Privacy policy

 

1. General

1.1 Personal data

The object of data protection is personal data (hereinafter ‘data’). This shall constitute any information relating to an identified or identifiable natural person, including details such as name, address, occupation, email address, state of health, income, marital status, genetic characteristics, telephone number and, if applicable, user data such as the IP address.

1.2 Controller and data protection officer

The controller responsible for the processing of your personal data within the scope of use of the www.romantic-cities.com website (hereinafter ‘website’) shall be Rheinland-Pfalz Tourismus GmbH (hereinafter ‘operator’ or ‘controller’). You can find the contact details in the legal notice.

The data protection officer can be reached at:

MORGENSTERN consecom GmbH
Grosse Himmelsgasse 1
67346 Speyer
Tel.: +49 (0)6232 100119 44

2. Scope and purposes of data processing, legal basis, provision of data and storage period

2.1 Access and use of the website

Each time the website and its subordinate pages are accessed, usage data is transmitted by the respective web browser and stored in log files (server log files). The records stored in this process contain the following data:

  • date and time of retrieval,
  • name of the retrieved subordinate page,
  • IP address,
  • referrer URL (the URL from which you accessed the website),
  • amount of data transmitted and
  • browser version and details.

The legitimacy of this processing shall be in compliance with Art. 6 (1) lit. b of the General Data Protection Regulation (GDPR) (user relationship). The data processed by the operator shall be needed by the operator to enable you to access and use the website. This is data that it shall be necessary to process during the use of a telecommunications and electronic media service. Otherwise you shall not be able to access the website.

The log files shall be analysed in anonymised form by the operator in order to continuously improve the website and make it more user-friendly, find and correct errors more quickly and manage server load. For example, the operator can identify the time at which the website is particularly popular and subsequently make the corresponding bandwidth available.

The legitimacy of this processing shall be in compliance with Art. 6 (1) lit. f GDPR (legitimate interest). The legitimate interest of the operator shall be to provide a website containing information, to provide services to the operator’s customers and to optimise website operations. The provision of data is neither legally nor contractually required. Failure to provide data means that such data cannot be used to optimise the website.

Your IP address shall be deleted or anonymised after use. Anonymisation involves modifying the IP addresses in such a manner that association with a determined or determinable, or an identified or identifiable natural person shall no longer be possible or shall only be possible by investing a disproportionate amount of time, cost and effort.

2.2 Contact form and click to email

If you would like to contact the operator, a contact form is available for this purpose. You must provide the following information to submit this form:

  • email address and
  • your message.

You may also provide the following optional information:

  • standard personal data (title, name, surname) and
  • address data (street address, place of residence).

On the website, you have the option to open an email that is pre-addressed to the operator with just one click. The email address that is set up in your default email programme will be automatically inserted as the sender. If you do not wish that your email address is retrieved in this manner, you can change this in the settings of your respective email programme.

The legitimacy of this processing shall be in compliance with Art. 6 (1) lit. b GDPR (contract or pre-contractual provision). The provision of data is required since you will otherwise not be able to send a message to the operator.

The processed personal data shall be erased upon expiry of the legal retention obligations unless the controller has a legitimate interest for its further retention. In any case, only that data that is absolutely necessary to achieve the corresponding purpose shall continue to be stored.

2.3 Advertising

The operator shall use your data for advertising purposes. The legitimacy of this processing shall be in compliance with Art. 6 (1) lit. f GDPR (legitimate interest). The use of data for advertising purposes shall constitute a legitimate interest of the operator pursuant to Art. 6 (1) lit. f GDPR. The operator depends on this to actively promote its services to new and existing customers.

As a customer of the operator, you shall also receive regular emails about product suggestions based on the products or services you have already ordered. This is how the operator shall keep you informed about the operator’s services that may be of interest to you based on your last order or booking. The legal basis for this shall be Art. 6 (1) lit. f GDPR and Section 7 (3) of the Act Against Unfair Competition (UWG).

The provision of data is neither contractually nor legally required. Failure to provide this information means that you cannot be contacted for advertising purposes.

Personal data processed for the purpose of advertising shall be erased unless the controller has a legitimate interest for its further retention. In any case, only that data that is absolutely necessary to achieve the corresponding purpose shall continue to be stored.

