data protection

As of February 2020

CONTENTS
I.         General information
II.        Person in charge
III.       Processing of personal data
            1. Processing procedures / Purpose and recipients
            1.1 Visits to the Herzogstandbahn GmbH website
            1.2 Contract conclusion
            1.3 Communication via email
            1.4 Contact form
            1.5 Newsletter
            1.6 Contact by telephone
            1.7application documents
            1.8 Profiling / Advertising
            2. Storage of personal data
            3. Retention and deletion periods
IV.       Your rights as a data subject
            1. Information, correction, deletion, blocking
            2. Enforcement
            3. Objection
            4. Data transfer
            5. Right to lodge a complaint with the supervisory authority
V.        privacy policy
           1. Contracts for order processing
           2. data protection officer
           3. employee training
           4. access regulations
VI.      Analytics services / Third-party integration
           1. General / Tracking
           2. Cookies
           3. Web Fonts
           4. Panorama Webcams
           5. Links to other websites

_____________________________________________________________________

I. General information

We are delighted that you have visited the Herzogstandbahn GmbH website. In order to keep this website informative and up to date, we cooperate with the municipality of Kochel am See by using a shared platform to provide you with a range of regional offers.

As we take the protection of your personal data very seriously, we would like to provide you with comprehensive information about how we process your data and what rights you have. To protect your privacy, we apply the EU General Data Protection Regulation (EU GDPR), the Federal Data Protection Act (BDSG), the Telemedia Act (TMG), the Telecommunications Act (TKG), and all other relevant data protection regulations and legal requirements.

We take all necessary technical and organizational measures to protect your data from loss, unauthorized access, and manipulation. In the following, we explain our data protection-compliant handling of your personal data collected when you visit our website, as well as the data we require in order to fulfill our tasks.

Due to legal regulations or new requirements, it may be necessary to change this

data protection information. Herzogstandbahn GmbH therefore reserves the right to change the data protection information at any time and to adapt it to the latest data protection regulations. Please check our website regularly for the latest version of our data protection information.

The following explanations on the implementation of data protection principles and legal provisions apply to all services provided by Herzogstandbahn GmbH.

II. Person in charge
According to Article 4(7) of the EU General Data Protection Regulation:

Herzogstandbahn GmbH
Am Tanneneck 6
82432 Walchensee
Telefon 08858 236
Telefax 08858 718
E-Mail: info(at)herzogstandbahn.de
Represented by the managing director Jörg Findeisen

III. Processing of personal data

Below, we explain how we process your personal data that may be collected when you visit our website, as well as our processing procedures when you contact Herzogstandbahn.

1. Processing procedures / Purpose and recipients
The processing of personal data serves exclusively to provide the services of Herzogstandbahn GmbH, which, in accordance with Art. 6 GDPR

relate to the fulfillment of interest and pre-contractual measures, or
are based on a contract, or
comply with legal obligations.

Your data may be transferred to the following recipients:

Processors within the meaning of Art. 28 GDPR (e.g., data center) in the course of order processing,
other third parties within the scope of external service providers and
public authorities due to legal regulations.

Your personal data processed by Herzogstandbahn will not be transferred outside the European Union or the European Economic Area.

1.1 Visits to the Herzogstandbahn GmbH website
When you access our website, general information, known as server log files, is automatically logged. This includes:

Browser type, language, and version
operating system
Name and associated dwell time of the pages accessed,
Date and time of receipt,
time zone difference
Names of downloaded files and
the referrer URL
IP (Internet Protocol) address
Website from which the request originates
Content of the request (specific page)
Access status / HTTP status code
Amount of data transferred in each case

We use cookies (text files) to optimize and stabilize our website and make our Internet offering user-friendly and effective. These cookies have different storage periods depending on their properties. You can also delete them at any time in the security settings of your browser.

We will not combine this log data with other data sources to create a user profile.

However, Herzogstandbahn GmbH reserves the right to subsequently check log data if there is reasonable suspicion of illegal use.

1.2 Conclusion of contract / Ticket sales
In order to initiate or execute a contract via our website, we may require information about your name, address (postal address), telephone numbers, and email addresses, which we will only process if you wish to purchase tickets or vouchers, etc. For this purpose, we use service providers who handle ticket sales online on our behalf.

To protect your personal data, we also conclude a contract for order processing with the service providers we commission and ensure that all necessary technical and organizational measures are documented and regularly verified. We publish the service providers we commission at www.herzogstandbahn.de/dienstleister.

