charge information about the origin, recipient and purpose of the personal data stored about you. Moreover, you have the right to request the rectification or erasure of this data. Where you have provided consent to data processing, you may withdraw this consent at any time with effect for the future. You also have the right to request the restriction of processing of your personal data if certain conditions are met. Furthermore, you have the right to lodge a complaint with the competent supervisory authority.

You may contact us at any time to exercise these rights or if you have other questions concerning data protection.

Analytics and third-party tools

Statistics of your internet usage habits can be compiled when you visit this website. This is done mainly with analytics programmes. For detailed information about these analytics programmes, please refer to the following Privacy Policy.

2. Hosting

External hosting

This website is hosted externally. The personal data collected on this website is stored on the servers operated by the hoster(s). This may include, but is not limited to, IP addresses, contact enquiries, meta and communication data, contractual data, contact details, names, website accesses and other data generated via a website.

External hosting is performed for the purpose of contract fulfilment vis-à-vis our potential and existing customers (Art. 6 para. 1 point b) GDPR) and in the interest of a secure, fast and efficient delivery of our online presence by a professional provider (Art. 6 para. 1 point f) GDPR). Where consent was requested in this regard, processing shall be carried out exclusively on the basis of Art. 6 para. 1 point a) GDPR and Section 25 para. 1 Telecommunications-Telemedia Data Protection Act (TTDSG), insofar as the consent includes the storage of cookies or access to information in the user’s terminal device (e.g. device fingerprinting) as defined in TTDSG. Consent may be withdrawn at any time.

Our hoster(s) will only process your data to the extent that is necessary to fulfil their performance obligations and shall follow our instructions in relation to such data.

We use the following hoster(s):
MAJORMEDIA
Landshuter Straße 9
93047 Regensburg

Contract processing
We have entered into a data processing agreement (DPA) for use of the above service. This contract is mandatory under data protection law. It ensures that this company only processes the personal data of our website visitors in accordance with our instructions and in compliance with the GDPR.

3. General instructions and mandatory information

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this Privacy Policy.

A variety of personal data is collected when you use this website. Personal data is any data by which you can be personally identified. This Privacy Policy explains which data we collect and how it is used. It also describes the purposes of its use.

Please note that security vulnerabilities may affect data transmission on the internet (e.g. communication by email). Complete protection of data from unauthorised access by third parties is not possible.

Information concerning the controller

The controller for data processing on this website is:
Fürst Albert von Thurn und Taxis Gesamtverwaltung
Emmeramsplatz 5
93047 Regensburg
Germany
Contact: Dietmar Bastius
Telephone: +49 941 – 5048 - 504
Email: gesamtverwaltung@thurnundtaxis.de

The controller is the natural or legal person who alone or jointly with others determines the purposes and means by which personal data is processed (e.g. names, email addresses, etc.).

Retention period

We will retain your personal data until the purpose of its processing no longer applies, unless a more specific retention period is stated in this Privacy Policy. Your data will be erased if you submit a justified request for erasure or withdraw your consent to data processing. This does not apply if we have other lawful reasons for storing your personal data (e.g. retention periods under tax or commercial law); in the latter case, the data will be erased once these reasons no longer apply.

General information concerning the legal bases for data processing on this website

Where you have consented to data processing, we will process your personal data on the basis of Art. 6 para. 1 point a) GDPR or, if special categories of data are processed pursuant to Art. 9 para. 1 GDPR, in accordance with Art. 9 para. 2 point a) GDPR. If you have given explicit consent to the transfer of personal data to third countries, data processing shall also be carried out on the basis of Art. 49 para. 1 point a) GDPR. In the event of your consent to the storage of cookies or access to information on your terminal device (e.g. via device fingerprinting), data processing shall also take place on the basis of Section 25 para. 1 TTDSG. Consent may be withdrawn at any time. Where your data is required for the performance of a contract or for measure prior to the conclusion of a contract, we will process your data on the basis of Art. 6 para. 1 point b) GDPR. Furthermore, we process your data where necessary for compliance with a legal obligation on the basis of Art. 6 para. 1 point c) GDPR. Data processing may also take place on the basis of our legitimate interest pursuant to Art. 6 para. 1 point f) GDPR. The following paragraphs of this Privacy Policy contain information on the relevant legal basis in each case.

Data protection officer

We have appointed a data protection officer:
Sabine Sobola
c/o LiiDU GmbH
Neupfarrplatz 10
93047 Regensburg
Email: info@liidu.de

Information concerning data transfer to the United States or other third countries

We use some tools from companies based in the USA or other third countries that are not secure under data protection law. Your data may be transferred to these third countries and processed there if the above tools are enabled. Please note that an equivalent level of data protection, comparable to the EU, cannot be guaranteed in these countries. For instance, US companies are obliged to submit personal data to security authorities without you having a right to legal recourse as the data subject. It is therefore not possible to rule out that US authorities (e.g. intelligence services) process, evaluate and permanently store for surveillance purposes your data that is located on US servers. We have no influence on this processing activity.

