Privacy Policy

1. General information

The Tourismus-Agentur Schleswig-Holstein GmbH, Wall 55, 24103 Kiel, is the controller responsible for data processing on this website as defined in the European General Data Protection Regulation (GDPR). We respect your personal rights. We understand the importance of the personal information we receive from you as a user of this website. We respect the privacy of your personal data and will collect, store or process all data obtained exclusively in accordance with the relevant data protection regulations within the scope of the purpose of our business.

2. Definitions

Personal data is any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person.

3. Legal basis of the processing

If and to the extent that we obtain your consent for the processing of personal data, Article 6 (1) 1 (a) of the European General Data Protection Regulation (GDPR) serves as the legal basis.

The processing of personal data required for the fulfilment of a contract with you is based on Article 6 (1) 1 (b) GDPR. This also applies to processing operations that are necessary for carrying out pre-contractual measures.

Where the processing of personal data is required for the compliance with a legal obligation to which our company is subject, Article 6 (1) 1 (c) GDPR serves as the legal basis for the data processing.

If the processing is necessary, in order to safeguard a legitimate interest of us (or a third party) and if your interests, fundamental rights and freedoms do not outweigh said legitimate interest, Art. 6 (1) 1 (f) GDPR will serve as the legal basis for the processing. If information is stored on your end device, e.g. by means of cookies (see also 5.2 and 5.6, in particular), the permissibility of data usage will also be governed by Section 25 (1) – consent – or, in the case of mandatory storage processes, by Section 25 (2) No. 1 – communication process – or No. 2 – provision of a telemedia service – of the German Telecommunications-Telemedia Data Protection Act (TDDDG). Provided nothing to the contrary is stated, the legitimate interest of our company is in continuously optimising our services and presentations in order to constantly improve our services while appropriately taking your interests into account.

4. Data erasure and duration of storage

Personal data will be erased or blocked from use as soon as the purpose of the storage ceases to apply. Any further storage may be carried out if this is stipulated. The data will also be blocked from use if any storage deadline stipulated by the specified standards expires, unless there is a requirement for the further storage of the data on other legal grounds, which we must prove, e.g. due to legitimate interests in the defence of legal claims.

5. Collection of personal data

During visits to our website we will only process personal data if this is necessary to provide a functional website as well as for our contents and services, or if we have obtained consent. This otherwise applies if it is necessary to process the data due to statutory regulations.

We would like to inform you below about the type, scope and purpose of our data processing within the scope of this website:

5.1 Hosting the website

The website is hosted by Mittwald CM Service GmbH & Co.KG (https://www.sh-tourismus.de & www.sh-business.de). The host receives the data specified above as a processor on the basis of an agreement in accordance with the requirements of Art. 28 GDPR.

5.2 Server log files

Every time you visit our website, the user's access data required for use and billing purposes are stored on our server in a log file which your browser automatically transmits to us.

These include:

Browser type/ browser version
Operating system used
Referrer URL
Date and time of the server request
IP address of the computer requesting the website (anonymisation of the last three digits)
Website from which the access was made (referrer URL)
Files accessed; status code; logs
Amount of data transferred.

The log file is stored for the following purposes:

Analysing file retrieval for statistical purposes;
System security and the stability of the website
Checking for non-contractual or otherwise illegal use, provided that there are actual indications for this.

The legal basis for this data processing is Art. 6 (1) 1 (f) GDPR. Our legitimate interest results from the data collection purposes that are specified above. We will not use the data collected for the purposes of identifying you under any circumstances. We will not merge this data with other data sources. This data will be erased automatically within one month if there are no particular indications that a longer storage period applies in the individual case.

5.3 Required cookies

After the user logs on to our website, what are known as “cookies” will be stored on the user's computer. Cookies are small text files stored in a designated directory on your computer. This file is used to identify the user's computer for the duration of the session. Cookies cannot manipulates the relevant end device of the user and can be deleted manually at any time, most easily in the browser.

You can individually adjust the settings of your Internet browser so that cookies are rejected or only accepted after confirmation. The cookies, what are known as “session cookies” here, are used to expand the functions of our Internet service and to make your use as convenient as possible. Please note that if you reject the use of cookies, you may be unable to use all the features of our application properly.

Processing data with cookies is necessary for the purposes mentioned to protect our legitimate interests and, if applicable, those of third parties in accordance with Art. 6 (1) 1 (f) GDPR, and Section 25 (2) German Telecommunications-Telemedia Data Protection Act (TDDDG).

5.4 Data in connection with your contact

If you send us enquiries by filling out the contact form, we will store your details from the form or an e-mail address you provide solely to process the relevant enquiry and to enable us to address any follow-up questions. We will not pass on this data to third parties without your consent. The corresponding data use is based on Art. 6 (1) 1 (b) GDPR within the scope of processing your request.

