Legal Notice

Information pursuant to Section 5 of the German Digital Services Act (Digitale-Dienste-Gesetz – DDG)

Mokni’s Palais Hotel & SPA KG Kurplatz 4–6 75323 Bad Wildbad im Schwarzwald Germany Telephone: +49 (0) 7081 301-0 Fax: +49 (0) 7081 301-166 Email: hotel@moknis.com

Legal representation

Represented by the personally liable partner: Erika Mokni

Commercial register

Registered in the Commercial Register of the Local Court of Stuttgart. Registration number: HRA 735321

VAT identification number

VAT identification number pursuant to Section 27a of the German Value Added Tax Act: DE323234375

Competent supervisory authority

Landratsamt Calw Vogteistraße 42–46 75365 Calw Germany

Consumer dispute resolution

We are neither willing nor obliged to participate in dispute resolution proceedings before a consumer arbitration board.

Liability for content

We prepare and maintain the content of this website with the greatest possible care. However, we cannot guarantee that the information provided is complete, correct or up to date at all times. Statutory liability claims remain unaffected.

Liability for external links

This website may contain links to external third-party websites. We have no influence over the content of such websites. The respective provider or operator of the linked website is always responsible for its content. At the time the links were first created, no legal infringements were apparent to us. Permanent monitoring of the content of linked websites is not reasonable without specific indications of a legal infringement. As soon as we become aware of any legal infringement, we will remove the relevant links.

Copyright

The content, texts, photographs, graphics and other works published on this website are subject to German copyright law or to the rights of the respective named rights holders. Any reproduction, editing, distribution or other use outside the limits permitted by law requires the prior consent of the respective rights holder. Downloads and copies of this website are permitted only for private, non-commercial use, unless expressly stated otherwise.

Image rights

Unless otherwise stated next to the respective image: © Werbeagentur Knopf KG – Dielheim © Staatsbad Wildbad © Verena Locher – Fotodesign & Manufaktur © Manuel Kamuf – Lightworkart © Christian Eppelt – Echt Eppelt Visuelle Kommunikation © Sven Hummel – Hummel Design Additional image credits and rights holders may be stated directly next to the respective content.

---

Privacy Policy

1. Data protection at a glance

General information

The protection of your personal data is important to us. This Privacy Policy explains which personal data are processed when you visit and use our website, for what purposes the processing takes place and which rights you have. Personal data are any information relating to an identified or identifiable natural person. This includes, for example, names, postal addresses, email addresses, telephone numbers, IP addresses, booking information and the contents of messages.

How do we collect your data?

Some data are collected when you provide them to us. This applies, for example, to information entered into a contact form, a booking enquiry, an online booking, a newsletter registration or a conversation with our digital assistant. Other data are processed automatically or after you have given your consent by the IT systems used on our website. These include, in particular, technical data such as your IP address, browser, operating system, time of access, content accessed and information about your use of our website.

What do we use your data for?

We process personal data in particular:

• to provide the website securely and without technical errors,
• to process enquiries,
• to initiate and perform bookings and contracts,
• to provide our AI-supported digital assistant,
• to measure reach and improve our online services,
• to measure the success of and optimise our advertising,
• to send our newsletter,
• to comply with legal obligations.

2. Controller

The controller responsible for data processing on this website is: Mokni’s Palais Hotel & SPA KG Kurplatz 4–6 75323 Bad Wildbad im Schwarzwald Germany Telephone: +49 (0) 7081 301-0 Email: hotel@moknis.com The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

3. Hosting

Our website is hosted by: ALL-INKL.COM – Neue Medien Münnich Owner: René Münnich Hauptstraße 68 02742 Friedersdorf Germany When you visit our website, the hosting provider processes server log data in particular. These may include:

• IP address,
• browser type and browser version,
• operating system used,
• referrer URL,
• host name of the accessing device,
• page or file accessed,
• date and time of the server request,
• amount of data transferred,
• status of the server request.