1.3 E-Mail Communication

In order to initiate or execute a contract via our website, we may require information about your name, address (postal address), telephone numbers, and email addresses, which we will only process if you wish to purchase tickets or vouchers, etc. For this purpose, we use service providers who handle ticket sales online on our behalf.

1.4 Contact form
If you contact us via our contact form, we require information that enables us to communicate with you. This information includes at least your name, email address, and the reason for your inquiry.

To prevent bot attacks, the contact form is supported by a captcha function. This is to ensure that the contact form is sent to us by a real user and not by a computer bot.

We delete all information on the contact form once the reason for contacting us no longer applies and there are no legal requirements preventing deletion or no legitimate interest in longer storage.

1.5 Newsletter
We do not currently plan to send newsletters. Should this change, we will inform you accordingly in this privacy policy about the procedure and your rights.

1.6 Contact by telephone
When you contact us by phone, we will endeavor to resolve your issue immediately. If we are unable to answer your telephone enquiry immediately, we will note your name, the reason for your call, and your telephone number so that we can call you back. We will store this data until we have resolved your issue and will destroy or delete it once the reason for your enquiry no longer applies and there are no legal requirements preventing its deletion.

1.7 Advertising / Disclosure of personal data
Personal data processed by Herzogstandbahn GmbH will not be used to create personality profiles, nor will it be passed on to third parties for advertising purposes or for sale. However, if Herzogstandbahn GmbH is required to do so by law or court order, we will transfer your data to authorities entitled to receive such information and will attempt to inform you of this.

1.8 application documents
Please send us your application documents and attachments by post rather than by email, as this medium does not offer a secure means of transmission. If you still wish to send us your application by email, we can offer you the option of sending us your data in encrypted form and informing us of the key you have chosen by telephone.

Your application documents will only be accessible to a very limited number of people and will be treated as strictly confidential. If we do not enter into an employment relationship with you, we will delete or destroy your documents after a maximum of 6 months. If we do enter into an employment relationship with you, we will keep your application documents in printed form in your personnel file for the entire duration of the contractual relationship.

1.9 Webshop / Online sales
We use service providers, known as contractors, to sell tickets and vouchers, who manage these sales via a web shop. Various payment options are available for processing ticket sales.

Please note that the personal data required when placing an order or making a payment is not stored by us, but is processed by the contracted service provider. We select our service providers with great care and ensure that your personal data is processed in accordance with data protection regulations. To this end, we conclude contracts with the selected service providers for order processing in accordance with Art. 28 GDPR and regularly check their technical and organizational measures. Another prerequisite for selecting our web shop providers is that your personal data is stored on servers within the European Union. A list of our service providers can be found at www.herzogstandbahn.de/dienstleister.

2. Storage of personal data
When processing your personal data, we observe the principles of data avoidance and data minimization. Data that you send to Herzogstandbahn for processing is encrypted and stored on servers at external German data centers during transmission. Herzogstandbahn GmbH uses the standard TSL (Transport Layer Security) / SSL code (Secure Socket Layer Protocol) for encryption. For areas that we cannot carry out ourselves, e.g. the online sale of tickets, we commission service providers (processors) to process and store the personal data generated in this process and agree on compliance with data protection-compliant processing in accordance with Art. 28 GDPR and storage on servers within the European Union (mainly in Germany and Austria). Your personal data will only be stored until the statutory retention periods expire and there are no other reasons for deletion in accordance with Section 3.

3. Retention and deletion periods
IP addresses etc. are stored when you visit our website for reasons of stability, user-friendliness, and operational security of the system.

The storage of all other personal data is governed by the applicable legal requirements. We regularly review the database in accordance with our deletion policy and purge the database of personal data.

for which the purpose no longer applies,
for which there is no longer a legitimate interest and
for which there are no longer any statutory retention periods.

IV. Your rights as a data subject

As a data subject, you have the following rights:

1. Information, correction, restriction, deletion, blocking
Regardless of the form in which you have provided us with personal data, you can at any time

- request information about the stored personal data in accordance with Art. 15 GDPR,
- pursuant to Art. 16 GDPR, request the correction of incorrectly stored data,
- pursuant to Art. 18 GDPR, request the restriction of processing, and
- pursuant to Art. 17 GDPR, request the deletion of data that is no longer required, provided that the purpose of the aforementioned rights no longer applies and there are no legal obstacles to doing so.

You can request the blocking of disputed or no longer required data, provided that there is still a retention obligation for this data.

In accordance with Art. 7 GDPR, you also have the right to revoke your consent at any time.

2. Enforcing your rights
To exercise your rights, please contact Herzogstandbahn GmbH by telephone at 08858-236 or by email at info(at)herzogstandbahn.de. Please inform us if your personal data is incomplete, incorrect, or has been collected unlawfully so that we can correct, block, or delete it.