5.5 Webshop

If you wish to place an order in our webshop, in order to conclude a contract it is necessary for you to provide the personal data that we require to process your order. Mandatory information required to process contracts is marked separately; the disclosure of any further information is voluntary. We will process the data you provide to process your order. The legal basis for this is Art. 6 (1) 1 (b) GDPR.

You may voluntarily create a customer account, through which we can save your data for future purchases. When you create an account under “My account”, the data you provide will be stored on a revocable basis. You may delete all other data – including your user account – at any time in the customer area.

We may also process the data you provide in order to inform you about other interesting products from our portfolio, or to send you e-mails that contain technical information.

Due to commercial and tax law requirements, we are obliged to store your address, payment and order data for a period of ten years. However, we will restrict processing after two years, i.e. your data will only be used to comply with legal obligations.

In order to prevent unauthorised access by third parties to your personal data – in particular, financial data – the order process is encrypted using TLS technology.

We will also transmit your address data to the shipping service providers we use for the purpose of processing your order. The legal basis for this is Art. 6 (1) 1 (b) GDPR, as shipping is not possible without the use of a shipping service provider. We may also transmit your e-mail address to the shipping service provider for the purpose of informing you about the shipping status. In this respect, the shipping service provider will be obliged to use the e-mail address exclusively for the purpose of notifying you. The legal basis for this is our legitimate interest in ensuring that you receive your shipment as easily as possible and receive the best possible service from us, Art. 6 (1) 1 (f) GDPR.

5.6 Services from third-party providers

The use of third-party services – in particular, tracking tools and the cookies set in this context – will be based on Art. 6 (1) 1 (a) GDPR / Section 25 (1) German Telecommunications-Telemedia Data Protection Act (TDDDG) through your consent, which may be revoked at any time. With this, we want to guarantee the appropriate design and constant optimisation of our website (by using statistical evaluations, improving the availability and presentation of the contents as well as by integrating requested services).

5.6.1 Use of Google Analytics 4

We use Google Analytics 4 on our website, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (‘Google’).

Google Analytics 4 enables us to analyse the use of our website statistically. We use the insights gained, in particular, to understand how visitors use our website, which content is accessed, the sources from which visits originate, and how users interact with the features of our website. On this basis, we can improve the content, user experience, technical functionality and reach of our website, as well as evaluate the success of our communication and advertising measures.

Google Analytics 4 is only activated on our website if you have previously given your consent via our consent management tool in the ‘Marketing’ category or for the Google Analytics service. Google Analytics 4 will not be loaded without your consent.

When using Google Analytics 4, the following data in particular may be processed:

pages and content accessed;
time and duration of the visit;
interactions with the website and events triggered;
approximate geographical location;
referrer URL and source of access;
information on browser, operating system, language, screen resolution and device;
technical identifiers, in particular cookie and device identifiers;
information on campaigns and advertising materials through which you accessed our website.

Google Analytics uses cookies and similar technologies to recognise visits and interactions and to analyse them statistically. Details of the specific cookies used and their retention periods can be found in the detailed information provided by our consent management tool.

For technical reasons, your IP address is also processed during data transmission. According to Google, IP addresses of users from the European Union and the European Economic Area are used solely to derive approximate location information and are subsequently discarded before the data is stored. The full IP address is not made available to us.

The storage of information on your device or access to information already stored is based on your consent in accordance with Section 25(1) of the TDDDG. The subsequent processing of personal data is based on your consent in accordance with Article 6(1), first sentence, point (a) of the GDPR.

Google generally processes the data collected via Google Analytics on our behalf. Google’s privacy policy for advertising and measurement services applies in this regard. Depending on the data sharing settings activated in our Google Analytics account and any links to other Google services, data may also be transferred to other Google services and processed there in accordance with the applicable terms and conditions.

The data stored by Google Analytics at user and event level is deleted in accordance with the retention period specified in our Google Analytics account. This is currently 14 months. Aggregated analyses and reports that no longer contain any direct personal references may also be stored.

In addition to Google Ireland Limited, recipients of the data may include companies affiliated with Google and service providers engaged by Google. Processing may also take place in countries outside the European Union and the European Economic Area, in particular in the USA. Google LLC is certified under the EU-US Data Privacy Framework. Where data transfer is not based on an adequacy decision, Google states that it uses the Standard Contractual Clauses approved by the European Commission.

You may amend or withdraw your consent at any time with future effect via the settings in our consent management tool. The lawfulness of any processing carried out prior to withdrawal remains unaffected.