Withdrawal of your consent to data processing

Many data processing operations are only permitted with your explicit consent. You may withdraw consent you have given at any time. This does not affect the lawfulness of data processing carried out prior to the withdrawal of consent.

Right to object to the collection of data in specific cases and to direct marketing (Art. 21 GDPR)

WHERE DATA PROCESSING IS PERFORMED ON THE BASIS OF ART. 6 PARA. 1 POINT E) OR F) GDPR, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. THE SPECIFIC LEGAL BASIS FOR PROCESSING IS AS STATED IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR PERSONAL DATA UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING IS FOR THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS (OBJECTION PURSUANT TO ART. 21 PARA. 1 GDPR).

WHERE YOUR PERSONAL DATA IS PROCESSED FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH MARKETING; THIS ALSO APPLIES TO PROFILING INSOFAR AS IT IS CONNECTED TO THIS FORM OF DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL NO LONGER BE USED FOR THE PURPOSE OF DIRECT MARKETING (OBJECTION PURSUANT TO ART. 21 PARA. 2 GDPR).

Right to lodge a complaint with the competent supervisory authority

In the event of a breach of the GDPR, data subjects shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work or the place of the alleged breach. The right of to lodge a complaint is without prejudice to other administrative or judicial remedies.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or for the performance of a contract handed over to you or a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only take place if it is technically feasible.

Information, erasure and rectification

Within the framework of the applicable legal provisions, you have the right at any time to obtain without charge information concerning the personal data stored about you, its origins and recipients and the purpose of the data processing and, if applicable, a right to the rectification or erasure of this data. You may contact us at any time to exercise these rights or if you have other questions concerning data protection.

Right to the restriction of processing

You have the right to request the restriction of processing of your personal data. You may contact us at any time in this regard. The right to the restriction of processing applies in the following cases:

Should you dispute the accuracy of your personal data stored by us, we will usually need time for verification. You have the right to request the restriction of processing of your personal data for the time it takes us to verify your claim.
Where the processing of your personal data is or was unlawful, you may request the restriction of data processing instead of erasure.
If we no longer need your personal data, but it is required by you for the establishment, exercise or defence of legal claims, you have the right to request the restriction of processing of your personal data instead of erasure.
It will be necessary to weigh up your interests against ours if you have lodged an objection pursuant to Art. 21 para. 1 GDPR. You have the right to request the restriction of processing of your personal data for as long as it has not been established which interests outweigh the interests of the other party.

If you have requested the restriction of the processing of your personal data, this data may – with the exception of storage – only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of an important public interest of the European Union or a Member State.

SSL/TLS encryption

This website uses SSL or TLS encryption for security reasons and to protect the transmission of confidential content such as orders or enquiries that you send to us as the website operator. You can tell that a connection is encrypted by the fact that the browser address line changes from “http://” to “https://” and by the padlock icon in your browser line. Third parties will be unable to read the data that you send to us when SSL or TLS encryption is enabled.

Encrypted payment transactions on this website

If an obligation to provide us with payment details (e.g. an account number in the case of a direct debit mandate) applies after the conclusion of a contract that incurs costs, this data will be required for the processing of payments.

Payment transactions by means of common means of payment (Visa/MasterCard, direct debit) take place exclusively via an encrypted SSL or TLS connection. You can tell that a connection is encrypted by the fact that the browser address line changes from “http://” to “https://” and by the padlock icon in your browser line.

Third parties will be unable to read the payment details that you send to us when SSL or TLS encryption is enabled.

Objection to marketing emails

The contact details published in the site notice for compliance with mandatory disclosure obligations must not be used for the transmission of marketing and informational material that we have not explicitly requested. The website operators explicitly reserve the right to take legal action in the event of unsolicited dissemination of marketing information, for example in the form of spam emails.

4. Data collection on this website

Cookies

Our website uses “cookies”. Cookies are small data packets that do not cause any damage to your terminal device. They are stored on your terminal device either temporarily for the duration of a session (session cookies) or permanently (permanent cookies). Session cookies are deleted automatically when you leave our website. Permanent cookies remain stored on your terminal device until you delete them yourself or they are automatically deleted by your web browser.

Cookies may originate from us (first-party cookies) or from third-party companies (third-party cookies). Third-party cookies enable the integration of certain services by third-party companies within websites (e.g. cookies for processing payment services).

