Data protection

5.2. TDDDG

The legal basis for the storage of cookies, device identifiers, similar tracking technologies, and the storage of information on the user's device and access to this information is the European ePrivacy Directive in conjunction with the Telecommunications and Telemedia Data Protection Act (TDDDG).

Please note that the legal basis for the processing of personal data collected in this context is derived from the GDPR (Art. 6(1) sentence 1 of the GDPR). The specific legal basis for the processing of personal data can be found below each respective cookie or processing.

The primary legal basis for the storage of information on the user's device, particularly for the storage of cookies, is your consent under § 25(1) sentence 1 of the TDDDG. Consent is given when visiting our website, although it is not mandatory, and can be revoked at any time in the cookie settings.

According to § 25(2) no. 2 of the TDDDG, consent is not required when the storage of information on the user's device or access to information already stored on the user's device is strictly necessary for the provider of a telemedia service to provide a telemedia service explicitly requested by the user. You can check the cookie settings to see which cookies are classified as strictly necessary (often referred to as "technically necessary cookies"), fall under the exception of § 25(2) TDDDG, and therefore do not require consent.

6. Your Rights / Data Subject's Rights

6.1. Right to Information

You have the right to obtain information from us as the data controller about whether and which personal data concerning you is being processed by us, as well as further information in accordance with the legal requirements under Art. 13 and 14 of the GDPR.

You can exercise your right to information by contacting: datenschutz@spielbank-bad-neuenahr.de

6.2. Right to Rectification

If the personal data concerning you processed by us is incorrect or incomplete, you have the right to have it rectified and/or completed. Rectification will be carried out without undue delay.

6.3. Right to Restriction

You have the right to restrict the processing of your personal data in accordance with the legal provisions (Art. 18 of the GDPR).

6.4. Right to Erasure

Subject to the conditions set out in Art. 17 of the GDPR, you may request the immediate erasure of personal data concerning you.

We would like to inform you that the right to erasure does not exist to the extent that processing is necessary for one of the exceptions specified in Art. 17(3).

6.5. Right to be Informed

If you have exercised your right to rectification, erasure, or restriction of processing, we are obligated to inform all recipients to whom the personal data concerning you has been disclosed about such rectification or erasure of data or restriction of processing, unless this proves impossible or involves a disproportionate effort. Furthermore, you have the right to be informed about these recipients.

6.6. Right to Data Portability

According to the GDPR, you also have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format, or to request the transmission of such data to another controller.

6.7. Right to Withdraw Consent

You have the right to withdraw your consent to data protection at any time. Please note that the withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

6.8. Right to Object

Furthermore, you have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you which is based on Article 6(1)(e) or (f) of the GDPR.

6.9. Automated Individual Decision-Making, Including Profiling

Under the EU General Data Protection Regulation, you also have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

6.10. Right to Lodge a Complaint with a Supervisory Authority

If you believe that the processing of personal data concerning you infringes the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or the place of the alleged infringement.

7. Transfer of Data Outside the EU

The GDPR ensures an equally high level of data protection within the European Union. Therefore, when selecting our service providers, we prefer European partners wherever possible if your personal data is to be processed. Only in exceptional cases will we have your data processed outside the European Union when using services from third parties. We will only allow processing of your data in a third country if the specific requirements of Articles 44 onwards of the GDPR are fulfilled. This means that the processing of your data may only take place on the basis of special safeguards, such as an officially recognized determination of a level of data protection equivalent to that of the EU by the European Commission or the adherence to officially recognized specific contractual obligations, known as "standard data protection clauses."

EU-US Trans-Atlantic Data Privacy Framework

Within the framework of the so-called "Data Privacy Framework" (DPF), the EU Com-mission
has also recognized the level of data protection for certain companies from the U.S. as safe
within the framework of the adequacy decision of 10.07.2023. The list of certified companies
as well as further information on the DPF can be found on the website of the U.S.
Department of Commerce at https://www.dataprivacyframework.gov/s/participant-search.

8. Newsletter

8.1. General

You can subscribe to a free newsletter on our website, which will inform you about our current interesting offers. The advertised goods and services are specified in the consent declaration. The data you enter in the input mask during registration will be transmitted to us.

Based on your consent obtained during the registration process, we collect the following data:

- Last name, first name, email address
- Furthermore, the following data will be stored at the time of transmission:
- IP address of the accessing computer, date and time of registration.

Your data will not be disclosed in connection with the processing of data for newsletter dispatch. The data will be used exclusively for the purpose of sending the newsletter.

8.2. Double Opt-In and Logging

The registration for our newsletter takes place in a double opt-in process. After registration, you will receive an email asking you to confirm your registration. This confirmation is necessary to prevent someone else from registering with your email address.