2.4 Use of cookies

The operator uses cookies. These are small packets of data, usually comprising letters and numbers, that are stored by your browser when you visit a website. Cookies enable the website to recognise your browser, track you as you browse through various sections of the website and identify you when you return to the website. Cookies do not contain any data that personally identifies you. However, the information concerning you stored by the operator can be associated with the data received from and stored in the cookies.

Information that the operator obtains from you by using cookies may be used for the following purposes:

  • to recognise the user’s computer when visiting the website,
  • to track the user’s activities on the website,
  • to make the website more user-friendly,
  • to analyse how the website is used,
  • to operate the website,
  • to prevent fraud and improve the website’s security, and
  • to customise the design of the website based on the users’ needs.

Cookies do not harm the browser. They do not contain viruses and do not enable the operator to spy on you. Two types of cookie are used:

  • temporary or session cookies, which are automatically deleted when you close your browser, and
  • permanent cookies, which expire after a maximum of 20 days and enable a website to recognise you when you return after having once left it.

Cookies help the operator track user behaviour for the above-mentioned purposes, each to the extent required. They are also intended to help optimise your browsing experience on the operator’s website. The operator shall also collect this data solely in anonymised form. The legitimacy of this processing shall be in compliance with Art. 6 (1) lit. f GDPR (legitimate interest). The legitimate interest of the operator shall be to optimise the website’s design.

The provision of data is required to access the operator’s website without encountering errors. Not accepting cookies or deleting cookies that have already been set may limit the functionality of the website.

2.5 Use of tracking tools

2.5.1 Google Analytics

The operator uses Google Analytics, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which uses the cookies described above to collect information about your visit to the operator’s website, including your operating system, your browser, your IP address, the website you previously visited and the date and time of your visit. The information generated by the cookies about your use of the website shall be transmitted to and stored by Google on servers in Ireland. If required, the data may also be transmitted to the USA.

Your personal data shall be transmitted to Google in accordance with the standard data protection clauses set out in Art. 46 (2) lit. c GDPR, which was adopted by the European Commission pursuant to Art. 93 (2) GDPR. You can find information on the standard data protection clauses on the European Commission website (https://ec.europa.eu/info/index_en).

You can find further information on data protection at Google here.

Google shall use this information to analyse your use of the website, compile reports on website activity for the operator and provide other services related to website and Internet use. If required by law or if third parties process this data on behalf of Google, Google shall also disclose this information to these third parties. This data shall be anonymised or pseudonymised for this purpose. You can find out more on the Google website at https://policies.google.com/privacy.

Google Analytics shall not store any direct personal data, only the Internet protocol (IP) address. Google uses this information to automatically recognise you the next time you visit the operator’s website and to make browsing the website easier for you.

The legitimacy of this processing shall be in compliance with Art. 6 (1) lit. a GDPR (consent).

The personal data collected within the scope of use of the tracking tools shall be erased unless the controller has a legitimate interest for its further retention. In any case, only that data that is absolutely necessary to achieve the corresponding purpose shall continue to be stored. Personal data shall be anonymised wherever possible.

The provision of data is neither legally nor contractually required. Failure to provide data means that Google Analytics cannot be used.

2.5.2 Use of Adform

The operator uses cookie matching provided by Adform on the operator’s website to display advertisements that are relevant for you when visiting the website. For this purpose, identifiers are collected and compared to one another. This comparison enables the website operator to identify whether relevant advertising content should be displayed when you visit the website and if so which. The following information concerning you is collected for the purpose of cookie matching:

  • cookie ID,
  • mobile advertising ID,
  • cross-device ID,
  • partner ID,
  • information about the operating system you are using,
  • information about cookie IDs and other identifiers associated with a user device,
  • IP address,
  • information about website interaction, such as time of retrieval, and
  • approximate geographical location (city, region, postcode).

The legal basis for the processing of personal data using Adform’s cookie matching shall be Art. 6 (1) lit. f GDPR (legitimate interest). The website operator wishes to ensure that only relevant advertising content is displayed to you. The operator also wishes to analyse which advertising content is relevant to website visitors in the first place. Insights gained are largely collected pseudonymously. The website operator is not in a position to associate the insights gained from Adform with a specific person.