The processing takes place in order to provide our website securely, reliably and without technical errors. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the secure and reliable operation of our online services. Where the hosting provider processes personal data on our behalf, this takes place on the basis of a data processing agreement pursuant to Article 28 GDPR.

4. General legal bases

Where you have consented to data processing, the processing is based on Article 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future. Where processing is necessary for the performance of a contract or in order to take steps prior to entering into a contract, it is based on Article 6(1)(b) GDPR. Where processing is necessary for compliance with a legal obligation, it is based on Article 6(1)(c) GDPR. In other cases, processing may be based on our legitimate interests pursuant to Article 6(1)(f) GDPR. Where cookies or comparable technologies are stored on your device or information is read from your device, non-essential technologies are used on the basis of your consent pursuant to Section 25(1) of the German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz – TDDDG). Technically necessary access may be based on Section 25(2) TDDDG.

5. Storage period

Unless a specific storage period is stated in this Privacy Policy, we store personal data only for as long as is necessary for the respective processing purpose. If you withdraw your consent or submit a justified request for deletion, we will delete the relevant data unless statutory retention obligations or other lawful grounds require continued storage. Commercial and tax-related documents may be subject to statutory retention periods. In such cases, the data will be deleted after the relevant retention period has expired.

6. Recipients of personal data

We disclose personal data only where this is necessary for the performance of a contract, where a legal obligation exists, where we have a legitimate interest in the disclosure or where you have consented to it. Recipients may include:

• hosting and IT service providers,
• booking and reservation systems,
• payment service providers,
• newsletter service providers,
• analytics and marketing service providers,
• communication and chatbot providers,
• tax advisers, public authorities or other legally authorised bodies.

Where a recipient processes personal data on our behalf, we enter into a data processing agreement pursuant to Article 28 GDPR where required by law.

7. Transfers to third countries

Some of the providers we use are based outside the European Economic Area or process data in countries outside the European Economic Area. A transfer takes place only where the statutory requirements are met. The safeguards used may include:

• an adequacy decision of the European Commission,
• valid certification under the EU-US Data Privacy Framework,
• Standard Contractual Clauses issued by the European Commission,
• supplementary technical and organisational safeguards,
• your explicit consent in an individual case where legally permissible.

Despite such safeguards, processing outside the European Economic Area may not always provide a level of data protection fully equivalent to that within the European Union.

8. Cookies and consent management

Our website uses cookies and comparable technologies. Cookies are small data records stored on your device. Other technologies may store or read information in your browser or recognise devices and browser sessions. Technically necessary technologies are used to provide essential website functions. Technologies used for statistics, analytics, external media or marketing are generally used only in accordance with the selection you make in our consent banner.

Borlabs Cookie

We use Borlabs Cookie to obtain, manage and document your consent. The software provider is: Borlabs GmbH Germany Borlabs Cookie stores your selected consent settings in a technically necessary cookie. The following information may be stored:

• your consent decision,
• time of the decision,
• period of validity of the decision,
• language used,
• version of the consent configuration,
• technical browser information.

The consent information is generally stored on our own web server. According to the provider, Borlabs Cookie does not transfer personal visitor data to Borlabs. The processing takes place in order to comply with our statutory documentation and accountability obligations pursuant to Article 6(1)(c) GDPR and on the basis of our legitimate interest in legally compliant consent management pursuant to Article 6(1)(f) GDPR. You may change or withdraw your selection at any time using the cookie settings provided on our website.

9. Server log files

Our hosting provider automatically collects and stores information in server log files. This may include:

• IP address,
• browser type and browser version,
• operating system used,
• referrer URL,
• host name of the accessing device,
• page or file accessed,
• date and time of the server request.

The processing is based on Article 6(1)(f) GDPR. Our legitimate interest lies in the secure and technically reliable provision of the website and in detecting and preventing attacks and misuse.

10. Contacting us

Contact form

If you contact us using a contact form, we process the data you enter in order to handle your enquiry. This may include:

• name,
• email address,
• telephone number,
• requested travel dates,
• number of travellers,
• contents of your message.

