1. We are responsible for your data
(1) As a visitor to www.naturgesund-bw.de, you can expect not only tourist highlights, but also a high level of quality in the processing of your personal data. We are responsible for the handling of your data, which we process in accordance with your wishes and the provisions of German and EU data protection laws. Your personal data will only be processed by us if this is permitted by law or if you have given your prior consent.
(2) We are
HKM Heilbäder und Kurorte Marketing GmbH Baden-Württemberg
Represented by the Managing Director Arne Mellert
Esslinger Straße 8,
70182 Stuttgart
Telephone 0711 89 24 80 00
Fax 0711 89248020 info@heilbaeder-bw.de
hereinafter referred to as “we”.
(3) Transparent and lawful processing of your data is of great importance to us. Therefore, the following information should enable you to find out at any time which personal data is collected during your visit to our website and when using our services and offers and how we process your data.
2. which personal data is processed?
3. What is your data processed for, how long is it processed for and on what legal basis?
a. Contact requests
(1) We process your data to respond to your contact requests either directly through service providers or by transmitting them to the respective service provider (accommodation host, leisure offer provider, etc.).
(2) The communication of address data or telecommunications data is necessary in order to process your request and to be able to respond to it via the desired communication channel. The legal basis for this is Art. 6 para. 1 f of the EU General Data Protection Regulation (GDPR).
(3) As a rule, we store the information from your contact request for a further six months after answering the request in the event of further inquiries, unless it has to be stored for longer due to statutory retention obligations.
b. Brochure and catalog orders
(1) We process your data to answer and ship your order either directly or through contracted service providers. Where data is marked as mandatory, it is required for processing or handling the order.
(2) The legal basis for this is Art. 6 para. 1 f of the EU General Data Protection Regulation (GDPR).
(3) We and, if applicable, the respective service provider will process the information from your order request until the order is dispatched. Your data will be deleted after dispatch.
c. Booking-related inquiries
(1) In the case of a booking-related inquiry, we process your personal data (address data, telecommunications data) to process the inquiry and forward your inquiry to the selected service provider(s) that offer(s) suitable offers for the booking-related inquiry. Where data is marked as mandatory, it is required for processing the request.
(2) The legal basis is Art. 6 para. 1 b GDPR.
(3) After answering or forwarding your booking-related request, we will delete your data.
d. E-mail newsletter
a) If you would like to use the contact form provided on the website to get in touch with us, we require the data requested in the form in order to respond to your inquiry. Some data is only collected on a voluntary basis. We use this data exclusively for processing your inquiry and do not pass this data on to third parties. The data entered in the contact form is processed exclusively on the basis of your consent (Art. 6 para. 1 lit. a GDPR).
You can revoke your consent to the storage of data at any time. The legality of the data processing operations that have already taken place remains unaffected by the revocation. The data you provide us with for the purpose of contacting you will be stored by us until you request us to delete it or until legal deadlines permit or require us to delete it.
b) This website uses the CRM software CentralStationCRM to store and process your contact details. The provider is 42he GmbH, Marktstraße 10, Building E8, 50968 Cologne, Germany. CentralStationCRM is a service with which, among other things, customers can be organized and supported. The data you enter for the purpose of contacting us is stored on CentralStationCRM's servers in Germany. If you do not want any further processing by CentralStationCRM, you must inform the operator of this website after you have contacted us.
With the help of CentralStationCRM, we are able to better organize the inquiries via our website and respond to them more quickly. CentralStationCRM also enables us to better group our customers and contacts. This allows us to work in a more targeted manner in sales and marketing.
c) The data processing is based on your consent (Art. 6 para. 1 lit. a GDPR). You can withdraw this consent at any time. The legality of the data processing operations that have already taken place remains unaffected by the revocation.
d) The data you provide us with for the purpose of contacting us will be stored by us until this data is deleted by us. For more information, please refer to the data protection provisions of CentralStationCRM at: https://centralstationcrm.net/www/privacy .