The newsletter registrations are logged in order to be able to provide evidence of the registration process in accordance with legal requirements. This includes storing the time of registration and confirmation, as well as the IP address.

8.3. Legal Basis

The legal basis for processing the data, if the user has given their consent, is Art. 6(1)(a) of the GDPR. The collection of the user's email address is for the purpose of delivering the newsletter.

8.4. Deletion, Withdrawal, and Objection

Your data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. Your email address will be stored as long as the newsletter subscription is active. You can unsubscribe from the newsletter at any time by withdrawing your consent. Each newsletter contains a corresponding link for this purpose.

Furthermore, we would like to inform you that you can object to the future processing of your personal data in accordance with the legal requirements of Art. 21 of the GDPR at any time. The objection can be made, in particular, against processing for direct marketing purposes.

8.5. Mailing Service Provider

8.5.1. Sendinblue

This website uses Sendinblue for the purpose of sending newsletters. The provider is Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany.

Sendinblue is a service that can be used to organize and analyze the sending of newsletters, among other things. The data you enter for the purpose of subscribing to the newsletter will be stored on Sendinblue's servers in Germany.

Data analysis by Sendinblue

With the help of Sendinblue, we are able to analyze our newsletter campaigns. For example, we can see if a newsletter message has been opened and which links have been clicked. This allows us to determine which links have been clicked most frequently.

In addition, we can determine if certain predefined actions (conversion rate) have been taken after opening/clicking, such as making a purchase after clicking the newsletter. 

Sendinblue also allows us to segment the newsletter recipients into different categories ("clustering"). For example, newsletter recipients can be segmented based on age, gender, or location. This allows us to better tailor the newsletters to the respective target audiences.

If you do not want your data to be analyzed by Sendinblue, you must unsubscribe from the newsletter. We provide a corresponding link in each newsletter message for this purpose.

For detailed information about the functions of Sendinblue, please refer to the following link: https://de.sendinblue.com/newsletter-software/.

Legal basis

The data processing is based on your consent (Art. 6(1)(a) GDPR). You can revoke this consent at any time. The revocation does not affect the lawfulness of the data processing carried out before the revocation.

Storage period

The data you provide for the purpose of subscribing to the newsletter will be stored by us until you unsubscribe from the newsletter or until we or the newsletter service provider delete your data from the newsletter distribution list after unsubscribing. Data that has been stored for other purposes with us remains unaffected.

After you have been unsubscribed from the newsletter distribution list, your email address may be stored by us or the newsletter service provider in a blacklist to prevent future mailings. The data from the blacklist will only be used for this purpose and will not be merged with other data. This serves both your interest and our interest in complying with the legal requirements for sending newsletters (legitimate interest within the meaning of Art. 6(1)(f) GDPR). The storage in the blacklist is not time-limited. You can object to the storage if your interests outweigh our legitimate interest.

For more information, please refer to Sendinblue's privacy policy at: https://de.sendinblue.com/datenschutz-uebersicht/.

Conclusion of a contract for order processing

We have concluded a contract with Sendinblue in which we obligate Sendinblue to protect the data of our customers and not to disclose it to third parties.

9. Electronic contact 

If you want to contact us, you have the option to contact us via the provided email address. In this case, the personal data of the user transmitted with the email will be stored.

Your data will not be disclosed to third parties in this context, and the data will be used solely for the purpose of processing the communication.

The legal basis for processing the contact request and its processing is typically Art. 6(1)(b) GDPR.

If additional personal data is processed during the sending process, it serves only to prevent misuse of the contact form and to ensure the security of our information technology systems.

Your data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. For the personal data from the input mask of the contact form and those sent by email, this is the case when the respective conversation with the user has ended. The conversation is deemed to be ended when it can be inferred from the circumstances that the matter in question has been conclusively clarified.

Any additional personal data collected during the sending process will be deleted no later than seven days after the end of the conversation.

10. Processing of data (customer and contract data)

We collect, process, and use personal data only to the extent necessary for establishing, structuring the content of, or modifying the legal relationship (inventory data). This is based on Art. 6(1)(b) GDPR, which permits the processing of data for the performance of a contract or pre-contractual measures. We only collect, process, and use personal data regarding the use of our website (usage data) to the extent necessary to enable the user to use the service or to bill the user.

The collected customer data will be deleted after the completion of the order or termination of the business relationship. Legal retention periods remain unaffected.

10.1. Online reservation

For online reservations, we use the DIRS21 web application implemented on our website by our software partner TourOnline AG, Borsigstrasse 26, 73249 Wernau, Germany (www.dirs21.de), with whom we have concluded a data processing agreement.

To process online reservations, we collect the following data:

Salutation, title, first name, last name, email address, your other messages, and if applicable, your payment details.