Where your enquiry relates to a booking or a possible contract, the processing is based on Article 6(1)(b) GDPR. For other enquiries, processing is based on our legitimate interest in proper and efficient communication pursuant to Article 6(1)(f) GDPR. Where consent is requested, processing is additionally based on Article 6(1)(a) GDPR.

Contact by email, telephone or fax

If you contact us by email, telephone or fax, we process your enquiry and the personal data arising from it in order to handle your request and any follow-up questions. The legal basis is Article 6(1)(b) GDPR where the communication relates to the initiation or performance of a contract. In other cases, processing is based on Article 6(1)(f) GDPR. Our legitimate interest lies in the proper handling of communications addressed to us.

11. Online bookings, availability searches and vouchers via DIRS21

We use DIRS21 services to display availability and to process room bookings and, where applicable, voucher purchases. The provider is: TourOnline AG Borsigstraße 26 73249 Wernau Germany When you access our booking system or make a booking, the following data in particular may be processed:

• requested travel period,
• number and age of travellers,
• selected rooms, packages or services,
• name and contact details,
• address and billing information,
• booking and contractual information,
• technical connection data,
• payment information where applicable,
• special booking requests where applicable.

Processing takes place in order to take steps prior to entering into a contract and to perform the accommodation contract pursuant to Article 6(1)(b) GDPR. Where DIRS21 processes personal data on our behalf, this takes place on the basis of a data processing agreement pursuant to Article 28 GDPR. Where external payment service providers are used within the booking process, the privacy information of the respective payment provider also applies. Data required for payment processing are disclosed only to the parties involved in the payment transaction. For live price and availability checks performed via our Mokni’s AI Assistant, DIRS21 is queried server-side using the booking parameters required for the relevant check. These include in particular travel dates, length of stay, occupancy and, where applicable, a requested room or rate identifier. Free-text chat content or contact details are not transmitted to DIRS21 for this live check.

12. AI-supported digital assistant

Use of artificial intelligence

We provide our own Mokni’s AI Assistant on our website and in our digital guest app. The assistant generates automated answers to questions about our hotel, services, prices, availability and general guest information. When using the assistant, you are communicating with an AI-supported system. The answers are generated automatically and may in individual cases be incomplete, misleading or incorrect. The AI Assistant does not make legally binding decisions. Binding bookings, amendments, cancellations, price commitments and individual agreements require confirmation by us or must be completed through the relevant booking system.

Activation on the website via Borlabs Cookie

On our website, the Mokni’s AI Assistant is activated only after you have given your consent via Borlabs Cookie for the dedicated service “Mokni’s KI-Assistent”. Without this consent, the website chat is not loaded or made available for use. You can withdraw your consent at any time with effect for the future via the cookie settings on our website. Using the AI Assistant is not required in order to use our website or make a booking. In our guest app, the AI Assistant may be provided independently of the consent given on the website. Our own AI Assistant does not set analytics or advertising cookies for the chat function itself.

Data processed

When you use the Mokni’s AI Assistant, the following data in particular may be processed:

• the contents of your questions and entries,
• conversation history,
• date and time of the communication,
• technical session information,
• your name, email address, telephone number, booking reference or room number where you provide them voluntarily,
• travel dates, occupancy and, where applicable, the requested room category, package or service where these details are required to answer your enquiry.

Please do not provide payment details, health data, identity documents, passwords or other particularly confidential or specially protected personal data through the AI Assistant. Recognisable payment details are, where technically possible, blocked or not passed on to the AI service.

Purposes and legal bases

Processing serves to answer questions automatically, provide information, assist with travel planning, prepare possible booking and service enquiries, check current prices and availability in real time, detect errors and assure the quality of our digital guest service. Where your enquiry relates to a possible or existing booking, processing takes place in particular in order to take steps prior to entering into a contract or to handle contract-related matters on the basis of Article 6(1)(b) GDPR. For general questions and data-minimised quality assurance, processing is based on our legitimate interest in fast, modern, secure and reliable guest communication pursuant to Article 6(1)(f) GDPR. You may object to processing based on Article 6(1)(f) GDPR in accordance with Article 21 GDPR. Where activation of the website chat depends on your consent via Borlabs Cookie, the corresponding processing is additionally based on Article 6(1)(a) GDPR and, where information is stored on or read from your terminal device, Section 25(1) TDDDG.