In addition, you can prevent data collection by Google Analytics using the browser add-on provided by Google:

https://tools.google.com/dlpage/gaoptout

Further information can be found at:

https://policies.google.com/privacy

https://support.google.com/analytics/answer/12017362

https://business.safety.google/adsprocessorterms/

5.6.2 Use of YouTube_DEplug-ins

Our website uses the plug-in function of the YouTube_DE platform of Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Every time you visit our website, a connection to YouTube's servers will be established. The YouTube server will be informed of your visit to our website. To our knowledge, no personal data will be stored here. However, if you are logged into your YouTube account, you would allow YouTube to allocate your browser history directly to your personal profile.

You have the option to deactivate this allocation if you log out of your account beforehand.

You will find further information about this in the Privacy Policy of YouTube at https://policies.google.com/privacy/youtube.

5.6.3 Use of Vimeo-Plugins

Our website uses components from the provider Vimeo LCC, 555 West 18th Street, New York, New York 10011, USA. Every time a website is called up on which the Vimeo service is installed, the service used on that website will cause your browser to download corresponding data from Vimeo. If you visit our website and while doing so you are logged into Vimeo with your user account, Vimeo will use the information collected by the service installed on that website to recognise which specific site you are visiting and will allocate this information to your personal account with Vimeo if you have one. The information that you have visited our website will also be relayed to Vimeo. This will happen irrespective of whether you use relevant Vimeo functions on our website.

If you wish to prevent data about you and your behaviour on our website being sent to and stored by Vimeo, you must log out of Vimeo before you visit our site.

You will find the Vimeo Privacy Policy, in particular with regard to the collection and use of data by Vimeo, here: https://vimeo.com/privacy.

5.6.4 Use of Google Tag Manager

We use Google Tag Manager on our website, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (‘Google’).

Google Tag Manager is a tag management system that enables us to centrally manage and integrate scripts and code snippets – known as tags – into our website. These tags are used, in particular, to control the analytics and marketing services described separately in this privacy policy.

Google Tag Manager is loaded as soon as you access our website. When the script required for this is retrieved, a connection is established with Google’s servers for technical reasons. In particular, your IP address, information about your browser and device, the date and time of the request, the URL accessed and referrer information may be transmitted to Google.

Google Tag Manager itself serves exclusively to manage and trigger the integrated tags. According to Google, it does not create its own user profiles and does not carry out any independent analysis of your usage behaviour. Nor does Google Tag Manager itself decide which data is processed by the services integrated via it. Rather, the nature, scope and purpose of further data processing depend on the specific service integrated in each case. You can find information on this in the relevant sections of this privacy policy.

Analytics and marketing tags requiring consent are controlled via our consent management tool and are only triggered if you have previously consented to the respective processing. If you do not give your consent or withdraw it, these tags remain deactivated. You can change or withdraw your consent at any time with future effect via the settings of our consent management tool.

The processing of personal data generated during the technical retrieval of Google Tag Manager is carried out on the basis of Article 6(1), first sentence, point (f) of the GDPR. Our legitimate interest lies in the technically reliable, secure and efficient management of the services used on our website, as well as in implementing the decisions you have made in the consent management tool. Where a service integrated via Google Tag Manager stores information on your device or accesses information already stored there, this is done – unless a statutory exception applies – exclusively on the basis of your consent in accordance with Section 25(1) of the TDDDG. The subsequent processing of personal data by the respective analytics or marketing service takes place on the basis of Article 6(1), first sentence, point (a) of the GDPR.

Recipients of the data processed when Google Tag Manager is accessed may include, in addition to Google Ireland Limited, companies affiliated with Google and service providers engaged by Google. Processing may also take place in countries outside the European Union and the European Economic Area, in particular in the USA. Google LLC is certified under the EU-US Data Privacy Framework. Where a data transfer is not based on an adequacy decision, Google states that it uses the Standard Contractual Clauses approved by the European Commission.

Further information can be found at:

https://marketingplatform.google.com/intl/de/about/analytics/tag-manager/use-policy/