You can access this online reservation without the need to collect any personal data. However, certain anonymized data is stored each time you access the site, e.g. which offer was accessed. However, this data is not personal and is therefore not subject to the legal regulations of the GDPR or the BDSG.

TourOnline AG collects data about access to the online reservation and stores it as "server log files". The following data is logged:

Website visited, time of access, amount of data sent in bytes, source/reference from which you accessed the site, browser used, operating system used, IP address used

The data collected is only used for statistical evaluations and to improve the website. However, the website operator reserves the right to subsequently check the server log files if there are concrete indications of illegal use.

Anonymous data is collected solely for statistical evaluation in order to improve our offering.

Your data will not be passed on to third parties. No automated decision-making or profiling takes place.

Please also note the data protection declaration of TourOnline AG at www.dirs21.de/datenschutz.

11. Career portal

On this website, we display job offers that interested parties can apply for via email. Unsolicited applications can also be sent to us via email. In the event of an incoming application, we process the data received from the applicant solely for the purpose of processing and potentially filling the available position.

The primary legal basis for this is Art. 88 GDPR in conjunction with § 26(1) BDSG.

Within our company, only those individuals who are responsible for and have decision-making authority regarding the application process have access to your personal data.

We delete your personal data as soon as it is no longer necessary for the purposes mentioned above. If we conclude an employment contract with an applicant, the transmitted data will be stored for the purpose of processing the employment relationship in compliance with legal regulations. If no employment contract is concluded with the applicant, the application documents will be deleted no later than six months after the rejection decision is communicated, unless there are other legitimate interests of the data controller that oppose deletion. Such other legitimate interests may include, for example, an obligation to provide evidence in proceedings under the General Equal Treatment Act (AGG).

Your personal data will not be disclosed to third parties.

12. Google Consent Mode (Basic Implementation)

To obtain your consent for Google products, we use the Consent Mode from Google (Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland). This includes the following products: Google Tag Manager, Google Analytics, Google DoubleClick.

We use the basic implementation of the Consent Mode. This means that no data is sent directly to Google for the Consent Mode. Your consent will only be sent and a Google product will only be executed if you have given us your consent.

By using the Consent Mode, Google can also view the consent you have given as consent within the framework of the Digital Markets Act.

You can find more information about the Google Consent Mode directly from Google at: support.google.com/analytics/answer/9976101: or in the privacy policy at policies.google.com/privacy

12.1. Google Tag Manager

This website uses the Google Tag Manager. Google Tag Manager is a solution that allows marketers to manage website tags via one interface. The Tag Manager tool itself (which implements the tags) is a cookie-free domain and does not collect any personal data. The tool triggers other tags, which in turn may collect data. Google Tag Manager does not access this data. If deactivation has been carried out at domain or cookie level, this remains in place for all tracking tags that are implemented with Google Tag Manager.

The legal basis for the use of the technically necessary cookies is the legitimate interest of the website operator in accordance with Art. 6 Para. 1 Clause 1 Letter f of GDPR.

You can find more information in the provider's terms of use at: www.google.com/intl/de/tagmanager/use-policy.html

13. Web Analytics
13.1. Google Analytics 4

This website uses Google Analytics 4, a web analysis service provided by Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google").

The use of Google Analytics 4 enables us to use a wide range of applications. We operate Google Analytics 4 using the following technologies:

Cookies

Scripts

This stores and retrieves information on your computer that enables us to analyze your use of the website. The information generated in this way about your use of this website is usually transferred to a Google server in the USA and stored there. Your IP address is anonymized by default before being transmitted to us and Google. The full IP address is transferred to a Google server in the USA but immediately shortened there. According to Google, the IP address transmitted by your browser as part of Google Analytics is not merged with other Google data. The legal basis for the use of Google Analytics is your consent in accordance with Art. 6 Paragraph 1 Clause 1 Letter a of GDPR.

During your visit to the website, your user behavior is recorded in the form of “events”. Events can be:

Page views
First visit to the website
Start of the session
Your "click path", interaction with the website
Scrolls (every time a user scrolls to the end of the page (90%)
Clicks on external links
Internal search queries
Interaction with videos
File downloads
Ads viewed / clicked
Language setting
The following can also be recorded:

Your approximate location (region)
Your IP address (in abbreviated form)
Technical information about your browser and the devices you use (e.g. language setting, screen resolution)
Your internet provider
The referrer URL (via which website/via which advertising medium you came to this website)

On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide other services related to website and internet usage. To provide services to the website operator.

We use the User ID function. Using the User ID, we can assign a unique, permanent ID to one or more sessions (and the activities within these sessions) and analyze user behavior across devices.