Technical operation and OpenAI

The technical interface of the Mokni’s AI Assistant and the quality logs are provided on our own WordPress installation. To generate answers, the content required for the relevant enquiry is transmitted server-side to OpenAI via an application programming interface (API). No external OpenAI chat widget is loaded in the guest’s browser for this purpose. For AI-supported processing, we use the OpenAI API. For customers established in the European Economic Area, the applicable OpenAI contractual terms provide in particular for the involvement of the following company: OpenAI Ireland Ltd. 1st Floor, The Liffey Trust Centre 117–126 Sheriff Street Upper Dublin 1, D01 YC43 Ireland Where OpenAI processes personal data on our behalf, this takes place on the basis of the data processing terms applicable to the OpenAI services pursuant to Article 28 GDPR. According to OpenAI, customer data submitted via the API are not used by default to train or improve OpenAI models unless the customer expressly opts in to such use. In standard operation, API inputs and outputs may, according to OpenAI, generally be retained for up to 30 days for security and abuse-monitoring purposes; different or additional data-retention controls may be available to eligible customers.

Live price and availability checks via DIRS21

Where your enquiry contains specific travel dates and sufficient occupancy information, the Mokni’s AI Assistant may check current prices and availability server-side via DIRS21. Only the booking parameters required for the check are transmitted to DIRS21, in particular travel dates, length of stay, occupancy and, where applicable, the requested room or rate identifier. The free-text chat content, your name, email address, telephone number or booking reference are not transmitted to DIRS21 for this live check. The information in the section “Online bookings, availability searches and vouchers via DIRS21” of this Privacy Policy also applies.

Quality assurance and retention period

For error detection and quality assurance, we generally retain chat histories from our own AI Assistant for a maximum of 14 days and then delete them automatically. These quality logs are kept in a data-minimised and pseudonymised form. In particular, we do not store IP addresses, browser or device identifiers, or analytics or advertising IDs in these quality logs. Recognisable email addresses, telephone numbers, booking references, room numbers, names and payment details are automatically masked before storage where technically possible. Complete anonymisation cannot be guaranteed in every individual case where users enter free text. The “New conversation” function offered in the chat only resets the conversation visible in your browser or starts a new chat session. It does not delete the server-side quality log already stored for quality-assurance purposes. Your statutory data-protection rights remain unaffected, including any right to erasure that may apply under Article 17 GDPR and your right to object under Article 21 GDPR.

Handover to our reception team

If you expressly request a handover to our reception team, you may provide your name, email address and, where applicable, an additional message. These details and the chat history required to process your request are transmitted to our reception team. The contact details entered in the handover form are not additionally stored in the quality log. The retention periods described in this Privacy Policy for contacting us apply to the further handling of your enquiry.

No advertising profiles

We do not use the contents of chats for personalised advertising or to create individual advertising profiles. We do not create permanent guest profiles. Content from different chat sessions is not combined to create an individual user profile.

Transfers to third countries

As part of the technical processing, data may be processed by OpenAI or its subprocessors outside the European Economic Area. Under OpenAI’s applicable data processing terms, data originating in the European Economic Area are processed by OpenAI Ireland. Where onward transfers to affiliates or service providers outside the European Economic Area are necessary, OpenAI relies in particular on European Commission adequacy decisions or Standard Contractual Clauses. Where information is transferred for the processing of a specific booking, contact or service enquiry, the retention periods applicable to the respective enquiry or booking apply.