https://policies.google.com/privacy

https://policies.google.com/privacy/frameworks

5.6.5 Use of Podigee

General information
We use the platform and services of Podigee GmbH, Schlesische Str. 20, 10997 Berlin (hereinafter “Podigee”). Our corporate profile at Podigee serves a number of communications purposes, such as providing general information, announcing events and in particular, providing our podcasts. In this context, personal data from you as a listener to our podcast will also be processed in part.
Please note that it is not necessary to use this service to contact us or to receive information from us.
You use our Podigee podcasts on your own responsibility. Podigee is solely responsible for operating the platform.
Processing by Podigee
When listening to or accessing our podcast provided by Podigee on our website or through third providers, data processing by Podigee is unavoidable. This data processing is orientated on the corresponding requirements of the portal operator, which you can view here: https://www.podigee.com/de/ueber-uns/datenschutz and in addition, on the guidelines of any third parties that may also be involved, such as streaming service providers.
Podigee uses hosting and analysis services from other service providers in order to offer access to the audio contents. Podigee also uses the streaming service Spotify here. We have no influence over the data processing carried out by Podigee or by any other third providers that are used. The details of the data processing carried out by Podigee can be found in the Privacy Policy specified above.
Processing by us
Podigee provides us with statistical evaluations of the access figures for our podcasts made through our website or third providers, including any advertising that is provided. This is exclusively statistical/anonymous data that does not allow any conclusions to be drawn about natural persons.
If you listen to our podcast, your data will be automatically included in these statistical records.
Further information
Please take all additional data protection information, in particular about the rights to which you are entitled, from our General Privacy Policy, which you can view here: www.sh-tourismus.de/datenschutz.

5.6.6 Use of Maptoolkit

We use the map service Maptoolkit to create directions and to display maps on our website. Maptoolkit is provided by Toursprung GmbH, Mariahilfer Str. 93/20, 1060 Vienna, Austria. When you access our website’s content, you will be connected to the servers of Toursprung GmbH. Your IP address and possibly browser data such as your user agent will be transmitted. This data is processed exclusively for the above-mentioned purposes, and to maintain the security and range of functions associated with Maptoolkit. The IP address is already anonymised from a technical standpoint before any further processing. Tracing back to individual persons is not possible.

The aforementioned data will only be stored during the period of use. You will find further information about this in their Privacy Policy at https://www.maptoolkit.com/de/privacy/.

5.6.7 Use of Matomo

We use the open source software Matomo to analyse and statistically evaluate the use of the website. Cookies are used for this purpose (see above). The information generated by the cookie regarding website usage is transmitted to our servers and summarised in pseudonymous usage profiles. The information is used to analyse the use of the website, and to facilitate a needs-based design of our website. The information will not be passed on to third parties. The IP address will not be associated with other data relating to the user. IP addresses will be anonymised so that no attribution to an individual is possible (IP masking). Your visit to this website is currently recorded by Matomo web analytics. Click here (https://matomo.org/privacy/) so that your visit will no longer be recorded.

5.6.8 Google advertising services

Google Ads – Conversion Tracking and Remarketing

We use Google Ads, an online advertising service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (‘Google’), to promote our services and measure the success of our advertising campaigns.

With the help of Google Ads conversion tracking, we can track whether users carry out specific actions on our website (known as ‘conversions’) after coming into contact with or clicking on one of our adverts. Depending on the conversion we have defined, this may include, for example, visiting specific pages, clicking on specific content or other interactions on our website. We use the information obtained in this way to evaluate the effectiveness of our adverts and to optimise our campaigns.

Where we use it, we also utilise Google Ads for remarketing. This enables us to assign people who have visited our website or carried out specific actions on it to target groups, and to show them our adverts again on Google services as well as on websites and in apps operated by Google’s advertising partners. The selection and personalisation of adverts may depend on previous interactions with our website.

If you consent to this, the tags intended for Google Ads are triggered via Google Tag Manager. In the process, cookies or similar technologies may be stored on your device and information already stored may be read. In particular, the following may be processed:

Online identifiers and cookie IDs,
the IP address,
details of your browser, operating system and device,
pages and URLs visited, as well as referrer information,
the date and time of visits and interactions,
information about adverts displayed or clicked on,
the conversion events defined by us, and
the consent status transmitted via our consent management tool.

Google may also process this information for its own purposes in accordance with its privacy policy. If you are logged into your Google account, Google may, where applicable, associate the processed information with your account. In particular, we receive campaign and conversion reports from Google. These reports do not, in principle, enable us to directly identify individual users.

The storage of information on your device or access to it is based on your consent in accordance with Section 25(1) of the TDDDG. The subsequent processing of personal data is based on your consent in accordance with Article 6(1), first sentence, point (a) of the GDPR. You may withdraw your consent at any time with future effect via the settings of our consent management tool. Without your consent, the Google Ads tags will not be triggered for the advertising and measurement purposes described. The lawfulness of the processing carried out up to the point of withdrawal remains unaffected.

The retention period depends on the type of data, the function used in each case and the settings configured by us or by Google. Details of the technologies used on your device and their durations can be found in our consent management tool. In addition, the retention periods specified by Google for the respective service apply.