Cookies have a variety of functions. Many cookies are technically necessary, as certain website functions would not work without them (e.g. the shopping cart function or the display of videos). Other cookies can be used to evaluate usage behaviour or for advertising purposes.

Cookies that are necessary to perform the electronic communication process, to provide certain functions that you have requested (e.g. for the shopping cart function) or to optimise the website (e.g. cookies to measure the web audience) (necessary cookies) are stored on the basis of Art. 6 para. 1 point f) GDPR, except where a different legal basis is stated. The website operator has a legitimate interest in the storage of necessary cookies to ensure that its services are optimised and made available without technical errors. Where consent to the storage of cookies and comparable recognition technologies has been requested, processing is carried out exclusively on the basis of this consent (Art. 6 para. 1 point a) GDPR and Section 25 para. 1 TTDSG); consent may be withdrawn at any time.

You may adjust your browser configuration so that you are alerted when cookies are set and only allow cookies in individual cases, block cookies for certain cases or altogether and enable the automatic deletion of cookies when closing the browser. The functions of this website may be restricted if cookies are disabled.

This Privacy Policy contains information about the cookies and services used on this website.

Consent with Usercentrics

This website uses consent technology from Usercentrics to obtain your consent to the storage of certain cookies on your terminal device or to the use of certain technologies and to document this procedure in accordance with data protection law. This technology is made available by Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, website: https://usercentrics.com/de/ (referred to in the following as “Usercentrics”). The following personal data will be transmitted to Usercentrics when you access our website:

Your consent(s) or the withdrawal of your consent(s)
Your IP address
Information about your browser
Information about your terminal device
Time of your visit to our website

In addition, Usercentrics stores a cookie in your browser in order to associate the consent or its withdrawal with you. The data collected in this way is stored until you request its erasure by us, delete the Usercentrics cookie yourself or if the purpose for storing the data no longer applies. Mandatory statutory retention obligations remain unaffected. Usercentrics is used to obtain consent for the use of certain technologies as required by law. The legal basis for this is Art. 6 para. 1 point c) GDPR.

Contract processing
We have entered into a data processing agreement (DPA) for use of the above service. This contract is mandatory under data protection law. It ensures that this company only processes the personal data of our website visitors in accordance with our instructions and in compliance with the GDPR.

Server log files

The website provider automatically collects and stores information in server log files, which your browser automatically transmits to us. These are:

Browser type and version
Operating system
Referrer URL
Host name of the accessing computer
Time of the server request
IP address

This data is not merged with other data sources. The data is collected on the basis of Art. 6 para. 1 point f) GDPR. The website operator has a legitimate interest in the optimisation of its website and the absence of technical errors. Server log files must be collected for this purpose.

Contact form

When you use the contact form to send us enquiries, the details you provide in the enquiry form, including the contact details entered by you, will be stored by us for the purpose of processing the enquiry and for the event that we have any questions. We will not pass on this data without your consent.

This data is collected on the basis of Art. 6 para. 1 point b) GDPR, insofar as your enquiry relates to the performance of a contract or is necessary to take steps prior to entering into a contract. Processing is based in all other cases on our legitimate interest in the efficient handling of enquiries addressed to us (Art. 6 para. 1 point f) GDPR) or on your consent (Art. 6 para. 1 point a) GDPR) where this has been requested; consent may be withdrawn at any time.

The data you enter in the contact form will remain with us until you request its erasure by us, withdraw your consent to its storage or the purpose for storing the data no longer applies (e.g. after we have completed the processing of your enquiry). Mandatory statutory provisions – retention periods in particular – remain unaffected.

Enquiries by email, telephone or fax

If you contact us by email, telephone or fax, your enquiry – including all personal data included (name, enquiry) – will be stored and handled by us for the purpose of processing your request. We will not pass on this data without your consent.

This data is collected on the basis of Art. 6 para. 1 point b) GDPR, insofar as your enquiry relates to the performance of a contract or is necessary to take steps prior to entering into a contract. Processing is based in all other cases on our legitimate interest in the efficient handling of enquiries addressed to us (Art. 6 para. 1 point f) GDPR) or on your consent (Art. 6 para. 1 point a) GDPR) where this has been requested; consent may be withdrawn at any time.

The data sent to us in the contact enquiries will remain with us until you request its erasure by us, withdraw your consent to its storage or the purpose for storing the data no longer applies (e.g. after we have completed the processing of your concern). Mandatory statutory provisions – legal retention periods in particular – remain unaffected.

5. Analytics tools and advertising

Google Analytics

This website uses functions of the Google Analytics web service. It is provided by Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics enables the website operator to analyse the behaviour of website visitors. In doing so, the website operator receives various usage data such as page views, duration of visit, operating systems and the general location of the user. This data is grouped in a user ID and assigned to the website visitor’s terminal device.