13. Google Tag Manager

We use Google Tag Manager. The provider is: Google Ireland Limited Gordon House Barrow Street Dublin 4 Ireland Google Tag Manager is used to technically manage and deploy other website technologies, in particular analytics and marketing tags. Google Tag Manager generally does not create independent user profiles. However, when the Tag Manager is loaded, technical connection data such as your IP address may be transmitted to Google. Analytics and marketing services integrated through Google Tag Manager are controlled in accordance with your consent decision and the respective technical configuration. The legal basis for non-essential processing is your consent pursuant to Article 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG.

14. Google Consent Mode

We use Google Consent Mode to transmit the selection you make in our consent banner to the Google tags used on our website. In particular, consent statuses for analytics and advertising functions are processed. Google tags adapt their behaviour to the consent signals transmitted. Google Consent Mode does not replace your consent. It is used to implement and transmit your decision technically. Depending on the technical configuration, restricted or cookieless technical signals may be processed where consent has not been granted. These may include information about consent status, the page accessed, time, device and type of event. The processing takes place in accordance with your consent decision and on the basis of our legitimate interest in properly managing consent signals pursuant to Article 6(1)(f) GDPR.

15. Analytics and reach measurement

We use the following analytics and statistics services to measure reach, improve our website and identify usability issues. Where cookies or comparable technologies are used or information is read from your device, processing is based on your consent pursuant to Article 6(1)(a) GDPR and Section 25(1) TDDDG. You may change or withdraw your consent at any time through the cookie settings.

Google Analytics 4

We use Google Analytics 4, a web analytics service provided by Google Ireland Limited. Google Analytics helps us understand how visitors use our website. The following information in particular may be processed:

• pages accessed,
• source of the visit,
• date and time,
• duration of the visit,
• clicking and navigation behaviour,
• device used,
• browser and operating system,
• approximate geographical location,
• technical identifiers,
• booking, contact or conversion events.

Google may use the data collected to create reports concerning the use of our website and to provide, maintain and improve its services. The IP address transmitted by Google Analytics is processed in accordance with the technical functions provided by Google and is not intended to be combined by us with other data. Google may also process data in the United States or other countries outside the European Economic Area.

Hotjar

We use Hotjar, a service provided by: Hotjar Limited Malta Hotjar helps us better understand how visitors use our website and identify usability issues. The following data in particular may be processed:

• pages visited,
• clicks and taps,
• scrolling behaviour,
• use of individual website elements,
• device and browser information,
• screen size,
• approximate geographical location,
• technical session data,
• session recordings where applicable.

Where correctly configured, form contents, passwords, payment information and other sensitive entries should not be recorded. Hotjar is used only in accordance with the consent decision you have made.

Matomo

We use Matomo Analytics for statistical evaluation of the use of our website. Matomo may process the following data in particular:

• pages accessed,
• source of the visit,
• date and time,
• length of stay,
• device used,
• browser and operating system,
• screen resolution,
• clicks and downloads,
• technical events,
• truncated or pseudonymised IP address,
• booking and conversion events.

Depending on the technical configuration, Matomo may set first-party cookies that allow the browser to be recognised and several page views to be assigned to one visit. The data are processed within the Matomo instance used by us or by a hosting or analytics service provider acting on our behalf. Matomo is used in accordance with the consent decision you have made.

16. Advertising and conversion measurement

We use the following marketing services to measure the success of our advertising, optimise our advertisements and, where applicable, create target groups for interest-based advertising. Processing is based on your consent pursuant to Article 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. You may change or withdraw your consent at any time through the cookie settings.

Google Ads

We use Google Ads, provided by Google Ireland Limited. Google Ads enables us to display advertisements in Google Search and the Google advertising network and to measure their success. We use in particular:

• Google Ads conversion tracking,
• Google Ads remarketing,
• Conversion Linker,
• enhanced conversion measurement where applicable.

If you access our website through a Google advertisement or perform certain actions on our website, the following data in particular may be processed:

• advertisement click or impression,
• pages accessed,
• booking enquiries,
• start of a booking,
• completed bookings,
• contact enquiries,
• email clicks,
• technical identifiers,
• date and time,
• booking or revenue values where applicable.

Where remarketing is used, visitors to our website may be assigned to specific target groups so that suitable advertisements can be displayed to them at a later date.