You can object to the processing of personal data by Adform here: https://site.adform.com/privacy-center/platform-privacy/opt-out/.

The provision of your personal data is required to display relevant advertising content but is neither legally nor contractually required.

The data collected by Adform is stored for a maximum of 60 days and then anonymised or erased.

2.6 reCAPTCHA

The Google reCAPTCHA service, which is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, is integrated into the forms on the website. This is used to improve the security of the website and distinguish between a natural person and a machine when data is entered. For this purpose, personal data such as your IP address is collected and transmitted to Google in Ireland. If required, the data may also be transferred to the USA.

Your personal data shall be transmitted to Google in accordance with the standard data protection clauses set out in Art. 46 (2) lit. c GDPR, which was adopted by the European Commission pursuant to Art. 93 (2) GDPR. You can find information on the standard data protection clauses on the European Commission website (https://ec.europa.eu/info/index_en).

You can find further information on data protection at Google here.

You can find further information related to this in Google’s Terms of Service and Privacy Policy.

The legitimacy of this processing shall be in compliance with Art. 6 (1) lit. f GDPR (legitimate interest). The use for website security purposes shall constitute a legitimate interest of the operator pursuant to Art. 6 (1) lit. f GDPR.

The provision of data is required neither for legal purposes nor for the purpose of entering into a contract. Failure to provide the data means that you shall not be able to use the corresponding forms.

The operator does not store any personal data collected in connection with the reCAPTCHA integration. The personal data collected by Google shall be erased unless Google has a legitimate interest for its further retention. In any case, only that data that is absolutely necessary to achieve the corresponding purpose shall continue to be stored. Personal data shall be anonymised wherever possible. The data shall be stored by Google in accordance with the provisions of its own Privacy Policy. You can find further information related to this in Google’s Terms of Service and Privacy Policy.

2.7 YouTube

The operator uses YouTube videos on the website. YouTube is a service provided by YouTube LLC (‘YouTube’), 901 Cherry Ave., San Bruno, CA 94066, USA. YouTube is a subsidiary of Google Ireland Limited (‘Google’), Gordon House, Barrow Street, Dublin 4, Ireland.

When you visit the website, YouTube shall be informed that you have retrieved the specific subordinate page on our website. In addition, further information on the use of the website (such as the date and time of the visit, IP address, etc.) may be transmitted to Google servers (possibly in a third country such as the USA) and stored there. This shall occur regardless of whether YouTube supplies the user account with which you are logged in or whether no such user account exists.

Your personal data shall be transmitted to Google in accordance with the standard data protection clauses set out in Art. 46 (2) lit. c GDPR, which was adopted by the European Commission pursuant to Art. 93 (2) GDPR. You can find information on the standard data protection clauses on the European Commission website (https://ec.europa.eu/info/index_en).

You can find further information on data protection at YouTube here.

Google shall use the data for the purposes of advertising, market research and/or the needs-based design of its website. This may also involve creating a link to your user account if you are logged in to the service. If you do not wish this to happen, you must log out before using the website. Google’s Terms of Service and Privacy Policy shall apply.

The operator uses YouTube videos to provide you with videos on various topics. The legitimacy of this processing shall be in compliance with Art. 6 (1) lit. f GDPR (legitimate interest). The use of data for the purpose of providing videos to illustrate our services and products shall constitute a legitimate interest pursuant to Art. 6 (1) lit. f GDPR. The operator shall exclusively embed videos in the website in Privacy Enhanced Mode to prevent automatic transmission of the data to Google when the page in which the video is embedded is accessed.

The provision of data is required neither for legal purposes nor for the purpose of entering into a contract. Failure to provide the data means that you shall not be able to use our website at all or to its full extent.

You can find further information on the purpose and scope of data collection and processing by YouTube in Google’s Terms of Service and Privacy Policy.

2.8 Competitions

The operator shall regularly conduct competitions in which participants must provide the following minimum data:

  • standard personal data (surname, name, title),
  • address data (street address, place of residence) and
  • email address.