Recipients of the data may include Google Ireland Limited, companies affiliated with Google, and service providers engaged by Google. Processing may also be carried out by Google LLC and other recipients in countries outside the European Union and the European Economic Area, in particular in the USA. Google LLC is certified under the EU-US Data Privacy Framework. Where a transfer is not based on an adequacy decision, Google states that it may be based, in particular, on the European Commission’s Standard Contractual Clauses.

Further information can be found in Google’s Privacy Policy, in Google’s information on advertising and data protection, in the terms and conditions governing data transfers, and in the Google Ads Centre.

Display & Video 360, Campaign Manager 360 and Floodlight

We use Google Display & Video 360 (“DV360”) and – where this forms part of our technical campaign configuration – Campaign Manager 360, including the associated Floodlight technology. The provider for users in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

DV360 is used for the planning, delivery, management and evaluation of digital advertising campaigns. Campaign Manager 360 can be used in particular for the management, delivery and measurement of campaigns. Floodlight is a measurement system within the Google Marketing Platform. With the help of Floodlight, we can determine whether users carry out specific actions on our website after coming into contact with or clicking on an advert (known as conversion tracking). Depending on the campaign configuration, Floodlight can also be used for reach and frequency measurement, cross-campaign attribution of conversions, campaign optimisation, audience targeting and retargeting (remarketing).

If you consent to this, the relevant DV360, Campaign Manager 360 and Floodlight tags will be triggered via Google Tag Manager. In doing so, cookies or similar technologies may be stored on your device and information already stored may be read. In particular, the following may be processed:

Online identifiers and cookie IDs,
the IP address,
details of the browser, operating system and device,
pages and URLs visited, as well as referrer information,
the date and time of visits and interactions,
information on adverts displayed or clicked on,
the conversion events defined by us,
campaign-related parameters, where applicable, and
the consent status transmitted via our consent management tool.

Google may also process this information for its own purposes in accordance with its privacy policy. If you are logged into your Google account, Google may, where applicable, associate the processed information with your account. In particular, we receive campaign-related analyses and reports from Google. These do not, in principle, enable us to directly identify individual users.

The storage of information on your device or access to it is based on your consent in accordance with Section 25(1) of the TDDDG. The subsequent processing of personal data is based on your consent in accordance with Article 6(1), first sentence, point (a) of the GDPR. You may withdraw your consent at any time with future effect via the settings of our consent management tool. Without your consent, the tags mentioned will not be triggered for the advertising and measurement purposes described. The lawfulness of the processing carried out up to the point of withdrawal remains unaffected.

The retention period depends on the type of data, the function used and the settings configured by us or by Google. Details of the technologies used on your device and their retention periods can be found in our consent management tool. In addition, the retention periods specified in the relevant platform account or provided for by Google apply.

Recipients of the data may include Google Ireland Limited, companies affiliated with Google, and service providers engaged by Google. Processing may also be carried out by Google LLC and other recipients in countries outside the European Union and the European Economic Area, in particular in the USA. Google LLC is certified under the EU-US Data Privacy Framework. Where a transfer is not based on an adequacy decision, it may, according to Google, be based in particular on the European Commission’s Standard Contractual Clauses.

Google AdSense

We use the “Google AdSense” service on our website to display advertisements and monetize our content. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland. The purpose of data processing is to display personalized advertising and analyze user interactions with advertisements. The legal basis for the use of AdSense is your consent in accordance with Art. 6 (1) (a) GDPR. You can revoke your consent at any time with effect for the future.

The data processed by Google AdSense includes your IP address, device information, browser type, pages visited, interactions with advertisements, and cookies set by Google. Google AdSense may collect user data to create personalized advertising profiles.

It cannot be ruled out that personal data may be transferred to unsafe third countries (USA) where the level of data protection is lower than in the EU. Google is certified under the EU-US Data Privacy Framework, which regulates the secure processing of EU citizens' data in the USA. We have entered into a data processing agreement (DPA) with Google, which ensures that personal data is only processed in accordance with our instructions and in compliance with the GDPR.

For more information about AdSense's privacy policy, please visit: https://policies.google.com/privacy

5.6.9 Use of Meta Pixel

Our website uses the visitor action pixel from Facebook/Instagram, Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”) to measure conversions. This allows the behaviour of site visitors to be tracked after they have been redirected to the provider’s website by clicking on a Facebook/Instagram ad. This allows the efficacy of Facebook/Instagram ads to be evaluated for statistical and market research-related purposes, and for future advertising measures to be optimised. The data collected is anonymous to us as the operator of this website; we are unable to draw any conclusions about the identity of the user. However, the data is stored and processed by Facebook/Instagram, in order to enable a connection to the respective user profile and so that Facebook/Instagram can use the data for its own advertising purposes in accordance with the Facebook/Instagram Data Usage Policy. This allows Facebook/Instagram to enable the placement of adverts on Facebook/Instagram pages and outside of Facebook/Instagram. This use of the data cannot be influenced by us as the website operator.