e) We have concluded a contract with CentralStationCRM in which we oblige CentralStationCRM to protect our customers' data and not to pass it on to third parties. This contract can be viewed at the following link: https://centralstationcrm.de/avv
f) Analysis tools and advertising We use "Google reCAPTCHA" (hereinafter "reCAPTCHA") on our websites. The provider is Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"). The purpose of reCAPTCHA is to check whether the data input on our websites (e.g. in a contact form) is made by a human or by an automated program. For this purpose, reCAPTCHA analyzes the behavior of the website visitor based on various characteristics. This analysis begins automatically as soon as the website visitor enters the website. For the analysis, reCAPTCHA evaluates various information (e.g. IP address, time spent on the website by the website visitor or mouse movements made by the user). The data collected during the analysis is forwarded to Google. The reCAPTCHA analyses run completely in the background. Website visitors are not informed that an analysis is taking place. Data processing is carried out on the basis of Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in protecting its website from abusive automated spying and SPAM. Further information about Google reCAPTCHA and Google's privacy policy can be found at the following links: https://www.google.com/intl/de/policies/privacy and https://www.google.com/recaptcha/intro/android.html.
4. ensuring system security
(1) Each time a user accesses a page from our website, data about this service provider process is temporarily stored and processed in a log file (Art. 6 Para. 1 f GDPR). This is:
Category or type, name and URL of the file accessed,
Date and time of access, amount of data transferred,
Notification as to whether the access was successful,
The access method/function requested by the requesting computer,
A description of the type of web browser used with further information about the system,
IP address, website from which access is made.
(2) The temporary storage of this so-called server log data is necessary for technical reasons to provide the service and subsequently to ensure system security. The data will be anonymized after seven days at the latest by shortening the IP address, provided that there are no abnormalities that indicate possible system errors, attempts at unauthorized access or other hacker attacks and that longer storage is necessary for further clarification, technical elimination of the problems and/or legal prosecution. Any other evaluation of this data is carried out anonymously for statistical purposes.
(3) The legal basis for this is our legitimate interest in the user-friendliness of our website, ensuring its functions and the security of our offering, Art. 6 Para. 1 f GDPR.
5 We work together with service providers
(1) Our service providers include IT service providers, file and internet hosters, printers and lettershops. We have concluded an order processing contract with them in accordance with the requirements of Art. 28 GDPR. Our service providers are prohibited from processing your data for purposes other than for the specific order. (2) If we process data with service providers as joint controllers, this is done in accordance with a contractual agreement pursuant to Art. 26 GDPR.
6 How secure is your data?
7 How can you exercise your data protection rights?
If you have any questions about the processing of your personal data by us, we will of course be happy to provide you with information about the data concerning you (Art. 15 GDPR). If the legal requirements are met, you also have the right to rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and objection (Art. 21 GDPR). You also have the right to data portability (Art. 20 GDPR). In all these cases, please contact our data protection officer at the above-mentioned communication addresses. Finally, you have the right to lodge a complaint with a competent data protection supervisory authority (Art. 77 GDPR, Section 19 BDSG).
8. Right of objection and revocation at any time
(1) You can revoke your consent at any time without giving reasons for the future.
(2) You have the right to object to the processing of your data at any time for reasons arising from your particular situation, provided that the legal requirements are met.
(3) If you object to the processing of your data for advertising purposes or would like to revoke your consent, a short message to info@heilbaeder-bw.de or by post to HKM Heilbäder und Kurorte Marketing GmbH, Esslinger Straße 8., 70182 Stuttgart is sufficient.
(4) You can unsubscribe from the e-mail newsletter particularly easily using the unsubscribe link in the newsletter. Your data will then no longer be processed for corresponding advertising purposes.
(5) The legality of the processing carried out up to the time of objection or revocation remains unaffected.
(6) After you object to the processing of your personal data for advertising purposes or withdraw your consent, we are obliged under data protection law in accordance with the requirements of the German data protection supervisory authorities to include the data required for this (name, address, email address) in our internal advertising block list and to store it permanently - only for this purpose - (to block) and to use it to compare it with our future advertising files (Art. 21 Para. 3, Art. 17 Para. 3 b, Art. 6 Para. 1 c, f GDPR). This ensures that your objection to advertising or withdrawal of your consent is permanently observed.