The required participation data shall only be used to conduct and process the competitions. Participation in some competitions may also require free registration. For this purpose, participants must also enter a password of their choice.

In addition, you may also complete registration for some competitions by way of the Facebook Connect service. For this purpose, the participant would require a Facebook profile. Participants who click the ‘Log in with Facebook’ button shall be redirected to Facebook where they can log in using their Facebook account. In the course of this process, a link is created to the participant’s Facebook profile and the participant’s name, surname and email address are automatically transmitted to the operator. This data is absolutely necessary to conduct and process the competition. Facebook also forwards information that is publicly available on the participant’s profile to the operator (full [Facebook profile] name, user ID, age, gender, profile picture and friends list). However, the operator shall neither store nor otherwise use this information.

Once the competition has ended, the operator shall erase the participants’ data. You can find further information on Facebook Connect and the privacy settings for the Facebook profile in Facebook’s Data Policy and Terms of Service.

The legitimacy of this processing shall be in compliance with Art. 6 (1) lit. f GDPR (legitimate interest). The use of data for the purpose of conducting a competition shall constitute a legitimate interest of the operator pursuant to Art. 6 (1) lit. f GDPR. The operator wishes to reward its users and advertise the operator’s services in return. The provision of your data is not mandatory but voluntary. Failure to provide the data means that you shall not be able to enter the competition.

If we transfer your data to cooperation partners for the purpose of a competition, this shall be done on the basis of  Art. 6 (1) lit. a GDPR (consent).

The data processed for the purpose of participation in the competition shall be deleted once the competition has ended and there are no longer any legal obligations to retain the data.

2.9 Bookings

You can book accommodation at various establishments on the website. For this purpose, you must provide the following data:

  • standard personal data (surname, name),
  • address data (street address, place of residence) and
  • contact details (telephone, email address).

Your data shall be used to process your booking and shall be disclosed to the accommodation establishment accordingly.

The legitimacy of this processing shall be in compliance with Art. 6 (1) lit. b GDPR (performance of the contract).

The legitimacy of this processing shall also be in compliance with Art. 6 (1) lit. f GDPR (legitimate interest). The legitimate interest shall be to provide a booking system for various event organisers and third-party providers. The provision of your data is required to process a contract. Failure to do so means that you shall not be able to make a booking.

The personal data processed for the purpose of bookings and processing contracts shall be erased upon expiry of the legal retention obligations (in particular, the German Commercial Code [HGB] and Fiscal Code [AO]) unless the controller has a legitimate interest for its further retention.

2.10 Outdooractive

We reproduce content from the www.tourenplaner-rheinland-pfalz.de website by way of an interface to service provider Outdooractive GmbH & Co. KG (hereinafter ‘Outdooractive’) on the website. Outdooractive provides electronic databases in the form of an electronic information portal in the digital tourism sector, which you can use. This includes map and route planning.

Outdooractive shall independently process the following data to make the databases available to you:

  • IP address,
  • date and time of the request,
  • difference in time zone from Greenwich Mean Time (GMT),
  • content related to the request (specific page),
  • access status and HTTP response status code,
  • amount of data transmitted in each case,
  • referrer URL (the URL from which you accessed the database),
  • browser,
  • user’s location,
  • operating system and the relevant interface, and
  • browser language and version.

This data is technically necessary to display the electronic databases and ensure stability and security. The legitimacy of this processing shall be in compliance with Art. 6 (1) lit. f GDPR (legitimate interest). The commercial interest of the controller shall be to provide a travel database. The provision of data is voluntary but necessary to use the features provided.

Outdooractive uses cookies that are stored on your device for analytical purposes. Outdooractive stores information collected in this manner on servers in Germany as well as in third countries. You can change the settings for analysis by deleting existing cookies and disabling cookies. If you disable cookies, please be advised that you may be unable to make full use of Outdooractive’s electronic databases. You can disable cookies through your browser’s settings. Outdooractive shall continue to use your GPS data when you use the electronic databases.

The operator has no influence on the collected data and data processing procedures, and has not been informed of the full extent of the data collection, the purposes of data processing and the storage periods. The operator has also not been informed on the erasure of the data collected by Outdooractive.