The legal basis for data processing is your consent in accordance with Art. 6 (1) a GDPR.

You can find further information on protecting your privacy in the Facebook/Instagram privacy policy:

https://www.facebook.com/about/privacy/

https://privacycenter.instagram.com/policy/

You may also deactivate the remarketing function “Custom Audiences” in the section “Settings for adverts”. You must be logged in to Facebook/Instagram to do so.

If you do not have a Facebook/Instagram account, you can deactivate use-based advertising from Facebook/Instagram on the website of the European Interactive Digital Advertising Alliance: http://www.youronlinechoices.com/de/praferenzmanagement/

5.6.10 Use of Google Fonts

This website uses Google Fonts, a web service API of Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

By using Google Fonts, we can provide website visitors with a standardised and user-friendly presentation of our website and online offers. Upon accessing our website, your browser automatically loads the required web fonts from the Google servers into your browser cache, in order to display our texts in a visually improved way. For this purpose, your browser must connect to the Google servers, whereby your IP address is automatically transferred to the Google server in the USA. This provides Google with the information that our website has been accessed via your IP address. If your browser does not support this function (or you prevent access to the Google servers), a standard font will be used by your computer to display the website texts.

IP addresses are neither logged nor stored on Google servers and are not analysed. The Google Fonts Web API logs details of HTTP requests (requested URL, user agent and referrer URL). Access to this data is restricted and subject to strict control measures. To our knowledge, Google does not use any of the information collected by Google Fonts to create profiles of end users or to place targeted adverts.

The use of Google Fonts on our website only takes place with your effective consent (Art. 6 (1) 1 (a) GDPR). Please refer to our Consent Management Tool for details and setting options for your currently defined consents.

You will find further information about Google Fonts at https://developers.google.com/fonts, in the Google Privacy Policy at https://www.google.com/policies/privacy/ as well as in the Terms of Service for Google API at https://developers.google.com/terms.

5.6.11 Use of our Consent Management Tool (CMT)

Our website uses the CMT “Usercentrics Consent Management”, a web service provided by Usercentrics GmbH, Sendlingerstrasse 7, 80331 Munich (hereinafter “Usercentrics”).

We use this data to ensure the full functionality of our website, to inform the user about the use of cookies on our website and to obtain and record the user’s consent in accordance with the law.

The following data is automatically transmitted to the provider / technical service provider of our CMT:

Anonymised IP address of the user;
Date, time of consent;
User agent of the end user’s browser;
Website from which the access was established (referrer URL);
Anonymous, random and encrypted key;
The cookies authorised by the user (cookie status), which serves as proof of consent.

A key automatically generated by the CMT for the management/proof of consents granted and the consent status are also stored in a cookie in the end user’s browser. This allows the website to automatically read (and adhere to) the end user’s consent on all subsequent page requests and future end user sessions for up to 12 months.

The legal basis for data processing is Art. 6 (1) 1 (c) GDPR in conjunction with Section 25 (2) No. 2 German Telecommunications-Telemedia Data Protection Act (TDDDG). Only with an appropriate mechanism for granting and managing consent are we able to comply with the legal requirements.

You can prevent the collection and processing of your data by our CMT by deactivating the execution of script codes in the settings of your browser or by installing a script blocker in your browser.

You will find further information about the scope of data processing carried out by CMT in the privacy policy of our CMT provider at https://usercentrics.com/de/datenschutzerklaerung.

5.6.12 Newsletter

In order to add you to our e-mail distribution list, we need your confirmation or consent that you are the owner of the e-mail address provided, and that you agree to receive the notifications.

We use what is called the double opt-in process to register you for our newsletter. This means that after you register we will send an e-mail to the e-mail address given in which we will ask you to confirm that you wish to receive the newsletter. If you do not confirm your registration, your information will be erased. The data collected will be used exclusively to send our newsletter and to document your consent. In addition, we will store the IP addresses you use and the dates of registration and confirmation. The purpose of this procedure is to prove your registration and, if necessary, to detect any possible misuse of your personal data.

This will not be passed on to third parties.

The granting of this consent is voluntary. The legal basis for your consent results from Art. 6 (1) 1 (a) GDPR.

You may revoke your consent to the mailing at any time with effect for the future. Your data entered above will then be deleted immediately, and no further notification will be sent.

