Privacy Policy

Controller

The controller responsible for processing personal data in connection with this blog is:

Schloss Elmau GmbH & Co. KG
In Elmau 28
82493 Krün

Phone: +49 (0)8823 18-0
E-mail: info@schloss-elmau.de

Data Protection Officer
You can reach our Data Protection Officer at:

Dr. Anke Thiedemann c/o RWT Anwaltskanzlei GmbH
Charlottenstraße 49
72764 Reutlingen

E-mail: anke.thiedemann@rwt-gruppe.de

Hosting

This website is hosted by Raidboxes GmbH, Hafenstraße 32, 48153 Münster.

For the purpose of providing and securely operating the website, our hosting service provider processes the following data in so-called server log files:

IP address of the accessing terminal device
Date and time of access
Pages and files accessed
Browser type and browser version
Operating system used
Referrer URL
Access status

Processing is carried out to ensure the secure and trouble-free operation of the website. The legal basis is Art. 6 (1) lit. f GDPR. Our legitimate interest lies in the secure provision and operation of our online offer.

A data processing agreement pursuant to Art. 28 GDPR has been concluded with our hosting service provider.

Cookies and Consent Management

We use the consent management tool Borlabs Cookie to obtain and document consents for the use of cookies and comparable technologies. In particular, the following information is stored:

Your consent decision or the revocation of a consent
Time of the decision
Information about your terminal device and your browser
A Consent ID

The processing is carried out to meet the legal requirements for providing proof of consents granted. The legal basis is Art. 6 (1) lit. c GDPR in conjunction with Art. 7 (1) GDPR as well as § 25 (2) No. 2 TDDDG.

Google Analytics

Provided you give your consent, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics uses cookies and similar technologies to evaluate the use of our website. This allows the following information, in particular, to be processed:

Pages visited
Click behavior
Duration of visit
Origin of visitors
Technical information regarding the browser, operating system, and terminal device
Shortened IP address

IP anonymization is activated. According to Google, the IP address is shortened within the European Union or the European Economic Area before it is further processed. Google Signals is not utilized.

Processing is carried out exclusively on the basis of your consent pursuant to Art. 6 (1) lit. a GDPR and § 25 (1) TDDDG. You can revoke your consent at any time with effect for the future via the cookie settings.

The data may be transmitted to servers of Google LLC in the USA. Google is certified under the EU-U.S. Data Privacy Framework. Further information: https://policies.google.com/privacy

Contacting Us via E-mail

If you contact us by e-mail, we process the data you transmit to handle your inquiry. This includes, in particular:

Name
E-mail address
Content of your message
Other information voluntarily transmitted by you

Processing is carried out to handle your inquiry and communicate with you. The legal basis is Art. 6 (1) lit. f GDPR or Art. 6 (1) lit. b GDPR, provided that your inquiry is aimed at the conclusion or performance of a contract.

The data will be deleted as soon as they are no longer required for processing your inquiry and no statutory retention obligations conflict with this.

User Account and Favorites Function

To use certain functions of our blog, in particular the favorites function, it is necessary to set up a user account. As part of the registration process, we process the following data in particular:

Username
E-mail address
Password (stored encrypted)

Registration takes place via a double-opt-in procedure. After registering, you will receive an e-mail in which you must confirm your registration.

Within your user account, you can save posts and content as favorites. The saved favorites are assigned to your user account.

Processing is carried out to provide and manage the user account as well as the favorites function. The legal basis is Art. 6 (1) lit. b GDPR.

The data will be stored for as long as your user account remains active. You may request deletion of your user account at any time.

Spotify Podcasts

On individual pages of our blog, we embed content from the streaming service Spotify. The provider is Spotify AB, Regeringsgatan 19, 111 53 Stockholm, Sweden.

When calling up a page with embedded Spotify content, personal data, in particular your IP address as well as technical information about your terminal device, may be transmitted to Spotify.

Insofar as Spotify uses cookies or comparable technologies, their use is based exclusively on your consent pursuant to Art. 6 (1) lit. a GDPR and § 25 (1) TDDDG.

Further information: https://www.spotify.com/de/legal/privacy-policy/

Social Media Links

On our website, you will find links to our profiles on social networks, in particular:

Facebook
Instagram
YouTube

These are pure links. As a general rule, personal data is only transmitted to the respective providers when you click on the respective link.

No separate newsletter registration form is provided on this blog. If you wish to subscribe to our newsletter, you will be redirected via a link to the corresponding page of the main Schloss Elmau website. The privacy information of the respective website applies to the processing of personal data occurring there.

Data Transfers to Third Countries

Insofar as services of companies based outside the European Union or the European Economic Area are used or a data transfer to such states takes place, a lower level of data protection may exist.

When using Google Analytics, personal data may be transferred to the USA. The transfer is based on the EU-U.S. Data Privacy Framework or appropriate safeguards pursuant to Art. 44 et seq. GDPR.

Storage Period

We store personal data only as long as necessary for the respective processing purposes or as long as statutory retention obligations exist.

Your Rights

Under the legal prerequisites, you have the following rights:

Right of access (Art. 15 GDPR)
Right to rectification (Art. 16 GDPR)
Right to erasure / “right to be forgotten” (Art. 17 GDPR)
Right to restriction of processing (Art. 18 GDPR)
Right to data portability (Art. 20 GDPR)
Right to object (Art. 21 GDPR)
Right to withdraw consent at any time with effect for the future

Withdrawal of Consent

If the processing of personal data is based on your consent, you can withdraw this consent at any time with effect for the future. The lawfulness of the processing carried out up to the time of withdrawal remains unaffected. You can withdraw your consent in particular via the cookie settings of our website or by contacting us via the contact details provided above.

Right to Object

Insofar as we process personal data on the basis of Art. 6 (1) lit. f GDPR, you have the right to object to the processing of your personal data at any time for reasons arising from your particular situation.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims.

If personal data are processed to operate direct marketing, you have the right to object at any time to the processing of your personal data for the purpose of such advertising. This also applies to profiling insofar as it is associated with such direct marketing. If you object to processing for direct marketing purposes, your personal data will no longer be processed for these purposes.

Right to Lodge a Complaint

You also have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data. The competent supervisory authority for Schloss Elmau is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach
www.lda.bayern.de

Changes to this Privacy Policy
We reserve the right to adapt this privacy policy if this becomes necessary due to technical, legal, or organizational changes.