3. right of objection
In accordance with Art. 21 GDPR, you may object to the processing of your personal data at any time, provided that this does not serve the purpose of contract performance or is subject to statutory retention periods. You will find the contact details for your objection in Chapter II.

4. data portability
You have the right to transfer your personal data, i.e. you can receive the data you have provided to Herzogstandbahn GmbH in a structured, commonly used format so that you can transfer it to another provider without hindrance.

5. Right to lodge a complaint with the supervisory authority
The Bavarian State Office for Data Protection Supervision in Ansbach is responsible for the Herzogstandbahn. If you believe that your rights have been violated in the processing of your personal data, you can contact this supervisory authority. After receiving your report, the authority will investigate your complaint and inform you of the outcome. Further information on this can also be found on the website of the www.lda.bayern.de.

V. data protection policy

1. Contracts for order processing
Herzogstandbahn obliges the processors involved (service providers/subcontractors) to comply with all necessary technical and organizational measures to protect your data from unauthorized access, viewing, or manipulation in a contract for order processing.

A list of the contracted companies can be found at www.herzogstandbahn.de/dienstleister

2. data protection officer
We are not legally required to appoint a data protection officer. To ensure data protection compliance, we are supported by an external data protection officer in all important matters.
If you have any questions about data protection or the handling of your personal data, you can contact us as follows: datenschutz(at)herzogstandbahn.de.
You can also contact us by calling 08858-236. We will endeavor to process your request as quickly as possible.

3. Data protection training / confidentiality agreements
The employees of Herzogbahn GmbH receive data protection training and are instructed accordingly at their workplaces to ensure that your personal data is handled sensitively. All employees are bound to secrecy and to comply with all relevant legal provisions, which continue to apply even after they have left the company.

4. access regulations
Access to personal data is only permitted to trained and authorized employees of Herzogstandbahn GmbH or contractually authorized contractors who have been sworn to confidentiality or have concluded a contract with us for order processing.

VI. Analytics services / Third-party integration

1. General information
Third-party online offerings are integrated into the Herzogstandbahn GmbH website. In order to access third-party content, the exchange of IP addresses is a technical requirement, as this is necessary for the content to be displayed.

Unfortunately, we have no influence over whether third-party providers use your IP address solely for the purpose of delivering the service. We endeavor to select only those providers who use the IP address solely for the purpose of producing the content, but we have no influence over whether these third-party providers also store your IP address for statistical purposes. Please familiarize yourself with the providers' privacy policies before using third-party services.

2. Cookies
Cookies (small text files) are used on various pages to make your visit to the Herzogstandbahn website user-friendly and to enable certain functions. These are used to control the Internet connection during your visit to our website. We generally avoid tracking our website visitors and only use cookies that are necessary for user-friendliness. We do not use cookies for statistical or marketing purposes.

3. Use of Google Web Fonts
This site uses web fonts provided by Google to ensure uniform font display. When you visit a page, your browser loads the required web fonts into your browser cache to display texts and fonts correctly.

To do this, the browser you are using must connect to Google's servers. This allows Google to know that our website has been accessed via your IP address. The use of Google web fonts is in the interest of a uniform and appealing visual presentation of our online offerings. This constitutes a legitimate interest within the meaning of Art. 6 (1) lit. f GDPR. If your browser does not support web fonts, a standard font from your computer will be used. Further information about Google web fonts can be found at https://developers.google.com/fonts/faq. and in Google's privacy policy: https://www.google.com/policies/privacy/.

4. Panorama Webcams
For informational purposes only, Herzogstandbahn provides various panoramic webcam images of different scenic locations on its website, which are used exclusively for this purpose. The use of panoramic webcams and the publication of the images are based on Section 23 (1) No. KUG.

Only German or European companies with servers located in Europe are involved as operators of the webcams. Remote maintenance of the webcams via the Internet is carried out using a secure SSH tunnel.

5. Links to other websites / service providers
Due to our cooperation in the tourism sector, the Herzogstandbahn website links to other website providers for which different data protection information may apply. The respective provider is responsible for this content. However, if we become aware of illegal content, we will attempt to remedy these deficiencies through cooperation; alternatively, we will remove these links.

However, Herzogstandbahn cannot accept responsibility for the content of third-party providers or for the consequences of accessing their websites. Therefore, please check whether and how third-party providers process your personal data and please observe their privacy policies.

If you become aware of any illegal content on the linked pages in this context, please notify us so that we can delete it.

Produced in cooperation with Herzogstandbahn

Data protection Service team Augsburg