Outdooractive stores the data collected concerning you as use profiles, which it then uses for its own purposes of market research and/or the needs-based design of its electronic databases. You shall have the right to object to the creation of these user profiles. You must contact Outdooractive to exercise this right.

You can find further information on the purpose and extent of the collection and processing of data by Outdooractive at: Outdooractive GmbH & Co. KG, Missener Strasse 18, 87509 Immenstadt, and in their privacy policy:

https://corporate.outdooractive.com/en/privacy-policy and

https://www.outdooractive.com/en/privacy.html.

2.11 Social plug-ins

The operator uses a number of social plug-ins from various social networks for the purposes of networking, sharing and interacting.

The plug-ins are disabled by default and therefore do not transmit any data to other websites. You can enable a plug-in by clicking the respective button (Shariff solution).

If these plug-ins are enabled, your browser establishes a direct connection to the servers of the respective social network as soon as you access the operator’s website. Plug-in content is then transmitted directly to your browser and integrated into the website by the respective social network.

By integrating the plug-ins, the social network shall be informed that you have accessed the corresponding web page of the operator. If you are logged in to the social network, it can associate the visit to your account. When you interact with plug-ins, your browser directly transmits the corresponding information to the social network, where it is stored.

You can find further information on the purpose and extent of the collection, processing and use of data by social networks, as well as your rights in this regard and the available options for protecting your privacy in the privacy policy of the respective network.

If you do not wish social networks to collect data concerning you when you access the operator’s website, you must log out of these networks or disable social plug-ins before visiting our website.

Websites for which social plug-ins are enabled can transmit data to social networks even if you are not logged in to the social networks. When a plug-in is enabled, it sets a cookie with an identifier each time the website is accessed. In principle, since your browser transmits this cookie unsolicitedly every time you connect to a network server, the network could use it to create a profile of the websites the user associated with the identifier has accessed. And it would then also be quite possible to associate this identifier with a person, for example, when subsequently logging in to the social network. The social media used are Facebook and Twitter.

The legitimacy of this processing shall be in compliance with Art. 6 (1) lit. a GDPR (consent). The provision of your data is not mandatory.

2.12 Deskline brochure orders

The website on web4.deskline.net/rlpinfo/en/brochure/list enables you to order the controller’s brochures. For this purpose, you must provide the following data:

  • standard personal data,
  • address data and
  • email address.

Additional data is optional.

The legitimacy of this processing shall be in compliance with Art. 6 (1) lit. b GDPR (contract or pre-contractual provision). The provision of your data is required to process an order. Failure to do so means that you shall not be able to place an order.

The data shall be stored until the purpose shall no longer apply and there are no legal obligations to retain the data that prevent its erasure.

3. Rights of the data subject

You shall have a right of access (Art. 15 GDPR), a right to rectification (Art. 16 GDPR), a right to erasure (Art. 17 GDPR), a right to restriction of processing (Art. 18 GDPR) and a right to data portability (Art. 20 GDPR). We shall make every effort to process enquiries promptly.

If your personal data is processed on the basis of Art. 6 (1) lit. f GDPR, you shall have the right to object if there are grounds for doing so relating to your particular situation or if you object to direct marketing (Art. 21 GDPR). If you object to direct marketing, we shall refrain from sending you promotional material.

4. Withdrawal of your consent

If you have consented to the processing of your personal data and withdraw this consent, the processing carried out up to the time of withdrawal of consent shall remain unaffected.

5. Right to lodge a complaint

You shall have the right to lodge a complaint with a supervisory authority at any time.

6. Recipients

The data collected when you visit and use the website, and the information you provide when you engage with the operator shall be transmitted to the operator’s server and stored there. Otherwise, your data may be transferred to the following categories of recipients:

  • internal departments involved in the processing of your personal data (such as the marketing, customer care and bookings departments),
  • commissioned data processors (such as data centres, IT service providers, tracking tool providers and software providers) and
  • contractual partners of the operator (such as shipping service providers, hotels, organisers and cooperation partners).

7. Links to third-party websites

Content that is linked to third-party websites may be displayed when you visit the website. The operator can neither access the cookies or other features set by third-party sites, nor control them. Such third-party websites shall not be subject to the provisions of the operator’s privacy policy.