We use Google Signals. This allows Google Analytics to collect additional information about users who have activated personalized ads (interests and demographic data, such as your gender or interests) and ads can be delivered to these users in cross-device remarketing campaigns.

To better understand user behavior, Google Analytics 4 uses machine learning. These algorithms help to close data gaps that arise, for example, due to tracking errors.

14. Social Media

14.1. Social Media Platforms

Facebook

Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland
Privacy Policy: https://www.facebook.com/about/privacy/
Opt-Out: https://www.facebook.com/settings?tab=ads
and http://www.youronlinechoices.com
Supplemental Agreement on Insights Data: https://www.facebook.com/legal/terms/page_controller_addendum

Instagram

Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland
Datenschutzerklärung/Opt-Out: instagram.com/about/legal/privacy/.

14.2. Social Media Presence

We maintain fan pages on various social networks and platforms with the aim of communicating with active customers, prospects, and users, and informing them about our services. We would like to point out that your personal data may be processed outside the European Union, which may pose risks to you (e.g., regarding the enforcement of your rights under European/German law). User data is typically processed for market research and advertising purposes. For example, user behavior and resulting interests can be used to create user profiles. These user profiles can then be used to display advertisements within and outside the platforms that are likely to correspond to the users' interests. For these purposes, cookies are usually stored on users' computers to store their usage behavior and interests. Furthermore, data can be stored in the user profiles regardless of the devices used by the users (particularly if the users are members of the respective platforms and logged in).

The processing of users' personal data is based on our legitimate interests in effectively informing and communicating with users pursuant to Art. 6(1)(f) of the GDPR. If users are asked by the respective providers to give their consent to data processing (i.e., give their consent, for example, by checking a checkbox or confirming a button), the legal basis for processing is Art. 6(1)(a) of the GDPR.

For further information on the processing of your personal data and your options for objection, please refer to the links provided by the respective provider. Requests for information and other rights of data subjects can also be addressed to the providers, specifically those who have direct access to users' data and possess relevant information. We are available to answer any questions and provide assistance if needed.

With some social media platforms, a supplemental agreement is concluded when operating a fan page. According to this agreement, affected rights can generally be asserted both with the social media platform and with us. However, the primary responsibility under the GDPR for the processing of insights data lies with the social media platform, and it fulfills all obligations under the GDPR regarding the processing of insights data. In this context, the social media platform provides the essential aspects of the Page Insights supplement to the affected individuals.

As the operator of the fan page, we do not make decisions regarding the processing of insights data and all other information resulting from Art. 13 of the GDPR, such as the legal basis, the identity of the controller, and the storage duration of cookies on user devices.

15. Online Advertising

15.1. Google DoubleClick

This website also uses the online marketing tool DoubleClick by Google. DoubleClick uses cookies to display relevant ads to users, improve campaign performance reports, or prevent users from seeing the same ads multiple times. Google uses a cookie ID to track which ads are shown in which browser and to prevent them from being displayed multiple times. In addition, with the help of cookie IDs, DoubleClick can record conversions related to ad requests. This is the case, for example, when a user sees a DoubleClick ad and later visits the advertiser's website with the same browser and makes a purchase. According to Google, DoubleClick cookies do not contain personally identifiable information.

Due to the marketing tools used, your browser automatically establishes a direct connection with Google's server. We have no control over the scope and further use of the data collected by Google through the use of this tool and therefore inform you to the best of our knowledge: By incorporating DoubleClick, Google receives information that you have accessed the corresponding part of our website or clicked on an ad from us. If you are registered with a Google service, Google can associate your visit with your account. Even if you are not registered with Google or have not logged in, there is a possibility that the provider will obtain and store your IP address.

You can prevent participation in this tracking procedure in various ways:

a) by adjusting your browser software accordingly, in particular by suppressing third-party cookies, you will not receive ads from third-party providers;

b) by deactivating cookies for conversion tracking by setting your browser to block cookies from the domain "www.googleadservices.com," https://www.google.de/settings/ads, with this setting being deleted when you delete your cookies;

c) by deactivating interest-based ads from providers that are part of the self-regulatory campaign "About Ads" via the link http://www.aboutads.info/choices, with this setting being deleted when you delete your cookies;

d) by permanently deactivating them in your browsers Firefox, Internet Explorer, or Google Chrome using the link http://www.google.com/settings/ads/plugin. Please note that in this case, you may not be able to use all functions of this offer to their full extent.

The legal basis for processing your data is your consent under Art. 6(1)(a) of the GDPR.

For more information about privacy at Google, please visit: http://www.google.com/intl/de/policies/privacy and https://services.google.com/sitestats/de.html.

Alternatively, you can visit the Network Advertising Initiative (NAI) website at http://www.networkadvertising.org.