5.6.13 hCaptcha

We use the “hCaptcha” service on our website to ensure that interactions are carried out by humans and to prevent spam and abuse. The provider is Intuition Machines, Inc. (“Intuition Machines”), 350 Alabama St, San Francisco, CA 94110, USA.

The legal basis for the use of hCaptcha is our legitimate interest pursuant to Art. 6 (1) lit. f GDPR to protect our website from spam and abuse and to ensure its security and functionality. The data processed by hCaptcha includes your IP address, browser type, operating system, device information, interaction data, and the service sets cookies. The purpose of data processing is to verify that interactions originate from humans and to prevent automated abuse and spam.

It cannot be ruled out that personal data may be transferred to unsafe third countries (USA) where the level of data protection is lower than in the EU. Intuition Machines is certified under the EU-US Data Privacy Framework, which regulates the secure processing of EU citizens' data in the USA. Intuition Machines uses standard contractual clauses to ensure that your data complies with European data protection standards even when it is transferred to and stored in third countries.

For more information on hCaptcha's privacy policy, please visit: https://www.hcaptcha.com/privacy

5.6.14 Using imx.Platform white label widgets

This website integrates white label widgets from the imx.platform. The white label widgets are used to integrate data (tourism businesses, attractions, events, tours, tourist offers etc.) from the tourism database of Tourismus-Agentur Schleswig-Holstein GmbH – which is based on the imx.Platform software – into the website. The imx.Platform and the imx.Platform white label widgets are provided and operated by infomax websolutions GmbH, Aichfeld 2, 83224 Grassau, Germany (hereinafter referred to as infomax). infomax operates its services exclusively on servers in Germany in accordance with German and European data protection regulations.

infomax may process personal data according to its own specifications, which is why we have no knowledge of any processing of personal data by infomax and, therefore, accept no responsibility for this. Possible purposes, legal bases and the scope of processing of personal data by infomax, as well as your rights in this regard and setting options to protect your privacy, can be found in infomax’s data protection information at https://www.infomax-online.de/datenschutz.

5.6.15 Using Bliro.io

We use Bliro.io to automatically generate meeting notes and document them. The provider is Bliro GmbH, Schellingstraße 112, 80798 Munich, Germany. Bliro processes personal data such as participants’ names, contact details and meeting content within the EU; where necessary, subcontractors outside the EU may also be involved.

The processing and use of this transcription tool takes place only with your prior consent (Art. 6(1)(a) GDPR).

We have concluded a data protection-compliant data processing agreement with the provider in accordance with the provisions of Art. 28 GDPR.

The data is stored in accordance with our retention policy and deleted as soon as it is no longer required.

Further details on data protection can be found at https://www.bliro.io/privacy-policy.

6. Your rights

Insofar as we process your personal data on our website, you are a “data subject” as defined in the GDPR. You have the following rights vis-à-vis our company:

6.1 Right of access

You can request us to confirm whether we are processing your personal data. If this is the case, you can request the following information from us:

the purposes for which the personal data is being processed;
the categories of personal data that are being processed;
the recipients or categories of recipient to whom your personal data has been or will be disclosed;
the envisaged period for which your personal data will be stored, or, if no concrete disclosures are possible here, the criteria used to determine that period;
the existence of the right to lodge a complaint with a supervisory authority;
all available information regarding the origin of the data, if the personal data has not been collected from you;
the existence of automated decision-making, including profiling, in accordance with Art. 22 (1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you.

Furthermore, you have the right to request information about whether your personal data is transferred to a third country or to an international organisation. In this context, you can request to be informed about the appropriate safeguards in accordance with Art. 46 GDPR in connection with the transfer.

6.2 Right to rectification

You have the right to correct and/or complete your personal data if your processed data is incorrect or incomplete. If this is the case we will make the correction immediately.

6.3 Right to restriction of processing

Under the following pre-conditions you have the right to demand the restriction of the processing of your personal data if:

you are contesting the accuracy of your personal data for a period enabling us to verify the accuracy of the data;
the processing is unlawful, and you oppose the erasure of your personal data and request the restriction of its use instead;
we no longer require your personal data for the purposes of the processing, however, you require the personal data for the establishment, exercise or defence of legal claims, or
you have objected to the processing in accordance with Art. 21(1) GDPR and it has not yet been determined whether our legitimate grounds override your grounds.

If you have requested that the processing of your personal data is restricted, such personal data will, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or of a Member State. You will be informed by us before the restriction is lifted.