9. Cookies and tracking
a. Cookies
“Cookies” are small files that are sent to your device (e.g. computer, smartphone) via your web browser or other programs. These cookies are stored locally on your device and kept ready for later retrieval. We use cookies on our website to evaluate visits to our website (web tracking) so that we can adapt our website to your needs and make it user-friendly (legal basis Art. 6 Para. 1 a, 7 GDPR) and to recognize your consent or refusal to set cookies (legal basis Art. 6 Para. 1 f GDPR).
b. Rejection/deletion of cookies
(1) Without your consent, only technically necessary cookies will be set. You will be informed of this in our banner on the homepage.
(2) You can set your web browser so that it notifies you when cookies are set or generally rejects cookies or restricts their setting. However, if you deactivate or restrict the setting of cookies using your browser, various functions on our website will no longer be available to you. You can delete stored cookies at any time using your web browser, including automatically.
(3) You can find out about this option for the most commonly used browsers via the following links:
Explorer: https://support.microsoft.com/de-de/help/17442/windows-internet-explorer-deletemanage-cookies
Firefox: http://support.mozilla.org/de/kb/cookies-informationen-websites-auf-ihrem-computer Google
Chrome: http://support.google.com/chrome/bin/answer.py?hl=de&answer=95647
Safari: https://support.apple.com/kb/ph21411?locale=de_DE
Opera: http://help.opera.com/Linux/12.10/de/cookies.html
(4) Unless you have made or make any different settings, cookies designed to enable and ensure the necessary technical functions will remain on your device until you close your browser; other cookies may remain on your device for longer (see c. below).
c. Tracking with Google Analytics
This website uses Google Analytics, a web analysis service provided by our service provider Google Inc., USA (Art. 6 Para. 1 a GDPR), with your consent, which can be revoked at any time in the future (see below d.). Google uses cookies to enable an analysis of your use of the website. The information collected through the cookies is usually transferred to a Google server in the USA and stored there. By activating IP anonymization on our website, your IP address transmitted at the same time will be shortened beforehand by Google within member states of the European Union or in other contracting states to the Agreement on the European Economic Area and thus anonymized. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. On our behalf, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide us with other services related to website activity and internet usage. Google cookies remain stored on your device for 90 days. You can prevent the collection of data determined by the cookie and related to your use of the website (including your shortened IP address) as well as the processing of this data by Google by not giving your consent (see d.) or by downloading and installing the browser add-on available under the following link: https://tools.google.com/dlpage/gaoptout?hl=de
Disable Google Analytics
d. Consent
e. Web analysis using etracker
(1) On our website we use the services of etracker GmbH from Hamburg, Germany (www.etracker.com) to analyse usage data. We do not use cookies for web analysis.
(2) The data generated with etracker is processed and stored by etracker on behalf of the provider of this website exclusively in Germany. Data that may be related to an individual, such as the IP address, login or device identifiers, are anonymised or pseudonymised as soon as possible. There is no other use, merging with other data or passing on to third parties.
(3) The data processing is carried out on the basis of Art. 6 Para. 1 lit. f GDPR because we have a legitimate interest in optimising our online offer and our website.
(4) You can object to this data processing at any time at info@heilbaeder-bw.de. The objection has no adverse consequences. You can find more information on data protection at etracker here.
10. Presence in social networks (social media)
(1) We maintain online presences within social networks (Facebook and Instagram) and process user data in this context in order to communicate with users active there or to offer information about us. We link to these online presences on our website.
(2) Please note the following: As far as we know, user data during activities within social networks is usually processed by the network operators for market research and advertising purposes. For example, user profiles can be created based on user behavior and the resulting interests. The user profiles can in turn be used, for example, to place advertisements within and outside the networks that presumably correspond to the interests of the users. For these purposes, cookies are usually stored on users' computers in which the user behavior and interests of the users are stored. Furthermore, data can also be stored in the user profiles regardless of the devices used by the users (especially if the users are members of the respective platforms and are logged in to them).