Meta Pixel and server-side conversion measurement

We use the Meta Pixel and, where applicable, server-side conversion measurement. The provider is: Meta Platforms Ireland Limited Merrion Road Dublin 4 D04 X2K5 Ireland These technologies enable us to determine whether users perform certain actions on our website after viewing or clicking an advertisement on Facebook or Instagram. The following data in particular may be processed:

• pages accessed,
• clicks and other website actions,
• start of the booking process,
• contact enquiries,
• completed bookings,
• time of the action,
• IP address,
• browser and device information,
• technical identifiers,
• booking or revenue values where applicable.

Where server-side transmission is used, event data may additionally be transmitted to Meta via a server operated by us or by our service provider. Where events are transmitted both through the browser and server-side, technical event identifiers may be used to prevent duplicate counting. Where data are collected on our website and subsequently transmitted to Meta, we and Meta may be jointly responsible for the collection and transmission. Meta is independently responsible for further processing.

TikTok Pixel

We use the TikTok Pixel. The provider for users within the European Economic Area is in particular: TikTok Technology Limited Ireland The TikTok Pixel enables us to measure the success of our TikTok advertising and optimise our advertisements. The following data in particular may be processed:

• IP address,
• pages accessed,
• time of the visit,
• browser and device information,
• technical identifiers,
• start of the booking process,
• completed bookings,
• booking or revenue values where applicable.

TikTok may link the information received to an existing TikTok account and process it for its own purposes.

Pinterest Tag

We use the Pinterest Tag. The provider for users within the European Economic Area is: Pinterest Europe Ltd. Waterloo Exchange 3rd Floor, Waterloo Road Dublin 4 Ireland The Pinterest Tag enables us to measure the success of our advertising on Pinterest and optimise our advertisements. The following events in particular may be processed:

• page views,
• clicks,
• start of a booking process,
• adding a service or offer to the booking process,
• completed bookings,
• booking or revenue values,
• technical device and browser information,
• IP address,
• technical identifiers.

Pinterest may associate the information received with an existing Pinterest account and use it for measurement, personalisation and advertising purposes.

17. Enhanced conversion measurement and contact details

Where you have consented to marketing and conversion technologies, data provided by you in connection with a booking or booking enquiry may be processed to improve the attribution of advertising and conversion events. This may include:

• email address,
• telephone number,
• first and last name,
• postal address,
• town or city,
• postal code,
• country.

Where these details are transmitted to an advertising provider, they are intended to be normalised and hashed using a cryptographic process before transmission. For technical attribution purposes, the information may be temporarily stored in first-party cookies or local browser storage. Processing takes place solely in accordance with your consent decision and for the purposes of conversion measurement, preventing duplicate counting and optimising our advertising. These details are not intended to be used by Google Analytics as directly identifying contact information.

18. Newsletter

Newsletter registration

If you subscribe to our newsletter, we process your email address and any additional information you provide voluntarily. Registration generally takes place using a double opt-in procedure. After registering, you will receive an email asking you to confirm your subscription. The following data in particular may be stored as proof of registration:

• email address,
• time of registration,
• time of confirmation,
• IP address,
• registration form used.

Processing is based on your consent pursuant to Article 6(1)(a) GDPR. You may unsubscribe at any time using the unsubscribe link at the end of each newsletter or by contacting us.

Rapidmail

We use Rapidmail to send and technically evaluate our newsletter. The provider is: Positive Group Deutschland GmbH Ingeborg-Krummer-Schroth-Straße 18a 79106 Freiburg im Breisgau Germany Rapidmail processes the data required to send the newsletter on our behalf. Newsletters may contain technologies that enable us to determine whether a message has been opened and which links have been clicked. This evaluation is used to improve our newsletter content and measure interest in the information sent. After unsubscribing, your email address will be removed from the active newsletter mailing list. It may be stored in a suppression list where this is necessary to prevent further mailings and comply with our legal obligations. Where Rapidmail processes personal data on our behalf, this takes place on the basis been opened and which links have been clicked. This evaluation is used to improve our of a data processing agreement pursuant to Article 28 GDPR.