6.4 Right to erasure

You can ask us to erase your personal data without undue delay. We are obligated to erase the data without undue delay if one of the following reasons applies:

Your personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed.
You withdraw any existing consent on which the processing was based according to Art. 6 (1) 1 (a) or Art. 9 (2) (a) GDPR, and there is no other legal basis for the processing.
You file an objection against the processing pursuant to Art. 21 (1) GDPR and there are no overriding legitimate reasons for the processing.
In accordance with Art. 21 (2) GDPR, you file an objection against the processing by means of direct marketing.
Your personal data has been unlawfully processed.
Your personal data must be erased to comply with a legal obligation in accordance with EU law or the law of a Member State to which we are subject.
Your personal data has been collected in relation to the services offered by an information society as per Art. 8 (1) GDPR.

If we have published your personal data and are obliged to erase it in accordance with Art. 17 (1) GDPR, we will take appropriate measures – considering the available technology and the implementation costs – to
inform the controller(s) responsible for data processing that you have requested the erasure by such controllers of all links to, or copies or replications of such personal data.

Your right to erasure does not apply if processing is required

to exercise the right to freedom of expression and information;
to comply with a legal obligation which requires processing in accordance with EU law or that of a Member State to which we are subject, or for the performance of a task carried out in the public interest, or in the exercise of official authority vested in us;
For reasons of public interest in the area of public health as per Art. 9 (2) 1 (h) and (i) as well as Art. 9 (3) GDPR;
for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes in accordance with Art. 89 (1) GDPR insofar as the right referred to in (1) is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
the establishment, exercise or defence of legal claims.

6.5 Right to information

If you have exercised the right to rectification, erasure or restriction of processing against us, we are obliged to notify all recipients to whom your personal data has been disclosed of the rectification or erasure of the data or restriction of processing, unless this proves impossible or involves disproportionate effort.

You have the right to be informed about the recipients.

6.6 Right to data portability

You have the right to receive your personal data which you may have provided to us, in a structured, commonly used and machine-readable format. You also have the right to transmit such data to another controller without hindrance from us, if

the processing is based on a declaration of consent in accordance with Art. 6 (1) 1 (a) GDPR, or Art. 9 (2) (a) GDPR, or on a contract in accordance with Art. 6 (1) 1 (b) GDPR and
the processing is carried out using automated methods.

In addition, you have the right to request the transfer of your personal data directly from us to another controller, insofar as this is technically feasible. This should not impair any other person's freedoms or rights.

The right to data portability does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.

We currently do not assume that the data which is subject to the right to data transferability will be processed within the scope of our website offer.

6.7 Right to object

You have the right to object, on grounds relating to your particular situation, at any time to processing of your personal data which is based on Art. 6 (1) 1 (e) or (f) GDPR, including profiling based on these provisions.

We will no longer process your personal data unless we can demonstrate compelling legitimate grounds worthy of protection for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

If your personal data is processed for the purpose of direct marketing, you have the right to object at any time to the processing of the personal data concerning you for such purposes; this also applies to any related profiling.

If you object to the processing for direct marketing purposes, your personal data will no longer be processed for these purposes.

In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you have the option to exercise your right to object by automated means using technical specifications.

6.8 Right to revoke the declaration of consent under data protection law

You are entitled to revoke your declaration of consent under data protection law at any time. Revoking your consent will not affect the legality of any processing that took place before the revocation.

Renew or change your cookie consent in our Consent Management Tool.

6.9 Automated individual decision-making including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. We do not carry out such processing.

6.10 Right to lodge a complaint with a supervisory authority

You are entitled to appeal to a supervisory authority, without prejudice to any other rights of appeal, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of your personal data infringes the GDPR.

7. Responsibility for linked content

This website may also use links to the websites of other providers. This Privacy Policy does not apply in this respect. If personal data is collected, processed or used when using the websites of other providers, please note the information on data protection of the respective providers. We are not responsible for their privacy policy.

8. Disclosure of personal data to third parties

Your personal data will only be stored on our servers or on servers used on our behalf. Access to and use of the data is only possible for authorised employees or service providers and is also limited to the data required to perform the respective task.

Your data will not be transmitted to third parties without your consent. A data transfer to third countries (countries outside the European Economic Area - EEA) will not take place, unless otherwise stated in this Privacy Policy, and is also not intended in the future.

9. Data security

To protect your personal data, we have taken technical and organisational measures to ensure that your data is protected against accidental or intentional loss, destruction or tampering as well as access by unauthorised persons. Our protective measures are reviewed at regular intervals and adapted to technical progress if necessary.

10. Data Protection Officer

If you have any further questions with regard to the processing of your personal data, please contact our Data Protection Officer: compolicy GmbH, Schwedenkai 1, 24103 Kiel, info@compolicy.de.

11. Amendments to this Privacy Policy

We reserve the right to amend this Privacy Policy at any time if necessary and in consideration of the data protection regulations applicable at the time of the change.

Version as of: September 2026