(3) For a detailed description of the respective processing methods and the objection options (opt-out), we refer to the data protection declarations and information of the operators of the respective networks. In the case of requests for information and the assertion of data subject rights, we would also like to point out that these can be asserted most effectively with the providers. Only the providers have access to the users' data and can take appropriate measures and provide information directly. If you still need help, you can contact us.
(4) As part of the communication with users on our presence in social networks, we ourselves only process their names and the other voluntarily provided information exclusively for communication with the users. The legal basis is our legitimate interest in communicating with users in accordance with Art. 6 Para. 1 f GDPR.
(5) Further information about Instagram, service provider Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA, can be found on the website: https://www.instagram.com and in the privacy policy at https://instagram.com/about/legal/privacy.
(6) Further information about Facebook, service provider Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, parent company Facebook, 1 Hacker Way, Menlo Park, CA 94025, USA, can be found on the website https://www.facebook.com and in the privacy policy https://www.facebook.com/about/privacy and at https://www.facebook.com/legal/terms/information_about_page_insights_data. For information on opting out and settings for advertisements, please visit https://www.facebook.com/settings?tab=ads. Information on the agreement on joint processing of personal data can be found at https://www.facebook.com/legal/terms/page_controller_addendum.
11. Plugins and embedded functions and content
(1) We integrate functions (YouTube, Google Maps) into our online offering that are obtained from the servers of their respective providers.
(2) The integration always requires that the provider of this function processes the IP addresses of the users, since without the IP address they would not be able to send the content to their browser. The IP address is therefore required to display these functions.
(3) If we ask users for their consent to use the function (YouTube), the legal basis for the processing of data is Art. 6 Para. 1 a, 7 GDPR. Otherwise, user data is processed on the basis of our legitimate interests (i.e. interest in efficient, economical and recipient-friendly services) in accordance with Art. 6 Para. 1 f GDPR.
(4) Further information on YouTube videos: The service provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Information can be found on the website at https://www.youtube.com and in the privacy policy https://policies.google.com/privacy. The option to object and the opt-out plug-in can be found at https://tools.google.com/dlpage/gaoptout?hl=de, settings for the display of advertisements: https://adssettings.google.com/authenticated.
(5) Further information on Google Maps: Service provider Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; information can be found on the website at https://cloud.google.com/maps-platform and in the privacy policy, available at https://policies.google.com/privacy. The option to object (opt-out) and the opt-out plug-in can be found at https://tools.google.com/dlpage/gaoptout?hl=de. You can view and change settings for the display of advertisements at https://adssettings.google.com/authenticated.
(6) The data processed may include, in particular, IP addresses and location data of users, which, however, are not collected without their consent (usually carried out as part of the settings on their mobile devices).
12. Cookie banner
13. mein.toubiz
We use the plugin mein.toubiz #elements from the provider land in sicht AG (Wiesentalstr. 5, 79115 Freiburg; hereinafter referred to as “mein.toubiz”) on our website to make our online offer more quickly accessible. This plugin displays database contents, for which the so-called cookies are technically necessary. Data collected is: IP address, referrer URL, device information, interactions with the plug-in. The data is deleted as soon as it is no longer required for processing purposes. The legal basis for processing is Art. 6 Paragraph 1 Clause 1 Letter f) of GDPR. By using “mein.toubiz”, we pursue the legitimate interest of faster accessibility and a more effective and improved presentation of our online offer. Further information on data protection and the storage period at “mein.toubiz” can be found at: https://mein.toubiz.de/datenschutz.
You can object to the processing if it is based on Art. 6 Paragraph 1 Clause 1 Letter f) of GDPR. You have the right to object for reasons arising from your particular situation. You can send us your objection using the contact details provided in the "Responsible Person" section.
14. Changes
From time to time it is necessary to adapt the content of this privacy policy. We therefore reserve the right to change this content at any time in the future. We will also publish the amended version of the privacy policy here. If you visit us again, you should therefore read the privacy policy again.
As of: 19 December 2023
EN 
DE 
FR