Google Analytics also enables us to record your mouse and scroll movements and clicks, among other things. Furthermore, Google Analytics uses a variety of modelling approaches to supplement the recorded datasets and deploys machine learning technologies in data analysis.

Google Analytics uses technologies that enable user recognition for the purpose of analysing their behaviour (e.g. cookies or device fingerprinting). The information collected by Google about the use of this website is usually transferred to a Google server in the United States and stored there.

Use of this service is based on your consent according to Art. 6 para. 1 point a) GDPR and Section 25 para. 1 TTDSG. Consent may be withdrawn at any time.

Data transfer to the United States is based on EU Commission standard contractual clauses. Click on the following links for details: https://privacy.google.com/businesses/controllerterms/mccs/.

Browser plug-in
You can prevent Google from collecting and processing your data by downloading and installing the browser plug-in which is available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de. Please refer to the Google privacy policy for more information on what Google Analytics does with the user data: https://support.google.com/analytics/answer/6004245?hl=de.

Contract processing
We have concluded a data processing agreement with Google and implement all of the strict requirements imposed by the German data protection authorities for the use Google Analytics.

6. E-commerce and payment providers

Processing of customer and contractual data

We collect, process and use personal customer and contractual data for the purpose of establishing, formulating and amending our contractual relationships. We only collect, process and use personal data concerning use of this website (usage data) where doing so is necessary to enable users to access the service or for accounting purposes. The legal basis for this is Art. 6 para. 1 point b) GDPR.

The customer data collected in this way is erased after fulfilment of the order or termination of the business relationship and expiry of any applicable legal retention periods. Statutory retention periods remain unaffected.

Data transmission upon conclusion of a contract for online shops, traders and in regard to shipping

When you order goods from us, we transfer your personal data to the transport company entrusted with delivery and to the payment service provider commissioned with payment processing. We only disclose the data that the service provider requires in each case to perform their task. The legal basis for this is Art. 6 para. 1 point b) GDPR, which permits the processing of data for the performance of a contract or to take steps prior to entering into a contract. Where you have given consent in accordance with Art. 6 para. 1 point a) GDPR, we will pass your email address to the transport company entrusted with the delivery so that they can notify you by email about the shipping status of your order; you may withdraw your consent at any time.

7. Proprietary services

Handling of applicant data

We provide you with the opportunity to submit job applications to us (e.g. by email, post or using the online application form). The following section informs you of the scope, purpose and use of your personal data submitted as part of the application process. We warrant that the collection, processing and use of your data will be performed in compliance with valid data protection law and all other statutory provisions and that your data will be treated in strict confidence.

Scope and purpose of data collection
When you send us an application, we process your personal data (e.g. contact and communication details, application documents, notes taken during interviews, etc.) to the extent that is necessary to reach a decision on establishing an employment relationship. The legal basis for this is Section 26 Federal Data Protection Act (BDSG) under German law (initiation of an employment relationship), Art. 6 para. 1 point b) GDPR (steps prior to entering into a contractual relationship) and – where you have given consent – Art. 6 para. 1 point a) GDPR. Consent may be withdrawn at any time. Within our company, your personal data will only be passed on to persons who are involved in processing your application. If the application is successful, the data submitted by you will be stored in our data processing systems on the basis of Section 26 BDSG and Art. 6 para. 1 point b) GDPR for the purpose of implementing the employment relationship.

Data retention period
If we are unable to make you a job offer, you reject a job offer or withdraw your application, we reserve the right to retain the data you have provided on the basis of our legitimate interests (Art. 6 para. 1 point f) GDPR) for up to 6 months after the end of the application process (rejection or withdrawal of the application). The data will then be erased and the physical application documents destroyed. The particular purpose of retention is to preserve evidence for the event of a legal dispute. Should it become clear that the data will be required after the 6-month period has expired (e.g. due to an impending or pending legal dispute), the data will only be erased when the purpose of continued storage no longer applies. Furthermore, more extended storage is also permitted if you have given your consent (Art. 6 para. 1 point a) GDPR) or if erasure is prevented by statutory retention obligations.

Inclusion in the applicant pool
We may be able to include you in our applicant pool if we do not make you a job offer. If you are included, all documents and details from the application will be transferred to the applicant pool in order to be able to contact you in the event of suitable vacancies. Inclusion in the applicant pool takes place exclusively on the basis of your explicit consent (Art. 6 para. 1 point a) GDPR). Consent is voluntary and has no affect on the ongoing application process. The data subject may withdraw their consent at any time. If this occurs, the data contained in the applicant pool will be irretrievably erased, unless statutory reasons for retention apply.

The data from the applicant pool will be irretrievably erased no later than two years after consent was granted.