19. External media and services

YouTube

Videos from YouTube may be embedded on our website. The provider is Google Ireland Limited. YouTube content is generally loaded in accordance with the selection you make in our consent banner or after you expressly activate the content. When a YouTube video is loaded, the following data in particular may be transmitted to Google or YouTube:

• IP address,
• page accessed,
• device and browser information,
• date and time,
• information about the use of the video,
• information from your Google account where applicable.

Google may also use the information for its own analytics and advertising purposes.

Google Maps

We use Google Maps to display maps and assist with travel planning. The provider is Google Ireland Limited. Google Maps is loaded in accordance with the selection you make in our consent banner or after you expressly activate the content. The following data in particular may be processed:

• IP address,
• page accessed,
• device and browser information,
• location data,
• search and map entries,
• information about use of the map.

Google reCAPTCHA

Where applicable, we use Google reCAPTCHA to protect forms against automated entries, spam and misuse. The provider is Google Ireland Limited. reCAPTCHA may process the following information in particular:

• IP address,
• browser and device information,
• referrer URL,
• length of stay,
• mouse and keyboard movements,
• date and time,
• technical information concerning use of the website,
• Google cookies where applicable.

Processing serves to protect the security of our website and our forms against automated misuse. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in protecting our forms and IT systems against spam and attacks. Where reCAPTCHA uses cookies or comparable technologies, processing additionally takes place in accordance with the statutory consent requirements.

20. Links to social networks

Our website may contain links to our profiles on social networks, in particular Facebook, Instagram, TikTok, YouTube, Pinterest, LinkedIn, X or XING. In the case of a simple link, a connection to the respective provider is generally established only when you click the link. After clicking, you leave our website or open a page or application operated by the respective platform provider. The respective platform provider is generally responsible for the processing of personal data that takes place there. Please note that social networks may also process data outside the European Economic Area and may associate your visit with your user account.

21. Automated decision-making

We do not make decisions based on personal data collected through this website that produce legal effects concerning you or similarly significantly affect you solely on the basis of automated processing. The automatically generated answers provided by our digital assistant do not constitute binding decisions.

22. Your rights

Subject to the applicable statutory requirements, you have the following rights in particular:

Right of access

You may request information as to whether and which personal data concerning you are processed by us.

Right to rectification

You may request the correction of inaccurate personal data and the completion of incomplete personal data.

Right to erasure

You may request the deletion of your personal data where the statutory requirements are met.

Right to restriction of processing

You may request the restriction of processing of your personal data where the statutory requirements are met.

Right to data portability

Where the statutory requirements are met, you may request that data you have provided to us be made available to you in a structured, commonly used and machine-readable format.

Withdrawal of consent

You may withdraw consent you have given at any time with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected.

Right to object

Where we process personal data on the basis of Article 6(1)(e) or (f) GDPR, you may object to the processing at any time on grounds relating to your particular situation. Where personal data are processed for direct marketing purposes, you may object to processing for this purpose at any time without stating specific grounds.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. For companies based in Baden-Württemberg, the competent authority is in particular: The State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg) You may also contact the data protection supervisory authority of your habitual residence, your place of work or the place of the alleged infringement.

23. SSL or TLS encryption

This website uses SSL or TLS encryption to protect transmitted content against unauthorised access by third parties. You can recognise an encrypted connection in particular by the website address beginning with “https://” and by the padlock symbol in your browser.

24. Security notice concerning email communication

Communication by unencrypted email may involve security risks. Complete protection of transmitted content against access by third parties cannot be guaranteed. Please do not send us credit card information, passwords or particularly sensitive personal data by unencrypted email. As a general rule, we do not request complete payment or credit card details by email or telephone.

25. Amendments to this Privacy Policy

We may amend this Privacy Policy if statutory requirements, the technical design of our website or the services we use change. The version published on this website at the relevant time applies. Last updated: 4 September 2026